4 ms·
We really should look at ads as this service where random strangers get to run Javascript in your browser. They're an attack vector, and ads should be treated
by calibas 3y ago
We really should look at ads as this service where random strangers get to run Javascript in your browser.
They're an attack vector, and ads should be treated like the security/privacy threats that they are.
- Xeamek 3y agoWhy? Browsers already treat all the code that is run by the website as potentially unsafe. Why would we focus specifically on adds where there are other, equally unsafe vectors present? What advantages would that have over the current way?
- Zak 3y agoPerhaps because security isn't binary. Browsers should sandbox JS such that it's harmless, but sometimes fail at that. Letting fewer random strangers run JS in your browser reduces your attack surface area.
- bell-cot 3y agoTHIS, but `sed 's/fewer/far, far fewer/'` AND - the owners of the (relatively) few web sites that most people visit are far more invested in staying malware-free, vs. the Ad companies letting ~anyone on the planet run js in ads, at "what's their credit card good for?" scale.
- bhouston 3y agoAds generally run in iframes and iframes are considered a form of sandboxing.
- falcolas 3y agoIMO, because ad code is a step above “potentially unsafe”, it’s sometimes malicious, and even intentionally malicious.
- aaomidi 3y agoEspecially when you get to do hyper targeted attacks through the ad provider. It’s one of the reasons I do not turn on personalized ads anywhere.