CNET's Clientside developer blog serving Adobe Flash exploits

TalkBack 3 of 5:

Next »

« Previous

• Thread View
• Flat View

You are correct, it depends on the circumstances

Telling NoScript that you trust one site does not tell it to trust all scripts served through a site's Web page.

You are right. It would depend on if the javascript in question was linked from the trusted page (NoScript would block this) or if it was embedded into the page (NoScript wouldn't block it).

Seems to me that Firefox with NoScript meets that description

This I disagree with. NoScript actually disables the javascript engine for untrusted sources so the javascript doesn't run at all. Protected Mode (and AppArmor) allow the javascript to run but with greatly reduced permissions. NoScript doesn't trust any javascript, even if it is harmless. Protected Mode allows javascript to run but denies access to anything that the script shouldn't be messing with.

The disadvantage of NoScript is that it stops even legitimate javascript from running. Protected Mode (and AppArmor) allows legitimate javascript to run. Both fail the scenario where you get attacked by a "trusted site" but because NoScript disables even legitimate javascript, you are much more likely to turn NoScript off than Protected Mode for a certain site.

NoScript is like the gate of a gated community where there are no locks on the houses. Don't trust the mailman? Fine, you get no mail. Trust the mailman? Nothing stops him from walking into your house and stealing your stuff. Protected Mode is like a normal community. Anyone can put stuff in your mailbox but they can't get into your house.

I'll continue to use NoScript even if Firefox gets Protected Mode since they both live quite happily together! People in gated communities can still lock their doors.

Posted by: NonZealot   Posted on: 08/08/08 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Infrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now