Hacker News Reader

NoScript is great, and it may reduce the attack surface of your browser, but it's not a panacea. If you look at the history of browser attacks, they're not overwhelmingly Javascript-based.

View on HN

But it does reduce popups to 0, which reduces those fake "you have 5 viruses! Scan now" programs that fill up the whole screen (and probably cause a portion of malware).

Again, just to be perfectly clear: assume that any time you browse with any mainstream browser to any malicious website, your browser could probably be popped. Especially if your adversary can bankroll $100,000-$200,000 of security research. That's the number I'd put on this attack.

Maybe a reliable IE clientside bumps the number up north of $200,000, because folk wisdom puts the actual value of a reliable IE in the six figures. I don't know. I know what a year of time from someone who can find these bugs costs.

The equivalent salary for a top-notch engineer in China is about 12-25% of the US rate, however.

That does not necessarily imply that Chinese vulnerability researchers are proportionally cheaper... yet.

Except we don't know who did this work, the research could have been done anywhere.

Reply on news.ycombinator.com