10 ms·

Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also,

Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(

hnaccy 7y ago
Yikes.
thekyle 7y ago
That's really bad because it means it also effects Firefox ESR which is what lots of large enterprise users have installed.
deleted 7y ago
[deleted]
mirimir 7y ago
That was predictable.
- mirimir 7y ago
  Well, it was. I mean, it's Firefox! But see https://trac.torproject.org/projects/tor/ticket/30388 https://trac.torproject.org/projects/tor/ticket/30388 for the same temporary fix as at https://news.ycombinator.com/item?id=19823928 https://news.ycombinator.com/item?id=19823928
mrep 7y ago
> Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :( Try turning it off. I got rid of ublock after arstechnica complained about a lot of their users blocking ads years ago and it honestly isn't that bad. Every once in a while I do back out of a page for maxing out one of my cpu cores but otherwise, nothing ever bad happens. With ads: either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website. The alternative is websites charging insane amounts of money with paywalls (Wall street journal has their "best" price for 12 months at $360 a year). That is horrible because it means only rich people can pay for high quality news as ads are one of the most progressive forms of payment (rich people ads are way more valuable than poor peoples and yet everyone gets the same quality services/news with the ad model despite their income/net worth).
- hnaccy 7y ago
  >nothing ever bad happens. With ads: either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website. You just described something bad.
  - mrep 7y ago
    Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website?
    - Nicksil 7y ago
      >Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website? Funding the Internet? What you're talking about (ads) is a revenue stream for what amounts to a handful of websites. google.com, amazon.com, ycombinator.com, reddit.com, thefacebook.com, tweeter.com, etc. could all go offline right now and the Internet would still be here.
      - gugagore 7y ago
        That doesn't sound right. What about all the other websites with ads, like recipe sites, guitar chords, porn, diy, etc.? or apps on the Google play store with ads?
        luckylion 7y ago
        I run sites that don't have ads. I don't make any money off of them. I still run them. Seems like a lot of people in software development think similarly.
        sleavey 7y ago
        This is the web that I like. Hobbyists and volunteers running low-fi websites for common interests. I'm not against commercial sites like Netflix but don't think every last blog should be monetised.
deleted 7y ago
[deleted]
ApolloFortyNine 7y ago
The more people who use adblocker, the more ads websites need to make the same amount of money. It's been brought up that many twitch streamers don't receive ad revenue from more than half their viewers. I can only find a source right now for YouTube, but they're out there for twitch too. [1] https://www.vg247.com/2015/10/30/around-40-of-pewdiepies-audience-uses-adblock/ https://www.vg247.com/2015/10/30/around-40-of-pewdiepies-aud...
- antt 7y ago
  And? If ads were ads and not malware trackers I wouldn't care. Calling these franken-programs ads stretches the word past its breaking point. No one can stop actual ads - this comment was brought to you by Pepsi, Pepsi for the love of it. See? Everyone had to read the last sentence even if they had adblock on.
  - ApolloFortyNine 7y ago
    Requiring ads like that will only kill small businesses. Big companies can get custom ads like that. Small ones have to rely on Adsense. You can justify it however you want, the fact is if you remove automated ads from the internet, the internet would be a lot smaller than it is today.
- mAritz 7y ago
  To add to the specific example of twitch, their ads are broken and annoying as hell. The broken: - they still don't have the volume of ads under control - the android app regularly freezes during ad display - sometimes it disrupts and buffers the stream without then displaying the actual ad And possibly more, I wouldn't know since all these are enough to make me either not watch twitch or block ads. I disable it once every few months to see if it got better though. The annoying: - the same ad every time often (when The Grand Tour started again this year, it was the only ad that ever played for me) - most ads seem to be trailers for TV shows or movies. Most of those spoil half the story - if you just want to see what some streamer is doing you have to watch an ad first Twitch Prime was the only reason I still had Amazon Prime when it removed ads officially. Not anymore. Twitch turbo was great before Twitch Prime and I had it. But now it's 9,99€ per month which I find outrageous, especially because the streamers will see very little of this money anyways, afaik.
iamnothere 7y ago
Considering that JavaScript has been used in the past to unmask Tor users, this is a frightening security bug and is not "fail-safe" behavior. The extension should remain enabled, but with a warning. It is doubtful that Mozilla will change this behavior, as they will likely consider it a niche case, but the Tor browser should probably look into alternate means of changing the behavior (patching). Edit: apparently the packaged versions of NoScript and HTTPS Everywhere were not affected. See thread here https://old.reddit.com/r/TOR/comments/bkg7vf/due_to_a_bug_in_firefox_all_addons_in/ https://old.reddit.com/r/TOR/comments/bkg7vf/due_to_a_bug_in...
0xdeadb00f 7y ago
That really sucks that Tor was vulnerable to this too. Tor needs to fork Firefox "properly" and remove all of Mozilla's bullshit like I've seen some forks do (Waterfox?). I thought this would be common sense for the people at Tor.

