Judging exclusively from what I've read so far the situation is actually far
worse than mate quantum describes. First of all, it appears that I would say
99% of tracking techniques rely heavily on javascript, and by heavily I mean
they will not work if js is disabled. If EFF's study on fingerprinting is
correct we can safely conclude that javascript can give away so much
information about your hardware as to, often, uniquely identify it.
This is privacy though, security is another thing. Well, it appears that
again javascript is a quite large attack vector.
After all escaping the same origin policy or the sandbox is no science
fiction and it has been done many times in the past. Fortunately your browser
gets patched often against known vulnerabilities. Cross site vulnerabilities
and forgeries can also be used. Noscript is an awesome addon for this. Buffer
overflows combined with malicious scripts can pwn ur browsy. It doesn't
happen often but it does happen.
Basically here it seems to me, and I might be wrong, you are trusting a
sandbox with malicious software that can do a lot of harm to your browser and
in some cases even more.
Besides, browsing the interwebs with js disabled is an awesome experience.
And I mean it. I have been doing so for years (only few websites allowed),
you would be surprised how much shit gets cut out and how clean and
functional a website is (well, when it works :P), no crap, no ads, no
slowdown, less fingerprinting. Why not?
Noscript is currently the only addon I have installed :)
