Mozilla confirms this bug is exploitable. I am making sure JavaScript is off by default and only enabled in pages where I want it to.

https://www.bleepingcomputer.com/news/security/mozilla-confirms-web-based-execution-vector-for-meltdown-and-spectre-attacks/

On Fri, Jan 5, 2018 at 1:36 AM, der.hans <PLUGd@lufthans.com> wrote:

Am 05. Jan, 2018 schwätzte Herminio Hernandez, Jr. so:

moin moin,

Yeah, JavaScript's annoying. I've been using NoScript to block it outright
for years. I only allow certain sites to have JavaScript. Some of those
sites only get JavaScript when I'm trying to checkout. Some get their own
browser instance before I allow them to have JavaScript.

Recently JavaScript has been used to do bitcoin mining via web browsers
and it's had several security issues over the years.

It can't escape the sandbox if it never runs :).

ciao,

der.hans

Damn Stallman was right again

https://www.gnu.org/philosophy/po/javascript-trap.ja-en.html

On Thu, Jan 4, 2018 at 10:52 PM, Andrew McRobb <andrewmcrobb@gmail.com>
wrote:

JavaScript being the Raccoon? heh

Andrew McRobb
Full-time Software Developer
Part-time Freelancer
mcrobb.info

On Thu, Jan 4, 2018 at 8:46 PM, Ed <plug@0x1b.com> wrote:

More like raccoons to oranges...
8)

On Thu, Jan 4, 2018 at 4:59 PM, der.hans <PLUGd@lufthans.com> wrote:

Am 04. Jan, 2018 schwätzte Andrew McRobb so:

moin moin Andrew,

cool, sounds like having umatrix or NoScript blocking javascript is

still

sufficient.

Need to make sure <script> is blocked as well as the external JS.

https://www.w3schools.com/html/html_scripts.asp

ciao,

der.hans

No, HTML5 is a markup at the end of the day. Comparing JS and HTML, is
like
comparing apples to oranges. All HTML5 does is include new tags to use
when
building a web app for you or search engines to use:
https://www.w3schools.com/html/html5_intro.asp. It doesn't at all

handle

any logic like JS would, if that's what you are asking.

Same can almost go for CSS. It's a description language, it doesn't

handle

any logic (except for select queries). However, CSS is starting to
implement variables, but you can only use those for *attributes*. Not
write

a fully functional app with CSS alone.

Andrew McRobb
Full-time Software Developer
Part-time Freelancer
mcrobb.info

On Thu, Jan 4, 2018 at 10:21 AM, der.hans <PLUGd@lufthans.com> wrote:

moin moin,

I haven't paid much attention to HTML and CSS standards for many

years.

As I understand it, HTML5 is script-like to lesson use of javascript.

Does that mean plain HTML ( no javascript ) is sufficient to exploit
browsers in light of #meltdown and #spectre ?

https://blog.mozilla.org/security/2018/01/03/mitigations-
landing-new-class-timing-attack/

https://sites.google.com/a/chromium.org/dev/Home/chromium-

security/ssca

What about CSS?

ciao,

der.hans
--
#  https://www.LuftHans.com   https://www.PhxLinux.org
#  As we enjoy great Advantages from the
#  Inventions of others we should be glad of an
#  Opportunity to serve others by any Invention of ours,
#  and this we should do freely and generously.
#  -- Benjamin Franklin (1706-1790), on his refusal to patent his
inventions.
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss

--
#  https://www.LuftHans.com   https://www.PhxLinux.org
#  Nobody grows old merely by living a number of years.
#  We grow old by deserting our ideals.
#  Years may wrinkle the skin, but to give up enthusiasm
#  wrinkles the soul.  -- Samuel Ullman
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss

--
#  https://www.LuftHans.com   https://www.PhxLinux.org

#  It's up to the reader to make the book interesting.
#  An author has only the opportunity to make it uninteresting. - der.hans
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss