sent from a disposable whonix qube

  • OwOarchist@pawb.socialBannedEnglish
    78·
    3 months ago

    Honestly, it’s bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.

    Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.

    • cley_faye@lemmy.world
      5·
      3 months ago

      Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can’t access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.

      The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.

      It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don’t know what site you’re viewing.

      • OwOarchist@pawb.socialBannedEnglish
        1·
        3 months ago

        Still can have issues with javascript crypto miners. And there’s always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.

        • Tanoh@lemmy.world
          2·
          3 months ago

          Most (all?) browsers throttle tabs that take too much cpu for too long (especially background). The actual numbers vary, but hidden cryptominers are not that effective anymore.

        • cley_faye@lemmy.world
          1·
          3 months ago

          JavaScript in the browser have no “sandbox” to evade. It does not have the ability to run outside of it’s virtual machine, at all. It’s completely different from a native executable, that actually have the ability to make system calls, that would evade a container/chroot/whatever.

          Also, running a crypto miner in a browser tab (or even as a service worker) is probably more costly to put in place than it will ever bring back. It’s just not efficient enough.

  • axh@lemmy.world
    23·
    3 months ago

    I can’t convince my wife to even use an add blocker, because it makes some (terrible) websites unusable (and you need an entire one additional click to disable it, it’s too much effort), blocking JS would make the entire internet unusable for normies.

      • keiko@fedia.ioOP
        4·
        3 months ago

        Pi-hole is a great project for network-wide dns-based blocking, yes. I was going to link to the official site, but it seems to be broken now, so I linked to the official github repo.

          • ReluctantMuskrat@lemmy.world
            5·
            3 months ago

            My wife loves our pihole setup so much I was forced to setup VPN access to the home network so she could block ads while traveling. Now our oldest daughter wants me to setup pihole for her house.

          • keiko@fedia.ioOP
            4·
            3 months ago

            One thing that’s really nice about pi-hole is that it gives a window into your network, allowing you to easily see dns requests as they happen, while also organizing them into useful charts and graphs.

  • keiko@fedia.ioOP
    12·
    3 months ago

    Hey, so there are a few threads I can’t see from this instance due to defederations and I wanna respond anyway.

    @Digit@lemmy.today open dyslexia font? nice touch.

    Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.

    @Onomatopoeia@lemmy.cafe That makes it easier for dyslexics?

    Possibly for some, as @Ludicrous0251@piefed.zip said. I think it would probably be more beneficial for those who are introduced to it at a young age. Otherwise it takes some time to get used to it, and I did end up falling back to the fonts I had been using. But I do like OpenDyslexicAlta font and think it makes a good meme font, so yeah.

    Okay so that’s my response to the chain of comments quoted above. Sorry I can’t give y’all upvotes due to the defederation, and sorry it took me so long to realize there were comments which were hidden from me. I do try my best to respond to everything that seems directed at me or which I can offer a worthwhile response.

    The next chain of comments is much longer (it’s a really good one too), and I’m thinking I’ll make one or more responses when I get back online a while from now.

    🩷

      • keiko@fedia.ioOP
        2·
        3 months ago

        I have a brand??! 🫨 (seriously tyvm 🩷) I’m currently going through my notifications and responding to stuff before using another qube to find that other chain of comments (and any new ones too). I am pretty obsessive ^^’ (and maybe trying to show more of myself here in the hopes that people can truly see me when I say things that matter)

    • keiko@fedia.ioOP
      2·
      3 months ago

      Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.

      @Digit@lemmy.today This, I applaud. I aim similarly.

      tyvm for the appreciation. and since I can’t send upvotes directly, you get extra hearts: 🩷🩷🩷🩷🩷

    • Digit@lemmy.todayEnglish
      1·
      3 months ago

      Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.

      This, I applaud. I aim similarly.

  • PinkiePieYay2707@pawb.socialEnglish
    9·
    3 months ago

    I’m currently testing just outright blocking all scripts through uBO, and to be honest it is not usable. I will use it for a little longer, then for sure disable it. A lot of websites just refuse to load (thanks, SPAs), and those that do often have little interactions that break, thus making the pages hard to use or even outright unusable.

    To give some examples for those that haven’t tried this: images may refuse to load (js based lazy load implementation), dropdown menus almost never work, search option usually doesn’t work (and if it does it’s only because it goes to a different page, which is fair), comments probably won’t show up, pretty much anything “live” won’t work. Oh and let’s not forget the captchas and all the proof-of-work blockers.

    For me the only really interesting part about this experience is that imgur refuses to load, even if you have a direct link to an image.

    • keiko@fedia.ioOP
      1·
      3 months ago

      To give some examples for those that haven’t tried this: images may refuse to load (js based lazy load implementation), dropdown menus almost never work, search option usually doesn’t work (and if it does it’s only because it goes to a different page, which is fair), comments probably won’t show up, pretty much anything “live” won’t work.

      All of those things work perfectly on non-broken sites like mbin instances. As far as captchas, I refuse to do them, as I don’t consent to being used like that.

      For me the only really interesting part about this experience is that imgur refuses to load, even if you have a direct link to an image.

      imgur.com/something -> farside.link/rimgo/something

      Not all of the rimgo instances work, but some do.

      Edit: Well apparently farside has been shut down.

    • Richard@lemmy.world
      11·
      3 months ago

      This disabling scripts thing is really for hardcore privacy enthusiasts. Just install librewolf on your linux box, change the DNS on your router to block ads and you’re good.

      The reason i say it’s for enthusiasts is that it will break everything as soon as you do it. And i mean it. The modern web is not useful without java script. Only websites designed specifically for working without javascript will still work.

