TOR Wants You To Stop Using Windows, Disable JavaScript 341
itwbennett writes "The TOR Project is advising that people stop using Windows after the discovery of a startling vulnerability in Firefox that undermined the main advantages of the privacy-centered network. The zero-day vulnerability allowed as-yet-unknown interlopers to use a malicious piece of JavaScript to collect crucial identifying information on computers visiting some websites using The Onion Router (TOR) network. 'Really, switching away from Windows is probably a good security move for many reasons,' according to a security advisory posted Monday by The TOR Project."
NSA owned netblocks (Score:5, Informative)
Re: (Score:2)
Looks like the NSA is up to their old dirty tricks: http://arstechnica.com/tech-policy/2013/08/researchers-say-tor-targeted-malware-phoned-home-to-nsa/ [arstechnica.com] ... And yes, I second the motion to stop using Windows -- its full of zero day bugs like this. Not a day goes by where you don't hear about a new zero day attack focused on Windows, and its been that way for decades.
Because no other operating systems or applications have zero day bugs....
Users can not secure themselves against invasive hacking by the US Government.
The best that can be done is probably a VM that's been stripped down to essentials and does nothing but TOR but even that isn't going to keep the NSA out if they want in.
Re:NSA owned netblocks (Score:5, Interesting)
Sure.
Now, if instead of engaging in this selfdefeating every-man-to-himself canned-goods-and-ammo mentality users would actually stand up for their rights actively, which means, engaging in politics - that could work.
Re: (Score:3)
"People using Linux and OS X were not affected, but that doesn't mean they couldn't be targeted in the future. This wasn't the first Firefox vulnerability, nor will it be the last."
So....no. It wasn't even a Windows exploit, actually. It was a firefox exploit that happened to only work on Windows but it's equally likely any future flaws will not be platform dependent. What you should do is stay on Windows and just update your damn Tor browser bundle when a new one is released.
Very poor advice (Score:4, Insightful)
Many of the people using Tor in restrictive countries won't have the luxury of switching away from Windows. Even if they don, they won't necessarily know how.
Secondly, it's poor advice. The vulnerability affects Firefox 17....and Firefox is up to 22 now I think. Wouldn't it make more sense for them to make sure the tor browser is hardened and recommend people to use that?
Finally, Using a more recent windows version is actually good for security. ASLR, DEP, a rudimentary MAC implementation, UAC...despite what people say, Windows is actually one of the better operating systems security wise these days. Not just because of the preventive technology that most other OS's don't have (OS X has a lacking and broken implementation, most linux distros are not as complete in their implementations..), but because Microsoft started taking security seriously and vulnerabilities are rare these days.
Whatever, bring on the irrational arguments and Microsoft hate. Is it really too much for a forum of tech nerds to be objective in their analysis?
Re:Very poor advice (Score:4, Interesting)
Many of the people using Tor in restrictive countries won't have the luxury of switching away from Windows. Even if they don, they won't necessarily know how.
Secondly, it's poor advice. The vulnerability affects Firefox 17....and Firefox is up to 22 now I think. Wouldn't it make more sense for them to make sure the tor browser is hardened and recommend people to use that?
Finally, Using a more recent windows version is actually good for security. ASLR, DEP, a rudimentary MAC implementation, UAC...despite what people say, Windows is actually one of the better operating systems security wise these days. Not just because of the preventive technology that most other OS's don't have (OS X has a lacking and broken implementation, most linux distros are not as complete in their implementations..), but because Microsoft started taking security seriously and vulnerabilities are rare these days.
Whatever, bring on the irrational arguments and Microsoft hate. Is it really too much for a forum of tech nerds to be objective in their analysis?
http://www.zdnet.com/blog/btl/microsoft-certificate-used-to-sign-flame-malware-issues-warning/78980 [zdnet.com]
It would be interesting to know how the 'state' that developed Flame acquired the MS certificate in question.
