Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have recently started using NoScript (in addition to ABP). It took a little while to get used to it and can occasionally require some clicking when visiting a new site to investigate why the site's not working and where I need to allow JavaScript from. Is the extra security worth it?

Some of the controversy is discussed here. I suppose it boils down to a matter of whether JavaScript is a genuine threat to your computer or not. Any thoughts on this?

share|improve this question

migrated from stackoverflow.com Mar 23 '10 at 1:25

This question came from our site for professional and enthusiast programmers.

1  
This isn't a programming question, it belongs back on superuser.com –  animuson Mar 23 '10 at 1:16
2  
Try tinyurl.com/y8qdwsv if you feel browsing without NoScript is a decent idea. –  Josh K Mar 23 '10 at 1:28
1  
Try tinyurl.com/ydwxk63 if you want to laugh really hard. –  Hasaan Chop Mar 23 '10 at 1:31
    
@JoshK owwww, CPU and mem goes way up! –  Maxim Zaslavsky Mar 23 '10 at 1:33
1  
And quite a few things probably crash. It's 2.4MB of iframe's –  Josh K Mar 23 '10 at 1:39
show 3 more comments

5 Answers

up vote 3 down vote accepted

The reason NoScript even exists in the first place is not necessarily JavaScript per se, but security holes in the browser. In the past Firefox and other browsers have had many security vulnerabilities that have allowed malicious JavaScript to do bad things to a user's system. (In many cases native code could be run through JavaScript, meaning a website could potentially do anything to your computer.) There is also a possibility of cross-site scripting attacks, like @Eric said.

However, in my experience, these threats are not really threats at all. If you stay up-to-date and don't visit questionable websites on a regular basis, you'll be fine. NoScript is, in my opinion, more of a pain than anything else. I don't think it's worth temporarily shutting out 99.9% of the websites you visit just to protect yourself from the other 0.1%. If you're really that worried, re-evaluate your browsing habits.


That said, if you're worried about going to potentially malicious websites, you could install Web of Trust: it's a Firefox add-on that shows a "WOT rating" next to links on popular websites such as Google, and prevents you from going to websites with a low rating. That way, you can tell if a website is malicious before even clicking on it. With this method, you aren't hampering your browsing experience in any way, and you get practically the same security benefit.

share|improve this answer
add comment

See http://en.wikipedia.org/wiki/Cross-site_scripting and http://en.wikipedia.org/wiki/Cross-site_request_forgery for examples of how someone with malicious intent can cause problems using JavaScript.

FWIW - I personally don't roll with NoScript as I think it's a major headache. Sometimes you just have to watch where you're browsing and hope for the best.

share|improve this answer
2  
I dunno, I think both of those are bigger concerns for the web developer than for the user. I suppose a poorly designed site is susceptible to those kinds of flaws which then in turn could compromise the user's data.. but really, what kind of stuff are they going to steal? You username on some crummy forum? Whoopy doo. Only place it matters is when you've got credit card info and stuff, but you should never be entering that sort of info on a site you don't trust in the first place. –  Mark Mar 23 '10 at 1:30
1  
@Mark, Do you understand what CSRF is? Say you have your browser open to your bank and another tab open to an evil site. With a CSRF the evil site can trick your browser into making a request to your bank to transfer all your money out of your account. –  Zoredache Mar 23 '10 at 2:58
1  
You can protect yourself from CSRF by logging out of sensitive sites before going elsewhere. Though I'd like to think banks would be designed without this glaring hole, I know they haven't been in the past. –  Zurahn Mar 23 '10 at 4:14
add comment
  • Poorly written or malicious JavaScript can crash your browser, or cause it to freeze up
  • JavaScript may be used to cause drive-by downloads

  • But, used properly and as intended, JavaScript does enhance the web browsing experience

There are pros and cons, but on the whole it is worth the trouble. For the record, I always use the NoScript extension, selectively enabling scripts for the sites I regularly visit and I expect are safe.

