4 ms·

A much overlooked alternative to installing sketchy addons is to simply disable Javascript by default.

by andor 11y ago

dtech 11y ago
This also breaks 95% of the web
- emn13 11y ago
  Just 95%?
- barrkel 11y ago
  Nowhere near 95% of the web; I can attest to this because I disable JS on my default phone browser, and it speeds up everything massively. Something may be broken on 95% of web pages (e.g. commenting or menus), but the main bit of the web - rendering hypertext and following links - mostly works. Web applications less so, of course. But I don't think they're 95% of the web.
- andor 11y ago
  You're spreading FUD. Disabling Javascript by default is one of the easiest ways to reduce browser attack surface, improve page load times and to remove the most annoying ads. The vast majority of pages work (to some degree) without scripts. If you really need scripting on a page, it's very uncomplicated to add an exception in Chrome: just click the "Javascript blocked" icon in the address bar, and choose "Always allow Javascript on example.com".
  - chimeracoder 11y ago
    > improve page load times and to remove the most annoying ads. The vast majority of pages work (to some degree) without scripts. In my experience using NoScript for the past year on all my desktops and laptops, this is at best only partly true. Load times do definitely decrease, but this is dwarfed by the effect of having to reload the page for most new sites after re-enabling Javascript (since so many sites are unusable without Javascript[0]). In the end, it's a much slower experience browsing the web, not faster, and even with aggressive whitelisting, it's still rather frustrating. I actually have separate Firefox profiles that I use for various websites that tend to be particularly problematic with extensions (like online banking), so I'm not even including those in this summary. I wish using NoScript provided a faster browsing experience overall while providing better security, but the simple fact remains that right now, it does not. It provides better security at the expense of slowing down your browsing experience. [0] So many static blogs now literally fail to display static text without Javascript!
    - nske 11y ago
      Sadly, that's true. I'm wondering how many feel that this is not a good direction where things are going -or if it's just me being "old". Why would someone want to use javascript on the client-side for things where it's not necessary? Year after year, the browser and the web are turning into "something else", and while the possibilities are exciting, it seems the use cases where javascript is used for things that actually make a positive difference, are vastly outnumbered by the cases where it is used to re-implement in a more flashy, complex and resource-intensive way things that have been usable, performant and functional, 10 years ago. IMO displaying content should be done just by HTML, using javascript if it's not to provide useful functionality, is wrong. Whether it is browser HTML/CSS incompatibilities, flash atrocities or complex script bloat, it seems the popular web always manages to fix one problem and create another.
  - asillystory 11y ago
    Or just use a NoScript-like extension that makes it easier to whitelist sites?
  - hcs 11y ago
    I used to run noscript but gave up some time ago. On your suggestion I tried just disabling JS in Chrome, and this does really seem to work pretty well. It's nice to have the blocking so well integrated into the browser.
- logfromblammo 11y ago
  It partially breaks 100% of sites that require the user to blindly execute scripts from unknown second or third parties before presenting a usable response, and 0% of sites that do not. At the risk of not finding a true Scotsman, I would argue that sites that do not give a meaningful response to an HTTP request as is, without client-side processing, are not making themselves part of the web. When I click a link and see a blank page, I often click the back button or close the tab rather than allow it to run scripts. You do not need a script to display text. That functionality has been present since Sir Tim wrote version 0.1 . Would it be so hard to provide alternate text for no-script browsers that says "Some content on this site is only viewable to users that allow scripts hosted by www.example.com and js.example.com to run on their browser clients."? No. It's not. There is no excuse for serving a blank page full of invisible scripts.
wnevets 11y ago
even Steve Gibson of www.grc.com fame has given up on disabling javascript.
the8472 11y ago
> sketchy what justifies the usage of "sketchy" for these particular addons? Many of them are open source, you can audit them yourself. Or you could hope that the reviewers did a decent job.

A much overlooked alternative to installing sketchy addons is to simply disable Javascript by default.

by andor 11y ago

A much overlooked alternative to installing sketchy addons is to simply disable Javascript by default.

dtech 11y ago

This also breaks 95% of the web

emn13 11y ago
Just 95%?
barrkel 11y ago
Nowhere near 95% of the web; I can attest to this because I disable JS on my default phone browser, and it speeds up everything massively. Something may be broken on 95% of web pages (e.g. commenting or menus), but the main bit of the web - rendering hypertext and following links - mostly works. Web applications less so, of course. But I don't think they're 95% of the web.
andor 11y ago
You're spreading FUD. Disabling Javascript by default is one of the easiest ways to reduce browser attack surface, improve page load times and to remove the most annoying ads. The vast majority of pages work (to some degree) without scripts. If you really need scripting on a page, it's very uncomplicated to add an exception in Chrome: just click the "Javascript blocked" icon in the address bar, and choose "Always allow Javascript on example.com".
- chimeracoder 11y ago
  > improve page load times and to remove the most annoying ads. The vast majority of pages work (to some degree) without scripts. In my experience using NoScript for the past year on all my desktops and laptops, this is at best only partly true. Load times do definitely decrease, but this is dwarfed by the effect of having to reload the page for most new sites after re-enabling Javascript (since so many sites are unusable without Javascript[0]). In the end, it's a much slower experience browsing the web, not faster, and even with aggressive whitelisting, it's still rather frustrating. I actually have separate Firefox profiles that I use for various websites that tend to be particularly problematic with extensions (like online banking), so I'm not even including those in this summary. I wish using NoScript provided a faster browsing experience overall while providing better security, but the simple fact remains that right now, it does not. It provides better security at the expense of slowing down your browsing experience. [0] So many static blogs now literally fail to display static text without Javascript!
  - nske 11y ago
    Sadly, that's true. I'm wondering how many feel that this is not a good direction where things are going -or if it's just me being "old". Why would someone want to use javascript on the client-side for things where it's not necessary? Year after year, the browser and the web are turning into "something else", and while the possibilities are exciting, it seems the use cases where javascript is used for things that actually make a positive difference, are vastly outnumbered by the cases where it is used to re-implement in a more flashy, complex and resource-intensive way things that have been usable, performant and functional, 10 years ago. IMO displaying content should be done just by HTML, using javascript if it's not to provide useful functionality, is wrong. Whether it is browser HTML/CSS incompatibilities, flash atrocities or complex script bloat, it seems the popular web always manages to fix one problem and create another.
- asillystory 11y ago
  Or just use a NoScript-like extension that makes it easier to whitelist sites?
- hcs 11y ago
  I used to run noscript but gave up some time ago. On your suggestion I tried just disabling JS in Chrome, and this does really seem to work pretty well. It's nice to have the blocking so well integrated into the browser.
logfromblammo 11y ago
It partially breaks 100% of sites that require the user to blindly execute scripts from unknown second or third parties before presenting a usable response, and 0% of sites that do not. At the risk of not finding a true Scotsman, I would argue that sites that do not give a meaningful response to an HTTP request as is, without client-side processing, are not making themselves part of the web. When I click a link and see a blank page, I often click the back button or close the tab rather than allow it to run scripts. You do not need a script to display text. That functionality has been present since Sir Tim wrote version 0.1 . Would it be so hard to provide alternate text for no-script browsers that says "Some content on this site is only viewable to users that allow scripts hosted by www.example.com and js.example.com to run on their browser clients."? No. It's not. There is no excuse for serving a blank page full of invisible scripts.

wnevets 11y ago

even Steve Gibson of www.grc.com fame has given up on disabling javascript.

the8472 11y ago

> sketchy what justifies the usage of "sketchy" for these particular addons? Many of them are open source, you can audit them yourself. Or you could hope that the reviewers did a decent job.