hackerfactor

You might want to re-read the criticisms about the Broken Windows theory. They didn't disprove it. They only showed that it is not necessarily the only cause of crime in cities.

On the Internet, the theory holds up really well. If you run a site that doesn't ban child porn, then you quickly get lots of child porn. If you don't stop porn, then you quickly get porn. Same with drugs, human trafficking, etc.

If you put an unmoderated public proxy on the web, it will quickly be used for spam, network attacks, and other malicious activities. And if you monitor the rate it is used for malicious purposes, you'll see it start slowly and then quickly ramp up to being mostly used for malicious causes.

If you put up an unmoderated public FTP site, it might be a while before the bad guys find it. But then they will start using it. For storing porn, child porn, warez, distributing malware, coordinating phishing attacks, etc.

Similarly, the reason you don't see many escort services offered on Google Hangouts or Facebook or eBay isn't because the escort services haven't tried being there. They are not there because Google and Facebook and eBay actively kick them out. Craigslist is not as proactive, so it has more escort offerings. And TOR? Not only is it not proactively stopping it, it has entire forums dedicated to supporting it. There's even forums where you can rate your escort! (Escort services are typically associated with prostitution, human trafficking, pornography, drugs, and money laundering.)

At FotoForensics (before I blocked TOR uploads): TOR was about 3% of traffic, but accounted for >50% of porn uploads and about 80% of child porn uploads.

Today, TOR is about 1% of overall traffic to the site. (I block uploads, but TOR users can still access and view the site.) However, it accounts for about 20% of network attacks.

Be careful what you ask for...

Right now (and without ad blockers): Go to homedepot.com, search for toilets, and view one toilet product page. This marks your interest. facebook.com will show you ads for toilets for the next month.

Actually, I intentionally left that out. I thought 4000 words was long enough. Surveillance would add in another 4000 words.

Your proposed approach will stop direct risks to browsers, but does nothing for ads that link to web pages that are hostile. E.g., you click on an ad because you are interested in the product and get directed to a phishing site or a site offering counterfeit goods or a site that has malware and infects your browser.

It's not just the graphic used by the ad, it's also the ad's destination.

"and again Flash is the scapegoat"

Truth hurts? Adobe Flash and Microsoft Silverlight are common exploit paths because they have new critical exploits every few days. Here's the CVE list for Flash -- notice how many critical exploits there are? It averages to about 1 every 3 days. https://www.cvedetails.com/vulnerability-list/vendor_id-53/p...

In contrast, JavaScript itself has been pretty stable for years. I think the last vulnerability related to JavaScript ES5 impacted old Firefox browsers. http://www.cvedetails.com/cve/CVE-2015-4516/ https://www.cvedetails.com/vulnerability-list/vendor_id-452/... (Two JavaScript exploits for Firefox in 2015, both low risk.)

And HTML5? Extremely stable. There may be specific plugins or specific browsers that are vulnerable, but the underlying HTML5 specifications are very safe and have been safe for years. https://www.cvedetails.com/google-search-results.php?q=html5...

If you know otherwise, then please cite the specific CVEs. Otherwise, you're just spreading false information. You wrote, "Browsers and HTML5/JS also have a hell lot of CVE that can be exploited". I say: Prove it. Cite your sources.

Edit: Adding links to Firefox exploit CVEs.