Author Topic: Firefox vulnerabilities.  (Read 11101 times)

Dave Yeo

  • Hero Member
  • *****
  • Posts: 4805
  • Karma: +99/-1
    • View Profile
Firefox vulnerabilities.
« on: August 08, 2015, 06:51:53 am »
OS/2 users can get pretty compliant about security as we have a minor platform that was relatively secure. as such many users do not update browsers and other potentially insecure software.
Here is an example of a security vulnerability that allows a malicious actor to download any file on our computers, https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/. While only targeted at Windows and Linux, there is no reason that it couldn't also target everything in general.
Luckily this particular vulnerability doesn't affect us due to not being up to date, our old browsers quite possibly have vulnerabilities.
I suggest not running JavaScript by default, perhaps using no-script. Not loading ads as often they come from somewhere else and have exploits attached as the ad companies don't seem to care much. Adblock Plus is one solution. And minimizing usage of Flash by going into the addons manager and setting Flash to always ask for permission to run. Especially important given our old version of Flash. Same could be done for Java.

Joop

  • Hero Member
  • *****
  • Posts: 633
  • Karma: +5/-0
    • View Profile
Re: Firefox vulnerabilities.
« Reply #1 on: August 08, 2015, 04:40:12 pm »
I didn't find a setting to switch off javascript in the available menu's. Also it will be almost impossible to surf without javascript. Lots of things are then ruled out and many things will be very difficult on own homepage. Setting the date as an example for copyright due to differences in law in various countries.
I do have another question. Is it possible to connect sripts into the favorites file (in Dutch "bladwijzers")?

ivan

  • Hero Member
  • *****
  • Posts: 1561
  • Karma: +18/-0
    • View Profile
Re: Firefox vulnerabilities.
« Reply #2 on: August 09, 2015, 12:50:07 am »
Quote
I didn't find a setting to switch off javascript

That is where  the NoScript addon or PrefBar comes to the fore.  NoScript allows you to select just what javascript is run and Prefbar gives switching off that and flash player.

Dave Yeo

  • Hero Member
  • *****
  • Posts: 4805
  • Karma: +99/-1
    • View Profile
Re: Firefox vulnerabilities.
« Reply #3 on: August 09, 2015, 05:57:04 am »
Quote
I didn't find a setting to switch off javascript

That is where  the NoScript addon or PrefBar comes to the fore.  NoScript allows you to select just what javascript is run and Prefbar gives switching off that and flash player.

I like NoScript as well but it is work as it is based on whitelists and blocks everything by default and some sites will just not work without allowing some scripts and if you have to interact with a site, some scripts are needed.
If visiting sketchy sites NoScript is an important add-on.
For most main stream sites the infection vector is often 3rd party ads. Block them and you've blocked the main vector as well as speeding up your site loading. Adblock Plus is the popular addon for ad blocking. There are also solutions such as privoxy www.privoxy.org and/or sending offending sites into a black hole with entries in your hosts file, eg http://winhelp2002.mvps.org/hosts.htm. Hosts file lives in %ETC% and can be replaced with 3rd party ones (back yours up and copy any entries into the new one).
Flash can also be set to "Click to Play" in the Addon Manager