hnaccy 7y ago

Yikes.

thekyle 7y ago

That's really bad because it means it also effects Firefox ESR which is what lots of large enterprise users have installed.

deleted 7y ago

[deleted]

mirimir 7y ago

That was predictable.

mirimir 7y ago
Well, it was. I mean, it's Firefox! But see https://trac.torproject.org/projects/tor/ticket/30388 https://trac.torproject.org/projects/tor/ticket/30388 for the same temporary fix as at https://news.ycombinator.com/item?id=19823928 https://news.ycombinator.com/item?id=19823928

mrep 7y ago

> Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :( Try turning it off. I got rid of ublock after arstechnica complained about a lot of their users blocking ads years ago and it honestly isn't that bad. Every once in a while I do back out of a page for maxing out one of my cpu cores but otherwise, nothing ever bad happens. With ads: either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website. The alternative is websites charging insane amounts of money with paywalls (Wall street journal has their "best" price for 12 months at $360 a year). That is horrible because it means only rich people can pay for high quality news as ads are one of the most progressive forms of payment (rich people ads are way more valuable than poor peoples and yet everyone gets the same quality services/news with the ad model despite their income/net worth).

hnaccy 7y ago
>nothing ever bad happens. With ads: either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website. You just described something bad.
- mrep 7y ago
  Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website?
  - Nicksil 7y ago
    >Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website? Funding the Internet? What you're talking about (ads) is a revenue stream for what amounts to a handful of websites. google.com, amazon.com, ycombinator.com, reddit.com, thefacebook.com, tweeter.com, etc. could all go offline right now and the Internet would still be here.
    - gugagore 7y ago
      That doesn't sound right. What about all the other websites with ads, like recipe sites, guitar chords, porn, diy, etc.? or apps on the Google play store with ads?
      - luckylion 7y ago
        I run sites that don't have ads. I don't make any money off of them. I still run them. Seems like a lot of people in software development think similarly.
        sleavey 7y ago
        This is the web that I like. Hobbyists and volunteers running low-fi websites for common interests. I'm not against commercial sites like Netflix but don't think every last blog should be monetised.

deleted 7y ago

[deleted]

ApolloFortyNine 7y ago

The more people who use adblocker, the more ads websites need to make the same amount of money. It's been brought up that many twitch streamers don't receive ad revenue from more than half their viewers. I can only find a source right now for YouTube, but they're out there for twitch too. [1] https://www.vg247.com/2015/10/30/around-40-of-pewdiepies-audience-uses-adblock/ https://www.vg247.com/2015/10/30/around-40-of-pewdiepies-aud...

antt 7y ago
And? If ads were ads and not malware trackers I wouldn't care. Calling these franken-programs ads stretches the word past its breaking point. No one can stop actual ads - this comment was brought to you by Pepsi, Pepsi for the love of it. See? Everyone had to read the last sentence even if they had adblock on.
- ApolloFortyNine 7y ago
  Requiring ads like that will only kill small businesses. Big companies can get custom ads like that. Small ones have to rely on Adsense. You can justify it however you want, the fact is if you remove automated ads from the internet, the internet would be a lot smaller than it is today.
mAritz 7y ago
To add to the specific example of twitch, their ads are broken and annoying as hell. The broken: - they still don't have the volume of ads under control - the android app regularly freezes during ad display - sometimes it disrupts and buffers the stream without then displaying the actual ad And possibly more, I wouldn't know since all these are enough to make me either not watch twitch or block ads. I disable it once every few months to see if it got better though. The annoying: - the same ad every time often (when The Grand Tour started again this year, it was the only ad that ever played for me) - most ads seem to be trailers for TV shows or movies. Most of those spoil half the story - if you just want to see what some streamer is doing you have to watch an ad first Twitch Prime was the only reason I still had Amazon Prime when it removed ads officially. Not anymore. Twitch turbo was great before Twitch Prime and I had it. But now it's 9,99€ per month which I find outrageous, especially because the streamers will see very little of this money anyways, afaik.

iamnothere 7y ago

Considering that JavaScript has been used in the past to unmask Tor users, this is a frightening security bug and is not "fail-safe" behavior. The extension should remain enabled, but with a warning. It is doubtful that Mozilla will change this behavior, as they will likely consider it a niche case, but the Tor browser should probably look into alternate means of changing the behavior (patching). Edit: apparently the packaged versions of NoScript and HTTPS Everywhere were not affected. See thread here https://old.reddit.com/r/TOR/comments/bkg7vf/due_to_a_bug_in_firefox_all_addons_in/ https://old.reddit.com/r/TOR/comments/bkg7vf/due_to_a_bug_in...

0xdeadb00f 7y ago

That really sucks that Tor was vulnerable to this too. Tor needs to fork Firefox "properly" and remove all of Mozilla's bullshit like I've seen some forks do (Waterfox?). I thought this would be common sense for the people at Tor.