3 ms·

It depends on how concerned are you about the regular security issues. Which ideally depends on the things you are responsible for. If it's your family photos i

by pas 5y ago

It depends on how concerned are you about the regular security issues. Which ideally depends on the things you are responsible for. If it's your family photos in iCloud? Nah. If it's the nuclear launch codes for the whole world? Then yeah, you should already be isolating separating compartmentalizing...

myself248 5y ago
> photos in iCloud? I mean, the last fappening was done by phishing, as I recall. Are you saying another one, done by rowhammer, wouldn't be a problem? I suspect most folks have stuff they'd rather not make public. Credit card numbers, at the very least. This affects us all.
- pas 5y ago
  While there are clearly bad (and some interesting) ethical aspects of the Fappening, it was not a big problem for society. Everyday many people experience the same violation of their privacy (revenge porn sites, accidentally sending nudes to the wrong address, etc), and life goes on. (And as far as I know nobody of the affected celebs have taken drastic measures, while unfortunately this cannot be said for non-celebs, as cyberbullying regularly gets people to attempt suicide with "success".) Similarly the day-to-day ransomwares probably cost more than securing browsers will.
javajosh 5y ago
You don't have to be in charge of launch codes to worry about this one. I mean, if anyone can 'npm install rowhammer' and reliably attack anyone that visits their site, even in a modern browser, then it's time to turn js off. I'm okay if there are some minor or even moderate XSS exploits out there; but a hardware vuln accessible to javascript means javascript goes bye bye for now, at least from my local machine's browser.
- pas 5y ago
  If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. If it comes you'll hear about "apps" that freeze every other browser process while you do online banking. That said, proactively blocking JS is great for many reasons, and you can whitelist sites you sort of trust.
  - ziddoap 5y ago
    >If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. This is a pretty laissez-faire attitude with regards to security-critical exploits. You might be the one of the first ones affected. After all, someone has to be first one before they can post it on HN. In a more general sense, it's a bad idea to rely on someone else as your primary alert. Whether it is a HN post, news article, whatever. (I know that you aren't quite saying to use it as a primary alert, but a cursory read of your comment implies it, so it's worth discussing.)
    - scandinavian 5y ago
      > You might be the one of the first ones affected If you are regularly the fist target of zero-days your threat model should be stricter yes. The other 7.9 billion people in the world can afford to be a little less strict.
      - ziddoap 5y ago
        I didn't consider "don't wait for someone else to get hacked and tell you about it" to be a particularly strict method of security, but sure, I guess so.
  - acuozzo 5y ago
    > If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. It did come to that, years ago: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs

by pas 5y ago

myself248 5y ago

> photos in iCloud? I mean, the last fappening was done by phishing, as I recall. Are you saying another one, done by rowhammer, wouldn't be a problem? I suspect most folks have stuff they'd rather not make public. Credit card numbers, at the very least. This affects us all.

pas 5y ago
While there are clearly bad (and some interesting) ethical aspects of the Fappening, it was not a big problem for society. Everyday many people experience the same violation of their privacy (revenge porn sites, accidentally sending nudes to the wrong address, etc), and life goes on. (And as far as I know nobody of the affected celebs have taken drastic measures, while unfortunately this cannot be said for non-celebs, as cyberbullying regularly gets people to attempt suicide with "success".) Similarly the day-to-day ransomwares probably cost more than securing browsers will.

javajosh 5y ago

You don't have to be in charge of launch codes to worry about this one. I mean, if anyone can 'npm install rowhammer' and reliably attack anyone that visits their site, even in a modern browser, then it's time to turn js off. I'm okay if there are some minor or even moderate XSS exploits out there; but a hardware vuln accessible to javascript means javascript goes bye bye for now, at least from my local machine's browser.

pas 5y ago
If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. If it comes you'll hear about "apps" that freeze every other browser process while you do online banking. That said, proactively blocking JS is great for many reasons, and you can whitelist sites you sort of trust.
- ziddoap 5y ago
  >If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. This is a pretty laissez-faire attitude with regards to security-critical exploits. You might be the one of the first ones affected. After all, someone has to be first one before they can post it on HN. In a more general sense, it's a bad idea to rely on someone else as your primary alert. Whether it is a HN post, news article, whatever. (I know that you aren't quite saying to use it as a primary alert, but a cursory read of your comment implies it, so it's worth discussing.)
  - scandinavian 5y ago
    > You might be the one of the first ones affected If you are regularly the fist target of zero-days your threat model should be stricter yes. The other 7.9 billion people in the world can afford to be a little less strict.
    - ziddoap 5y ago
      I didn't consider "don't wait for someone else to get hacked and tell you about it" to be a particularly strict method of security, but sure, I guess so.
- acuozzo 5y ago
  > If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. It did come to that, years ago: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs