Re:Exploit vendor drops Tor Browser zero-day on Twitter
by pcwalton on Tuesday September 11, 2018 @12:18PM
(#17961094)
All that has to happen to fix this vulnerability is to remove support for legacy addons—which is what Firefox Quantum already did.
The old addon system made it far too easy to make catastrophic mistakes like this. Web Extensions, which are an API that was actually designed with security in mind, constitute a huge security improvement.
Re:Exploit vendor drops Tor Browser zero-day on Twitter
by evilpie on Tuesday September 11, 2018 @12:14PM
(#17961061)
Firefox doesn't work without a JavaScript engine.
Re:Exploit vendor drops Tor Browser zero-day on Twitter
by flatiron on Tuesday September 11, 2018 @02:40PM
(#17962210)
what about just toggling javascript.enabled ?
Re:Exploit vendor drops Tor Browser zero-day on Twitter
by tmpaccount823 on Tuesday September 11, 2018 @03:20PM
(#17962468)
I can confirm that setting javascript.enabled to false would have prevented that bug in older versions.
I've always thought that the highest security setting would set it to false on its own, but apparently it does not.
Re:Exploit vendor drops Tor Browser zero-day on Twitter
by crtasm on Tuesday September 11, 2018 @12:38PM
(#17961265)
> Especially since Tor is usually used to access hidden services instead of the clearnet.
My assumption is the opposite but I have no data to cite here, is it even possible to tell?
Re:Exploit vendor drops Tor Browser zero-day on Twitter
by throwaway2048 on Tuesday September 11, 2018 @12:22PM
(#17961128)
A tor browser that isn't usable means people don't use it.
It'd be much easier to just strip it all out, despite breaking site support in the process. Especially since Tor is usually used to access hidden services instead of the clearnet.