3 ms·

Clientside mitigation: install noscript. https://addons.mozilla.org/en-US/firefox/addon/noscript/ https://addons.mozilla.org/en-US/firefox/addon/noscript/ You

by sneak 2y ago

Clientside mitigation: install noscript. https://addons.mozilla.org/en-US/firefox/addon/noscript/ https://addons.mozilla.org/en-US/firefox/addon/noscript/ You can’t expect to remain secure on the modern web while running arbitrary javascript from anyone and everyone.

globalise83 2y ago
Nice: to be secure on the web, you just need to install an add-on which needs to: Access browser tabs Store unlimited amount of client-side data Access browser activity during navigation Access your data for all websites
- zuminator 2y ago
  Unless you design your own silicon, build your own pc and peripherals, and write all your own software, there's always going to be a level of trust involved. But at least NoScript is FOSS so you can in theory examine the source code yourself. https://github.com/hackademix https://github.com/hackademix
  - globalise83 2y ago
    So is polyfill https://github.com/polyfillpolyfill/polyfill-service https://github.com/polyfillpolyfill/polyfill-service
- bee_rider 2y ago
  I think there’s a toggle to just disable JavaScript entirely somewhere in the menus, but it is sort of inconvenient, because you can’t selectively enable sites that are too poorly coded to run without JavaScript. Mozilla has marked NoScript as a recommended extension, which is supposed to mean they reviewed the code. Did they do it perfectly? I don’t know. But the same logic could be applied to the patches they receive for their browser itself, right? It’s all just code that we trust them to audit correctly.
- Jakob 2y ago
  Yes that is unfortunate. Safari had the option to toggle JavaScript via Shortcut until recently, but it was removed. The only browser I know which can easily toggle JavaScript now is Brave. But uBlock Origin has that functionality, too, and I guess most people who would care about JavaScript have that already enabled anyways. The web is so much nicer without JavaScript but easily activating it (via cmd-J) once it seems necessary without reloading.
  - nobody9999 2y ago
    >Yes that is unfortunate. Safari had the option to toggle JavaScript via Shortcut until recently, but it was removed. The only browser I know which can easily toggle JavaScript now is Brave. There's a Firefox Addon[0] for that. [0] https://addons.mozilla.org/en-US/firefox/addon/javascript-toggler/ https://addons.mozilla.org/en-US/firefox/addon/javascript-to...
- brunoqc 2y ago
  You don't need an addon for https://safebrowsing.google.com https://safebrowsing.google.com
  - officeplant 2y ago
    >Google’s Ads Security team uses Safe Browsing to make sure that Google ads do not promote dangerous pages. This is already wrong in my experience. I had a coworker panicking two weeks ago because he googled youtube and clicked the first link. Which turned out to be a fake ransomware page ad designed to get you to call a scam call center. There is no such thing as a safe ad anymore because no one is policing them appropriately. Especially if something like this can happen when searching a service google themselves owns.
    - emporas 2y ago
      > "no such thing as a safe ad anymore because no one is policing them appropriately" That's one of the most Kafkaesque sentences i have read in a while.
flanbiscuit 2y ago
If you're running uBlock Origin, you can also add it to your filters. discussed here: https://news.ycombinator.com/item?id=40792322 https://news.ycombinator.com/item?id=40792322 I wonder if it would just better to edit your /etc/hosts file and add something like to this to it: 127.0.0.1 polyfill.io 127.0.0.1 www.polyfill.io 127.0.0.1 cdn.polyfill.io I use both FF and Chrome, and I use multiple profiles on Chrome, so I have to go in an add the filter for each profile and browser. At least for my personal laptop where I can do this. Not sure about my work one. edit: looks like uBlock is already blocking it: https://news.ycombinator.com/item?id=40796938 https://news.ycombinator.com/item?id=40796938
PufPufPuf 2y ago
You can't expect any modern page to work without JavaScript either. And auditing every page's JavaScript yourself isn't exactly feasible.

by sneak 2y ago

globalise83 2y ago

Nice: to be secure on the web, you just need to install an add-on which needs to: Access browser tabs Store unlimited amount of client-side data Access browser activity during navigation Access your data for all websites

zuminator 2y ago
Unless you design your own silicon, build your own pc and peripherals, and write all your own software, there's always going to be a level of trust involved. But at least NoScript is FOSS so you can in theory examine the source code yourself. https://github.com/hackademix https://github.com/hackademix
- globalise83 2y ago
  So is polyfill https://github.com/polyfillpolyfill/polyfill-service https://github.com/polyfillpolyfill/polyfill-service
bee_rider 2y ago
I think there’s a toggle to just disable JavaScript entirely somewhere in the menus, but it is sort of inconvenient, because you can’t selectively enable sites that are too poorly coded to run without JavaScript. Mozilla has marked NoScript as a recommended extension, which is supposed to mean they reviewed the code. Did they do it perfectly? I don’t know. But the same logic could be applied to the patches they receive for their browser itself, right? It’s all just code that we trust them to audit correctly.
Jakob 2y ago
Yes that is unfortunate. Safari had the option to toggle JavaScript via Shortcut until recently, but it was removed. The only browser I know which can easily toggle JavaScript now is Brave. But uBlock Origin has that functionality, too, and I guess most people who would care about JavaScript have that already enabled anyways. The web is so much nicer without JavaScript but easily activating it (via cmd-J) once it seems necessary without reloading.
- nobody9999 2y ago
  >Yes that is unfortunate. Safari had the option to toggle JavaScript via Shortcut until recently, but it was removed. The only browser I know which can easily toggle JavaScript now is Brave. There's a Firefox Addon[0] for that. [0] https://addons.mozilla.org/en-US/firefox/addon/javascript-toggler/ https://addons.mozilla.org/en-US/firefox/addon/javascript-to...
brunoqc 2y ago
You don't need an addon for https://safebrowsing.google.com https://safebrowsing.google.com
- officeplant 2y ago
  >Google’s Ads Security team uses Safe Browsing to make sure that Google ads do not promote dangerous pages. This is already wrong in my experience. I had a coworker panicking two weeks ago because he googled youtube and clicked the first link. Which turned out to be a fake ransomware page ad designed to get you to call a scam call center. There is no such thing as a safe ad anymore because no one is policing them appropriately. Especially if something like this can happen when searching a service google themselves owns.
  - emporas 2y ago
    > "no such thing as a safe ad anymore because no one is policing them appropriately" That's one of the most Kafkaesque sentences i have read in a while.

flanbiscuit 2y ago

If you're running uBlock Origin, you can also add it to your filters. discussed here: https://news.ycombinator.com/item?id=40792322 https://news.ycombinator.com/item?id=40792322 I wonder if it would just better to edit your /etc/hosts file and add something like to this to it: 127.0.0.1 polyfill.io 127.0.0.1 www.polyfill.io 127.0.0.1 cdn.polyfill.io I use both FF and Chrome, and I use multiple profiles on Chrome, so I have to go in an add the filter for each profile and browser. At least for my personal laptop where I can do this. Not sure about my work one. edit: looks like uBlock is already blocking it: https://news.ycombinator.com/item?id=40796938 https://news.ycombinator.com/item?id=40796938

PufPufPuf 2y ago

You can't expect any modern page to work without JavaScript either. And auditing every page's JavaScript yourself isn't exactly feasible.