- compromised using tech that the NSA has that we don't know about?
- bought off the black market after being stolen by some other entity?
- or just given by MS to the 'state'..?
Re:Very poor advice (Score:4, Informative)
It's trivial to use Tor in a secure fashion. In fact, if you need the security provided by Tor, chances are you're better off doing it this way instead:
1) Download Tails [boum.org]
2) Burn to CD
3) Boot disk
4) Use Tor
How hard was that?
(Personally, I use IE5 and Windows 2000 for Tor. Nobody's going to try to exploit that... and yes, I'm kidding.)
Re: (Score:3)
http://news.cnet.com/8301-13578_3-57593339-38/nsa-docs-boast-now-we-can-wiretap-skype-video-calls/ [cnet.com]
to Android software and..."remotely activate the microphones in phones"..
http://online.wsj.com/article_email/SB10001424127887323997004578641993388259674-lMyQjAxMTAzMDAwMTEwNDEyWj.html [wsj.com]
The tame, low cost, US OS are they way in.
Tor exit nodes and colluding fun back in the day:
http://them [wordpress.com]
Re:Very poor advice (Score:4, Insightful)
"Many of the people using Tor in restrictive countries won't have the luxury of switching away from Windows. Even if they don't, they won't necessarily know how."
Anyone can create bootable media with a short time spent practicing.
If you are at war you need to learn how to fight, not expect the rules to change for you. If that's not convenient, tough shit.
What one man can learn, another can learn. Plenty of Syrians didn't know how to kill tanks and APCs before "current events" either.
Re: (Score:2)
Wut?
Many of the people using Tor in restrictive countries won't have the luxury of switching away from Windows
Which country are you specifically talking about? Is it illegal to run Linux somewhere? To the best of my knowledge the only people working on keeping people from installing Linux are the ones trying to push secureboot and UEFI. That's Microsoft and friends. The whole "war on general computing" thing seems either overblown or in it's infancy. Seriously, who don't have the luxury of switching away from Windows? Are you talking about wage-slaves or something? Who would use TOR at work?
Secondly, yeah, it'
I think that one solution..... (Score:2)
So much for TOR (Score:2)
Re: (Score:2)
Geolocation and electronic chatter seems to be the focus of the surveillance structure that was build up... ie you have to keep feeding the machines, phones or mail.
Tor needs to encourage more users/usage. (Score:4, Insightful)
Re: (Score:2)
Yep. In light of these windows nodes getting exploited, I decided last night that I'm going to set up a tor node VM, with limited bandwidth, just for the purposes of providing an additional hop.
Tor use is likely to increase significantly due to all the domestic spying everyone has become aware of here in the West. This is both an opportunity for Tor as well as a challenge: there will be more users, and more people who were iffy about running high bandwidth nodes will likely do so, but there will also be mor
Re: (Score:2)
I2P encourages bittorrent and has been growing for years. Its also designed to be less exploitable than Tor (its less centralized) and hidden I2P sites generally assume you have Javascript turned off.
I think the best solution ... (Score:3, Insightful)
The Child Porn Angle (Score:4, Insightful)
How long will it be before the FBI goes publicly on the attack?
Freedom Hosting was, from what I've been reading over the last couple of days, not only taken over by the FBI and used to inject this code but it also probably hosted half of all child porn *.onion sites extant.
Demonizing the pervs seems like a good way to distract people from the fact that a state entity is now actively running malware that attacks everybody. I'm surprised it hasn't started already.
Re: (Score:2)
"Terror" worked as an excuse for a while, but then with all the Manning etc. revelations, people realised that war on a military strategy was just a bit of clever spin.
