As to “when Javascript is not available”, GET REAL: when Firefox fetches a website page, I haven’t seen one during the past four or five years that displays any significant content unless and until I access NoScript to allow the website to use Javascript. On the other hand, I cannot recall ever “missing out” on anything by not allowing “Google Analytics”; have you?? Since I couldn’t care less whether “ads” fetched from other sites need Javascript to run, I don’t allow them.

With Firefox, at least I have a real _choice_ of whether to run NoScript, and I can disable all Javascript with a Firefox option instead. But disable Javascript on the Internet Explorer Advanced configuration tab, and see what happens when I.E. fetches a page from a site like Tech Republic (where the content is embedded within advertising). Microsoft gives you a “choice” that they quite emphatically do _not_ want you to choose!

If only for that reason, Javascript has become the preferred method for introducing malware by criminals who want to obtain data from a computer, whether to gain control of it as well. (Using Javascript on a web page is the means of intrusion; that is only the start.)

The challenge with blacklists is that someone, some time, in some way, must access a website and, presumably based on their experience, decide whether to recommend its addition to the blacklist. I don’t consider Web Of Trust to be a blacklist, as such, but if a website has poor ratings, then WOT displays a warning page before Firefox fetches the first page from the website. There are websites where I have not found any identifiable indiscriminate threat to the security of anyone’s computer. But I know that those websites are owned, operated and frequented by people whose activities often are not quite what most of us are likely to regard as ethical or as virtuous. So there is some risk. Some such websites are, in and of themselves, “safe” but the websites of other people with whom they associate are anything but safe, and there may be links to those.

That doesn’t mean that I won’t revisit them, just that I recognize whom I am dealing with, what to expect, and take extra precautions to protect my computer system. In such a context, WOT or a blacklist is usually irrelevant. Nonetheless, should I give the site “poor” ratings for WOT just so it will display its warning to others?? I would not want my pre-teen child to visit the site, or want a teenager to go there without me to show them how to conduct themselves and to beware of what can go wrong. (“If they bluntly tell you to go away, then go away, do not return!”)

With regard to outright criminal activity the challenge is twofold. One is that criminals can and do create malicious websites faster than we can discover and blacklist them. Most of their websites typically don’t have the same URL for very long. So, blacklists eventually contain the IP addresses and/or URLs for many websites that no longer exist, whether all of them were used by criminals.

The second is that criminals have increasingly been planting malware on legitimate website servers, so that the page which your browser receives is not necessarily exactly the one that the website designer and coders created.
Criminals also alter DNS servers to replace the IP address of a legitimate website with the IP address of their counterfeit of that website, one which is rigged, of course, with malware. And a website like that is unlikely to be on any blacklist, because, after it has harmed some people who realize what has happened, the DNS operator remedies the corruption of their server(s). The criminals then take down their website or register it with another URL.

A blacklist in such contexts as those is practically useless, whether it might give us an unjustified sense of security. Even running NoScript with Firefox might not be enough to defend its user after the user has allowed Javascript from a specific website to be executed. That is one reason that I also run Sandboxie. I recommend it to anyone who is serious about security, but it requires more knowledge about computers than most people have, as well as some time and effort, to install, configure and use Sandboxie properly. It is not for the typical weekend sysadmin. Enough said??

1. It may be the most oft-used means of attack, but it’s far from the only one. I’ve seen security flaws that could be exploited by malformed images, and one that could be exploited by really long URLs. So if you want to stay perfectly safe, what you really need are tools to help you never land on a malicious site in the first place.

2. An expert Web developer is trained to a. use JavaScript to make things more convenient wherever possible, and b. when JavaScript is not available, have Web pages degrade gracefully and reduce functionality instead of complaining that JavaScript is missing. So by indiscriminately blocking active content, you may be missing out on numerous conveniences and you’ll never know they were there. For example, Simple Machines Forum, a freeware app that powers many online forums, offers an inline post editor that lets you rewrite a submitted post without having to move to a separate page. Browse an SMF-powered site with JavaScript off and the button to use such editor never even shows up.

If you want to use the Web to its fullest, you should find tools that block only the bad guys to work perfectly fine. WOT’s fantastic and Firefox’s built-in attack sites filter saved my bacon once. If you’re concerned about your privacy, throw in ABP with the EasyPrivacy subscription.

If they can’t, then you have a long week ahead of you, beginning with about 8 to 12 hours or more (depending upon the size of the HDD) of running Darik’s Boot And Nuke (DBAN) to replace everything that the HDD contains with a series of random bytes. And you know what follows that, don’t you??

(No, not a call to a suicide prevention hotline, though you might feel like making one after a while.)

http://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users-dear-mozilla-community/

Thanks to Mozilla as well for including WOT on their recommended add-ons list.

Safe surfing,
Deborah
Web of Trust