3 ms·
To me the danger seems to be not in the randomness of the code, but that it can run without the user's prompting or consent. Perhaps it would be a good idea for
by jwells89 3y ago
To me the danger seems to be not in the randomness of the code, but that it can run without the user's prompting or consent. Perhaps it would be a good idea for browsers to disable JS JIT by default (as this is where a large percentage of holes crop up) and allow the user to enable it where they find the benefit low-risk and worthwhile (e.g. with vetted web apps).
The downside is that the web is a bit slower by default, but that might not necessarily be such a bad thing and encourage more developer consciousness of how much JS they're pulling in and how resource intensive it is.
- Syonyk 3y agoJust disable JIT and WASM. I've been browsing that way for... oh, at least a year, probably more, and I don't notice a difference. The world isn't actually Javascript benchmarks (which suffer horribly, running the same hot loop over and over), and I seldom notice the performance difference. It's just the default in my template for web browsing Qubes, along with disabling a few other things. If you're on an Apple device, ignore Apple and enable Lockdown. You don't lose much (some image formats, occasionally this is annoying), and you gain serious robustness against a huge wave of attacks.
- n8cpdx 3y agoA little known fact is that you can disable lockdown mode per site and per app (e.g. you can disable lockdown mode for obsidian to make it work properly since it is web based). So actually it isn’t disabling JIT, it is making JIT opt-in. You also lose custom fonts on sites, but that is more feature than bug these days.