[code_research]

"remote-execution-by-default": web browsers execute code that was loaded from an untrusted source somewhere on the internet. Every (ok, most) browsers by default allow any website you visit to execute JavaScript code in your browser.

"same origin" is about the source of that code, only of minor relevance here as long as no working signed code distribution mechanism and infrastructure exists - why not, btw, after all these years?

For communications and general information transmission we do not need remote code execution.

Yes, browsers try to do that in a "safe way" - the "sandboxing" approach has been exercised for many years now, mostly without success. Maybe Qubes OS can be a successful approach to this problem, but we still have too many non-technical problems to solve, as reality shows, so enough time to do more research. Until then: css only should be the default.

CSS gives us a very good way to stop going on with that inacceptable defaults while we fix the first version of the internet.

[rtpg]

> the "sandboxing" approach has been exercised for many years now, mostly without success.

My impression is that Javascript has basically been the most successful sandbox ever deployed on a large scale. All vulnerabilities I've seen that escape the sandbox are due to things like Flash.

Does anybody know of any "JS-only" exploits that have happened?

[zeveb]

> Does anybody know of any "JS-only" exploits that have happened?

This was used to win a contest: https://securityevaluators.com/knowledge/papers/engineeringh...

Then there's this: http://arstechnica.com/security/2015/08/dram-bitflipping-exp...

And this looks to execute some shellcode (but maybe it doesn't work): http://stackoverflow.com/questions/381171/help-me-understand...

Regardless, the bottom line is clear: if you value security and privacy, you disable JavaScript.

[Jweb_Guru]

Tons of JS-only exploits have happened. Every year at PwnToOwn, JS-only exploits happen.