>>385492>"Not a web-dev guy, but does this essentially mean they have the ability for remote code execution on your machine, via a direct socket and not through the browser?">reply to this question:>"Yes, they have an RCE to your browser's sandbox. But surpisingly one can scan all localhost ports through this sandbox, for example..."Dumb retards.
I cannot stress this enough, visiting
any website using a browser that has javascript enabled
gives that website RCE into your browser's sandbox. The first quote is clearly asking if this gives access "on your machine, via a direct socket and not through the browser", and the answer "yes, in the browser" is nonsensical because it is literally "no". I don't know why that anon said "yes".
One can scan all ports through javascript, yes. You don't need this wasm websocket thingy to do that. Again, any website can do that at any time, unless you've turned off JS in your browser.
Now with that being said, the only purpose of this kind of mechanism is going to be obfuscation: i.e. making it harder to see what javascript it runs. The normal way to include scripts is as a file that's really easy to see in the browser console, so doing it this way makes you require to log all the websocket requests and reassemble the file yourself thus making it much harder to actually read it.
So in itself this is not malicious, but obfuscating the code this hard is definitely indicative of malicious stuff.
>>385531>>385544I don't know, maybe discord electron uses some non-HTTP ports for its networking?
Also, it doesn't prevent you from posting, from what I've heard it just gives your posts a "discordfag" tag visible to jannies.
>>385541I haven't looked into the site myself but just based on the OP it sounds like it probably executes by default, so no, you're not safe. Sounds like if you specifically block the script, then you won't be able to post, but without further info there's no reason to assume it wouldn't run automatically if you haven't blocked it.