3 ms·
> Yes, browser exploits are always worrisome, which is partly the reason I have JS off by default. That is your personal preference of course, but it's highly
by infosack 7y ago
> Yes, browser exploits are always worrisome, which is partly the reason I have JS off by default.
That is your personal preference of course, but it's highly atypical for any user to have JavaScript disabled. I was just pointing out that the attack surface isn't limited to downloading and running random binaries.
> RDP and SMB aren't exploitable from the Internet if you're behind a NAT
Unless they've forwarded the ports. But either way there are millions of hosts with RDP and SMB exposed (e.g. Shodan reports 5 million of the former and 1.5 million of the latter).
- userbinator 7y agoExploits or not, exposing those services to the Internet is a bad idea. If it weren't for NAT that number would probably be much higher...
- z3t4 7y agoIf you are a developer, make sure you make your app secure by default, eg. not listening on a public IP using a standard password. Don't fall in the trap of insecurity by convenience. Too many developers expect users to have NAT, that's why we can never adopt IPv6 for end users, and IoT will never take off until we get our shit together and make our software secure.