CSS is powerful, you can do a lot of things without JS

Re:CSS is powerful, you can do a lot of things without JS by rtpg on Tuesday July 05, 2016 @09:47AM (#12036365)

> the "sandboxing" approach has been exercised for many years now, mostly without success.

My impression is that Javascript has basically been the most successful sandbox ever deployed on a large scale. All vulnerabilities I've seen that escape the sandbox are due to things like Flash.

Does anybody know of any "JS-only" exploits that have happened?

[ Parent | on HN ]

Re:CSS is powerful, you can do a lot of things without JS by zeveb on Tuesday July 05, 2016 @10:21AM (#12036586)

> Does anybody know of any "JS-only" exploits that have happened?

This was used to win a contest: https://securityevaluators.com/knowledge/papers/engineeringh...

Then there's this: http://arstechnica.com/security/2015/08/dram-bitflipping-exp...

And this looks to execute some shellcode (but maybe it doesn't work): http://stackoverflow.com/questions/381171/help-me-understand...

Regardless, the bottom line is clear: if you value security and privacy, you disable JavaScript.

[ Parent | on HN ]

Re:CSS is powerful, you can do a lot of things without JS by Jweb_Guru on Tuesday July 05, 2016 @10:14AM (#12036540)

Tons of JS-only exploits have happened. Every year at PwnToOwn, JS-only exploits happen.

[ Parent | on HN ]