But what if NoScript makes us vulnerabler, frickfrock? What if it lets the aliens into my computer?

 

Quote:

Originally Posted by CynicalUnicorn

But what if NoScript makes us vulnerabler, frickfrock? What if it lets the aliens into my computer?

Noscript's powers are too great to be compromised.

You can't kill a God.

 

This seems a bit the kind of unlikely daisy chain of events that needs to happen before any harm is done:

1. "allows attackers who already have a toehold on a targeted computer to gain complete system control." - the attacker needs to already have somehow gone past the malware scanner anyhow;

2. The user must have somehow gotten other malware on the computer that the scanner does identify;

3. The user must choose to put said identified malware in quarantine instead of simply deleting it.

In any case, it's good to know that six AV makers have already patched the hole and the others are on their way to do so.

 

Quote:

Originally Posted by tpi2007

This seems a bit the kind of unlikely daisy chain of events that needs to happen before any harm is done:

1.
3. The user must choose to put said identified malware in quarantine instead of simply deleting it.

A lot of AV programs I've used Quarantine by default unless you specify to delete afterwards. It's surprisingly common, I know MSE does.

I don't really understand it myself, I think it has to do with making sure it doesn't delete a critical system file.

 

Quote:

Originally Posted by frickfrock999

Quote:

Originally Posted by tpi2007

This seems a bit the kind of unlikely daisy chain of events that needs to happen before any harm is done:

1.
3. The user must choose to put said identified malware in quarantine instead of simply deleting it.

A lot of AV programs I've used Quarantine by default unless you specify to delete afterwards. It's surprisingly common, I know MSE does.

I don't really understand it myself, I think it has to do with making sure it doesn't delete a critical system file.

I've got mine set to ask me (I think it was on by default as it's the first option on the list).

 

How do you guys browse the web with noscript? I've tried using it and it literally can't even open a single web page. So i had to turn it off. Sure you can enable it for a website you "trust" but then why have it at all at that point?

Malwarebytes seems to have done me well over the years. Only wish i could have gotten more lifetime subscriptions back when i still had the chance.

 

Quote:

Originally Posted by IMI4tth3w

How do you guys browse the web with noscript? I've tried using it and it literally can't even open a single web page. So i had to turn it off. Sure you can enable it for a website you "trust" but then why have it at all at that point?

Because you can trust only the domains needed to display the content you want. It's not the domains on which the site you usually want to visit is that will infect you.

To me, the question is, conversely, how do YOU navigate the web withOUT noscript or scriptsafe (for Chrome)?

If you set either up well enough and know how to use them, it'll keep you much safer than MalwareBytes. Prevention > treatment.

 

Quote:

Originally Posted by frickfrock999

Noscript's powers are too great to be compromised.

You can't kill a God.

I am pretty sure man kind has proven this to be wrong. LOL

 

Very childish article since "running a program" opens you to attacks that you otherwise would not be exposed to.

How many times was sol.exe infected in the early to mid 90s?

 

Quote:

Originally Posted by battlenut

I am pretty sure man kind has proven this to be wrong. LOL

X-Men's Apocalypse concurs.

 

Quote:

Originally Posted by IMI4tth3w

How do you guys browse the web with noscript? I've tried using it and it literally can't even open a single web page. So i had to turn it off. Sure you can enable it for a website you "trust" but then why have it at all at that point?

Malwarebytes seems to have done me well over the years. Only wish i could have gotten more lifetime subscriptions back when i still had the chance.

Exactly what ToTheSun! said. It takes a bit to set up, but you do it one script at a time. Eg, here on OCN I have huddler, overclock.net, yahooapis, google tag services, and google analytics allowed. That's it. Often, you'll only need one script for sites to funtion. Some sites like instagram that takes 50 someodd scripts, probably aren't worth viewing.

Also, I run 2 browsers. One with noscript, and one that is a compatability browser, for when I'm shopping, or doing school stuff and I don't want noscript stopping something important.

 

Noscript needs an update for Firefox 57

 

Quote:

Originally Posted by frickfrock999

So if you can't trust your own AV program anymore, what can you trust?

Your banker, obviously

 

Quote:

Originally Posted by ToTheSun!

Because you can trust only the domains needed to display the content you want. It's not the domains on which the site you usually want to visit is that will infect you.

To me, the question is, conversely, how do YOU navigate the web withOUT noscript or scriptsafe (for Chrome)?

If you set either up well enough and know how to use them, it'll keep you much safer than MalwareBytes. Prevention > treatment.

Malwarebytes + AdGuard Premium.

But yes I can agree that Malwarebytes alone is simply not enough, especially when connecting to certain Russian sites shall we say.

