3 ms·

>>The biggest risk is Javascript. You are literally blindly executing code somebody else wrote on your compute for a website you may or may not trust. I unders

>>The biggest risk is Javascript. You are literally blindly executing code somebody else wrote on your compute for a website you may or may not trust. I understand why you used this language, but I think it's worth noting that, unlike blindly executing a program on the operating system itself (such as by running an .exe file you receive via email, torrent, download, etc.), you are executing a script inside a program that is, or should be, sandboxed. So, even though something can still go wrong, the potential impact is a lot smaller.

blattimwind 8y ago
This is about risk assessment. Most vulnerabilities in browsers are either in JS or in media support. Pure-HTML+CSS exploits are rather rare these days. Therefore, disabling or limiting JS and media reduces risk drastically.
- enraged_camel 8y ago
  We are not disagreeing? What I'm saying is that not all "blind code executions" are the same. The distinction between running an exe file on the OS and running a script inside a browser does matter, for risk assessment.
  - blattimwind 8y ago
    I'm disagreeing on "the potential impact is a lot smaller", because we have seen time and time again that executing a script in a sandboxed environment can quickly turn into running machine code with the user's privileges instead.
calvinmorrison 8y ago
Yes, that is true in a certain sense, but for example, a lot of fingerprinting can happen with information gleaned via javascript. Granted, having javascript turned off is also a way to finger print poeple. Frankly, most web pages should not be interactive in any way. There is very little gained by using javascript on pages you aren't interacting with, and a whole lot to lose. I compromise often with NoScript, but it changes the way you think about running code on your computer. Block first, and adjust later is a good approach for me, especially because I only visit a few of the same sites regularly. On new sites, I definitely do not want any type of javascript being run.

blattimwind 8y ago

This is about risk assessment. Most vulnerabilities in browsers are either in JS or in media support. Pure-HTML+CSS exploits are rather rare these days. Therefore, disabling or limiting JS and media reduces risk drastically.

enraged_camel 8y ago
We are not disagreeing? What I'm saying is that not all "blind code executions" are the same. The distinction between running an exe file on the OS and running a script inside a browser does matter, for risk assessment.
- blattimwind 8y ago
  I'm disagreeing on "the potential impact is a lot smaller", because we have seen time and time again that executing a script in a sandboxed environment can quickly turn into running machine code with the user's privileges instead.

calvinmorrison 8y ago

Yes, that is true in a certain sense, but for example, a lot of fingerprinting can happen with information gleaned via javascript. Granted, having javascript turned off is also a way to finger print poeple. Frankly, most web pages should not be interactive in any way. There is very little gained by using javascript on pages you aren't interacting with, and a whole lot to lose. I compromise often with NoScript, but it changes the way you think about running code on your computer. Block first, and adjust later is a good approach for me, especially because I only visit a few of the same sites regularly. On new sites, I definitely do not want any type of javascript being run.