Shamar @Shamar@qoto.org

@grainloom

... and it shows it even if #JavaScript try to hide it... 😉

@wasamasa @polychrome

Dear @aral don't forget that #simplicity is not necessarily #easy. 😉

If you have to pick one, keep it simple: easiness, without simplicity, is the #marketing term for #lock-in.

Deanonymizing #Tor Circuits

https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html

#Privacy #Security #TorBrowser

Sometimes I feel like #God is patiently and lovely trying to explain something very important to me... but I can't understand.

I feel dumb. 😞

I hope He will keep trying.

The Dark side of expertise.

Or why we can't see the solution to the issues we create.

https://lwn.net/Articles/809556/

@grainloom

Actually, when I was young, I did something like that by mistake: an error page had a frame (can't recall why) but under some conditions it erroneously loaded itself as the frame target.

I have no idea if it would still be an issue 20 years later.

If I remember correctly, #Firefox has a maximum depth of 9 iframe.

@Wolf480pl@niu.moe @tuxcrafting @izaya

@teleclimber

#JavaScript let any website you visit to tunnel into your network.

You can read more about this here:
https://rain-1.github.io/in-browser-localhostdiscovery

and here:
https://dev.to/shamar/the-meltdown-of-the-web-4p1m

The #Russian Government is still exploiting this technique, months (years?) after #Mozilla and #Chrome have been informed:

https://bugzilla.mozilla.org/show_bug.cgi?id=1487081#c16

(and it's just ONE of the possible exploits of this wide class of #security vulnerability)

But yes, without the design changes I described back then, #lua would not be better that #JS, if used in the same way.

That's why #WebAssembly is such a terrible idea.

Because I was able to understand what the Russian government was doing by reformatting and reading the code. Try to do the same with a binary optimized by #GCC.

@tuxcrafting @izaya

@xj9

... over #9p2000?

@Wolf480pl@niu.moe

Probably.
(never tried, actually)

But it cannot (by itself) let website owners tunnel into your networks as #JavaScript does.

At least, as far as I know.

____

NOTE: I agree that Turing completeness is wrong for a presentation language.

#XSLT is more general, though.

@tuxcrafting @izaya

@Wolf480pl@niu.moe

It is.

But at least #XSLT is still more properly sandboxed than #JS.

@tuxcrafting @izaya