What's wrong with browsers is that they allow JavaScript to do anything once it's enabled (like make network requests).
So talk to your browser vendor. Ask them to implement a mode where JavaScript can be run with custom privileges.
What's wrong with browsers is that they allow JavaScript to do anything once it's enabled (like make network requests).
So talk to your browser vendor. Ask them to implement a mode where JavaScript can be run with custom privileges.
Spectre and Meltdown have shown that there is no such thing as a true sandbox. You're always safer not running a sandbox as this way you're safe from the next sandbox breaking vulnerability that already exists but has yet to be discovered.
On the Intel platform, perhaps. But that's only because of performance optimizations, so that statement is not universally true.
[1] https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...
This is not true, as Meltdown and Spectre have recently taught us.
A site which can degrade gracefully in the absence of js features is a higher bar than a static, js free site. At the end of the day, disabling js entirely is a custom privilege level of zero.