4 ms·

Both Firefox and Chrome have features that disable plugins but still allow you to run individual applets on demand. Please turn these on; it's not much hassle a

by skymt 14y ago

Both Firefox and Chrome have features that disable plugins but still allow you to run individual applets on demand. Please turn these on; it's not much hassle and you'll be shutting down the most common targets for exploits. For Chrome, go to advanced settings -> Privacy -> Content settings -> Plug-ins and select "click to play". For Firefox, go to about:config and enable "plugins.click_to_play".

stevencorona 14y ago
Awesome, I had Click2Flash installed on Chrome, but no idea it basically already came built into the browser.
im3w1l 14y ago
Is clickjacking a solved problem or will this only raise the bar a little?
arkitaip 14y ago
I would go one step further and recommend that you uninstall Java thus removing one attack vector. I did so a couple of months ago and have yet to find a case where I really needed Java.
- shanemhansen 14y ago
  To eliminate further attack vectors, uninstall both the browser and the OS ; ). I just want to point out that's there's a big difference between having an interpreter on your machine like python, ruby, or java, and having a browser plugin that executes remote code by default. There's nothing wrong with the former, there's everything wrong with the latter.
  - jebblue 14y ago
    Do you mean Java in the browser? If so, what do you think is happening when your JavaScript code hits your server's REST code returning JSON?
    - karlmdavis 14y ago
      The primary difference is that JSON isn't considered executable-- at least not by any Java JSON libraries that I've seen; it's just data. (Yes, non-executable data can still deliver a malicious payload, e.g. http://technet.microsoft.com/en-us/security/bulletin/ms04-028 http://technet.microsoft.com/en-us/security/bulletin/ms04-02.... It's just much less common-- presumably because it's a much smaller attack surface.)
      - justincormack 14y ago
        you forget the time when json was usually called with exec... But mostly it is buffer overflow bugs that get you now.
    - lttlrck 14y ago
      what do you think is happening? Browsers don't use Java to parse/encode JSON... JSON is a Javascript facility.
- te_chris 14y ago
  I use netbeans for php coding mostly for its code completion and use ElasticSearch for some sites I build. There's two.
- jebblue 14y ago
  Do you also equate PC with Windows?
- sixothree 14y ago
  For firefox I use quickjava which puts a disable button in the bar. I can't remember the last time I actually enabled it. I do use Java quite frequently but rarely in the browser.
- mikeycgto 14y ago
  And drop flash too while you're at it!
  - pjscott 14y ago
    Flash has legitimate uses for streaming video. I very, very rarely use Java applets.
- pasbesoin 14y ago
  Not that the parent was suggesting the following, but do note that if you only disable the Java browser plugins, when you next update Java (the SE package/installer, at least), the updated versions of those plugins will be installed and enabled in all or most browsers. You have to go and manually disable them, again. I keep Java around for some other reasons, so when I update, I have to remember to go and disable the browser plugins once again.
kmfrk 14y ago
Opera, too. I had to go back to enabling plug-ins with Chrome, though, as I couldn't load videos for some reason.
- aw3c2 14y ago
  In Opera you can so easily enable those things on a per-site basis, it is wonderful. Rightclick on page -> Site Preferences -> Content
gurkendoktor 14y ago
The sad thing is that Click To Play still breaks websites. I think SoundCloud (Flash) was the one where I gave up last time. I use Safari for day-to-day browsing now and open Chrome when I need to use anything infective (Java, Flash, Facebook, Google, ...).
- chime 14y ago
  Click To Play breaks whenever a 1px Flash embed is used - you can't click what you can't see. I generally whitelist sites I trust (YouTube, Vimeo, Google Maps, ETrade etc.) and never have to click on Flash from those sites. Other sites show me Click To Play and 90% of the time, it's ads I want to ignore or the single video link I want to click.
  - dchest 14y ago
    There's an icon in the address bar that you can click to enable all plugins on the page, even 1px ones.
    - ZoFreX 14y ago
      That icon doesn't appear on all sites. Sometimes it seems like the site does feature detection, comes to the conclusion you don't have flash, and refuses to serve anything useful. Also on OS X the Flash mouse capture is broken if you enable click to play in Firefox.
- ch0wn 14y ago
  Luckily, SoundCloud's next release will be HTML5-audio-only. You can also enable experimental HTML5 playback support with the current version in your settings. Your point is correct, though. There are a lot of sites that break if they don't detect Flash right at page load.

