4 ms·

While I don't particularly agree that it's totally acceptable for a static 404 to need JS, I also don't really follow your concern for security. I've been brows

While I don't particularly agree that it's totally acceptable for a static 404 to need JS, I also don't really follow your concern for security. I've been browsing the web since 1998 and not once has my machine been compromised by malware due to normal JS on a normal website - so not sure what the "huge vector" impact is...Concern over Meltdown exploit through JS? Again, when just browsing the "normal" web? Maybe you're working on top national security secrets from your home while opening a LibDem site?

tempguy9999 7y ago
Let's start with the answer in a nutshell: a personal approach to safety, and a systemic approach to safety. > Concern over Meltdown exploit through JS? Again, when just browsing the "normal" web? I am not an expert in these things but what I do know, and it is backed up by the quotes from various well-known engineers (in the looser sense, encompassing programmers) I gave, is that complexity costs. Security is one such. From https://coar.risc.anl.gov/meltdown-spectre-and-speculative-execution-oh-my/ https://coar.risc.anl.gov/meltdown-spectre-and-speculative-e... "Using these instructions, a malicious program can be created that leveraged speculative execution to read and send every address in memory to the attackers [...] Additionally, the authors crafted a JavaScript program that leverages the browser process that houses it to access additional memory locations. Both of these proof-of-concept attacks violate memory isolation boundaries that have delineated program execution spaces" There were some quick patching and releasing done to browsers for this (coarsening the granularity of the timer IIRC) so I guess they must have cared. If you can read outside process boundaries then theoretically... well, do you bank online? Do you ever put your credit card number into a website? If you don't do you think other people do? I don't know if these cpu flaws can be realistically used, and the data exfiltrated from your machine, but I know with certainty that no JS = no exploitation will ever be possible with JS. Example: this happened in about 2012 with a company I was working for. I'll necessarily be vague, sorry. We were phished with a precision that was shocking and had nearly £20,000 taken from the company account. The malware came with browser-embedded java (not javascript!). Our off-site support guy, R, came in after and me and him uninstalled java from all the machines (~20, small business). Without the java the attack could not have taken place (the attack was 2-pronged and needed more than the java, but it was a necessary). The broader lesson is, if there's a hole it can be exploited, but if no hole then no exploit is possible there. This should be self-evident. OK, my GP has desktops in their office which are connected to the web, and allow JS to run. Are my medical records safe? Are yours? A company I worked for a year ago (turnover several million) had the browser screen hijacked with a warning I had malware and to call this number. I had to call support to verify it was a scam - remember I don't see these at home so I literally never saw this before and had to check. If I'd been a naive user at home I'd have been on the phone to wherever so the nice man could help me. The machines in that office would crawl for an hour once a week when a malware scan was being run (run late, but staff often worked late so it bothered them occasionally). Malware checker and human time interfered with - another cost. What about the cost of your browsing time of slow page loads and annoying audio/video? The cost of being tracked? Is this acceptable to you? Not for me it isn't. We may differ in what we're prepared to tolerate though. If more sites are allowe to abuse js because people won't push back then that js-disease will spread and sites will choose to use it. If there's pushback then it will be reduced and we start to gain a kind of herd immunity. You asked about malware, does this help?https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/javascript-malware-in-spam-spreads-ransomware-miners-spyware-worm https://www.trendmicro.com/vinfo/us/security/news/cybercrime... Just google "javascript malware". You won't run out of hits. Stupid net security holes and we are talking about cyber warfare - closing dumb js holes aren't the end but they might be a start. More importantly it'll be the start of a security mindset. I want us to think long-term, systemic, not "it probably won't happen". I should not have to point this out. It should be self-evident that abusable things will be abused. It's just a minor variation on Power Corrupts. Oh well. This is a bit of an unstructured brain dump so sorry for it not being precise but I hope it clarifies my position. Edit: much to me and R's annoyance the bank refunded the stolen cash, so the boss never felt need to do a proper security review.

tempguy9999 7y ago

Let's start with the answer in a nutshell: a personal approach to safety, and a systemic approach to safety. > Concern over Meltdown exploit through JS? Again, when just browsing the "normal" web? I am not an expert in these things but what I do know, and it is backed up by the quotes from various well-known engineers (in the looser sense, encompassing programmers) I gave, is that complexity costs. Security is one such. From https://coar.risc.anl.gov/meltdown-spectre-and-speculative-execution-oh-my/ https://coar.risc.anl.gov/meltdown-spectre-and-speculative-e... "Using these instructions, a malicious program can be created that leveraged speculative execution to read and send every address in memory to the attackers [...] Additionally, the authors crafted a JavaScript program that leverages the browser process that houses it to access additional memory locations. Both of these proof-of-concept attacks violate memory isolation boundaries that have delineated program execution spaces" There were some quick patching and releasing done to browsers for this (coarsening the granularity of the timer IIRC) so I guess they must have cared. If you can read outside process boundaries then theoretically... well, do you bank online? Do you ever put your credit card number into a website? If you don't do you think other people do? I don't know if these cpu flaws can be realistically used, and the data exfiltrated from your machine, but I know with certainty that no JS = no exploitation will ever be possible with JS. Example: this happened in about 2012 with a company I was working for. I'll necessarily be vague, sorry. We were phished with a precision that was shocking and had nearly £20,000 taken from the company account. The malware came with browser-embedded java (not javascript!). Our off-site support guy, R, came in after and me and him uninstalled java from all the machines (~20, small business). Without the java the attack could not have taken place (the attack was 2-pronged and needed more than the java, but it was a necessary). The broader lesson is, if there's a hole it can be exploited, but if no hole then no exploit is possible there. This should be self-evident. OK, my GP has desktops in their office which are connected to the web, and allow JS to run. Are my medical records safe? Are yours? A company I worked for a year ago (turnover several million) had the browser screen hijacked with a warning I had malware and to call this number. I had to call support to verify it was a scam - remember I don't see these at home so I literally never saw this before and had to check. If I'd been a naive user at home I'd have been on the phone to wherever so the nice man could help me. The machines in that office would crawl for an hour once a week when a malware scan was being run (run late, but staff often worked late so it bothered them occasionally). Malware checker and human time interfered with - another cost. What about the cost of your browsing time of slow page loads and annoying audio/video? The cost of being tracked? Is this acceptable to you? Not for me it isn't. We may differ in what we're prepared to tolerate though. If more sites are allowe to abuse js because people won't push back then that js-disease will spread and sites will choose to use it. If there's pushback then it will be reduced and we start to gain a kind of herd immunity. You asked about malware, does this help?https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/javascript-malware-in-spam-spreads-ransomware-miners-spyware-worm https://www.trendmicro.com/vinfo/us/security/news/cybercrime... Just google "javascript malware". You won't run out of hits. Stupid net security holes and we are talking about cyber warfare - closing dumb js holes aren't the end but they might be a start. More importantly it'll be the start of a security mindset. I want us to think long-term, systemic, not "it probably won't happen". I should not have to point this out. It should be self-evident that abusable things will be abused. It's just a minor variation on Power Corrupts. Oh well. This is a bit of an unstructured brain dump so sorry for it not being precise but I hope it clarifies my position. Edit: much to me and R's annoyance the bank refunded the stolen cash, so the boss never felt need to do a proper security review.