Now we're onto the child porn angle, which easier as both the hawks and the pacifists can be seduced into a think-of-the-children argument. Never mind that driving the producers of child sex abuse images further underground is the worst possible thing - I say that such *evidence* of child sex abuse should be out in the open, so that humans ar
privacy advocates want you to... (Score:5, Insightful)
...stop using a system developed and partly sanctioned by the US military if you want actually want to preserve your privacy. Actually, lack of privacy is a social problem, alland technical solutions are based simply on not your doing anything important enough for someone to engage in an arms race with you (which you will lose).
If you want privacy, you need to have exclusive control of a great deal of the network and intermediate nodes, plus the exact content of the traffic. And then you need to make sure that merely the raw content isn't a giveaway. Otherwise stochastic methods will attack all of the above and identify who you are, before an exploit's even been planted on your home machine.
Or foster a society that refuses to allocate the resources to fuck you over. Remember, anyone can be taught skills - but values are much harder to instil.
More secure, equally silly recommendation (Score:2)
Why not just tell people to stop using the internet completely? Unplug their computers from the internet, then they'd be completely safe. And they might as well, too, if they disable javascript, given that basically everything uses it these days...
Ooh I Wouldn't do THAT (Score:5, Funny)
Stop using Windows. Disable Javascript. (Score:2)
Well, you could hardly argue with either suggestion, even before TOR was known to be compromised.
Don't use Firefox bundled by TOR (Score:2)
Re:Don't use Firefox bundled by TOR (Score:4, Informative)
This is a sure way to reveal your IP address to an attacker. The only proxy switcher ever deemed safe to use with Tor was TorButton... the rest allowed cache and history-based attacks. Even so, Tor project recommends the entire browser now be customized for Tor and not used for any in-the-clear web access.
not even remotely related (Score:2, Insightful)
TOR should be integrated with a browser (Score:3)
Yes, I know that you can get a web browser that is specifically set up to route everything through TOR. What I want is a simple setting in browsers to use TOR for all private browsing sessions.
Re: (Score:2)
A rough guide to setting it up is here [ehow.com].
So which is it, Firefox or Windows? (Score:4, Insightful)
The TOR Project is advising that people stop using Windows after the discovery of a startling vulnerability in Firefox
Stop using Firefox (this particular version, on Windows) surely?
Sounds like someone at TOR was hankering for an excuse to rail against Windows.
Firefox not part of PRISM (Score:3, Interesting)
Mozilla were not listed as NSA PRISM aiding and abetting companies. Microsoft was listed as an active participant, helping NSA bypass the search warrant requirements on their outlook products and providing technical assistance on Skype.
One company picked sides, and its not the side with the Constitution on it.
So yes, he's probably right.
NSA broke TOR on the excuse of kiddy diddlers but they broke TOR mainly to prevent leakers from the NSA from using it to leak. Why else would they use their own IP address c
collect enough data... (Score:2)
...and you have something on EVERYONE, in advance.
Then regularly select people at random, to keep the rest of the population in fear.
And specifically target any inconveniences.
The post-cryptography security world ... (Score:4, Interesting)
As Adi Shamir (the S in RSA) has been trying to point out [theregister.co.uk], cryptography is a method for transferring data between two trusted hosts. So the F-16 zooming above Washington can get some radar data from the airbase in Virginia and no one listening in can decrypt it. At the point where some luser picks up a USB drive [arstechnica.com] off the parking lot floor and plugs it into a computer inside the airbase, all the encryption in the world matters not one whit.
It's a massive change to the model we use to conceptualize the threat -- instead of Alice and Bob trying to communicate with each other and keep Charles from decrypting, we have Alice and Bob trying (a) to protect their machines from Charles compromising it and (b) trying to limit the data done if he does compromise it. This isn't your father's security any more.
What is also means is that we are going to need a lot fewer secrets that are really worth keeping or else spend much more time partitioning our virtual worlds. As BEAST/CRIME show, if you treat your Facebook login cookie as a secret, then you need to access it from a partitioned browser where a malicious page cannot make requests using it.
