Item — HN Reader

No. 3 months ago I started using NoScript and my life has gotten so much easier on the internet. I hate it less now. Usually you can get away without Javascript, and if not, it only takes a second or two to fix. The biggest risk is Javascript. You are literally blindly executing code somebody else wrote on your compute for a website you may or may not trust.

One thing I would like to figure out is how can I 'trust' JS for google on google maps (required to work), but4 not anywhere else? It seems like Noscript is per domain but not based on what page you are on.

2 comments

>>The biggest risk is Javascript. You are literally blindly executing code somebody else wrote on your compute for a website you may or may not trust.

I understand why you used this language, but I think it's worth noting that, unlike blindly executing a program on the operating system itself (such as by running an .exe file you receive via email, torrent, download, etc.), you are executing a script inside a program that is, or should be, sandboxed. So, even though something can still go wrong, the potential impact is a lot smaller.

Yes, that is true in a certain sense, but for example, a lot of fingerprinting can happen with information gleaned via javascript. Granted, having javascript turned off is also a way to finger print poeple.

Frankly, most web pages should not be interactive in any way. There is very little gained by using javascript on pages you aren't interacting with, and a whole lot to lose.

I compromise often with NoScript, but it changes the way you think about running code on your computer. Block first, and adjust later is a good approach for me, especially because I only visit a few of the same sites regularly. On new sites, I definitely do not want any type of javascript being run.

This is about risk assessment. Most vulnerabilities in browsers are either in JS or in media support. Pure-HTML+CSS exploits are rather rare these days. Therefore, disabling or limiting JS and media reduces risk drastically.

We are not disagreeing? What I'm saying is that not all "blind code executions" are the same. The distinction between running an exe file on the OS and running a script inside a browser does matter, for risk assessment.

I'm disagreeing on "the potential impact is a lot smaller", because we have seen time and time again that executing a script in a sandboxed environment can quickly turn into running machine code with the user's privileges instead.

You might want to consider switching to the uMatrix extension instead. My understanding is that uMatrix rules can be created to apply to all domains.