Re: New web site

On Fri, May 22, 2026 at 7:20 AM Stephen Farrell
<[email protected]> wrote:
>
> On 21/05/2026 19:38, Nicolas Giard wrote:
> > There is no rationale for blocking javascript on the rfc-editor.org website
> > (or ietf websites in general).
>
> That's an interesting attitude. I think I'll stick with making up my own
> mind though:-)
>
> > It's debatable whether disabling JavaScript on certain websites is the
> > right thing to do, but assuming all websites will fully work without it in
> > 2026 is an unrealistic and dated expectation.
> > The same will apply to other IETF websites over time as they get upgraded
> > to newer technologies.
> As a heads-up, I'll then complain, also over time:-) I don't think I'm
> entirely alone in preferring a smaller attack surface so it'd be nice if
> the tools team took that into account, as they used to.

Regarding attack surface, Microsoft found about half the browser bugs
were due to Javascript and Just-In-Time Compilation (JIT).[0]  It is
probably a good idea to disable JIT in your browser to reduce attack
surface.  From [0]:

   Performance and complexity often come at a cost, and often we bear
   this cost in the form of security bugs and subsequent patches.
   Looking at CVE (Common Vulnerabilities and Exposures) data after 2019
   shows that roughly 45% of CVEs issued for V8 were related to the JIT
   engine.

And regarding Javascript in general [0]:

   When working on browser exploits, our favorite target is always V8.
   JavaScript engine bugs are a mainstay for attackers for a variety of
   reasons; they provide powerful exploit primitives, there is a steady
   stream of bugs, and exploitation of these bugs often follows a
   straightforward template. JavaScript engine exploitation has not
   changed much over the years and generally follows the same pattern:

      * Fake an object
      * Get AddrOf Primitive
      * Achieve arbitrary write

   We can effectively copy/paste our bug into a template and have
   something working fairly quickly. Attackers even have frameworks like
   PwnJS which allow for this quick conversion.

[0] Super Duper Secure Mode,
<https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/>.

Jeff