by skymt 14y ago

stevencorona 14y ago

Awesome, I had Click2Flash installed on Chrome, but no idea it basically already came built into the browser.

im3w1l 14y ago

Is clickjacking a solved problem or will this only raise the bar a little?

arkitaip 14y ago

I would go one step further and recommend that you uninstall Java thus removing one attack vector. I did so a couple of months ago and have yet to find a case where I really needed Java.

shanemhansen 14y ago
To eliminate further attack vectors, uninstall both the browser and the OS ; ). I just want to point out that's there's a big difference between having an interpreter on your machine like python, ruby, or java, and having a browser plugin that executes remote code by default. There's nothing wrong with the former, there's everything wrong with the latter.
- jebblue 14y ago
  Do you mean Java in the browser? If so, what do you think is happening when your JavaScript code hits your server's REST code returning JSON?
  - karlmdavis 14y ago
    The primary difference is that JSON isn't considered executable-- at least not by any Java JSON libraries that I've seen; it's just data. (Yes, non-executable data can still deliver a malicious payload, e.g. http://technet.microsoft.com/en-us/security/bulletin/ms04-028 http://technet.microsoft.com/en-us/security/bulletin/ms04-02.... It's just much less common-- presumably because it's a much smaller attack surface.)
    - justincormack 14y ago
      you forget the time when json was usually called with exec... But mostly it is buffer overflow bugs that get you now.
  - lttlrck 14y ago
    what do you think is happening? Browsers don't use Java to parse/encode JSON... JSON is a Javascript facility.
te_chris 14y ago
I use netbeans for php coding mostly for its code completion and use ElasticSearch for some sites I build. There's two.
jebblue 14y ago
Do you also equate PC with Windows?
sixothree 14y ago
For firefox I use quickjava which puts a disable button in the bar. I can't remember the last time I actually enabled it. I do use Java quite frequently but rarely in the browser.
mikeycgto 14y ago
And drop flash too while you're at it!
- pjscott 14y ago
  Flash has legitimate uses for streaming video. I very, very rarely use Java applets.
pasbesoin 14y ago
Not that the parent was suggesting the following, but do note that if you only disable the Java browser plugins, when you next update Java (the SE package/installer, at least), the updated versions of those plugins will be installed and enabled in all or most browsers. You have to go and manually disable them, again. I keep Java around for some other reasons, so when I update, I have to remember to go and disable the browser plugins once again.

kmfrk 14y ago

Opera, too. I had to go back to enabling plug-ins with Chrome, though, as I couldn't load videos for some reason.

aw3c2 14y ago
In Opera you can so easily enable those things on a per-site basis, it is wonderful. Rightclick on page -> Site Preferences -> Content

gurkendoktor 14y ago

The sad thing is that Click To Play still breaks websites. I think SoundCloud (Flash) was the one where I gave up last time. I use Safari for day-to-day browsing now and open Chrome when I need to use anything infective (Java, Flash, Facebook, Google, ...).

chime 14y ago
Click To Play breaks whenever a 1px Flash embed is used - you can't click what you can't see. I generally whitelist sites I trust (YouTube, Vimeo, Google Maps, ETrade etc.) and never have to click on Flash from those sites. Other sites show me Click To Play and 90% of the time, it's ads I want to ignore or the single video link I want to click.
- dchest 14y ago
  There's an icon in the address bar that you can click to enable all plugins on the page, even 1px ones.
  - ZoFreX 14y ago
    That icon doesn't appear on all sites. Sometimes it seems like the site does feature detection, comes to the conclusion you don't have flash, and refuses to serve anything useful. Also on OS X the Flash mouse capture is broken if you enable click to play in Firefox.
ch0wn 14y ago
Luckily, SoundCloud's next release will be HTML5-audio-only. You can also enable experimental HTML5 playback support with the current version in your settings. Your point is correct, though. There are a lot of sites that break if they don't detect Flash right at page load.