(untitled)

What is so unsafe about Javascript? Would it do harm to solely use JS when browsing duckduckgo for images?

>the "secure" RNG is regularly found to be broken >location api >meltdown/spectre >bitcoin miners on ad networks >browser fingerprinting >increased attack surface for the alphabet agencies, spyware, and surveillance capitalism disable javascript

Javascript is widely used in abusive ways. For security specifically, browser exploits that don't require javascript sell for much more than those that do. It's safe to assume that javascript based exploits are relatively common on the open market.

>>6104 Mostly browser fingerprinting and unwanted tracking.

>>6109 Is it true JS will run most codes without checking them first?

>>6112 Checking them for what?

JavaScript is a slightly less harmful version of running native code on your system. So basically stay the fuarrrk away from it, if you don't want everyone to run their programm on your computer.

>Would it do harm to solely use JS when browsing duckduckgo for images? No, provided you trust DDG. As others have said, the two reasons to block js are (typically third party) tracking and (first/third party) exploits. DDG isn't going to try to hack your browser, and they don't bring in any third party tracking scripts, so there isn't much of a reason to block js. If you go on a sketchy streaming site, for example, you probably want to block all scripts because even first party ones may contain malware vectors. Everywhere else, it's still generally a good idea to block all third party scripts by default and whitelist them as needed. This is less to avoid malware and more to prevent advertising networks from tracking you. Something like 80% of websites contain google tracking scripts (i.e. google analytics), so its not like you can practically avoid them without a content blocker.

>>6118 You're not just trusting DDG. >ddg guy sold out users in the past You're also trusting: their stack you don't know the CA you didn't inspect their hosting provider disable javascript

JS is by far the biggest source of vulnerabilities in all modern web browsers. Turning it off makes your chances of getting hacked or tracked much lower

>>6121 And in addition to all that, you're also assuming that they're never hacked and have their webpages and scripts compromised. DDG gets hacked, hax0r loads up browser exploit onto DDG, and you get pwned. sandbox your browser.

>>6121 yeah that's true. DDG was probably a bad example. i was responding more to the sentiment that there is something inherently unsafe about javascript. if its non-obfuscated and from a trusted source, it's fine in theory, but that means you have to keep an eye on it to make sure it doesn't get changed to something malicious. makes me wonder if there is a way to implement signed javascript.

>>6125 That exists with SSL Certs, but is also pointless.

>>6125 signatures didn't work for active x, or java applets. JS is third try. They slow boiled the frog this time. It is arguably worse than the previous two.

>>6121 >>6125 then you can use duckduckgo.com/lite/ any links on ddg selling out users? I haven't heard of this

>>6129 >any links on ddg selling out users? Why do people always do this? I did not say there's evidence DDG sells out DDG users right now https://en.wikipedia.org/wiki/DuckDuckGo >DuckDuckGo was founded in 2008 by Gabriel Weinberg, an entrepreneur who previously launched Names Database, a now-defunct social network. Guess what he did with all the user data in Names Database? Sold it to advertisers. >ddg guy sold out users in the past Now he has a "privacy" search engine that's free and ad supported... Smells bad. I would not give DDG any form of special pass to run scripts. They're just as untrustworthy as anyone else until I can verify they aren't, which I can't.

>>6129 >>6131 sorry for assuming you're spooky this is just how spooky posts always seem to start

https://onpon4.github.io/articles/kill-js.html What we actually need is repositories for javascripts. Every time you visit a website, your browser only checks signer validity, and you know what, numerous times different certificate authorities "accidentally" leaked their private keys into someone's dirty hands. Website pages and scripts signed by it's author and saved in some sort of keyring along with a bookmark storage would solve content authoring problem that still exists on the web. IIRC there was a simple method when a PGP signature was generated for every page, and you could verify them by piping wget.

Her it is actually, have a look: http://pebble.ink/~imt/2014/12/08/signing-all-pages-with-gnupg.html

Is it safe to save pages that could have something bad like malware in them as html or pdf?

>>6136 Both could potentially be sketchy if you didn't trust your converter. PDF can contain malware, and HTML can contain javascript.

>>6138 I'm using firefox browser built-in converter, it converts to pdf, and in brave browser I can turn off java before saving.

>>6139 Pretty sure it will be fine then. Javascript is not included in PDF conversions, although it will be executed before the PDF is saved.

https://lite.qwant.com/?q=pumpkin&t=images Javascript free image search via Qwant as an alternative to duckduckgo?