7 ms·

> Easy actually: because a well-defined restricted subset of HTML can be machine-audited and there is no way to abuse it This is why I personally use NoScript.

> Easy actually: because a well-defined restricted subset of HTML can be machine-audited and there is no way to abuse it This is why I personally use NoScript. People often ask me "how can you stand to use NoScript on the modern web? Isn't it a huge pain to whitelist scripts? Isn't everything broken?" Nope. Most of the web works perfectly fine without loading Javascript from 35 different domains (as my local news site does). You whitelist a few webapps and you're pretty much good to go. The difference is incredible. Your browser uses a fraction of the memory. Pages load faster than you can blink. The browser never catches up or lags. Pages scroll as you expect. Audio and video never autoplay and distract you. When I briefly used NoScript on mobile, it was a miraculous life-saver that made my battery live forever. In the past couple years, however, I have noticed a new phenomenon. Remarkably - madly, in my view - there are webpages, webpages that should be simple, webpages by all appearances that consist of nothing more than a photo (maybe more than one), a byline, and a few hundred words of text, that require Javascript to load. As in, you will get a a blank page or an error message if you don't have their scripts enabled. I don't understand it. I don't want to understand it. I just want it to stop. I understand that you need Javascript and so forth to run a webapp. I'm not even asking for your webapp to be less than 5MB. Hell, make it 50MB (I just won't ever use it on mobile.) Making applications can be a lot of work, maybe yours is super complicated and requires tons of libraries or some crazy media loading in the background and autoplaying videos and god knows what else. But please, please, don't require Javascript to simply load an article and don't make a simple article 5MB. Why on Earth would you do that? How many things have to go wrong for that to happen? Who is writing these frameworks and the pages that use them?

