News for hackers. Stuff that matters.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by tbabb on Thursday January 24, 2019 @12:15PM (#18990603)
That's it. I'm disabling JS by default.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by 4ec0755f5522 on Thursday January 24, 2019 @12:46PM (#18990958)
You will be astounded how much of the web breaks. I know you think you know, but it's worse than you can imagine. The number of sites that can't even display their images, the amount of third party css that is needed and won't load, dropdowns, search buttons, and endless Big Red Banners telling you that you need to enable javascript.

I am 100% in agreement JS is the problem and should be abandoned. But the web falls apart if you disable it.

source: disabled JS on iOS safari. I leave it disabled but have to open other browser all the time. Even stupid HuffPo "click to read" is JS. So when I click 'news' links from the main news widget they open in Safari and I can't read the article I have to copy and paste into Chrome (which does have JS enabled).

There's no way this is an ok user experience. But JS is not an ok security experience. I'm like F THIS I'M SWITCHING TO LYNX. :-(

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by dreamcompiler on Thursday January 24, 2019 @06:41PM (#18994183)
Exactly this. Ten years ago, sites would fail gracefully if the client didn't have JS enabled. But today, all the cool web kids want to do "100% client-side rendering" which means the page is completely blank if you disable JS. For a very few web sites, this makes sense. For the vast majority, it does not.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by CGamesPlay on Thursday January 24, 2019 @12:28PM (#18990764)
If you're savvy enough to know that you can "disable JS by default" I'm betting you are also savvy enough to not download AdobeFlashPlayer.dmg from newtypeinstalllite.icu.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by toufiqbarhamov on Thursday January 24, 2019 @12:51PM (#18991015)
Use uMatrix, it will give you finer control than a simple “on/off” with a nice GUI.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by tinus_hn on Thursday January 24, 2019 @02:39PM (#18992137)
You don’t need JavaScript to make the user download a disk image. If you don’t just trust any ‘please install this plugin’ prompt you’re fine with or without JavaScript.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by zzzcpan on Thursday January 24, 2019 @12:29PM (#18990770)
We might need a fork of Chromium for that in the future. I hope Mozilla does it, but they seem to be heading towards non-existence burning resources to just copy everything Google does.