5 ms·

So what we've learned once again is: running random code off of the internet is a bad idea... Wonder if we'll stop doing this at some point?

deleted 3y ago
[deleted]
HideousKojima 3y ago
Hit F12. Unless you're using NoScript or something similar, you're doing just that right now.
- i_love_cookies 3y ago
  [dead]
jwells89 3y ago
To me the danger seems to be not in the randomness of the code, but that it can run without the user's prompting or consent. Perhaps it would be a good idea for browsers to disable JS JIT by default (as this is where a large percentage of holes crop up) and allow the user to enable it where they find the benefit low-risk and worthwhile (e.g. with vetted web apps). The downside is that the web is a bit slower by default, but that might not necessarily be such a bad thing and encourage more developer consciousness of how much JS they're pulling in and how resource intensive it is.
- Syonyk 3y ago
  Just disable JIT and WASM. I've been browsing that way for... oh, at least a year, probably more, and I don't notice a difference. The world isn't actually Javascript benchmarks (which suffer horribly, running the same hot loop over and over), and I seldom notice the performance difference. It's just the default in my template for web browsing Qubes, along with disabling a few other things. If you're on an Apple device, ignore Apple and enable Lockdown. You don't lose much (some image formats, occasionally this is annoying), and you gain serious robustness against a huge wave of attacks.
  - n8cpdx 3y ago
    A little known fact is that you can disable lockdown mode per site and per app (e.g. you can disable lockdown mode for obsidian to make it work properly since it is web based). So actually it isn’t disabling JIT, it is making JIT opt-in. You also lose custom fonts on sites, but that is more feature than bug these days.
    - euazOn 3y ago
      Thats a great tip, thanks! As a sidenote, how do you sync Obsidian on iOS?
      - n8cpdx 3y ago
        I use the obsidian sync service. I have been completely satisfied with it.
rfoo 3y ago
Be ready to say "playing random video off of the Internet is a bad idea" if someone decided JavaScript has to be gone.
- Zuiii 3y ago
  I would have assumed the range of things you could do in video would be limited by codec. Can you provide links that explain how video can achieve similar feats?
  - rfoo 3y ago
    Font: https://developer.apple.com/fonts/TrueType-Reference-Manual/RM05/Chap5.html https://developer.apple.com/fonts/TrueType-Reference-Manual/..., there's a lot of exploits in various implementations about ten years ago: https://security.stackexchange.com/questions/91347/how-can-a-font-be-used-for-privilege-escalation https://security.stackexchange.com/questions/91347/how-can-a.... There's still active ITW exploits in 2023: https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-26369.html https://googleprojectzero.github.io/0days-in-the-wild//0day-... Image: The famous JBIG2. Video: https://en.wikipedia.org/wiki/Stagefright_(bug) https://en.wikipedia.org/wiki/Stagefright_(bug)
userbinator 3y ago
A little extra attack surface won't stop the vested interests from making sure that their code (tracking, ads, whatever other user hostilities) continues to run.

deleted 3y ago

[deleted]

HideousKojima 3y ago

Hit F12. Unless you're using NoScript or something similar, you're doing just that right now.

i_love_cookies 3y ago
[dead]

jwells89 3y ago

To me the danger seems to be not in the randomness of the code, but that it can run without the user's prompting or consent. Perhaps it would be a good idea for browsers to disable JS JIT by default (as this is where a large percentage of holes crop up) and allow the user to enable it where they find the benefit low-risk and worthwhile (e.g. with vetted web apps). The downside is that the web is a bit slower by default, but that might not necessarily be such a bad thing and encourage more developer consciousness of how much JS they're pulling in and how resource intensive it is.

Syonyk 3y ago
Just disable JIT and WASM. I've been browsing that way for... oh, at least a year, probably more, and I don't notice a difference. The world isn't actually Javascript benchmarks (which suffer horribly, running the same hot loop over and over), and I seldom notice the performance difference. It's just the default in my template for web browsing Qubes, along with disabling a few other things. If you're on an Apple device, ignore Apple and enable Lockdown. You don't lose much (some image formats, occasionally this is annoying), and you gain serious robustness against a huge wave of attacks.
- n8cpdx 3y ago
  A little known fact is that you can disable lockdown mode per site and per app (e.g. you can disable lockdown mode for obsidian to make it work properly since it is web based). So actually it isn’t disabling JIT, it is making JIT opt-in. You also lose custom fonts on sites, but that is more feature than bug these days.
  - euazOn 3y ago
    Thats a great tip, thanks! As a sidenote, how do you sync Obsidian on iOS?
    - n8cpdx 3y ago
      I use the obsidian sync service. I have been completely satisfied with it.

rfoo 3y ago

Be ready to say "playing random video off of the Internet is a bad idea" if someone decided JavaScript has to be gone.

Zuiii 3y ago
I would have assumed the range of things you could do in video would be limited by codec. Can you provide links that explain how video can achieve similar feats?
- rfoo 3y ago
  Font: https://developer.apple.com/fonts/TrueType-Reference-Manual/RM05/Chap5.html https://developer.apple.com/fonts/TrueType-Reference-Manual/..., there's a lot of exploits in various implementations about ten years ago: https://security.stackexchange.com/questions/91347/how-can-a-font-be-used-for-privilege-escalation https://security.stackexchange.com/questions/91347/how-can-a.... There's still active ITW exploits in 2023: https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-26369.html https://googleprojectzero.github.io/0days-in-the-wild//0day-... Image: The famous JBIG2. Video: https://en.wikipedia.org/wiki/Stagefright_(bug) https://en.wikipedia.org/wiki/Stagefright_(bug)

userbinator 3y ago

A little extra attack surface won't stop the vested interests from making sure that their code (tracking, ads, whatever other user hostilities) continues to run.