It has been a while since I last used ZeroNet, I wasn't sure if any progress had been made about using it without JS. Didn't want to give you a bad answer, glad @jeff could at least confirm what I wanted to say would've been right.
@0 As there is a probability that ZeroNet sites may require JS (as I believe it can also make clearnet requests) I would be limiting my accessibility to what ZeroNet has to offer.
And that's another thing. I2P, for example, keeps within itself. ZeroNet can make external requests which explains the Tor recommendation.
I simply cannot consider it as a good Internet alternative as it shares some of the biggest security concerns with it. Perhaps it's good for those whom want to experiment with the technology but not for those looking for something that addresses what's wrong with the current state of the Internet.
@0 eepsites (I2P sites) don't use JS. Using it would weaken the security of the network and there's no reliable way to harden the execution environment except from defence-in-depth measures which only try to workaround its unsafety.
It only takes a single web page to compromise the browser. As ZeroNet is made for 'dynamic content' it will never be suitable for security-conscious purposes as it allows pages to execute JS in the first place.
@0 ZeroNet runs a lot of code in the browser. That code is supposedly sandboxed. If the browser's sandbox is not adequate, and it manages to run code outside of it, any mitigations mean nothing.
We know JS is powerful in both good and bad ways. The only way to make it 'safe' is to sanitise JS entirely. @jeff@izaya@louisoft01@pantsu
@0 The frontend is a gateway to the backend. Heck, it doesn't even need to touch the backend. If what runs up front can escape the sandbox it's running in then you're pretty screwed.
The dev acknowledges ZeroNet should be run in a VM or other isolated environment. You shouldn't have to do that. @jeff@izaya@louisoft01@pantsu
@orekix It's called 'Smilodon' because of the forced smile my 'smart' toothbrush will make me do when I'm not going to sleep in my 'smart' bed because I'm too busy on my 'smart' phone shitposting to a federated network.