News for hackers. Stuff that matters.
Re:Hackers used zerodays to infect Windows, iOS, and Android... by deepstack on Friday March 19, 2021 @05:27AM (#26511413)
> Disabling Javascript would have helped

Thank you for saying that. I'm one of first in 2005/2006 advocating JS rendering in the browser. JS in the browser has really gotten out of hand. I no longer advocate to do everything on the client/browser side. A web site should just work without JS.

Re:Hackers used zerodays to infect Windows, iOS, and Android... by moooo99 on Friday March 19, 2021 @07:18AM (#26512026)
Normal websites should absolutely, but actual webapps don't necessarily need to. Modern JS allows for very capable audio, video and 3d web applications inside the browser. The alternative if it wasn't for JS would be to build desktop apps, which would introduce a completely new set of problems and potential security risks.
Re:Hackers used zerodays to infect Windows, iOS, and Android... by deepstack on Friday March 19, 2021 @09:16AM (#26512910)
> audio, video and 3d web applications

For sure, audio, video do not need JS to function.

Yes you need JS for 3d webGL, but it also opened another can of worm that allows company to fingerprint GPU pretty much anyone who is not using Safari regardless if you are in incognito mode.

What most web developer don't realize browser was build to be a sandbox to protect you from the world wide web. Seems like the current trend is tear down that sandbox for usability and functions. Which is fine, then advertise that browser with JS enabled pretty much open you all that risk. It should be in the educational to the public as well as the first page of any browser that doesn't sandbox GPU finger printing.

Re:Hackers used zerodays to infect Windows, iOS, and Android... by zzo38computer on Friday March 19, 2021 @03:16PM (#26517244)
This is true, and web browsers will need better user configuration to control such things, including fine controls to control what exactly a script does. The web developer console is a good start, but it doesn't even start to go far enough at all.
Re:Hackers used zerodays to infect Windows, iOS, and Android... by zzo38computer on Friday March 19, 2021 @03:14PM (#26517225)
Most should work without JS (and also without CSS too, usually), yes.

Even in the few cases where it is needed, it should be designed to work OK without. I did see once where if JavaScript was disabled, it displayed a link to documentation instead; that is a good idea. (Unfortunately, the documentation didn't work without JavaScript enabled; they should fix that.) If it is accessing data, you can link to the documentation and/or to the data directly, in order to deal with it by yourself, with your own software, if the user wishes to do so. Sometimes the script is used to perform calculations, or automatically convert or render something; you can still add a <noscript> block to just mention what it is, links to source codes, or in some cases (e.g. automatic time zone conversion) just omit that part entirely will do. Simply writing "This page requires JavaScript enabled to work" is worthless; don't do that.