Re:Firefox (Score:5, Informative)
Security professionals generally missing the point (Score:5, Insightful)
Re: (Score:2)
Some of them are exactly that clueless. They tend to let perfect become the enemy of pretty good.
Re: (Score:2, Interesting)
Re:Security professionals generally missing the po (Score:5, Informative)
Re:Security professionals generally missing the po (Score:5, Interesting)
If encryption is a "please investigate me" red flag, then we need to find ways to hide the encryption (i.e. steganography).
Re:Security professionals generally missing the po (Score:5, Interesting)
Re:Security professionals generally missing the po (Score:5, Funny)
Yeah! I mean, they can't be watching ALL of us, right?
Re: (Score:3, Funny)
All my email employment applications are encoded in pictures of cats.
Re:Security professionals generally missing the po (Score:5, Insightful)
Doesn't really help. Steganography tools will be considered suspicious and there will be versions with backdoors out there. I don't think this can be fought with technology - the large government organizations will have the resources to get the data they want, either by hacks, or by rubber-hose decryption. A tiny percentage of really expert users may be able to find ways to communicate securely, but the vast majority of people will not have the skill to do so. Since the "experts" need to communicate with non-experts this really doesn't solve much of the problem anyway.
If we want the government to stop snooping we need to change the LAWS. If there aren't enough votes to change the law, then we just need to suck it up, same as for any other decision by the majority.
Re:Security professionals generally missing the po (Score:5, Insightful)
If we want the government to stop snooping we need to change the LAWS. If there aren't enough votes to change the law, then we just need to suck it up, same as for any other decision by the majority.
What good are laws if government ignores them?
Re:Security professionals generally missing the po (Score:5, Insightful)
In the US they are not quite "ignored". They are twisted and redefined. Still remember that the #1 goal of most politicians is to get re-elected, so they do in some ways respond to what voters want. I mostly blame a cowardly public that is willing to give up its rights and freedoms for a bit of extra safety.
Re: (Score:3)
The public is not "willing to give up its rights", it is smart enough to know it didn't have them to begin with.
Minor quibble: The public is too stupid to know that they aren't GIVEN rights, but that if they want them, they have to TAKE them. The Government isn't interested in letting you be free...you have to do that for yourself.
Re: (Score:3)
So which part of 'self-evident' makes you think that people need to be GIVEN their rights? The whole point to the Bill of Rights was to enumerate rights that human beings have, regardless of who they are or where they were born. Notice how it says that it's the Governments role to secure the people's rights (NOT to grant them).
Re: (Score:3)
What good are laws if government ignores them?
If the government ignores the laws, then we change the government!
Wait... I'm on a list now, aren't I?
Re:Security professionals generally missing the po (Score:5, Insightful)
Well I think part of the problem is that security experts are experts, and they don't understand that if they really want to encourage better security, they need to make it easy for non-experts. It's funny, because you'd think security experts would know this. One of the key things about security is that a great security measure that nobody uses and everyone circumvents is actually a terrible security measure.
Encryption implementations need to be so well designed and foolproof that they're enabled by default. Right now, we don't usually turn on full-drive encryption because it may cause unexpected problems and complications. We don't enable SSL on all of our web servers because it's an annoying and expensive process to get a cert from a CA. We don't enable encryption on email because it requires plugins and complicated setups. We don't use TOR because it's not quite brain-dead simple.
The experts will respond, "But it *is* brain-dead simple. Just download this plugin, drop into the command line and type [insert command here], compile this binary, change this configuration file in /etc. Oh wait, you're on Windows? Sorry, then you need to download these other files. Get GPG v1 because v2 is completely different and doesn't work with the plugins. Then when you get this error, hit 'ignore'..." And all that makes sense to the experts because they're experts, and they understand what's going on. People won't start using encryption en masse until it's so brain-dead simple that they don't even know they're using it.
Re:Security professionals generally missing the po (Score:5, Insightful)
Re: (Score:3)
Re:Security professionals generally missing the po (Score:5, Insightful)
It's funny, because you'd think security experts would know this.
