3 ms·

Name any CSS or JS exploit that had meaningful real-world impact in the last decade. In 20 years on the Internet, most without an ad blocker, I haven't suffere

Name any CSS or JS exploit that had meaningful real-world impact in the last decade. In 20 years on the Internet, most without an ad blocker, I haven't suffered from any lapses in browser security (that I know of, sure, but I don't much care about those I don't know about) The tale of frequent compromises of browsers via ads is told merely to legitimize the practice of blocking even entirely plain and benign ads.

jyrkesh 5y ago
Great, but you're computer-savvy. You know not to click the 9 phony "Download" buttons and to find the nondescript text that says "Download link (slow)", and you probably don't even end up on sites like that in the first place. Nowadays, the first thing I do when "cleaning up" a non-tech friend/relative's computer is to install uBlock Origin. Since I started doing that, the number of repeat calls dropped precipitously. (To be honest, it's probably good for their fake news intake, too...) The web is a lot scarier for most people than you might realize if you've been successfully navigating away from sketchy sites for 30 years.
Brybry 5y ago
People lose website account credentials, with meaningful life impacts, all of the time. Even simple image ads that are fake "click here to login" have tricked my elderly relatives before. I install an ad blocker on the computers of relatives out of reaction to real events that happened, not paranoia. You were never clickjacked? Never had pop-up or pop-under ads/windows created without your consent? Recursively? Crashing your browser? Never visited a page that was hijacked with an iframe? I've experienced a lot of malicious ads in my time on the internet, it baffles me that someone has not.
autoexec 5y ago
> Name any CSS or JS exploit that had meaningful real-world impact in the last decade. The tale of frequent compromises of browsers via ads is told merely to legitimize the practice of blocking even entirely plain and benign ads. I think the actual malware infections themselves legitimize the practice of blocking even entirely plain and benign ads. Ads do still infect people with malware. https://blog.confiant.com/tag-barnakle-the-malvertiser-that-hacks-revive-ad-servers-redirects-victims-to-malware-50cdc57435b1?gi=9fbcec4471e2 https://blog.confiant.com/tag-barnakle-the-malvertiser-that-... Hell, yahoo was hit not that long ago and users were at risk of infection just by loading yahoo.com. JS exploits and malware written in JS are common, but so far I haven't seen CSS used to infect systems, just steal data/log keystrokes and add a lot of privacy concerns which is bad enough. I'm already keeping an eye out for a CSS blocker that will only allow a sane subset of CSS and block or limit externally hosted resources.
MomoXenosaga 5y ago
Last time I tried reading a website without an ad blocker my sanity got compromised.

jyrkesh 5y ago

Great, but you're computer-savvy. You know not to click the 9 phony "Download" buttons and to find the nondescript text that says "Download link (slow)", and you probably don't even end up on sites like that in the first place. Nowadays, the first thing I do when "cleaning up" a non-tech friend/relative's computer is to install uBlock Origin. Since I started doing that, the number of repeat calls dropped precipitously. (To be honest, it's probably good for their fake news intake, too...) The web is a lot scarier for most people than you might realize if you've been successfully navigating away from sketchy sites for 30 years.

Brybry 5y ago

People lose website account credentials, with meaningful life impacts, all of the time. Even simple image ads that are fake "click here to login" have tricked my elderly relatives before. I install an ad blocker on the computers of relatives out of reaction to real events that happened, not paranoia. You were never clickjacked? Never had pop-up or pop-under ads/windows created without your consent? Recursively? Crashing your browser? Never visited a page that was hijacked with an iframe? I've experienced a lot of malicious ads in my time on the internet, it baffles me that someone has not.

autoexec 5y ago

> Name any CSS or JS exploit that had meaningful real-world impact in the last decade. The tale of frequent compromises of browsers via ads is told merely to legitimize the practice of blocking even entirely plain and benign ads. I think the actual malware infections themselves legitimize the practice of blocking even entirely plain and benign ads. Ads do still infect people with malware. https://blog.confiant.com/tag-barnakle-the-malvertiser-that-hacks-revive-ad-servers-redirects-victims-to-malware-50cdc57435b1?gi=9fbcec4471e2 https://blog.confiant.com/tag-barnakle-the-malvertiser-that-... Hell, yahoo was hit not that long ago and users were at risk of infection just by loading yahoo.com. JS exploits and malware written in JS are common, but so far I haven't seen CSS used to infect systems, just steal data/log keystrokes and add a lot of privacy concerns which is bad enough. I'm already keeping an eye out for a CSS blocker that will only allow a sane subset of CSS and block or limit externally hosted resources.

MomoXenosaga 5y ago

Last time I tried reading a website without an ad blocker my sanity got compromised.