3 ms·
With advertising eyeballs and third parties in the loop there is nothing that is not "commercial". Do you think that Comcast would have refrained from injecting
by saulrh 3y ago
With advertising eyeballs and third parties in the loop there is nothing that is not "commercial". Do you think that Comcast would have refrained from injecting ads and attack scripts if you'd been browsing Wikipedia or the Internet Archive or your own personal blog instead of Steam? Do you think that they'd have gotten less money for those impressions or extracted less of your personal data? The use case doesn't matter because the attackers in the HTTP vs HTTPS case have their own monetization scheme and their own attack chain and they _do not care_ whether something is commercial or private.
- superkuh 3y agoNearly all commercial services require the execution of javascript. For example, I couldn't disable javascript in my Steam browser. But in my personal browsers I have javascript execution set to temporary-whitelist-only. Much like how I don't open and execute every email attachment sent to me. Comcast's injection attacks actually don't do anything without JS being run. I am not being hyperbolic in saying that 100% of malicious attacks on the web of the type you're floating use javascript and fail without it. Personal and non-profit (non-incorporated) websites are mostly static html and files in directories and do not require everything everywhere be encrypted and verified. This "execute everything blindly" practice is only accepted because it's required for businesses which require JS execution. I reject this premise because no, it doesn't apply in all contexts and risks of MITM attacks (on personal websites) are very low once you question and mitigate it. The document web is much safer and requires less sacrifices than the application web.