cherry blossom
Senior Airman
- 504
- Apr 23, 2007
I assumed from sometime last week that the site had problems because I always received an error message on attempting to visit (shown below).
Yesterday, I realised that the Google cache had updated after I started to have problems and decided to check if there was a browser incompatibility. I found that I had to allow JavaScript and then go to the main page. Note that simply allowing JavaScript does not cause the error message to go away.
I personally think that requiring JavaScript is a bad idea. JavaScript was not required before last week, so it clearly does not give much advantage. Not giving a message about JavaScript if it is not enabled is a worse idea as it will cause careful surfers to conclude that the site is broken.
The point about blocking JavaScript is that a malicious website can run effectively arbitrary code in a browser that allows JavaScript. This caused part of the Meltdown panic within the last month when it was revealed that it was possible to use features of Intel chips to read out passwords and certificates from the kernel. Most browsers have now been patched to prevent the method found by Google and at the University of Graz from working by lowering the timer resolution Lowering JavaScript Timer Resolution Thwarts Meltdown and Spectre. However, any new zero day is also likely to be delivered via JavaScript.
I have allowed JavaScript for this site (obviously as I am posting) and I hope that I am fairly safe here running Firefox 58 in a Firejail sandbox Firejail with just ublock Origin to block adverts. However, Noscript does make me feel safer.
Yesterday, I realised that the Google cache had updated after I started to have problems and decided to check if there was a browser incompatibility. I found that I had to allow JavaScript and then go to the main page. Note that simply allowing JavaScript does not cause the error message to go away.
I personally think that requiring JavaScript is a bad idea. JavaScript was not required before last week, so it clearly does not give much advantage. Not giving a message about JavaScript if it is not enabled is a worse idea as it will cause careful surfers to conclude that the site is broken.
The point about blocking JavaScript is that a malicious website can run effectively arbitrary code in a browser that allows JavaScript. This caused part of the Meltdown panic within the last month when it was revealed that it was possible to use features of Intel chips to read out passwords and certificates from the kernel. Most browsers have now been patched to prevent the method found by Google and at the University of Graz from working by lowering the timer resolution Lowering JavaScript Timer Resolution Thwarts Meltdown and Spectre. However, any new zero day is also likely to be delivered via JavaScript.
I have allowed JavaScript for this site (obviously as I am posting) and I hope that I am fairly safe here running Firefox 58 in a Firejail sandbox Firejail with just ublock Origin to block adverts. However, Noscript does make me feel safer.
