6 ms·

JavaScript poses a large security and privacy risk. Think browser fingerprinting, XSS, JS-based analytics, poor or missing CSP + hijacked npm modules, etc. I

by jchook 6y ago

JavaScript poses a large security and privacy risk. Think browser fingerprinting, XSS, JS-based analytics, poor or missing CSP + hijacked npm modules, etc. I generally keep JS disabled as much as possible.

austincheney 6y ago
You can perform analytics almost as well from just the HTTP headers, you don’t need JS at all for fingerprinting, and hijacked NPM modules are probably still present even if there is no JS pushed into the browser.
- jchook 6y ago
  Curious, how do you do fingerprinting without JS? User agent, header order, etc? How well does it work?
  - paulryanrogers 6y ago
    Panopticlick did some of this with headers included, their order, and their timing. Which of course can be defeated without much loss of features. Tor Browser being one example
  - Beldin 6y ago
    Basically, each layer of any implementation of the OSI stack will have its own peculiarities. E.g. there's a paper on re-identifying computers via TCP clock drift. How well they work depends on the amount of effort you're putting in. Since Javascript is easy and offers a very rich attack surface, there seems to be little rain to really plunge the depths of other layers.
  - ratww 6y ago
    Cookie?
    - aabbcc1241 6y ago
      and also transparent pixel
chewmieser 6y ago
That's great and it's your choice to disable it but his point was don't expect developers that rely on JavaScript to power modern web experiences to develop their site to fit your strict requirements. JS does way more then just fingerprint users and open up security vulnerabilities. You're in a minority that's asking for fall-backs in a world that's so far removed from simple <noscript> fixes.
- throwaway_pdp09 6y ago
  > power modern web experiences So they're going to expect me to leave a major malware and privacy-invasion vector open so they can indulge in creating their 'web experiences'. Nope. This sounds like kids playing around, not professionals working.
  - errantspark 6y ago
    Ahahaha come on my guy, effective people get to where they are because they can make good risk/reward assessments. Turning off javascript hasn't been worth the opportunity cost to a "real professional" for decades.
    - throwaway_pdp09 6y ago
      > because they can make good risk/reward assessments Indeed, and I made mine. No ads, not tracking, no risk of malware, no need for virus scanner, high speed page loading (ahem, when it works). Worth it? For me, sure! Peace of mind means a lot to me. What's so hard about making web pages that don't use unnecessary tech?
      - errantspark 6y ago
        There's nothing wrong with it, I AGREE with you that we shouldn't ship 5 megs of some garbage framework with every blog post. The point I'm responding to is that it's somehow reasonable or common for "professionals" to run with JS off, and to not do so is "playing around". It's not. It's a very niche thing that very few people get an actual benefit from.

by jchook 6y ago

austincheney 6y ago

You can perform analytics almost as well from just the HTTP headers, you don’t need JS at all for fingerprinting, and hijacked NPM modules are probably still present even if there is no JS pushed into the browser.

jchook 6y ago
Curious, how do you do fingerprinting without JS? User agent, header order, etc? How well does it work?
- paulryanrogers 6y ago
  Panopticlick did some of this with headers included, their order, and their timing. Which of course can be defeated without much loss of features. Tor Browser being one example
- Beldin 6y ago
  Basically, each layer of any implementation of the OSI stack will have its own peculiarities. E.g. there's a paper on re-identifying computers via TCP clock drift. How well they work depends on the amount of effort you're putting in. Since Javascript is easy and offers a very rich attack surface, there seems to be little rain to really plunge the depths of other layers.
- ratww 6y ago
  Cookie?
  - aabbcc1241 6y ago
    and also transparent pixel

chewmieser 6y ago

That's great and it's your choice to disable it but his point was don't expect developers that rely on JavaScript to power modern web experiences to develop their site to fit your strict requirements. JS does way more then just fingerprint users and open up security vulnerabilities. You're in a minority that's asking for fall-backs in a world that's so far removed from simple <noscript> fixes.

throwaway_pdp09 6y ago
> power modern web experiences So they're going to expect me to leave a major malware and privacy-invasion vector open so they can indulge in creating their 'web experiences'. Nope. This sounds like kids playing around, not professionals working.
- errantspark 6y ago
  Ahahaha come on my guy, effective people get to where they are because they can make good risk/reward assessments. Turning off javascript hasn't been worth the opportunity cost to a "real professional" for decades.
  - throwaway_pdp09 6y ago
    > because they can make good risk/reward assessments Indeed, and I made mine. No ads, not tracking, no risk of malware, no need for virus scanner, high speed page loading (ahem, when it works). Worth it? For me, sure! Peace of mind means a lot to me. What's so hard about making web pages that don't use unnecessary tech?
    - errantspark 6y ago
      There's nothing wrong with it, I AGREE with you that we shouldn't ship 5 megs of some garbage framework with every blog post. The point I'm responding to is that it's somehow reasonable or common for "professionals" to run with JS off, and to not do so is "playing around". It's not. It's a very niche thing that very few people get an actual benefit from.