4 ms·
This is about risk assessment. Most vulnerabilities in browsers are either in JS or in media support. Pure-HTML+CSS exploits are rather rare these days. Therefo
by blattimwind 8y ago
This is about risk assessment. Most vulnerabilities in browsers are either in JS or in media support. Pure-HTML+CSS exploits are rather rare these days. Therefore, disabling or limiting JS and media reduces risk drastically.
- enraged_camel 8y agoWe are not disagreeing? What I'm saying is that not all "blind code executions" are the same. The distinction between running an exe file on the OS and running a script inside a browser does matter, for risk assessment.
- blattimwind 8y agoI'm disagreeing on "the potential impact is a lot smaller", because we have seen time and time again that executing a script in a sandboxed environment can quickly turn into running machine code with the user's privileges instead.