Knowing some folks that work on "major-browser-vendor" security in the era of Mythos-found-and-exploited vulnerabilities everywhere, the thought of running completely random untrusted Javascript on my machine has freaked me out to the point that I run NoScript on all of my machines now.
I've found NoScript actually very usable, as long as you allow yourself to be fairly liberal in marking domains "trusted." I only truly routinely visit a core 10-20 domains that require Javascript, and they're from "reputable" organizations (my bank, employer, etc.) so those all get marked "trusted" quickly and I don't worry about them going forward.
In the "long tail" of random things I click on from HN links, seeing a "You need to enable Javascript to view this app" message is actually a fairly good signal that I don't want to view that app (though you might be surprised how many websites are browsable comfortably---or even more comfortably!---without JS enabled).
One thing I wish NoScript supported was the ability to mark a domain as a "trusted page domain" in the sense of: "HTML served from this domain can load scripts from any domain" (rather than trust being assigned to the domain serving the script itself). Perhaps it has this feature and I just haven't found it.
My practical approach is to have a microvm for firefox and a bubblewrap “jail” for a firefox instance that runs on the host. Of course, the config options mentioned here are good too.
Mullvad Browser[1] is an example of just that, ready to go for people in the real world who don't have the time or inclination to mess around with random extensions and `about:config` hacking.
Also surprised the blog author made zero mention of the importance of keeping your OS up to date. Its all very well having a patched and hardened browser but not if you're running it on a vulnerable OS.
For a while, I used a firefox extension called "Temporary Containers" which would, as the name implies, create a temporary container for each site you visit. Combined with specifying some custom rules for ones you want to open in a specific container, that was a very convenient setup. But the extension at some point corrupted my firefox profile and has been unmaintained for a while so I didn't try again. I am not sure what happened and it may have been the combination of extensions that was the cause of that. Sadly, the author passed away, if I remember correctly, and it's been difficult to find maintainers for the project so I gave up on that.
You can still install that extension but from the reported issues the functionality and bugs were increasing with every new firefox version. And obviously that setup only helped with the cookie aspects and not necessarily any security issues from javascript and so on.
Aren't we in an era when you literally can build your own browser with everything just you need?
I have no knowledge in browsers developement. But in my field it became often easier to make your own tool\app then trying to use third party and make it work for you
We're exactly in that era of insanity that someone will use agent drivel development to cobble together a browser from existing browser sources in exchange for thousands of dollars of compute. Will it be standards conformant? No. Will it have security issues? Yes.
I mean you might be able to if you squint hard enough but the experience of using it would be absolitely piss poor so no. Realistically speaking AI is not even nearly that good yet and buildong a browser is an absolutely huge undertaking
Knowing some folks that work on "major-browser-vendor" security in the era of Mythos-found-and-exploited vulnerabilities everywhere, the thought of running completely random untrusted Javascript on my machine has freaked me out to the point that I run NoScript on all of my machines now.
I've found NoScript actually very usable, as long as you allow yourself to be fairly liberal in marking domains "trusted." I only truly routinely visit a core 10-20 domains that require Javascript, and they're from "reputable" organizations (my bank, employer, etc.) so those all get marked "trusted" quickly and I don't worry about them going forward.
In the "long tail" of random things I click on from HN links, seeing a "You need to enable Javascript to view this app" message is actually a fairly good signal that I don't want to view that app (though you might be surprised how many websites are browsable comfortably---or even more comfortably!---without JS enabled).
One thing I wish NoScript supported was the ability to mark a domain as a "trusted page domain" in the sense of: "HTML served from this domain can load scripts from any domain" (rather than trust being assigned to the domain serving the script itself). Perhaps it has this feature and I just haven't found it.
https://noscript.net/
Qubes OS is looking less crazy lately too.
My practical approach is to have a microvm for firefox and a bubblewrap “jail” for a firefox instance that runs on the host. Of course, the config options mentioned here are good too.
This sounds interesting and useful. How do you set something like this up? Are there good tutorials to follow?
> Main browser: A restricted Firefox
Mullvad Browser[1] is an example of just that, ready to go for people in the real world who don't have the time or inclination to mess around with random extensions and `about:config` hacking.
Also surprised the blog author made zero mention of the importance of keeping your OS up to date. Its all very well having a patched and hardened browser but not if you're running it on a vulnerable OS.
[1] https://mullvad.net/en/browser
For a while, I used a firefox extension called "Temporary Containers" which would, as the name implies, create a temporary container for each site you visit. Combined with specifying some custom rules for ones you want to open in a specific container, that was a very convenient setup. But the extension at some point corrupted my firefox profile and has been unmaintained for a while so I didn't try again. I am not sure what happened and it may have been the combination of extensions that was the cause of that. Sadly, the author passed away, if I remember correctly, and it's been difficult to find maintainers for the project so I gave up on that.
You can still install that extension but from the reported issues the functionality and bugs were increasing with every new firefox version. And obviously that setup only helped with the cookie aspects and not necessarily any security issues from javascript and so on.
Aren't we in an era when you literally can build your own browser with everything just you need? I have no knowledge in browsers developement. But in my field it became often easier to make your own tool\app then trying to use third party and make it work for you
We're exactly in that era of insanity that someone will use agent drivel development to cobble together a browser from existing browser sources in exchange for thousands of dollars of compute. Will it be standards conformant? No. Will it have security issues? Yes.
There have been recent attempts. Apparently not.
I mean you might be able to if you squint hard enough but the experience of using it would be absolitely piss poor so no. Realistically speaking AI is not even nearly that good yet and buildong a browser is an absolutely huge undertaking