      • keiko@fedia.ioOP
        4·
        3 months ago

        This disabling scripts thing is really for hardcore privacy enthusiasts.

        It also just makes things better. Javascripts tend to make for a worse browsing experience to me.

        it will break everything as soon as you do it

        Sites that don’t work without javascripts are broken sites. It’s not the lack of javascript functionality that causes them to break. They are in a broken state and should be updated to not rely on javascripts. Leaving scripts disables makes it clear which sites are broken and which sites are worth accessing.

        The modern web is not useful without java script.

        I disagree. The modern web is unusable with all the ads, trackers, captchas, and javascripts. The true modern web consists of the sites which don’t have all of those drawbacks. Mbin is a good example of what the modern web can and should be. It’s superior to all other fediverse instances I’ve known.

        Only websites designed specifically for not working with javascript will still work.

        Those are the sites worth accessing. ^^

        Just install librewolf on your linux box, change the DNS on your router to block ads and you’re good.

        I do agree that this is good advice <3

        • Inkstainthebat@pawb.social
          2·
          3 months ago

          Hi, question, my own website pretty much only uses JavaScript in order to correctly display a list of my blogposts without me having to manually update the html. I did really want a way to have this without JavaScript (or backend services like PHP, I’m still hosted by neocities). Is there?

          • keiko@fedia.ioOP
            2·
            3 months ago

            I am actually less-knowledgeable than you on these kinds of things, as I’ve still not yet setup my own services and know next-to-nothing about the dev part of web-dev. I have no real experience yet. The things I know come from a user perspective. Sorry to disappoint.

    • keiko@fedia.ioOP
      6·
      3 months ago

      It depends on the site. Some sites which leverage javascripts are still usable without the scripts. And there is a spectrum of usability. Lemmy is a good example. Most lemmy instances which are open to the public (without captchas or login) are generally usable without javascripts. Some features don’t work, but knowing the path to the page allows manually getting there without javascript buttons. So like, adding /?sort=TopHour to the end of a lemmy instance’s url sets the sorting for the page to top posts in the past hour. However, some other features don’t seem to work at all. But then there are lemmy instances which utilize mlmym, which basically replicates old reddit and works 100% without javascripts. And then there are instances like mbin, which is designed to be a modern fediverse experience which does not require any javascripts, and it works very well.

      When I load a site, any site, if I get a blank page or a bunch of placeholders for javascript elements, I just close the tab and move on. Sometimes if I’m curious, I’ll switch from “Basic Page Style” to “No Style” (Alt+V Y N) to see if there’s anything hidden beneath the surface.

  • obnomus@lemmy.mlEnglish
    6·
    3 months ago

    Its not related to this but Tempermonkey amd scripts is insanely good experience.

  • Bluescluestoothpaste@sh.itjust.works
    4·
    3 months ago

    Im not super tech saavy, especially compared to the lemmy userbase, but every complaint about software just reads to me like whining about something you chose to install on your computer. You can just not use someone else’s software, yes the mainstream software companies are fucking assholes and they will take all of your data and privacy in exchange for a subscription to their software. It’s on you if you accept that deal.

    • TorstenTyp@feddit.nu
      3·
      3 months ago

      While technically correct, it’s a slightly shallow analysis. It’s like people complaining that companies put chemicals in the food, you could grow all of your your own food but it’s probably not feasible.

        • TorstenTyp@feddit.nu
          1·
          3 months ago

          We’re both here on Lemmy so it’s safe to assume we’re both doing our best, but I’m willing to bet all my money that you are not sourcing all of your tech needs from ethical companies or the open source community. You probably use an Apple or Google made phone, your work might lock you into Microsoft operating systems, the list goes on. It’s not wrong for people to demand better solutions from companies that have managed to establish a monopoly and who use their vast resources to maintain that monopoly.

          • Bluescluestoothpaste@sh.itjust.works
            1·
            3 months ago

            Idk what we mean by wrong but it’s just dumb and causes self inflicted stress. Yes i use microsoft at work because they tell me i have to, i dont complain about it on the internet because that would just be wasting my energy for naught. And no monopoly has ever self policed itself and never will. The problem is the laws passed so go complain to your local politicians instead. And if microsoft was the first company to ever self police itself out of a monopoly, google and apple would instantly suck up all that market share.

    • keiko@fedia.ioOP
      2·
      3 months ago

      I’m confused (happens a lot). Is your comment responding to the meme or to some other comment? If the former, I am even more confused, since the meme isn’t complaining about anything at all. It’s poking fun some of the ways people view the web.

      You can just not use someone else’s software

      That is what I am doing when I deny a site to run scripts on my computer, yes. And I love that I have the ability to make that choice.

      yes the mainstream software companies are fucking assholes and they will take all of your data and privacy in exchange for a subscription to their software

      lol yes. That’s why I tend to avoid them and their products/services.

      It’s on you if you accept that deal.

      Well I do still find it fucked-up that they prey on unsuspecting people who are ignorant of what’s being done to them, including especially kids. It’s not on them. They don’t deserve the bad things done to them by the surveillance corporations. They can’t be expected to know and understand.

    • relativestranger@feddit.nlEnglish
      2·
      3 months ago

      i really wish raymond would restart umatrix… it was the most flexible script blocker. noscript’s ‘per site’ permissions takes far too many clicks to do (some of) what umatrix does from one toolbar icon drop-down.

        • keiko@fedia.ioOP
          1·
          3 months ago

          It was really nice but was eventually discontinued. ublock origin can do most of what umatrix could do, and NoScript is similarly useful. But it’s also simple to just deny javascripts and call it a day. Whatever works.