@OwOarchist@pawb.social
Honestly, it’s bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.
This, this, 1000 times this! That is exactly how I feel and was hoping to convey.
@OwOarchist@pawb.social
Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.
Yes, defense-in-depth includes minimizing threats rather than simply relying on protections. It shouldn’t be necessary to lower one’s shields constantly, and it’s better to avoid doing so if possible, from a security & privacy perspective.
@cley_faye@lemmy.world
Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. […]
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. […]
It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. […]
This reminds me of an interesting phenomenon: Some security-oriented people praise the security of the surveillance-advertising corporation’s browser engine (chromium), while proclaiming that gecko-based browsers (firefox) are unusable due to inferior security. Yet the main security threat I see is that fucking surveillance-advertising corporation which spreads unvetted and often malicious ads around the web without a care in the world.
This, this, 1000 times this! That is exactly how I feel and was hoping to convey.
Yes, defense-in-depth includes minimizing threats rather than simply relying on protections. It shouldn’t be necessary to lower one’s shields constantly, and it’s better to avoid doing so if possible, from a security & privacy perspective.
This reminds me of an interesting phenomenon: Some security-oriented people praise the security of the surveillance-advertising corporation’s browser engine (chromium), while proclaiming that gecko-based browsers (firefox) are unusable due to inferior security. Yet the main security threat I see is that fucking surveillance-advertising corporation which spreads unvetted and often malicious ads around the web without a care in the world.