![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
eftychia at 04:20pm on 2004-01-01I want a secure version of Javascript and enough processor speed and RAM to get away with running it on various of my machines without crashing the browser or OS, or making my systems unusably slow.
I've been able to get away without Javascript for a while. There are some sites that require it for basic navigation, but many of those are places I only want to go for "fun" anyhow, not sites I need, so I can just declare that they don't want my attention enough to bother being accessible. Other, more important sites, I write complaints to the webmasters of, explaining just how broken their sites are. And there are a few where I've had to hand-parse the Javascript to figure out where a link was supposed to take me, or in extreme cases, fire up a machine that I plan on replacing the OS on soon anyhow, and turning on Javascript in a browser there for a few minutes. And there are a few sites out there which use Javascript correctly -- extra bells and whistles if it's turned on, but still a perfectly navigable site otherwise. Once in a while I find a site that's properly designed for non-Javascript navigation but provides some nifty function that really does require client-side scripting to implement, and wind up doing without. So far all the "trackback" features of blogs I've seen have required Javascript -- I don't know whether that's because such a feature really requires client-side scripting or just because nobody's ever bothered to implement it differently, but the result is that as useful as trackback sounds, I've just ignored it. It's the only example I can think of so far where I've actually missed out on something other than an amusing cartoon or quiz because of my not using Javascript.
Well today, ![[livejournal.com profile]](https://www.dreamwidth.org/img/external/lj-userinfo.gif){kind=small}
syntonic_comma
pointed out something called
MemeStreams
which looks both interesting and useful at first glance. The
problem? Using it requires a) Javascript, and b)
either Windows or MacOS X. I've got Windows, but I also browse
under Linux and MacOS 9. And I don't leave Javascript turned
on. So I finally feel like I'm actually missing something by
not using Javascript. But I don't feel
terribly safe using Javascript, and my poor little computers are
overtaxed doing the things I already ask them to do, leading to
browser crashes (Opera occasionally; more often iCab) and
operating system crashes (mostly Windows) and "memory is running
low" warnings as it is. (My fast Linux box is a 686/200; my
Windows machines are Pentium/100 and Pentium/120; none of my
machines has enough RAM (the largest is the Mac with 128M); and
I've even got 486 boxes doing some network-support functions
(DNS, firewall, gateway).) I've wanted upgrades in a daydreamy
"wouldn't it be nice" way for a long time, but today I find
myself thinking, "Crap, there's stuff I can't do." I'm not sure
what to do about this ... I can keep an ear out for faster (or
better RAM-equipped) hand-me-downs, but that doesn't fix the
security issues with Javascript.
Maybe I can write a custom web proxy to rewrite web pages as they come down the wire, stripping out all other Javascript (or presenting me the choice of hand-checking it and then allowing or denying it), so I can run intentionally installed Javascript tools behind my firewall without exposing myself to potential malware (on potentially-cracked public sites). I'd still have the performance issues to deal with, of course.
Then again, I could solve my current navigation problems by having the proxy replace standard broken-navigation Javascript with plain ol' HTML href tags on the fly so my browsers with Javascript disabled could still navigate the screwed up sites (as long as they were screwed up in the common ways)... Hmm. I smell a project idea.
(no subject)
what JS security risks are you worried about? i don't know of any.
and does JS really slow your computers down? what browser are you running? (much of mozilla is actually *written* in JS, so it has to be fast.)
(no subject)
Decisions, decisions.
(no subject)
(no subject)
Java is supposed to be limited to a "security sandbox" if it's a web applet (as opposed to a standalone program). I was under the impression that Javascript was designed partly to get around such "inconveniences" as the sandbox. If I'm mistaken, I hope someone will correct me.
Now most webmasters wouldn't put malware on their sites deliberately -- one would not want it to be so easy for folks to know whom to blame when they finally noticed, after all -- but if a cracker breaks in and modifies the site, they could install malware. So just knowing "this is a reputable site" isn't good enough. Running Javascript in your mail client when downloading HTML email is far, far worse, of course, since worm/virus authors have no compunction about shipping malware around the net. But even running Javascript on web pages is a security risk.
As for my browsers: Opera 6 under Win95 and WinNT, Opera 5 under Linux, Lynx and Links under Linux, iCab and Opera under Mac OS 9.1. I haven't done formal speed comparisons lately, but several versions ago when I turned off Javascript I noticed that my browsers seemed to work a lot fast (probably simply because they weren't executing a lot of useless cruft on the pages).
(no subject)
Java and Javascript have almost nothing in common, aside from both being syntactically C-like. The name similarity was a marketing thing.
Both Java and Javascript run sandboxed if you get them from an untrusted source. There is, AFAIK, no cross-platform way of doing anything outside the sandbox in JS. (In Mozilla, a JS program can ask to leave the sandbox-- the user gets a dialogue asking whether to let it do so-- and once that's done, it can do almost anything. However, all the things it can do are based on Netscape/Mozilla's own technologies (XPCOM, and the objects under netscape.security, etc) so I'd be surprised if any of them worked in Explorer.
But even running Javascript on web pages is a security risk.
AFAIK, the main risk with having arbitrary JS on web pages is with things inside the browser, like cookies. If I could put a piece of JS on a page you were receiving from LJ, I could read your login cookie and send it to any site I chose. But unless your browser was very broken, I wouldn't have any way of getting at your files.
(no subject)
*nod* Deliberate name similarity, and one of the uses for Java is also similar to what Javascript was designed for. I didn't mean to imply greater connection that that.
"Both Java and Javascript run sandboxed if you get them from an untrusted source."
That was a clue I lacked -- that Javascript is also sandboxed.
