full-disclosure - Re: Unreal: a movement to block Firefox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <7752B42D-8EF4-4390-A621-F514E39DAC03@gmail.com>
Date: Tue, 11 Sep 2007 15:13:43 -0600
From: Tremaine Lea <tremaine@...il.com>
To: Juergen Fiedler <juergen@...dlerfamily.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Unreal: a movement to block Firefox

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11-Sep-07, at 1:12 PM, Juergen Fiedler wrote:

> On Tue, Sep 11, 2007 at 11:58:24AM -0400, mbs wrote:
> [...]
>> I don't know about anyone else, but I happen to pay for my internet
>> access. If I choose not to waste my bandwidth (and my time) with
>> unwanted content, I would suggest that is my right.
>
> This is not going to be a very popular opinion, but I submit that the
> only honest way to exercise this right is to stay away from sites that
> serve content that you don't want to see.
>

How will a user know what content, precisely, is on the site without  
visiting it?  You seem to be proposing that we should blindly trust  
the other side until proven otherwise rather than proactively  
protecting the system.

> By serving ads on a site, the owner implicitly demands viewing them as
> a form of payment for the content they provide. While I think that
> blocking all Firefox users from a site makes very litle sense, I can
> entirely disagree with the conclusion that blocking ads from ad
> supported sites is uncomfortably close to theft.
>
> Just my two cents...
>  -Juergen

These sites would be better off finding a way to ensure the  
advertising content has loaded before the site content is provided  
then.  As someone who administers perimeter security for a large  
enterprise, I could care less what these sites *think* they are  
entitled to push on users.  If their content (or advertising) matches  
our filters, it gets blocked.

Besides, taking action based on information provided by the client  
side has been considered a less than intelligent practice for some  
time ;)

Cheers,

- ---
Tremaine Lea
Network Security Consultant
Intrepid ACL
"Paranoia for hire"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iQEcBAEBAgAGBQJG5wUHAAoJEKGa22zRy9WCx+MH/iffBtxkEKo5GkzaHRt9ZpA9
2b7F5okrq9GRLSyp4Bsmj8uZa320XBvrDeJfgnN0EXyR87eP65lQSuSEkTVfkFjb
61ofo/tMcR8/HFMJMklRz3YZRHG7Nl6h08QOGAsYxXu4yOMH63Bl+OHryrmHMN58
HUyffxfNvrMwKWbIWlEYWOVs3yhMH7I5P5m2nsJYwuK4G8e8hsmXLGvh3FezQAnG
wpZSIRczRH7+PGO3h8ubyKLX8EJKP9O0zRMHDWLSEUhYXlhmW6Okl+SsRYAfGQez
pRRn7tEjqrPw1JcLSkqkcBq+IsIfViNWk0HQnpyl+poBxwLbodB/vfFm6EMlhmU=
=gYdp
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/