9 ms·

I use NoScript, you can't see shit.

by jsgyx 7y ago

julienreszka 7y ago
You can't see shit neither
- vbsteven 7y ago
  yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"
  - larkeith 7y ago
    Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with <noscript>, you just get a broken and/or blank page. I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users. (Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encounter several new sites daily.)
    - vbsteven 7y ago
      I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.
      - larkeith 7y ago
        Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.
        npsimons 7y ago
        > Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view. Yes. Joking aside, I will add that I've been a NoScript/FlashBlock user for quite some time (more than a decade? I honestly can't remember), and while I run into some things that are frustrating (just had to disable NoScript for a tab to order plane tickets), it is refreshingly uncommon. Yes, you can browse with default deny to JS and Flash.
- alfiedotwtf 7y ago
  That was actually funny
- icebraining 7y ago
  Actually, they can: even if you enable JS, NoScript's ABE will prevent this attack: https://en.wikipedia.org/wiki/NoScript#Application_Boundaries_Enforcer_.28ABE.29 https://en.wikipedia.org/wiki/NoScript#Application_Boundarie...
  - mrob 7y ago
    Not anymore. It's not included in modern versions (after the changes in Add-Ons for Firefox's Quantum update).
dwb 7y ago
This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.
- gnomewascool 7y ago
  > This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to. Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.
  - tinus_hn 7y ago
    Most users have a modem or router that comes with a web interface, like just about everything in the internet of things.
  - deadbunny 7y ago
    Their routers do, along with an ever growing number of IoT devices people happily hook up to their WiFi without a second thought. Given the long and gory history of companies releasing insecure by default devices methods like this are a legitimate entry point into a network.
- jsgyx 7y ago
  That's like saying that people shouldn't have to run ad blockers, that instead ad networks should behave. Sit and wait.
Thorrez 7y ago
Here's a port scanning technique that doesn't use javascript: https://blog.jeremiahgrossman.com/2006/11/browser-port-scanning-without.html https://blog.jeremiahgrossman.com/2006/11/browser-port-scann...

I use NoScript, you can't see shit.

by jsgyx 7y ago

I use NoScript, you can't see shit.

julienreszka 7y ago

You can't see shit neither

vbsteven 7y ago
yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"
- larkeith 7y ago
  Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with <noscript>, you just get a broken and/or blank page. I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users. (Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encounter several new sites daily.)
  - vbsteven 7y ago
    I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.
    - larkeith 7y ago
      Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.
      - npsimons 7y ago
        > Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view. Yes. Joking aside, I will add that I've been a NoScript/FlashBlock user for quite some time (more than a decade? I honestly can't remember), and while I run into some things that are frustrating (just had to disable NoScript for a tab to order plane tickets), it is refreshingly uncommon. Yes, you can browse with default deny to JS and Flash.
alfiedotwtf 7y ago
That was actually funny
icebraining 7y ago
Actually, they can: even if you enable JS, NoScript's ABE will prevent this attack: https://en.wikipedia.org/wiki/NoScript#Application_Boundaries_Enforcer_.28ABE.29 https://en.wikipedia.org/wiki/NoScript#Application_Boundarie...
- mrob 7y ago
  Not anymore. It's not included in modern versions (after the changes in Add-Ons for Firefox's Quantum update).

dwb 7y ago

This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

gnomewascool 7y ago
> This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to. Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.
- tinus_hn 7y ago
  Most users have a modem or router that comes with a web interface, like just about everything in the internet of things.
- deadbunny 7y ago
  Their routers do, along with an ever growing number of IoT devices people happily hook up to their WiFi without a second thought. Given the long and gory history of companies releasing insecure by default devices methods like this are a legitimate entry point into a network.
jsgyx 7y ago
That's like saying that people shouldn't have to run ad blockers, that instead ad networks should behave. Sit and wait.

Thorrez 7y ago

Here's a port scanning technique that doesn't use javascript: https://blog.jeremiahgrossman.com/2006/11/browser-port-scanning-without.html https://blog.jeremiahgrossman.com/2006/11/browser-port-scann...