Tor 0day: Stopping Tor Connections
> The bug is simple enough: using JavaScript, you can identify the scrollbar width.I thought it was accepted and strongly emphasized that running JavaScript in a Tor environment was insecure and could leak information in all sorts of ways, which is why Tor Browser came with NoScript enabled by default.Is that no longer the case? Is there now an expectation that you should be able to safely run JS in Tor Browser without risk?