4 ms·

It’s a bit of a leap to assume that TOR is vulnerable here, considering it disables JavaScript which is necessary for this exploit to work. Let’s not get carrie

It’s a bit of a leap to assume that TOR is vulnerable here, considering it disables JavaScript which is necessary for this exploit to work. Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance.

vbezhenar 7y ago
TOR Browser does not disable JavaScript. It would be pretty useless with disabled JavaScript to be honest, a lot of the websites nowadays require JavaScript to work.
deleted 7y ago
[deleted]
tyingq 7y ago
" Why is NoScript configured to allow JavaScript by default in Tor Browser? Isn't that unsafe? We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled." https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
chefandy 7y ago
Tor Browser Bundle does not outright disable JS at the settings level— it comes bundled with NoScript installed (and enabled by default,) but it can purposefully be wholly or partially disabled by the user with a couple of toolbar clicks. "Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance." You seem to be jumping to the opposite conclusion with your comment, which I'd argue is an even worse idea with security software. Considering that TBB is based on the vulnerable software package and the vulnerability could directly circumvent what TBB is attempting to accomplish, assuming there isn't a reasonable attack vector seems imprudent, rather than an appropriately measured response. If I had a serious privacy concern such as reporting on the activity of a government known for murdering its critics, I certainly would think twice if the only thing preventing remote attack code from executing in a vulnerable envrionment on my machine was a browser plugin.

vbezhenar 7y ago

TOR Browser does not disable JavaScript. It would be pretty useless with disabled JavaScript to be honest, a lot of the websites nowadays require JavaScript to work.

deleted 7y ago

[deleted]

tyingq 7y ago

" Why is NoScript configured to allow JavaScript by default in Tor Browser? Isn't that unsafe? We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled." https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...

chefandy 7y ago

Tor Browser Bundle does not outright disable JS at the settings level— it comes bundled with NoScript installed (and enabled by default,) but it can purposefully be wholly or partially disabled by the user with a couple of toolbar clicks. "Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance." You seem to be jumping to the opposite conclusion with your comment, which I'd argue is an even worse idea with security software. Considering that TBB is based on the vulnerable software package and the vulnerability could directly circumvent what TBB is attempting to accomplish, assuming there isn't a reasonable attack vector seems imprudent, rather than an appropriately measured response. If I had a serious privacy concern such as reporting on the activity of a government known for murdering its critics, I certainly would think twice if the only thing preventing remote attack code from executing in a vulnerable envrionment on my machine was a browser plugin.