Re:35-year-old vulnerability discovered in scp
by miohtama on Tuesday January 15, 2019 @05:17PM
(#18916062)
> It's entirely possible to use Javascript to place malware (such as installing a binary executable) and do other assorted nastiness on a target
This sounds interesting. Can you kindly link an example for this technique?
Re:35-year-old vulnerability discovered in scp
by Cpoll on Tuesday January 15, 2019 @05:18PM
(#18916070)
But if you want to go that far, it's entirely possible with Javascript disabled. Not every browser bug is a JS engine bug.
Your best bet (not guaranteed) is reading the html as plain text, not rendering any images, etc.
I think that depends on what you mean by "significantly less power". It's entirely possible to use Javascript to place malware (such as installing a binary executable) and do other assorted nastiness on a target machine. If the target machine is properly secured, it's still possible, it just requires more effort.
This is the primary reason why I do not allow Javascript to run on my machines by default. If I'm at a site that I trust and I have no alternative to using, and the JS in question is essential, then I'll allow just the specific piece of JS to run. Otherwise, it's not happening.