6 ms·
> not just in the form of Javascript but that's the largest example I can think of. As far as I understand browsers still get owned at every pwn2own. So you mi
by josefx 5y ago
> not just in the form of Javascript but that's the largest example I can think of.
As far as I understand browsers still get owned at every pwn2own. So you might want to stop running untrusted JavaScript anyway.
- swiley 5y agoI'm continually shocked that people are so ok with automatically executing any code random sites they connect to shove at them.
- alisonkisk 5y agoCode is data. Data is code.
- bruce343434 5y agoViral bacteria are matter. Matter is viral bacteria.
- swiley 5y agoIt's more or less impossible to express recursion (in the same ways you can with js) with pure css/html. If you want to be overly reductionist then you can argue nothing matters because your just staring at a box with lights in it.
- dijit 5y agoI don't want to go into this topic because frontend developers are very defensive of their capability to Javascript on people, they often cite javascript adoption numbers as proof that it's fine to make it mandatory or cite complex web applications as a reason for it to be mandatory for all sites, which I personally find to be a false dichotomy. I tend to agree with what you're saying but the ship has sailed very much and running without javascript is a losing proposition these days. (my web browser starts up with javascript disabled except for some whitelisted sites and it usually only takes 15 minutes for me to find something completely broken on the internet and re-enable javascript entirely).
- sneak 5y agoNah. I browse the web with NoScript. Snowden himself says to disable scripting in browsers.
- voakbasda 5y agoEntirely? Use NoScript to temporarily enable only those portions of the single site that you need. No affiliation, just a happy user.
- SkyMarshal 5y ago/second NoScript. Instead of whitelisting whole sites, you can whitelist links to JavaScript imports across all sites, temporarily or permanently. So for example, you can whitelist urls to all the major JavaScript frontend frameworks’ CDNs, like bootstrap, etc. while leaving known trackers and spyware blacklisted by default. Anecdotally it seems most websites still work with their trackers disabled, as long as they have their frontend framework/s loaded.
- gruez 5y agoI disagree. There are way too many sites that require javascript that you'll eventually get into the habit of blindly enabling scripts when a site breaks, negating any security benefits.
- hutzlibu 5y agoYou probably misunderstood : allmost all websites require javascript, yes - but you can selectivly allow only the javascript of that site, their framework etc. and block all the tracker/ads javascript with NoScript/UBlock - and then it is working and probably quite safe. But to mitigate, more and more websites find ways to sneak in the tracker/ads/analytics into the main sites js. So it is not as easy, either. Which is why I just use basic ublock origin and regulary wipe the browser cache.
- 5y ago