3 ms·

> Are we really supposed to cater to the sub 2% that chooses not to use javascript? In my opinion: No. JavaScript should be treated as default feature of the

by VMG 12y ago

> Are we really supposed to cater to the sub 2% that chooses not to use javascript? In my opinion: No. JavaScript should be treated as default feature of the browser now. It's about as worth the effort as catering to people who want to use Lynx as their browser. The screen reader argument is bogus too, modern screen reader software is not hampered by JS. I also wonder if those who disable JS because of the increased attack surface also disable CSS as well.

yuvadam 12y ago
Don't troll. CSS cannot run arbitrary code on your device.
- deleted 12y ago
  [deleted]
- domas 12y ago
  Actually there are some CSS vulnerabilities that works without JavaScript like <div> overlay affecting phishing attacks: http://i8jesus.com/?p=10 http://i8jesus.com/?p=10 Via: http://stackoverflow.com/questions/718611/css-injection-whats-the-worst-that-can-happen http://stackoverflow.com/questions/718611/css-injection-what...
- VMG 12y ago
  Neither can JS, as it is sandboxed. The interpretation and application of CSS directives is not Turing complete, but often enough to leak information from your browser.
  - csandreasen 12y ago
    > Neither can JS, as it is sandboxed. Not true. It's definitely possible to escape the sandbox. Some examples: https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/singles/firefox https://github.com/rapid7/metasploit-framework/tree/master/m... http://www.mozilla.org/security/announce/2013/mfsa2013-12.html http://www.mozilla.org/security/announce/2013/mfsa2013-12.ht... http://www.iss.net/security_center/reference/vuln/googlechrome-javascript-bo.htm http://www.iss.net/security_center/reference/vuln/googlechro... https://bugzilla.mozilla.org/show_bug.cgi?id=805121 https://bugzilla.mozilla.org/show_bug.cgi?id=805121 https://www.usenix.org/legacy/event/woot08/tech/full_papers/daniel/daniel.pdf https://www.usenix.org/legacy/event/woot08/tech/full_papers/...
ASneakyFox 12y ago
What about those that disable js because you didn't test your js on their mobile browser and it renders the site unusable?

by VMG 12y ago

yuvadam 12y ago

Don't troll. CSS cannot run arbitrary code on your device.

deleted 12y ago
[deleted]
domas 12y ago
Actually there are some CSS vulnerabilities that works without JavaScript like <div> overlay affecting phishing attacks: http://i8jesus.com/?p=10 http://i8jesus.com/?p=10 Via: http://stackoverflow.com/questions/718611/css-injection-whats-the-worst-that-can-happen http://stackoverflow.com/questions/718611/css-injection-what...
VMG 12y ago
Neither can JS, as it is sandboxed. The interpretation and application of CSS directives is not Turing complete, but often enough to leak information from your browser.
- csandreasen 12y ago
  > Neither can JS, as it is sandboxed. Not true. It's definitely possible to escape the sandbox. Some examples: https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/singles/firefox https://github.com/rapid7/metasploit-framework/tree/master/m... http://www.mozilla.org/security/announce/2013/mfsa2013-12.html http://www.mozilla.org/security/announce/2013/mfsa2013-12.ht... http://www.iss.net/security_center/reference/vuln/googlechrome-javascript-bo.htm http://www.iss.net/security_center/reference/vuln/googlechro... https://bugzilla.mozilla.org/show_bug.cgi?id=805121 https://bugzilla.mozilla.org/show_bug.cgi?id=805121 https://www.usenix.org/legacy/event/woot08/tech/full_papers/daniel/daniel.pdf https://www.usenix.org/legacy/event/woot08/tech/full_papers/...

ASneakyFox 12y ago

What about those that disable js because you didn't test your js on their mobile browser and it renders the site unusable?