5 ms·

Ah yes. Perfect timing. Just 2 days after I was heavily downvoted for saying that you're not particularly safe if you don't disable JS. This absolutely made m

Ah yes. Perfect timing. Just 2 days after I was heavily downvoted for saying that you're not particularly safe if you don't disable JS. This absolutely made my day. HN truly is a source of nonstop entertainment.

ShaneMcGowan 6y ago
"Particularly safe" is a bit alarmist, one could make the same argument about literally anything that connects to a public network isn't particularly safe
- chmod775 6y ago
  It isn't particularly safe compared to having JS disabled. RCE exploits, stealthy CSRFs, etc. that work with JS disabled are exceedingly rare compared their JS counterparts. This is quantifiable, not "alarmist".
  - rezonant 6y ago
    There are plenty of stealthy CSRFs that don't require javascript, but you probably meant stealthy XSS
    - chmod775 6y ago
      I did not.
- stinos 6y ago
  I.e. disabling JS is all fine, but in the end it is just 'safer' and whether or not that is already 'particularily safe' is a rather subjective thing.
deleted 6y ago
[deleted]
superjan 6y ago
Yeah, today’s browsers remind me of flash and acrobat: they add features faster than they can fix security bugs. And those features are default on for everyone to exploit. Yeah, I know the comparison is a hyperbole.
deleted 6y ago
[deleted]
anaganisk 6y ago
I could go ahead and say diable internet unless you dont want to be particularly safe. I mean there are CPU level zero days. But on a serious note, how would one protect oneself from Apps other than browser and talk to internet? I mean we can't ask regular users to learn and turn off stuff.
- lcall 6y ago
  I realize I am late in replying. What I do, while using OpenBSD, is limit which users access which apps, dividing my activities by user according to risk level and which apps a given user uses and sites that user browses to (some user accounts I use regularly do not use a browser). Also obsd has pledge and unveil built in, which are kernel API calls they put in apps which limit which syscalls and directories an app can access. Those combined give me some increase of confidence. (Edit: On Debian I could do this with multiple simultaneous X sessions, moving data between them via a shared text file. On obsd, one could use SSH and some scripts, so they can share a desktop if/when desired.) Maybe there is a maturity and effort level continuum, where we can help people along as appropriate, per their desires, interest, and situation.
- lcall 6y ago
  I forgot to mention: some of this can be done on Linux also, but another nice thing about openbsd is its ~ "only 2 remote holes in the default install", since ~ 1996. I've had to learn some things to use it effectively, but everything has tradeoffs.

ShaneMcGowan 6y ago

"Particularly safe" is a bit alarmist, one could make the same argument about literally anything that connects to a public network isn't particularly safe

chmod775 6y ago
It isn't particularly safe compared to having JS disabled. RCE exploits, stealthy CSRFs, etc. that work with JS disabled are exceedingly rare compared their JS counterparts. This is quantifiable, not "alarmist".
- rezonant 6y ago
  There are plenty of stealthy CSRFs that don't require javascript, but you probably meant stealthy XSS
  - chmod775 6y ago
    I did not.
stinos 6y ago
I.e. disabling JS is all fine, but in the end it is just 'safer' and whether or not that is already 'particularily safe' is a rather subjective thing.

deleted 6y ago

[deleted]

superjan 6y ago

Yeah, today’s browsers remind me of flash and acrobat: they add features faster than they can fix security bugs. And those features are default on for everyone to exploit. Yeah, I know the comparison is a hyperbole.

deleted 6y ago

[deleted]

anaganisk 6y ago

I could go ahead and say diable internet unless you dont want to be particularly safe. I mean there are CPU level zero days. But on a serious note, how would one protect oneself from Apps other than browser and talk to internet? I mean we can't ask regular users to learn and turn off stuff.

lcall 6y ago
I realize I am late in replying. What I do, while using OpenBSD, is limit which users access which apps, dividing my activities by user according to risk level and which apps a given user uses and sites that user browses to (some user accounts I use regularly do not use a browser). Also obsd has pledge and unveil built in, which are kernel API calls they put in apps which limit which syscalls and directories an app can access. Those combined give me some increase of confidence. (Edit: On Debian I could do this with multiple simultaneous X sessions, moving data between them via a shared text file. On obsd, one could use SSH and some scripts, so they can share a desktop if/when desired.) Maybe there is a maturity and effort level continuum, where we can help people along as appropriate, per their desires, interest, and situation.
lcall 6y ago
I forgot to mention: some of this can be done on Linux also, but another nice thing about openbsd is its ~ "only 2 remote holes in the default install", since ~ 1996. I've had to learn some things to use it effectively, but everything has tradeoffs.