Actually, they do know it. Often, making security, and encryption in particular, usable is a hard problem. There's also often not interest or support for it, in which case it doesn't get done. Hard problems take time and money to solve.
Right now, we don't usually turn on full-drive encryption because it may cause unexpected problems and complications.
That's pretty rare. A lot of people do use full-drive encryption: like people with iOS devices, newer versions of Mac OS X, and many versions of Ubuntu. It's because on those systems, it's been engineered to work well and it's very easy to turn on.
We don't enable encryption on email because it requires plugins and complicated setups.
This is more difficult because that's not the hard part of e-mail encryption. In fact, there are some fairly simple e-mail encryption systems and clients that have it built in. The hard part is that effective e-mail encryption basically boils down to running a public-key infrastructure. Almost any security problem that ends with "...then you just need to distribute public keys" has a hard time being widely adopted and scalable.
We don't enable SSL on all of our web servers because it's an annoying and expensive process to get a cert from a CA.
Nonsense. Buying a cert from a CA is simpler than setting up a web server, by a long shot. If you're not running your own web server (very reasonable these days), most half-decent hosting companies will do all the work of getting a cert and configuring your server for you. All it takes is money -- and it's so inexpensive that the only people that can't afford it are private individuals hosting websites that don't make money.
We don't use TOR because it's not quite brain-dead simple.
It's basically braindead simple now if you use the Tor Browser Bundle, which is what this exploit is targeting.
One of the major reasons the exploit works is that Security Is Hard, both for experts and non-experts.
Re: (Score:3)
Yes and no.
TrueCrypt is extremely simple to use and it holds your hand tightly through the entire process. It is really one of the best examples of good open software, where it makes an otherwise complex task very simple. There are no usability gaps typically seen in open source software and it's very well documented.
SSL works fine without a CA cert, but browsers have actually gotten a lot worse at making it a clear process to accept self-signed cert. They used to just allow it through and give you a di
Re: (Score:2, Informative)
They're being rather disingenuous too: https://lists.torproject.org/pipermail/tor-announce/2013-August/000089.html
Since the vulnerability isn't limited to Windows machines, it's just that they believe that only Windows machines were targeted.
WHO IS AFFECTED:
In principle, all users of all Tor Browser Bundles earlier than
the above versions are vulnerable. But in practice, it appears that
only Windows users with vulnerable Firefox versions were actually
exploitable by this attack.
(If you're not sure what version you have, click on "Help -> About
Torbrowser" and make sure it says Firefox 17.0.7. Here's a video: [7])
To be clear, while the Firefox vulnerability is cross-platform, the
attack code is Windows-specific. It appears that TBB users on Linux
and OS X, as well as users of LiveCD systems like Tails, were not
exploited by this attack.
IMPACT:
The vulnerability allows arbitrary code execution, so an attacker
could in principle take over the victim's computer. However, the
observed version of the attack appears to collect the hostname and MAC
address of the victim computer, send that to a remote webserver over
a non-Tor connection, and then crash or exit [8]. The attack appears
to have been injected into (or by) various Tor hidden services [9],
and it's reasonable to conclude that the attacker now has a list of
vulnerable Tor users who visited those hidden services.
We don't currently believe that the attack modifies anything on the
victim computer.
So what makes them so sure that only Windows machines were targeted? Sure only paranoid people would think that way, but lot of people using Tor are paranoid, and many using Tor SHOULD be that paranoid.
Re: (Score:3)
Mainly, it's the title and summary that's getting it wrong. The only thing they said was that switching off of Windows is a good idea for the security minded, which it is. They awknowledged that the zero-day affected firefox across the board and that the exploit only targetted Windows, but they never used that as the reasoning to switch OS's.
Re: (Score:2)
Are you kidding me? Why in hell would you even say something like this....