"AFAIK, the main risk with having arbitrary JS on web pages is with things inside the browser, like cookies."
Okay, another question: was this always the case, or did security get added/improved? Doing a web search for "malicious javascript" shows a lot of other people being concerned for reasons similar to mine, but most of the hits are for things written in 2001. So was this an improvement in the language and/or implementations since then, or just more writers finding out it wasn't as bad as they'd thought?
"[...] unless your browser was very broken, I wouldn't have any way of getting at your files."
And, of course, various implementations of both Java and Javascript have been found to be buggy in various ways ... Apparently the Nimda worm used Javascript holes, didn't it?
What I've seen today suggests (though I need to do a lot more research) that Javascript is far less dangerous than I'd thought but not quite safe in the real world (i.e. buggy real-world browsers); and Java is far more dangerous than I'd thought, about as bad as Javascript.
(Before I turned off Javascript, I had more reliability problems from Javascript -- browser crashes from buggy scripts -- and a greater performance hit from Java. But Java is a) less common and b) less likely to be used for random silly "dancing bears" types of things. I probably should have turned off Java as well.)
Hmm. It seems one of the big risks of Javascript is having passwords compromised ... so if the browsers I use now are less prone to crashing when faced with bad scripts (or because of memory leaks in their Javascript implementations), perhaps I could designate one machine to access my bank accounts, eBay, PayPal, etc., and turn Javascript back on on the others. I'll think about it. Running untrusted code still makes me a bit nervous in general, reasonable or not.
And thanks for the dose of Clue.
(no subject)
I don't know... I think it was always the case in theory, but problems have appeared over the years. I'm not well up on all the history, though (but I'd like to be). For example:
Apparently the Nimda worm used Javascript holes, didn't it?
AIUI the JS part of Nimda loaded the rest using window.open("filename-of-evil-stuff"). I think that's a browser problem rather than JS; it's pretty reasonable that JS on one page should be able to tell the browser to go to another page, but the browser shouldn't respond to being given a URL whether by JS or by the user, by just downloading and running anything. At least not without lots and lots of persuading from the user.
(no subject)
(no subject)
(no subject)
*nod* It's a voluntary surveilance system that promises usefulness in return *and* is supposed to Make The Net A More Useful Place in general, not just to the one individual.
(I need to look more closely, but skimming the docs made it appear that it only reported what you told it was worth noting, not everything you surf, right?)
(no subject)
(no subject)
But the wizard on configuring it is
Did someone up there in the discussion call me a "he" ?
(no subject)
Uh, I don't think you got called, "he". I think I did, which makes more sense.
(no subject)
when it comes to pop-ups (the biggest annoyance w/ javascript, obviously), there's always changing browsers, if the memory and machine requirements aren't too restrictive. MozillaFirebird 0.7 has the ability to tell javascript to not pop-up anything, then in the corner of the status bar is an icon that will highlight if javascript attempted to pop something up. you can double-click that icon and it'll bring up a dialog that will allow you to mark that site as pop-up safe, or just double-click the link that tried to navigate through a popup a second time and it'll do it "just this once".
however, mozilla is dog-slow on a 32 meg system, if that's how old a system you've got (like my laptop). it means that while mozilla's running, you can't really but running much else. and also have java and flash turned off 'cause turning them on causes page faults.
i actually have a much bigger problem with sites that live by flash exclusively than javascript navigation. i hate places that insist on popping up their own exclusive window to hang out in (in javascript, so you can't right-mouse-menu open it into a new tab), but i hate all-flash sites even more because being on a slow connection at home, downloading flash upgrades takes hours that i don't have or want to spend.
(no subject)
My problems with Javascript are twofold: First the paranoia (more a decision to avoid "untrusted code" as much as possible, which isn't 100%, but I have to draw lines somewhere), which I worry about a lot more than most people, I admit. (Then again, a lot of people run Outlook with HTML previewing turned on, too.)
Second, I do a small but significant amount of my browsing in text browsers (Lynx and Links) -- when I'm closest to a text-screen (console on a Linux box where I don't want to start an X server just to look up one quick thing), when what I want to look up is just text anyhow (calendars/schedules, song lyrics, definitions, etc.) and don't want to wait for lots of decorations to load, or when I've got so many GUI browser windows open that I'm either losing track of stuff or just scared of running out of RAM so I fire up Lynx in my telnet window instead. I really shouldn't need Javascript or a GUI to look up text information.
As for popups, I've heard that some browsers are better than others at dealing with / stopping them, but hadn't bothered to look into which does what because popups went away for me as a side effect of turning off Javascript. (By the way, does anyone know how to tell Outlook to view email as HTML but not execute Javascript in email messages, while still allowing MSIE to execute Javascript on web pages? I know someone who has a problem with popups from spam, and I'd like to help her, but she wants Javascript in the browser.)
And as for old hardware, my NT machine has, I think, 80 MB RAM, and I'd like to be able to run Excel and/or Acrobat plus Exceed (X server) alongside my browser and telnet client. My 95 box does indeed have a mere 32 MB RAM. And other than my one "fast" (200MHz) Linux box, which I think has 16 or 32 MB, most of my Linux machines have about 8 MB each. Yes, I'm way behind the curve and I know it.
"i actually have a much bigger problem with sites that live by flash exclusively than javascript navigation."
I agree. There's no fucking excuse for those. Really. Even if a page's point is to show a cute cartoon, it shouldn't load as nothing more than a blank window when someone tries to visit it without Flash (or with Flash but without Javascript -- I've seen that, too).
By the way, how dangerous is Flash in terms of scripting and access to local filesystems? I've seen references to interaction between Flash and ActiveX, but will a Flash script's attempt to use ActiveX override my having ActiveX turned off in my browser configuration?