scripts? (thelemmy.club)
submitted 1 month ago by to c/linuxmemes@lemmy.world
 

sent from a disposable whonix qube

4-panel meme using the "You guys are getting paid?" template from "We're the Millers" * Person 1: "I thought it was enough to just install Firefox" * Person 2: "You're not blocking ads to protect your pc?" * Person 3: "Y'all are allowing sites to run scripts on non-virtualized systems?" * Person 4: "Y'all are allowing scripts?"
you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 1 month ago (3 children)

Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can't access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.

The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.

It doesn't mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don't know what site you're viewing.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 month ago (2 children)

    Still can have issues with javascript crypto miners. And there's always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 month ago

    JavaScript in the browser have no "sandbox" to evade. It does not have the ability to run outside of it's virtual machine, at all. It's completely different from a native executable, that actually have the ability to make system calls, that would evade a container/chroot/whatever.

    Also, running a crypto miner in a browser tab (or even as a service worker) is probably more costly to put in place than it will ever bring back. It's just not efficient enough.

  • source
  • parent