Linus wouldn't fill out the 17 forms required to get a check from the feds, much less submit the monthly progress reports or sign the forms, in triplicate, each month to receive the paper check to be deposited. Goddamn 7 digits, no understanding of the system at all...
Much less participate in a system he would find grossly inefficient and horribly flawed. The man respects greatness, not whatever this is.
You are an idiot. If this was a
Re:Security professionals generally missing the po (Score:5, Funny)
Looks like they've got you fooled. For a century, the feds have cultivated the appearance of being a highly inefficient organization that nobody wants to have anything to do with. The reality is that there are no forms or time-wasting meetings, all the people who work there are actually highly motivated and competent, they do things with 5% of budget and then just throw away the other 395% to maintain deception, and they have to hire entire buildings of decoy employees to keep anyone from figuring out how small their core team really is. That Torvalds turned his back on that, just proves that he was too dumb to see through the smokescreen and is therefore too dumb to work for them.
Re: (Score:2, Informative)
This is incorrect, the latest versions of firefox do not allow javascript to be turned off. It is a valid complaint
Re: (Score:2, Informative)
This is incorrect, the latest version of firefox do allow javascript to be turned off. It is an invalid complaint.
Don't give me bullshit about it not being in the "UI" either, since I have a bookmark with the address about:config?filter=javascript.enabled right there in my bookmarks toolbar.
Re:Firefox (Score:4, Informative)
Re: (Score:2, Informative)
And that's an important point a lot of people, and most of the news media, have gotten wrong about this story. Download any TorProject Browser and NoScript is included by default and specific browser settings changed. As is it's relatively safe to use but if users even temporarily disable those protection measures because they can't do something like download a file or participate in some commenting page because a script is being prevented from running than it's not a fault with Tor, it's a user issue. TorP
Re: (Score:2, Informative)
So why do I have Firefox 22 with an enable/disable Javascript option? I downloaded this from Mozilla so you are saying they built a special version just for me? How nice of them.. Or perhaps Firefox still allows the user to enable/disable Javascript at this time.
You'll be unpleasantly surprised when you download Firefox 23 and find out it's gone. Which was released today, btw.
Re: (Score:3)
Re: (Score:2)
v23 of Firefox removed that feature. It might be buried in about:config somewhere, but I have heard some comments to the contrary. Still on 22 here.
Re: (Score:3)
It doesn't have to be inconvenient, Opera allows me to turn off Javascript based on a whitelist or blacklist.
Proper Summary (Score:4, Informative)
FTA: 'The vulnerability was patched by Mozilla in later versions of Firefox, but some people may still be using the older versions of the TOR Browser Bundle.'
Geeez, this is all about running old TOR on old Windows... who knew something could possibly go wrong with that?
Re:Proper Summary (Score:5, Interesting)
Re: (Score:3)
Actually they can. Just that the content producers don't want them to be. But there comes a point where the graphic designer's desire to make bling bling websites intrudes on my privacy and security. If the content delivery chain can't get their shit together... well fuck 'em.
Re: (Score:2)
Hey, remember that article stating you won't be able to turn Javascript off in an upcoming version of Firefox? Hopefully this incident is enough to get them to pull
Re: (Score:3)
Re:Proper Summary (Score:4, Funny)
I threw fedora away and went with slackware.
As for the neckbeard, it's chest hair, you insensitive clod.
cheers,
Re: Firefox (Score:2)
Re: Firefox (Score:2)
Re: (Score:3, Informative)
Firefox is apparently opting to remove the option from their settings and for a good reason - no one wants to globally disable JS these days. A default off with allowed sites is workable though, but there are extensions like NoScript to add that functionality.
Re: (Score:3)
But maybe it shouldn't be.
There will always be some JS 0-day. Maybe I'd like to bank online without an attacker previously having executing arbitrary code on my machine? Is that an oddball requirement?
