turning off Javascript

On Mon, 14 Sep 2015 06:38:08 +0200, Steve Hayes wrote:

And there's no reason even to have Java installed any more. I don't
mean in IE, I mean on your computer.

Unless you want to use LibreOffice.

LO runs just fine without Java. (At least, for the things I use it for.)

--
s|b

| And there's no reason even to have Java installed any more. I don't
| mean in IE, I mean on your computer.
|

That's not entirely true. I have a friend who
needs Java for one website: Some kind of
event calendar at Harvard University!

Anyone who has Java and decides to remove
it might do well to look first at why they installed
it in the first place. It could still be in use.

| echo DISABLE script and meta-refresh support in Internet Explorer ...
| reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\In ternet
Settings\Zones\3" /v 1400 /t reg_dword /d 3 /f

It's actually much more complicated than that. IE
settings are quite literally unusable. 1400 is active
scripting. But 1402 is scripting of Java applets and
1405 is scripting of AX controls marked as safe.
1209 is allow scriplets. 2000 is allow binary and script
behaviors.... Then there are more AX settings. .Net
settings... Running code in an iframe... Last I checked
there were over 60 security settings, and I haven't
even looked at anything later than IE8!

But that's the least of it....

Settings can exist in up to 8 locations. What you see
in Internet options is HKCU\Software.....Zones\3 --
assuming you're setting Internet Zone settings. So the
first issue is to make sure neither you nor malware has
added any sites to other zones, because those won't be
affected when you adjust Zones\3.

Now you've got it narrowed down to only 8 possible
settings for each value you want to change. (!)

There's HKCU and HKLM. There's \Software\Microsoft
and there's \Software\Policies\Microsoft. (In both HKCU
and HKLM.) There are the Lockdown zones and the non-
Lockdown zones. (Those shouldn't apply online, but
one never knows.) So that's a total of 8 possible values.
The Policy keys allow admins to override employees.

If Local Machine override is set (by admins or by
malware) then everything you do in HKCU is useless
fluff. You need to make sure these values or keys
don't exist:

HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVe rsion\Internet
Settings\Security_HKLM_only
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet
Settings\Security_HKLM_only

These two can be in 4 places - HKLM/HKCU Software
or Policies\Softwa
Windows\CurrentVersion\Internet Settings\Security_options_edit
Windows\CurrentVersion\Internet Settings\SecChangeSettings

When I set anything in IE I do it in 8 places just
to be thorough.

The problem is that IE was designed for use by
corporate employees, to be controlled by their
superiors. And it's also deeply tied into Windows.
*IE is simply not usable in any reasonable sense.*

Beyond the convoluted security settings mess there
are different settings for privacy and cookies. Then there
are BHOs, which can control IE. And Browser Extensions.
Any of those can completely control what you see and
do in IE. I once wrote an Explorer Bar for folder windows.
(The optional panels on the left side.) I still use it on
XP and Win7-32.
It gets total control over all Explorer *and* IE document
objects for as long as it's loaded. That's left over from
Active Desktop. Any other extension or BHO loaded gets
that same control.

I also wrote a mime filter, for use as a
security filter. It gets total control over the webpage
*before* IE even sees it. That allows me to do things
like remove SCRIPT tags. A mime filter can be installed
with a couple of simple Registry settings and you're likely
to be none the wiser.
My mime filter was created mainly as a security help for
a blind friend who had to use IE. It's a security filter for
personal use. But there's nothing stopping software companies
or malware from using it to track you, show ads, or whatever
else they like.

There are also ways to get hold of IE via Windows
programming. I've written a component for scripting
that can hand you the document object for any
running instance of IE, an HTA, or software with an
embedded IE browser window:

http://www.jsware.net/jsware/compfiles.php5#jsshl

It's not difficult. Any software on your system could
be doing that, fiddling with the pages you see or
recording what you do. No similar options exist for Firefox,
as far as I know, because FF is independent software.
IE is vulnerable by design. Microsoft has designed the
shell, since Active Desktop/Win98, such that standard
automation and API functionality can be used to control
any IE instance. They also designed it so that corporate
admins could create quick-and-easy scripting UIs for
business use. *IE is supposed to be full of holes.*

The list of problems goes on and on. IE is a spectacularly
useful and powerful tool on the Desktop. I use it a lot
to make utility software as HTAs. As you well know,
scripters use it a lot to provide hacks that extend the
powers of script. *I love IE!* But all of that power --
all of that deep tie-in to the Windows system -- is also
what makes IE absolutely unfit for online use, no matter
what one does with the settings.

| I did the other way around.
| I uninstalled Java and waited for a program to tell it needed Java.
| After over a year I am still waiting.

That will probably work for most people, but
anyone who has Java in the first place probably
had to install it for something specific. If they
can track down or remember what that something
was it could save them some trouble.