Quote:

Originally Posted by IMI4tth3w

How do you guys browse the web with noscript? I've tried using it and it literally can't even open a single web page. So i had to turn it off. Sure you can enable it for a website you "trust" but then why have it at all at that point?

Malwarebytes seems to have done me well over the years. Only wish i could have gotten more lifetime subscriptions back when i still had the chance.

They can still be found on eBay if you're willing to pay the price. (e.g. here's one)

 

Quote:

Originally Posted by AlphaC

Noscript needs an update for Firefox 57

Why else am I still on 56?

 

Quote:

Originally Posted by IMI4tth3w

How do you guys browse the web with noscript? I've tried using it and it literally can't even open a single web page. So i had to turn it off. Sure you can enable it for a website you "trust" but then why have it at all at that point?

Malwarebytes seems to have done me well over the years. Only wish i could have gotten more lifetime subscriptions back when i still had the chance.

If I get to a website that doesn't function with noscript running I question whether I really want to see whatever their website shows anyways. If the answer is yes then I'll temporarily allow the main topsite in question. If it still doesn't function after that then I seriously question whether they're worth my time. If the scum want to risk my computer all so they can harvest personal data about me and shove lies and ads in my face that I'm not going to fall for anyways then they can eat dirt and I don't need to see their garbage website anyways. If I'm trying to buy a product and they can't even make their website function correctly without a billion scripts running then I don't want their trash product anyways.

Websites like newegg are a good example. You can get most functionality by just allowing newegg.com (.ca), but there are a few extra scripts in there to allow things like pictures of products or the review blurbs. For a site I really want to check out and I know is probably safe like newegg I'll grant allowances to different scripts until the website functions correctly. But I still don't see a need to allow garbage like adsense or whatever. Or amazon, allowing amazon.ca works fine, but if I want to get the mouseover closeup view of products there's another script in there that needs to be allowed.

A major website like amazon can have like 15 or 20 different scripts all told, but you only need to allow a handful to get the website to function. It can be a chore to dig through them all to find the ones that you need but so be it.

And for things like doing job related orientations online at places like shells website where having noscript running will just screw everything up I have a clean and basic chrome that I can fire up without any addons, that I use for very specific and limited instances where I "know" I'm safe.

 

Quote:

Originally Posted by SpankyMcFlych

If I get to a website that doesn't function with noscript running I question whether I really want to see whatever their website shows anyways. If the answer is yes then I'll temporarily allow the main topsite in question. If it still doesn't function after that then I seriously question whether they're worth my time. If the scum want to risk my computer all so they can harvest personal data about me and shove lies and ads in my face that I'm not going to fall for anyways then they can eat dirt and I don't need to see their garbage website anyways. If I'm trying to buy a product and they can't even make their website function correctly without a billion scripts running then I don't want their trash product anyways.

Websites like newegg are a good example. You can get most functionality by just allowing newegg.com (.ca), but there are a few extra scripts in there to allow things like pictures of products or the review blurbs. For a site I really want to check out and I know is probably safe like newegg I'll grant allowances to different scripts until the website functions correctly. But I still don't see a need to allow garbage like adsense or whatever. Or amazon, allowing amazon.ca works fine, but if I want to get the mouseover closeup view of products there's another script in there that needs to be allowed.

A major website like amazon can have like 15 or 20 different scripts all told, but you only need to allow a handful to get the website to function. It can be a chore to dig through them all to find the ones that you need but so be it.

And for things like doing job related orientations online at places like shells website where having noscript running will just screw everything up I have a clean and basic chrome that I can fire up without any addons, that I use for very specific and limited instances where I "know" I'm safe.

Holy crap. My thought process is 100% the same, I just didn't want to write it all out. Thank you for saving me the effort.

Forbes is a perfect example of garbage not worth viewing.

Same on the Chrome too.

 

Holy hell Forbes is nigh unviewable without an adblocker of some sort. It's the poster child for why adblockers exist in the first place. ExtremeTech is another good example of ads gone haywire.

That said AdGuard does a wonderful job of keeping them all at bay and making the sites readable again.

 

the ads scripts are mostly for detecting that the ones viewing it are users instead of bot scripts to ramp up viewing count.
but sometimes dubious ads provider also side-loads other scripts to get the ads more "obvious".

 

I feel like this is said to death in just about every thread dealing with AV software, but I don't feel the need to use any. I just use my head when it comes to stuff, like using an adblock and noscript, and not downloading sketchy stuff. Haven't had a virus in years.

 

I delete anything that goes into my quarantine (assuming it's not something legitimate). Who would win: genius security researcher or my OCD of immediately deleting malware

. Obviously there are other potential security holes in AVs, but this one only seems to affect those who don't care.

Edit: Oh I see, it would be restored automatically. Should've read more carefully. Still, that gives you a massive headstart in removing the malware (knowing it exists on your system).