Hacker News Reader

Comment by chriswarbo | Hacker News Reader

> such as clueless users installing malicious extensions or luddite users switching off js.

So if I run arbitrary, potentially-malicious code from the Web, in the form of a browser extension, I'm "clueless"?

Yet if I don't run arbitrary, potentially-malicious code from the Web, in the form of JS, I'm a "luddite"?

Considering that many browser extensions are implemented in JS, the only difference is in control: users can pick and choose which browser extensions they want to use (I use a few; I've skimmed the source of a couple and written a couple myself), whereas enabling Javascript turns a machine into a third-party free-for-all.

View on HN

Extensions have access to browser APIs not available to webpages and run on your every request. Thus they are inherently more dangerous. So installing unsigned extensions from questionable sources makes you clueless, yes.

Vanilla js running on webpages should be considered relatively safe. It's sandboxed and not able to do anything - malicious of not - outside it's restricted environment. It can't even get your location or lock a cursor without asking for permission first.

If you could somehow disable all logic from executing in your OS native apps, would you do this by default?

>It's sandboxed and not able to do anything - malicious of not - outside it's restricted environment.

That argument is like the one that Linux is more secure because a malicious program will only have user rights.

Malicious scripts can do plenty of damage inside their restricted environment. There are whole books on how to securely write web apps due to the danger of "sandboxed" malicious JS.

Personally I don't want to be tracked and profiled yet nearly every major website is running multiple tracking and profiling scripts.

>If you could somehow disable all logic from executing in your OS native apps, would you do this by default?

I do disable native apps ability to communicate with the network unless they actually need it.

P.S. I also find that those who take a pure "webapp" approach introduce design flaws into their apps. In Toggl for example when browsing summaries you can't open multiple tasks in detail because instead of using a hyperlink they use JS to fetch and display the task details. Any content link should be able to be opened in a new window/tab.

It's sandboxed and not able to do anything - malicious of not - outside it's restricted environment.

Malicious things within the sandbox however, are a free for all.

> If you could somehow disable all logic from executing in your OS native apps, would you do this by default?

I've certainly recompiled native applications to throw out 'features' I don't want, but my "default" is to just not install such programs to begin with. Especially these days, since I tend to use minimalist "do one job" programs, rather than giant "desktop environment" stuff like Gnome/KDE. That applies to my phone too, since it runs a stripped-down install of Debian.

> Vanilla js running on webpages should be considered relatively safe. It's sandboxed and not able to do anything - malicious of not - outside it's restricted environment.

The number of exploits requiring JS versus the number of exploits not requiring JS seriously disagrees with that opinion.

JS is a dynamic language that browsers put a lot of effort into JITting to be fast and limiting memory usage. And as such, the engines are complex. And as such, it's inherently hard to keep safe.

The v8 engine has literally over a million lines of code.

> If you could somehow disable all logic from executing in your OS native apps, would you do this by default?

Yes. And I actually do this on a regular basis. There are a lot of things I'll only run in a VM, or run in a VM the first time to see what it's attempting to communicate with / do (and occasionally block said communication for later). Not perfect, but better than nothing.

Reply on news.ycombinator.com