51–60 of 146 posts
Node debug mode runs a websocket, but the address is something like ws://0.0.0.0:9229/1cda98c5-9ae8-4f9a-805a-f36d0a8cdbe8 - without the correct guid at the end, you can't open the websocket and communicate. You can only detect the port being open by timing.
I actually saw people leaving this enabled so much in shipping products, I wrote a little utility to test for it.
Earlier quoted context omitted.
NoScript isn't sufficient to protect you from this. Eg write a simple HTML file like ok If it takes different amounts of time for the page to stop loading and the text to appear depending on the port you checked, you're vulnerable to scans, even when Javascript is disabled.
If the page does not have JS running, how would it check the time elapsed? i'm not seeing the vulnerability with noscript here.
You could probably even automate this via , along the lines of (untested):
"In all seriousness, this attack vector is pretty slim. You’ve got to tempt unwitting users to visit your site, and to stay on it while they’re developing JS code." Wrap the exploit up in a blog post about Rust -- or an article about gut bacteria -- and submit it to Hackernews. Boom, a virtual feast of secrets.
I'm a pretty big Javascript advocate, but I do recommend advanced users run uMatrix and consider disabling at least 3rd-party JS by default. uMatrix is a fantastic tool and it really doesn't take long to get used to. And honestly, a relatively large portion of the web works with only 1st party Javascript, and a surprising chunk of the web still works just fine with no Javascript at all.
This is also why I advise advanced users to run Firefox. uMatrix isn't available for Safari, and it's looking extremely likely that it'll be at least underpowered in Chrome once Manifest v3 comes out. Or I guess run Brave or Vivaldi or whatever. Dang kids running around with their hipster browsers, I can't keep track of them all.
The point is, even though I'm extremely bullish on the web as a secure application platform, part of the reason I'm bullish is because the web makes it relatively easy to take simple security measures like disabling scripts by default. You should absolutely take advantage of that, you should absolutely be disabling at least some Javascript features when you browse.
You can even globally turn off fingerprinting vectors like WebGL[2]/Canvas[3] in Firefox, and just swap to a different profile whenever you want to visit the rare game/app that requires them. Although with more and more people trying to embed their own DOM models in Canvas, maybe that'll be harder in the future.
[0]: https://github.com/gorhill/uMatrix
[1]: https://github.com/gorhill/uMatrix/wiki/The-popup-panel#the-...
[2]: about:config -> `webgl.disabled` -> true
"In all seriousness, this attack vector is pretty slim. You’ve got to tempt unwitting users to visit your site, and to stay on it while they’re developing JS code." Wrap the exploit up in a blog post about Rust -- or an article about gut bacteria -- and submit it to Hackernews. Boom, a virtual feast of secrets.
Exactly. I've got a blog with dozens of technical documents about JS and other topics. That would be an ideal place to harvest this type of information, from developers actively looking for a solution to a particular problem.
Why the actual fuck will a browser allow traffic to localhost from anywhere else?
Localhost is just another site. If you want to make it secure, make it secure.
You realize that anybody on your coffeeshop wifi can also connect to your localhost server, don't you? Just because a server is running on your laptop doesn't mean it's not a server, running on the internet.
||localhost^$important,third-party
||127.*^$important,third-party
||10.*^$important,third-party
||192.168.*^$important,third-party
||172.16.*^$important,third-party
||172.17.*^$important,third-party
||172.18.*^$important,third-party
||172.19.*^$important,third-party
||172.20.*^$important,third-party
||172.21.*^$important,third-party
||172.22.*^$important,third-party
||172.23.*^$important,third-party
||172.24.*^$important,third-party
||172.25.*^$important,third-party
||172.26.*^$important,third-party
||172.27.*^$important,third-party
||172.28.*^$important,third-party
||172.29.*^$important,third-party
||172.30.*^$important,third-party
||172.31.*^$important,third-party