Mayayana wrote:
| I did the other way around.
| I uninstalled Java and waited for a program to tell it needed Java.
| After over a year I am still waiting.

That will probably work for most people, but
anyone who has Java in the first place probably
had to install it for something specific. If they
can track down or remember what that something
was it could save them some trouble.

Another example of why it is sometimes better to uninstall Java and wait
until 'reminded'...

Once upon a time, USAA required java to do check deposits (scanning) at
home, but now they don't.

Also, during the time that java was required, updating java was required
at least twice and it doesn't work if it isn't uptodate.

If a person were depositing a check that way every month, it would be
worth keeping. If the necessity to deposit a check that way were rare,
such as some kind of medical insurance reimbursement, then it would be
better to keep java disabled or installed and install it incidentally
since an old install wouldn't work anyway.

Having java installed on the system and active in the regular browser
for no good reason is a bad idea.


--
Mike Easter

On 9/14/2015 8:27 AM, Mike Easter wrote [in part]:

Also, during the time that java was required, updating java was required
at least twice and it doesn't work if it isn't uptodate.

I found that a good Java installation, installing only once, requires:

1. Uninstall the old version of Java.

2. Reboot.

3. Install new version of Java.

I know of at least two Web sites that I frequently visit that require
Java. One is a relatively mindless game, the play of whic is quite
relaxing. The other is a tool for choosing colors when designing Web
pages, which is powerful but very simple to use.

--
David E. Ross

Why do we tolerate political leaders who
spend more time belittling hungry children
than they do trying to fix the problem of
hunger? http://mazon.org/

David E. Ross wrote:
I know of at least two Web sites that I frequently visit that require
Java. One is a relatively mindless game, the play of whic is quite
relaxing. The other is a tool for choosing colors when designing Web
pages, which is powerful but very simple to use.

I'll try to not drift too far off-topic here...

I recently encountered a useful Java application in a security-related
linux distro, Encryption Wizard in the Lightweight Portable Security
distro. The reason it isn't quite OT here is because the USAF makes the
EW available as a Java app to many platforms including Windows besides
the linux distro.


http://www.spi.dod.mil/ewizard.htm Encryption Wizard (EW) is a simple,
strong, Java file and folder encryptor for protection of sensitive
information - Without requiring installation or elevated privileges, EW
runs on Windows, Mac, Linux, Solaris, and other computers with Standard
Edition Java. Behind its simple drag-and-drop interface, EW offers 128-
or 256-bit AES encryption, hashing, searchable metadata, archives,
compression, secure deleting, and PKI/CAC/PIV support. EW is GOTS -
Government invented, owned, and supported software.



--
Mike Easter

On 9/13/2015 1:49 PM, Mike Easter wrote:
Jo-Anne wrote:
Any suggestions for dealing with Javascript in IE?

Don't use it/IE. Mostly.

If you are interesting in having good control of your browser, it is
better to not use IE except for some very specific worthwhile site which
requires IE and then only use it for that site and not as your general
browser.

For example, if you need to use Java for something in IE, IE should be
the only browser capable of Java and not used for anything else.

If you are only using Ffx and Chrome generally, you can eliminate their
use of Java. If you stop all javascript, you are going to be
'inconvenienced', perhaps unnecessarily, but it can be done selectively.


Thank you, Mike. In Firefox I installed noscript, and it seems to be
working well so far. One website I use regularly had trouble, and I
enabled Javascript for that site. So far, even though I'm getting
notifications about scripting being disabled on other sites, it hasn't
seemed to cause any problems. As far as I know, I don't have Java on
this computer, and I remember getting rid of it on my XP computer.

I've read all the posts about IE and Javascript, and it looks like
there's nothing simple I can do. I wish FF was better about printing;
then I could avoid IE entirely.

--
Jo-Anne

On 9/13/2015 10:00 PM, VanguardLH wrote:
Jo-Anne wrote:

Any suggestions for dealing with Javascript in IE?

Internet Explorer has no add-on or toolbar button to quickly and easily
enable/disable Javascript. You can go into a security zone's setting to
disable scripting but Javascript will remained disabled until you again
wade through the config wizard to reenable scripting.

snip

So while it is a bit of effort to setup (well, all you have to do is
create a .bat file with the above and then create a shortcut pointing to
the .bat file), it's pretty easy to toggle off/on scripting and meta-
refresh. To make it even easier, and instead of putting the shortcut on
the desktop or in the Start menu, add the shortcut to a toolbar you add
to the taskbar. Then the shortcut is always available. Just remember
to use the shortcut when you want a neutered IE.

