hackerfactor

Joined 10 years ago

Karma

Submissions

Member since

Feb 29

Recent submissions

At FotoForensics (before I blocked TOR uploads): TOR was about 3% of traffic, but accounted for >50% of porn uploads and about 80% of child porn uploads.

Today, TOR is about 1% of overall traffic to the site. (I block uploads, but TOR users can still access and view the site.) However, it accounts for about 20% of network attacks.

Comment · 10 years ago

Be careful what you ask for...

Right now (and without ad blockers): Go to homedepot.com, search for toilets, and view one toilet product page. This marks your interest. facebook.com will show you ads for toilets for the next month.

Comment · 10 years ago

Actually, I intentionally left that out. I thought 4000 words was long enough. Surveillance would add in another 4000 words.

Comment · 10 years ago

Your proposed approach will stop direct risks to browsers, but does nothing for ads that link to web pages that are hostile. E.g., you click on an ad because you are interested in the product and get directed to a phishing site or a site offering counterfeit goods or a site that has malware and infects your browser.

It's not just the graphic used by the ad, it's also the ad's destination.

Comment · 10 years ago

"and again Flash is the scapegoat"

Truth hurts? Adobe Flash and Microsoft Silverlight are common exploit paths because they have new critical exploits every few days. Here's the CVE list for Flash -- notice how many critical exploits there are? It averages to about 1 every 3 days. https://www.cvedetails.com/vulnerability-list/vendor_id-53/p...

In contrast, JavaScript itself has been pretty stable for years. I think the last vulnerability related to JavaScript ES5 impacted old Firefox browsers. http://www.cvedetails.com/cve/CVE-2015-4516/ https://www.cvedetails.com/vulnerability-list/vendor_id-452/... (Two JavaScript exploits for Firefox in 2015, both low risk.)

And HTML5? Extremely stable. There may be specific plugins or specific browsers that are vulnerable, but the underlying HTML5 specifications are very safe and have been safe for years. https://www.cvedetails.com/google-search-results.php?q=html5...

If you know otherwise, then please cite the specific CVEs. Otherwise, you're just spreading false information. You wrote, "Browsers and HTML5/JS also have a hell lot of CVE that can be exploited". I say: Prove it. Cite your sources.

Edit: Adding links to Firefox exploit CVEs.