5 ms·

Seriously? Still on the disable-JavaScript kick? scratches head

by bjhoops1 14y ago

Tuna-Fish 14y ago
Most of the internet is unambiguously better with js off.
- CamperBob2 14y ago
  Well, that sounds like the definitive word on the subject.
yk 14y ago
Is there a possible way to use the internet without? At least it is my experience, that without NoScript any given site will either take half an hour to load, or have some annoying ads, as an overlay over the content. ( Not to mention videos which start to play automatically, flash banners and sound effects.) Seriously I have no problem with an advertisement which just displays a picture or text. But any possible use of JS in a ad is a use I do not want.
miles 14y ago
Yep. http://threatpost.com/en_us/blogs/yahoo-mail-cross-site-scripting-attack-sale-112612 http://threatpost.com/en_us/blogs/yahoo-mail-cross-site-scri... http://news.softpedia.com/news/Yahoo-Users-Accounts-Still-Not-Safe-DOM-XSS-Not-Properly-Fixed-Video-319716.shtml http://news.softpedia.com/news/Yahoo-Users-Accounts-Still-No...
- writtles 14y ago
  I see an obvious solution to this without disabling JS...
mixmastamyk 14y ago
Yeah, how silly to disable anonymous remote code execution by default. ;) Flashy pages that eschew compatibility and separation of concerns (even accessibility, seo at times) are the new standard, get used to it. Would you accept a Word.doc that required scripting to display itself? Shouldn't the response to a non-visible blog post be WTF? (Strangely enough, I am able to read the page w/o js, but responding in general to this type of comment I see on HN frequently.)
- esrauch 14y ago
  I wouldn't accept the word scripting because I don't trust their security model; I expect there to be a very high chance of getting a virus from MS Office scripting. I see a very low chance of getting a virus from js; there have also been 0-day exploits from <img> tags, why do you feel OK with images enabled?
  - mixmastamyk 14y ago
    There have been hundreds (thousands?) of javascript exploits. Javascript is also a major component in user tracking. Go to a news site and you'll see a dozen trackers most likely against your wishes, reducing privacy and performance. It's a hostile internet out there. Hostile images may exist but they are an order of mag. or two less common of a threat. Of course, where to draw the line is subjective, but the idea that blocking js by default is silly is misguided, imho.
    - chc 14y ago
      Can you link to a recent (for any reasonable value of the word) remote code execution vulnerability with JavaScript? Because my observation has been that RCE through codecs has been a much bigger vector for compromised systems.
      - thematt 14y ago
        Why does it have to be specifically RCE? Here are some lists of Firefox's and Chrome (fixed) security vulnerabilities. Browse the lists and you'll find plenty of critical issues related to Javascript. http://www.mozilla.org/security/known-vulnerabilities/firefox.html http://www.mozilla.org/security/known-vulnerabilities/firefo... http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html http://googlechromereleases.blogspot.com/2009/08/stable-upda...
      - psionski 14y ago
        http://www.metasploit.com/modules/exploit/windows/browser/ie_execcommand_uaf http://www.metasploit.com/modules/exploit/windows/browser/ie... was a cool one, but really, almost EVERY vulnerability requires JavaScript for the heap spray, even if the bug is somewhere else. Of course, running plug-ins in web pages is even more retarded than running JavaScript. By the way, images can spray the heap too, but, for some reason, they are not commonly used.
darkarmani 14y ago
Not disabled, white-listed. The internet is way better when you don't allow all of the annoying to dangerous JS to run.
deleted 14y ago
[deleted]
- RegEx 14y ago
  Java?
  - fnordfnordfnord 14y ago
    woops, let's go with mis-read.
- patmcguire 14y ago
  Do the Java vulnerabilities piggyback off of JS somehow? Or did you misread parent?

Seriously? Still on the disable-JavaScript kick? scratches head

Tuna-Fish 14y ago

Most of the internet is unambiguously better with js off.

CamperBob2 14y ago
Well, that sounds like the definitive word on the subject.

yk 14y ago

Is there a possible way to use the internet without? At least it is my experience, that without NoScript any given site will either take half an hour to load, or have some annoying ads, as an overlay over the content. ( Not to mention videos which start to play automatically, flash banners and sound effects.) Seriously I have no problem with an advertisement which just displays a picture or text. But any possible use of JS in a ad is a use I do not want.

miles 14y ago

Yep. http://threatpost.com/en_us/blogs/yahoo-mail-cross-site-scripting-attack-sale-112612 http://threatpost.com/en_us/blogs/yahoo-mail-cross-site-scri... http://news.softpedia.com/news/Yahoo-Users-Accounts-Still-Not-Safe-DOM-XSS-Not-Properly-Fixed-Video-319716.shtml http://news.softpedia.com/news/Yahoo-Users-Accounts-Still-No...

writtles 14y ago
I see an obvious solution to this without disabling JS...

mixmastamyk 14y ago

Yeah, how silly to disable anonymous remote code execution by default. ;) Flashy pages that eschew compatibility and separation of concerns (even accessibility, seo at times) are the new standard, get used to it. Would you accept a Word.doc that required scripting to display itself? Shouldn't the response to a non-visible blog post be WTF? (Strangely enough, I am able to read the page w/o js, but responding in general to this type of comment I see on HN frequently.)

esrauch 14y ago
I wouldn't accept the word scripting because I don't trust their security model; I expect there to be a very high chance of getting a virus from MS Office scripting. I see a very low chance of getting a virus from js; there have also been 0-day exploits from <img> tags, why do you feel OK with images enabled?
- mixmastamyk 14y ago
  There have been hundreds (thousands?) of javascript exploits. Javascript is also a major component in user tracking. Go to a news site and you'll see a dozen trackers most likely against your wishes, reducing privacy and performance. It's a hostile internet out there. Hostile images may exist but they are an order of mag. or two less common of a threat. Of course, where to draw the line is subjective, but the idea that blocking js by default is silly is misguided, imho.
  - chc 14y ago
    Can you link to a recent (for any reasonable value of the word) remote code execution vulnerability with JavaScript? Because my observation has been that RCE through codecs has been a much bigger vector for compromised systems.
    - thematt 14y ago
      Why does it have to be specifically RCE? Here are some lists of Firefox's and Chrome (fixed) security vulnerabilities. Browse the lists and you'll find plenty of critical issues related to Javascript. http://www.mozilla.org/security/known-vulnerabilities/firefox.html http://www.mozilla.org/security/known-vulnerabilities/firefo... http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html http://googlechromereleases.blogspot.com/2009/08/stable-upda...
    - psionski 14y ago
      http://www.metasploit.com/modules/exploit/windows/browser/ie_execcommand_uaf http://www.metasploit.com/modules/exploit/windows/browser/ie... was a cool one, but really, almost EVERY vulnerability requires JavaScript for the heap spray, even if the bug is somewhere else. Of course, running plug-ins in web pages is even more retarded than running JavaScript. By the way, images can spray the heap too, but, for some reason, they are not commonly used.

darkarmani 14y ago

Not disabled, white-listed. The internet is way better when you don't allow all of the annoying to dangerous JS to run.

deleted 14y ago

[deleted]

RegEx 14y ago
Java?
- fnordfnordfnord 14y ago
  woops, let's go with mis-read.
patmcguire 14y ago
Do the Java vulnerabilities piggyback off of JS somehow? Or did you misread parent?