I'm sure JS makes it all the more appealing to punch the monkey, but unless my intent is to run an application delivered over the web, I shouldn't need JS at all. If I'm just reading content, or doing simple forms-based interaction like a forum, why would I need JS again?
Re: (Score:3)
Nobody wants a pure forms based internet experience. It's horribly inefficient and awkward.
Do you write JS for a living? Have you ever put thought and effort into making a nice forms-based site? Few interactions requires constant chatter between the UI and the server behind the scenes.
If I'm just reading, a nicely laid-out page is all I need. If I'm doing simple interaction, like posting to Slashdot, why do I need JS? As long the needed UI controls are simple (and, you know, they usually are if you're not being complicated for the sake of showing off), why drag JS into it?
So much of the web th
Re: (Score:3, Insightful)
Re: (Score:3)
Since they are advocating throwing away an entire OS due to a flaw in Firefox, I'll go one step further. Throw out your entire PC and you'll be 100% secure.
But but but they can go through your garbage!
Wrong, it can be easily done (Score:4, Interesting)
Re:Firefox (Score:4, Informative)
URL about:config then enter 'javascript.enabled' into the search bar. Double click that setting in the list below to toggle back and forth.
Re: (Score:3)
Re: (Score:2)
Re:Why not stop using firefox and Java (Score:4, Insightful)
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
More like, "using this brand of tires reveals a safety issue with that brand of car. As do a few hundred other products combined with that brand of car. Even safe products combined with that brand of car. So stop using that brand of car."
Re:Why not stop using firefox and Java (Score:4, Informative)
The TOR Project's reasoning comes from the characteristics of the malicious JavaScript that exploited the zero-day vulnerability. The script was written to target Windows computers running Firefox 17 ESR (Extended Support Release), a version of the browser customized to view websites using TOR.
People using Linux and OS X were not affected, but that doesn't mean they couldn't be targeted in the future. "This wasn't the first Firefox vulnerability, nor will it be the last," The TOR Project warned.
Car / Caramel = Java / Javascript (Score:4, Informative)
Netscape had an interpreted scripting language called LiveScript. It wasn't used a whole lot.
Later, Sun released a virtual machine and a compiled language to program it in called Java. Java got a lot of press.
Seeing all the press that Java was getting, Netscape renamed Livescript "Javascript", to ride the coat-tails of the
completely different system, called Java.
They were developed completely separately, by different companies, for different purposes, and based on different principles.
It's exactly as if the BETAMAX were renamed DroidVideo.
Re: (Score:2)
Even TAILS has JS on by default. never really understood why.
If a majority of sites require JavaScript (Score:2)
But why do you have JS on in the first place?
Because 51 percent of web applications that someone uses require JavaScript.
Re: (Score:2)
But why do you have JS on in the first place?
Because 51 percent of web applications that someone uses require JavaScript.
Only 51%? Isn't that estimate a bit low?
Re: (Score:3)
tails is good.
Re: (Score:2)
Huff and puff and blow your house down (Score:3)
This is like saying "That them thar wood house is no good. Better replace it all with brick."
That sounds exactly like something one pig might warn another about [wikipedia.org], especially living on the edge of wolf country.
Re: (Score:2)
"Now Gramma, I've told you this before... 'sudo apt-get update; sudo apt-get install " and then the name of your package.
You don't know the name of the package? If you can't be troubled to look that up, how can I possibly help you?"
Re: (Score:3)
Don't you go through the same thing every n years anyway, with Windows upgrades?
Re: (Score:2)
Or you could just add the TorVM package to QubesOS where all apps are transparently virtualized. [qubes-os.org]
Re: (Score:3)
I would like to add an additional step:
After you tweak the guest OS install to your liking and ensure that it is fully working, take a snapshot and then restore from that snapshot every time.
Had this exact setup using DamnSmallLinux and it worked great. Low memory usage, also.
Re: (Score:2)
Maybe they remember when it was a acronym. Learn some history, kid.