share|improve this answer
add comment

No, I don't think it's a genuine threat at all. It was designed deliberately with limited privileges so that no one can wreck havoc on your computer. There might be the occasional security exploit that will crop up from time to time, but any browser worth its salt will eliminate this threat in no time at all (hence why you should keep your browser up to date). That said, I think JavaScript is fairly mature now and I don't think we'll be seeing any ground-breaking flaws any time soon. As Eric pointed out, people could use JavaScript to steal your Cookies or something, but that's only if the site is vulnerable to those kinds of attacks (they allow someone else to include JavaScript on their pages). Again, there's rarely anything valuable in a Cookie (in fact, there never should be or the site is storing information that they shouldn't!). If that's the case, the website you're viewing is the problem, not JavaScript, and they're probably leaking your precious information in other ways too. Stop worrying about JS, and just be smart about what you post on the internet.


In response to Josh K's link (which you should not click), JavaScript can be very annoying, but generally not harmful. I guess it depends on the sort of user you are. "Power users" generally know what they shouldn't click.

share|improve this answer
1  
Care to comment, downvoter? If JavaScript so harmful, how is it that millions of users with JS enabled have no problems at all? –  Mark Mar 23 '10 at 2:35
3  
How can you say millions of users have no problems at all with a straight face? Do you know how much malware gets onto computer because of javascript combined with some other vulnerability? –  Zoredache Mar 23 '10 at 3:00
    
@Zoredache: It's simple. There's 24 million internet users in Canada alone, in order to meet the "millions" quota I only need > 1 mil. I think, or would hope, it's safe to say there are at least 2 million competent interneteers out there. Jokes aside, fine, I retract my statement. I personally, and many of my friends, have never had any problems leaving JS enabled. But I guess that's because I'm computer-savvy then. If you don't know what you're doing, and you're prone to malware, then fine, disable it. –  Mark Mar 24 '10 at 3:49
    
I consider myself "computer savy" but browse with noscript as it removes so much crap from pages. (Even with adblock). Plus how on earth are "power users" supposed to be able to tell what tinyurls are safe, exactly? Or any url for that matter. And yes, XSS is the website's fault, but if I can stop (some) instances of this on my end, why would I chose not to do so? –  RJFalconer Apr 8 '10 at 10:59
    
Look at who posted the tinyurl? Was it one of your friends, or was it some troll? It's not perfect.... but... anywho, to each his own. –  Mark Apr 9 '10 at 7:45
add comment

While there have technically been exploits in image processing and XML rendering and the like, for all intents and purposes there are presently three vectors of attack: social engineering (tricking the user, getting the user to run a malicious file), plugins (Flash), and JavaScript.

JavaScript directly allows instructions to be run, and it's particularly bad in the case of Internet Explorer due to the incredibly poor decision and implementation of ActiveX controls in the past (though Microsoft has improved in this regard). You also don't have to necessarily go to shady sites, as ads are served in JavaScript and there are multiple cases of where malicious ads have been served to legitimate sites.

Short answer: If you're going to worry about threats, there are three things to be concerned about: Internet Explorer, Flash, and JavaScript.

share|improve this answer
    
"JavaScript directly allows instructions to be run" -- source? This is true in older version of IE due to ActiveX, but nowdays that only happens when security exploits are found, and those are usually patched pretty quickly. JavaScript itself actually can't do very much to your system--at most, it could slow down or maybe crash your browser. –  Sasha Chedygov Nov 8 '10 at 23:13
1  
JavaScript is a programming language, you write instructions. I'm not referring to machine code level instructions, I'm referring to the language itself -- that running JavaScript is running code; no more no less. Contrastable to HTML and CSS (aside from eval in IE) which are purely descriptive. Because of that, the likelihood of vulnerabilities through JavaScript is astronomically higher -- JavaScript is only benign if there are no mistakes either in implementation or specifications, which will never happen. –  Zurahn Nov 9 '10 at 1:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.