4 ms·

True it is a scary web but how many of those exploits have relied on default settings and Javascript to run? You are many times safer on the web if you have th

True it is a scary web but how many of those exploits have relied on default settings and Javascript to run? You are many times safer on the web if you have the discipline to use noscript properly.

phazmatis 12y ago
Fun fact: Noscript loads and parses all javascript and then just stops it from running against the live DOM. Decreases page render time, sure. Prevents exploits? Don't think so.
- rictic 12y ago
  I can't recall a single exploitable bug in these competitions that attacked the javascript parser. Running the js is a far larger surface area to attack.
- rudolf0 12y ago
  NoScript won't actually execute any of the Javascript, though. I am not aware of any historical vulnerabilities from the mere act of loading and parsing Javascript, though they're certainly theoretically possible. It's much easier to secure a parser than a runtime.
- INTPenis 12y ago
  That does not affect security significantly. If it did then it would totally defeat the purpose of noscript existing.
pcwalton 12y ago
> True it is a scary web but how many of those exploits have relied on default settings and Javascript to run? Layout (just to name one non-JS subsystem) has been responsible for a lot of vulnerabilities too.
- userbinator 12y ago
  True, but from experience it is often the case that exploits are obfuscated by being wrapped in one or more layers of JS, so that they are less likely to be discovered by passive scanners. This will probably seem quite shocking, but I almost exclusively used IE6 for a few years, with JS disabled - and despite frequently visiting the "darkest corners" of the Internet, was never exploited. On the sites that tried, I'd just see a blank page; view the source, and there was a blob of obfuscated JS.
wglb 12y ago
And if the person sitting next to you in the same organization doesn't do that, or any person doesn't do that, if they get compromised then their box could attack yours with a different kind of payload.

True it is a scary web but how many of those exploits have relied on default settings and Javascript to run? You are many times safer on the web if you have the discipline to use noscript properly.

phazmatis 12y ago

Fun fact: Noscript loads and parses all javascript and then just stops it from running against the live DOM. Decreases page render time, sure. Prevents exploits? Don't think so.

rictic 12y ago
I can't recall a single exploitable bug in these competitions that attacked the javascript parser. Running the js is a far larger surface area to attack.
rudolf0 12y ago
NoScript won't actually execute any of the Javascript, though. I am not aware of any historical vulnerabilities from the mere act of loading and parsing Javascript, though they're certainly theoretically possible. It's much easier to secure a parser than a runtime.
INTPenis 12y ago
That does not affect security significantly. If it did then it would totally defeat the purpose of noscript existing.

pcwalton 12y ago

> True it is a scary web but how many of those exploits have relied on default settings and Javascript to run? Layout (just to name one non-JS subsystem) has been responsible for a lot of vulnerabilities too.

userbinator 12y ago
True, but from experience it is often the case that exploits are obfuscated by being wrapped in one or more layers of JS, so that they are less likely to be discovered by passive scanners. This will probably seem quite shocking, but I almost exclusively used IE6 for a few years, with JS disabled - and despite frequently visiting the "darkest corners" of the Internet, was never exploited. On the sites that tried, I'd just see a blank page; view the source, and there was a blob of obfuscated JS.

wglb 12y ago

And if the person sitting next to you in the same organization doesn't do that, or any person doesn't do that, if they get compromised then their box could attack yours with a different kind of payload.