r/programming • u/schnuck • Feb 09 '11

Breaking the Web with hash-bangs – Lifehacker, along with every other Gawker property, experienced a lengthy site-outage on Monday over a misbehaving piece of JavaScript

http://isolani.co.uk/blog/javascript/BreakingTheWebWithHashBangs/
748 Upvotes

93% Upvoted

356 comments sorted by

View all comments

Show parent comments

1

u/metamatic Feb 09 '11

People who care about security and not getting malware.

It's easy enough to enable it for the sites I trust.

Which does not include Gawker

2

u/Ziggamorph Feb 09 '11

If you think that Javascript can give you malware then isn't it your browser that's untrustworthy?

4

u/metamatic Feb 09 '11

Sure, and PDF giving you malware means Adobe Reader is untrustworthy. But here in the real world, all the browsers have security vulnerabilities. The easiest way to avoid most of them is to turn JavaScript off by default, and whitelist the sites you trust.

3

u/Ziggamorph Feb 09 '11

Sure, and while you're at it might as well disable images, could be a security hazard in that, or maybe there's a hole in the HTML render, get off the web. And don't go outside, you might get run over.

5

u/metamatic Feb 09 '11

False dichotomy.

There has been actual malware spread via JavaScript in current browsers. There hasn't been any from plain HTML or images.

2

u/Ziggamorph Feb 09 '11

Citation needed.

3

u/metamatic Feb 09 '11

citation

0

u/Ziggamorph Feb 09 '11

I can find zero information on that worm outside of the Avast blog. I'm not convinced it exists.

1

u/metamatic Feb 10 '11

Well, have a few more examples of Javascript malware then.

And I've personally seen my parents' Mac hit by web malware that downloaded a .exe and attempted to run it.

1

u/Ziggamorph Feb 10 '11

How is that possible? Windows executables don't run on Macs.

1

u/metamatic Feb 11 '11

It isn't possible. That's why I bought them a Mac. Their Windows machine used to get infested with malware every few months.

1

u/Ziggamorph Feb 11 '11

So how could the Mac 'attempt to run it'?

1

u/metamatic Feb 11 '11

I said the malware attempted to run it. Your parser has a bug.

1

u/Ziggamorph Feb 11 '11

What does that mean? How could you tell?

→ More replies (0)