Hacker News Reader

Comment by rwmj | Hacker News Reader

Seems like an attack vector that I don't need. I turned it off in Firefox (about:config -> webgl.disabled == true)

Might as well disable JS. It's also an attack vector.

I do that too, only enabling it on sites that need it. Finer-grained controls would be nice though. (I miss uMatrix ...)

“How do you know if someone has disabled JavaScript? Don’t worry” the joke goes … “they’ll tell you”.

There’s always someone in a browser tech thread that has to proclaim their security high ground to the unwashed masses.

In my opinion, these comments do not add value to the discussion and should avoided.

Absolutely agreed. If we're going to be hyperbolic, the web itself is an attack vector. Better stay disconnected.

They were prompted to mention it by another user, though. Maybe the comments that don't add any value are "might as well disable JS."

Specially since, I think, many of us would do it if it weren't so inconvenient. I wish websites could only run JS if they're "installed" PWA style.

I’m still happily using uMatrix.

Yes. I'm not against ads, but if uMatrix stops working to block JS, I'll have to install uBlock for blocking ads (already do on mobile).

You have that finer-grained control with uBO. You just have to write the rules by hand instead of uM's table UI.

https://news.ycombinator.com/item?id=26284124

I switched from uMatrix to medium-mode uBO. Sort of a middle ground between what uMatrix was and default uBO mode (known as easy-mode). They offer other options as well.

https://github.com/gorhill/uBlock/wiki/Blocking-mode

Not an attack vector per se, but largely used for fingerprinting.

What's not used for fingerprinting nowadays?

> What's not used for fingerprinting nowadays?

HTML tags.

I'm not sure if this is sarcastic or not, but most likely not true.

Yes, WebGL remains a large surface area of an attack vector.

Disabling it makes your fingerprint more unique

Giving out a Null value has less entropy than a unique value. It may also be likely that it gets dropped when computing the overall fingerprint.

if 20% of people explicitly disable it then it carries log_2(5) = 2.32 bits of entropy so it's not going to get dropped.

Supposedly JShelter (formerly JavaScript Restrictor) wraps the WebGL APIs on a site-by-site basis.

https://jshelter.org/webgl/

Reply on news.ycombinator.com