Hacker News Reader

Comment by skymt | Hacker News Reader

Both Firefox and Chrome have features that disable plugins but still allow you to run individual applets on demand. Please turn these on; it's not much hassle and you'll be shutting down the most common targets for exploits.

For Chrome, go to advanced settings -> Privacy -> Content settings -> Plug-ins and select "click to play". For Firefox, go to about:config and enable "plugins.click_to_play".

View on HN

I would go one step further and recommend that you uninstall Java thus removing one attack vector. I did so a couple of months ago and have yet to find a case where I really needed Java.

To eliminate further attack vectors, uninstall both the browser and the OS ; ).

I just want to point out that's there's a big difference between having an interpreter on your machine like python, ruby, or java, and having a browser plugin that executes remote code by default.

There's nothing wrong with the former, there's everything wrong with the latter.

Do you mean Java in the browser? If so, what do you think is happening when your JavaScript code hits your server's REST code returning JSON?

The primary difference is that JSON isn't considered executable-- at least not by any Java JSON libraries that I've seen; it's just data.

(Yes, non-executable data can still deliver a malicious payload, e.g. http://technet.microsoft.com/en-us/security/bulletin/ms04-02.... It's just much less common-- presumably because it's a much smaller attack surface.)

you forget the time when json was usually called with exec...

But mostly it is buffer overflow bugs that get you now.

what do you think is happening? Browsers don't use Java to parse/encode JSON... JSON is a Javascript facility.

I use netbeans for php coding mostly for its code completion and use ElasticSearch for some sites I build. There's two.

For firefox I use quickjava which puts a disable button in the bar. I can't remember the last time I actually enabled it. I do use Java quite frequently but rarely in the browser.

And drop flash too while you're at it!

Flash has legitimate uses for streaming video. I very, very rarely use Java applets.

Not that the parent was suggesting the following, but do note that if you only disable the Java browser plugins, when you next update Java (the SE package/installer, at least), the updated versions of those plugins will be installed and enabled in all or most browsers. You have to go and manually disable them, again.

I keep Java around for some other reasons, so when I update, I have to remember to go and disable the browser plugins once again.

Do you also equate PC with Windows?

Is clickjacking a solved problem or will this only raise the bar a little?

The sad thing is that Click To Play still breaks websites. I think SoundCloud (Flash) was the one where I gave up last time. I use Safari for day-to-day browsing now and open Chrome when I need to use anything infective (Java, Flash, Facebook, Google, ...).

Luckily, SoundCloud's next release will be HTML5-audio-only. You can also enable experimental HTML5 playback support with the current version in your settings.

Your point is correct, though. There are a lot of sites that break if they don't detect Flash right at page load.

Click To Play breaks whenever a 1px Flash embed is used - you can't click what you can't see. I generally whitelist sites I trust (YouTube, Vimeo, Google Maps, ETrade etc.) and never have to click on Flash from those sites. Other sites show me Click To Play and 90% of the time, it's ads I want to ignore or the single video link I want to click.

There's an icon in the address bar that you can click to enable all plugins on the page, even 1px ones.

That icon doesn't appear on all sites. Sometimes it seems like the site does feature detection, comes to the conclusion you don't have flash, and refuses to serve anything useful.

Also on OS X the Flash mouse capture is broken if you enable click to play in Firefox.

Opera, too.

I had to go back to enabling plug-ins with Chrome, though, as I couldn't load videos for some reason.

In Opera you can so easily enable those things on a per-site basis, it is wonderful. Rightclick on page -> Site Preferences -> Content

Awesome, I had Click2Flash installed on Chrome, but no idea it basically already came built into the browser.

Reply on news.ycombinator.com