I have never found an extension for IE that lets you quickly and easily
toggle scripting in IE. I had to come up with registry edits for the
scripting option in IE but that affects every instance of IE currently
or later loaded. Not until you exit the instance of IE that the batch
file loaded to run reg.exe to reset the registry settings will IE then
again support scripting and meta-refresh. This is like using the main
light switch to turn off all the lights in a room so everyone trying to
read a book in that room are affected.


Thank you very much, Vanguard. I've saved your post and will create the
..bat file if I find I need to use IE again. I'm going to try my best to
avoid it, however.

--
Jo-Anne

On 9/14/2015 8:26 AM, Mayayana wrote:
snip

The list of problems goes on and on. IE is a spectacularly
useful and powerful tool on the Desktop. I use it a lot
to make utility software as HTAs. As you well know,
scripters use it a lot to provide hacks that extend the
powers of script. *I love IE!* But all of that power --
all of that deep tie-in to the Windows system -- is also
what makes IE absolutely unfit for online use, no matter
what one does with the settings.



Thank you, Mayayana. I'm going to try NOT to use IE at all.

--
Jo-Anne

On 9/13/2015 11:57 AM, Mayayana wrote:
I also vote for NoScript, though I haven't tried
others. NoScript can be set to block all script. Then
if a site doesn't work you can enable selectively.

snip

....Probably more than you want to know, but it
provides some sense of the pros and cons with script.
Most sites don't need it, but more sites are crippled
without it than ever before.


Thank you again, Mayayana. I've installed noscript in Firefox, and it
seems to be working well. So far, there's been only one website where I
needed to re-enable scripting. It's a site I use regularly (in
proofreading and formatting for Project Gutenberg), so I'm hoping it's OK.

--
Jo-Anne

On 9/13/2015 11:58 AM, David E. Ross wrote:
On 9/13/2015 9:14 AM, Jo-Anne wrote:
Given what I've been reading about Javascript, I suspect it's worthwhile
to keep it turned off most of the time. Is there a particular add-on in
Firefox that works well? I found JustDisableStuff but wondered if that's
the best approach. And what about in Internet Explorer? I mostly don't
use that browser; but when I can't print part of a webpage in Firefox
(which has very poor printing capability), I print from IE.


The problem with JavaScript is that some Web pages have really bad
scripts, not hostile but broken. The pages can consume all memory and
overload your processor, often causing the browser to freeze. I also
find that some Web site have JavaScript that is merely annoying.

I use the PrefBar extension in SeaMonkey. The same version of PrefBar
can also be used in Firefox.

Once PrefBar is installed with the option to enable its own tool bar,
you will find a checkbox to disable JavaScript. Check the box to
enable, and uncheck it to disable JavaScript. This checkbox applies
simultaneously to all instances -- windows and tabs -- of your browser.
You can also customize PrefBar to remove that checkbox and then replace
it with a checkbox that applies only to the current instance.


Thank you, David. If I install PrefBar, will I need to uninstall
NoScript? NoScript seems to have a lot of options for what to do with
scripts, so you can approve some without approving others.

--
Jo-Anne

On 9/13/2015 12:28 PM, Paul in Houston TX wrote:
Jo-Anne wrote:
Given what I've been reading about Javascript, I suspect it's
worthwhile to keep it turned
off most of the time. Is there a particular add-on in Firefox that
works well? I found
JustDisableStuff but wondered if that's the best approach. And what
about in Internet
Explorer? I mostly don't use that browser; but when I can't print part
of a webpage in
Firefox (which has very poor printing capability), I print from IE.

I set my FF's and SM's to let JS change browser images only.
All other JS stays off.


Thank you, Paul. How do you do that?

--
Jo-Anne

On 9/13/2015 8:20 PM, Stan Brown wrote:
On Sun, 13 Sep 2015 11:14:05 -0500, Jo-Anne wrote:
Given what I've been reading about Javascript, I suspect it's worthwhile
to keep it turned off most of the time. Is there a particular add-on in
Firefox that works well?

To turn it off, you don't need an add-in. Just type
about:config
in the URL window, find
javascript.enabled
and set it to false.

But to turn it on and off conveniently, when e.g. you visit your
bank's site (since banks, stupidly, all seem to require use of this
insecure technology), something like Prefbar is quite handy.


Thank you, Stan. I gather from what I've seen so far that NoScript
offers a number of options for what to turn off or on, although most
sites I've been to since installing it seem not to need to run
Javascript--or at least they're working without it.

--
Jo-Anne

Jo-Anne wrote:

If I install PrefBar, will I need to uninstall NoScript?

No.

PrefBar gives you a toolbar with a (customizable) set of checkboxes that
allows you to control/enable or disable certain things. JavaScript,
colors, images, weird fonts, and more. It's very useful and I've had it
installed for many years.

http://prefbar.tuxfamily.org/

--
-bts
-This space for rent, but the price is high