Javascript security

what are the security issues with JS that people like to browse without it? I can't fully understand the hate for it.

There are no specific issues with javascript, security or otherwise. Some people think it's trendy to hate on anything popular but it's mainly a young person thing, do not be harsh and let them grow out of it.

>>410 what i thought i understood the argument was that if you have javascript enabled a malicious actor hosting the site your on could send a malicious file and automatically have you run it through javascript? so people use extensions like umatrix\noscript to enable only the scipts they know what are needed for or libreJS extension

I think there's two important reasons: 1. JS is used to track users and disabling it severely limits the ways in which you can be fingerprinted 2. All of the contemporary browser exploits require JS, so at the very least blocking JS from unknown sources is a very reasonable security policy You could also argue that disabling Javascript decreases the resource consumption of your browser, but that's really only noticeable on awful sites or old hardware.

>>409 JavaScript can fingerprint users by looking for unique browser attributes. Most tracking by other websites is done client side through JavaScript. >>410 >There are no specific issues with javascript, security or otherwise. JavaScript is primarily used for adding annoying ads to websites, spying on people, and increasing page load times. http://idlewords.com/talks/website_obesity.htm Browser fingerprinting with JavaScript is used to identify people using Tor. The vast majority of websites don't need JavaScript or benefit from JavaScript. http://brandon.invergo.net/news/2013-03-10-Anti-web-design-Manifesto.html http://motherfuckingwebsite.com/ The web does not need JavaScript and JavaScript will never be a requirement for the web. https://www.youtube.com/watch?v=r38al1w-h4k&list=PL055Epbe6d5ZqIHE7NA5f6Iq_bZNjuWvS&index=10 And JavaScript has terrible type coercion. https://www.destroyallsoftware.com/talks/wat I think it's a little arrogant to claim there are no specific issues with JavaScript. There's no shortage of well thought out documented complaints about its purpose and design.

>>409 Its not about JS being inherently insecure, its the fact that when I visit some generic site, there are often more than 6-8 scripts being loaded, while I only need need 0-3 of those on average for the site to function properly. No reason to execute hostile (the level of hostility is irrelevant here) code on my machine. So in summary its because most of the JS code out there is simply harmful. From a language standpoint: JS is simply not a very well designed language in my opinion, has nothing to do with the claim of >>410 .

>>411 That's pretty much it really. I remember back when the original Silkroad was up, the feds exploited a flaw(actually just Tor default settings :P) in Tor browser that let them run JS code that sent identifyable data back just so they could catch a few people red handed. It was a real rukus. Anyway, some JS might be malicious, some might not, just gotta use your brain. It's up to you to toggle the ones you need or not.

>>413 >posting all this mumbling on a board that wouldn't even exist without js are you even trying?

>>416 If you're implying that lainchan requires JS to function, you're wrong. I have disabled all Javascript and can still post.

>>416 You can use lainchan without javascript. If you want to see what kind of tracking can be done with javascript, visit: http://www.ip-check.info Noscript protects you from most of these tracking techniques. You can further harden your firefox by setting: javascript.options.ion = false javascript.options.baselinejit = false javascript.options.asmjs = false dom.serviceWorkers.enabled = false dom.serviceWorkers.interception.enabled = false dom.push.enabled = false dom.push.connection.enabled = false javascript.options.wasm = false

>>416 This board works fine without JavaScript and early image boards didn't even use JavaScript.

I just love how the first 3 replies were like, JS is fine, nothing bad about it, why so many hate?

>>413 >The web does not need JavaScript and JavaScript will never be a requirement for the web it seems as though web3.0 (decentralized\distributed web) will require javascript since all the leading development on projects that will make web3.0 useable to the masses requires javascript. Zeronet, Ethereum, and I believe IPFS as well all rely on javascript. So what will the so solution to that problem? including something like umatrix by default and having a database with known javascript scripts so you enable the known safe ones and then enable others as you build trust from the websites owner?

>>425 I don't think any of that is right. It what ways do Zeronet and Ethereum rely on client side JavaScript? All I could find on Ethereum was that one of their clients was written in JavaScript, but that's only one of several clients. I'm almost certain IPFS doesn't require client side JavaScript. The paper doesn't mention it at all. There are examples of working distributed decentralized systems that don't rely on JavaScript at all, like Freenet and BitTorrent. More importantly, there's no reason why such a system would need client side JavaScript.

>>441 ZeroNet pretty much completely relies on javascript and ethereum Dapps like Akasha are web apps made with electron using javascript =\

Besides what everyone said here about privacy, there's security problems with the "architecture". In old times browsers only supported markup languages, that has very limited set of functions. Javascript is a full featured language and new browsers allow these code to run inside your computer. For people coming from Windows: it's like the old browsers supported opening a notepad text file... now browsers support an entire .exe running at every website you visit. Since most engines are "designed by commit" and a clusterfuck, there's mostly no security on how to handle the JS bitcode functions (except for some very simple privsep). http://beefproject.com