Not sure, but it's basically about how you shouldn't SSH from compromised machines because those can have "ControlMaster auto" in OpenSSH config to by pass authentication to the hosts you SSH to. That means the next time you SSH from that compromised host they will open another connection without having to use a password.

Of course, if you SSH from a compromised host, it could also just piggyback on your terminal session, or steal your credentials, or whatever else. This is really an instance of being on the other side of the airtight hatchway: https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10...

It's also about how users should be aware of malware injecting themselves by use of an alias.

I've just tried disabling Javascript in Firefox Klar/Focus (a built-in option) and the article loads, while this page says 'No':

https://www.whatismybrowser.com/detect/is-javascript-enabled

Works fine here, even over Tor - Firefox 70.0.1 with javascript.enabled=false in about:config.

If I curl the article's URL, all I get is:

  <html>
  <head>
  <META NAME="robots" CONTENT="noindex,nofollow">
  <script src="/_Incapsula_Resource?SWJIYLWA=5074a744e2e3d891814e9a2dace20bd4,719d34d31c8e3a6e6fffd425f7e032f3">
  </script>
  <body>
  </body></html>

And then if I curl:

https://www.nccgroup.trust/_Incapsula_Resource?SWJIYLWA=5074...

Then I get an obfuscated Javascript blob:

http://dpaste.com/2H519EP

I can't understand how this page could work on any browser that doesn't enable Javascript.

The only possible explanation I can think of is that it must be sending different content based on user agent, or something, though messing around with sending different user agents via "wget -U" gets me more or less the same thing.

I tried again and now get the Incapsula crap - maybe related to IP address (which changes often on Tor)?

Edit: the page loads for the first time after assigning a new IP in Tor, but subsequent loads throw the captcha. Odd system.

Use Firefox. Then prepend the url with `about:reader?url=` to force it into Reader Mode.

Hmm.. So how would that work exactly?

The source for that page only has Javascript in it.

Anyway, when I try to load that page in Firefox while blocking scripts with uMatrix, I get this error:

"The website you are visiting is protected and accelerated by Incapsula. Your computer may have been infected by malware and therefore flagged by the Incapsula network. Incapsula displays this page for you to verify that an actual human is the source of the traffic to this site, and not malicious software."

And then it tells me it wants me to click a "I am not a robot" checkbox.. but, of course, there isn't one, because I'm not allowing Javascript.

I also use uMatrix and probably with stricter settings than you do (* * * block) and also NoScript. I don't know what you're doing wrong; I load it just fine by following the exact instructions I said: prepend the URL with `about:reader?url=` and go. Page loads fine.

Yes, prepending 'about:reader?url=' did work, but I still wonder why. I suspect that Firefox's reader mode must be using Javascript behind uMatrix's back.

Interesting. I wonder what limitations there are to that.

Alternately, press F9.