mschuster91 11y ago
> But please, please, don't require Javascript to simply load an article and don't make a simple article 5MB. Why on Earth would you do that? No Javascript => no tracking/ads => force users to enable JS and (sometimes) disable their adblocker. It's all about money, never about technology.
- toast0 11y ago
  You can track without JavaScript, but you can't just include a 3rd party service, you actually have to do the work. Same thing for ads, JavaScript isn't required (especially for text ads, although few networks will let you do server side ad requests)
  - cbsmith 11y ago
    No, you can still do a 3rd pay service without JavaScript. GA expressly supports it.
    - userbinator 11y ago
      Tracking can absolutely be done without JS, although the granularity of the data is bigger; these have been around ever since the very beginning of the Web: https://en.wikipedia.org/wiki/Web_beacon https://en.wikipedia.org/wiki/Web_beacon
- madeofpalk 11y ago
  Not necessarily - a lot of the time it's just laziness and incompetence.
vacri 11y ago
The problem with NoScript is that when you use a browser that doesn't have it installed, the internet seems so much noisier. :)
hyperdunc 11y ago
I've noticed quite a few simple article websites that have something like a class on the body that sets display: none - and then that class is removed only after all the JavaScript has loaded. It's very obnoxious.
- toni 11y ago
  There are also websites that show you a completely blank page if you have cookies disabled! That's amazingly terrible.
- gengkev 11y ago
  Probably to avoid the flash of unstyled content, but yeah, that could probably be handled better.
bootload 11y ago
"In the past couple years, however, I have noticed a new phenomenon. Remarkably - madly, in my view - there are webpages, webpages that should be simple, webpages by all appearances that consist of nothing more than a photo (maybe more than one), a byline, and a few hundred words of text, that require Javascript to load. As in, you will get a a blank page or an error message if you don't have their scripts enabled." I use noscript as default and I'm noticing the same thing. I post them to twitter. Here's a sample: - 'Here are the instructions how to enable #JavaScript in your #web #browser.' - 'For full functionality of this site it is necessary to enable #JavaScript.' - You must enable #javascript in order to use #Slack. You can do this in your #browser settings. - 'You appear to have #JavaScript disabled, or are running a non-JavaScript capable #web #browser.' - 'Please note: Many features of this site require #JavaScript.' - 'Tinkercad requires #HTML5/#WebGL to work properly. It looks like your #browser does not support WebGL.' - 'Warning: The NCBI web site requires #JavaScript to function. more...' - 'Whoops! Our site requires #JavaScript to operate. Please allow JavaScript in order to use our site.' - 'The #media could not be played.' - 'Notice: While #Javascript is not essential for this website, your interaction with the content will be limited.' - 'Powered by #Discourse, best viewed with #JavaScript enabled'
- PhasmaFelis 11y ago
  > I post them to twitter. Why?
  - bootload 11y ago
    "> I post them to twitter. ...Why?" As a reminder to myself how lame some sites are and what happens when it's assumed JS is in use.
- toomanybeersies 11y ago
  It shouldn't be surprising that Tinkercad and Slack require JS.
  - mistercow 11y ago
    Seriously, did they think Tinkercad was just going to be a pile of CSS transforms?
derefr 11y ago
It's sorta-kinda a good thing, implemented poorly. What's actually happening is that more things that used to serve HTML directly to the browser, are now just browser-oblivious HTTP REST-API servers. Which is good! API servers are great! The correct thing to do, after implementing one, though, is to then make a "browser gateway" server that makes requests to your API server on the one side, and then uses that to assemble HTML served to the browser on the other side. (This is the way that e.g. WordPress blogs now work.) What's happening instead is that the site authors are realizing that they can just get away with writing one static blob of Javascript to act as an in-browser API client for their API server, stuff that Javascript in an S3 bucket, put e.g. CloudFlare in front of it, and point the A record of their domain's apex at that CF-fronted-S3-bucket. Now requesting any page from their "website" actually downloads what's effectively a viewer app (that they don't have to think about the bandwidth costs of at all; they've pushed that entirely off to a third party), and then the viewer app starts up, looks at the URL path/query/fragment, uses it to make an API request to their server, and the response from that is then the rendered page. Kind of ridiculous, no? It does sort of make sense to me for sites like e.g. Twitter, where their bread-and-butter is running API servers and writing API clients that interact with those servers. The "web client" is just, then, another API client, written in Javascript and "zero-installed" into web browsers whenever they request a page from the site. But for, say, a newspaper site, or a blogging engine? Those sites should definitely care about serving HTML directly, even if only for Googlebot's sake.
- hlandau 11y ago
  I think you really don't get the point of the article. This kind of crazy overcomplexity seems like one of the many things the article author would lump into excessive complexity for the sake of complexity. Yes you can implement a REST API thingy and then an application server that templates it all, and maybe that logic is written in JavaScript and is the same code that executes on the browser so you basically have a sort of headless quasi-web-browser assembling pages to serve so you can reuse the same code on the client side to try and reimplement the browser's navigation logic with pushState etc. etc. in some dubious quest to outperform the browser's own navigation logic. I understand this sort of thing is actually done now. Or you can just serve HTML. And you miss the point of REST as well, I think. I'm increasingly convinced that nobody has the slightest clue what 'REST' actually means, but to the extent that I can determine what it means, it seems to essentially mean to design according to the original vision of at least HTTP. To use, e.g. content negotiation, HTTP methods, etc. as they were originally intended, rather than carving out some arbitrary path of what works arbitrarily choosing features of HTTP and bending them into some custom RPC system that you for some reason chose to implement over HTTP. A consequence of this is that the same endpoint should be as happy to respond to Accept: text/html as Accept: application/json, surely. (And obviously, not just with some bootstrap page for your JavaScript web page-viewing web application.) It means your URLs represent resources and don't change. It means resources have canonical URLs. (If an API has a version prefix like "/v1/", it isn't RESTful no matter what its authors claim.) I suppose you could proxy Accept: application/json requests without transformation to an API server, making the "browser gateway" server a conditional response transformation engine. In some ways that's kind of elegant, I think. But it also feels like overkill.
arcameron 11y ago
>I just want it to stop. You and I are kindred spirits. I feel it's getting worse. A large % of the links (mostly start-ups landing pages, not articles) I click on HN just present me with a completely blank white page. No <noscript>, nothing! If you're lucky, you see enough to realize that it's probably just a page that relies on JS. It's never a good first impression. It's getting progressively more annoying to whitelist the TLD as well as the myriads of CDNs that sites are using. Often it's a click gamble: a "Temporarily allow sketchy.domain.com", throwing in the towel and saying "Temporarily allow all this site". Site embeds a video? Good luck picking which domain to whitelist out of a list of 35 different domains ;) Temporarily allow one, reload, repeat a few times, close tab in anger and disappointment.
hlandau 11y ago
Indeed. I have used Adblock and Noscript for years. My browsing the web is not an invitation for websites to serve a webpage viewing webapp so that they can (poorly, buggily, in a more error-prone manner) reimplement a browser's navigation logic. (Ever had to reload a website which uses the pushState API because you clicked a link and for whatever reason the XMLHTTPRequest it made to fetch the page didn't work and it just hung and ignored all future link clicks? Dear chickenshit webdevs, if you think you can implement navigation better than an actual web browser, you're probably wrong.) The vast majority of the time when I come to an article which is a blank page without JavaScript, I don't enable JavaScript; I just make a mental note that the web developers are beyond incompetence and move on. I'm starting to respond to this trend with a more aggressive refusenik approach. For example, CSS is now so powerful that you can cause excessive CPU load with it alone. So I now have a shortcut configured to disable CSS for a site. This also makes many sites readable which otherwise wouldn't be, because they're doing something insane like blanking out content with CSS under the expectation that it'll be shown using JavaScript. And of course all of these recent 'ad-blocker-blockers' (http://youtu.be/Iw3G80bplTg http://youtu.be/Iw3G80bplTg) seem to rely on JavaScript. Sometimes the content is loaded via JavaScript and so this won't work. Amazingly, for some years now there is a Blogger template which does this, which demonstrates that this brain-damaged approach has spread even to Google. But the greatest irony is that you can work around these sites, quite often, using the Google cached copy. Googlebot has supported JavaScript for some time (actually sort of unfortunate, in the sense that it removes an incentive for webdevs to design sites sanely), and it appears that cached copies are now some sort of DOM dump. Which has the hilarious consequence that you can now use Google to fix broken Google web design. There are *.blogspot.com sites which are blank pages, but the cached version is readable. My own weblog is very spartan, being rather of the motherfuckingwebsite.com school of non-design. bettermotherfuckingwebsite.com was linked below, but I don't think I agree with it. Ultimately, in terms of the original vision of the hypertext web, I'm not sure web designers should be dictating the rendering of their websites at all; that is, I'm not sure web designers should exist. So basically, imagine surfing the web with CSS disabled, but for your own user styles, that format absolutely all content the way you like it. Your own personal typographic practices are unilaterally adopted. bettermotherfuckingwebsite.com might be right as regards to typographic excellence, but it's wrong about where those decisions should be made. Unfortunately it's undeniable that this is a lost battle. Browsers used to let you choose default background, foreground and link colours, as well as fonts, font sizes, etc. I think you can still choose default fonts. But the idea of the web browser as providing a user-controlled rendering of semantic, designless text is long abandoned. That ship died with XHTML2 - I think I'm about the only person who mourned its cancellation.
ocdtrekkie 11y ago
A lot of times, that's just more effort than I want to deal with. I have Privacy Badger on a PC or two, and have reported things broken... probably a dozen times because I forgot I was on a computer with it enabled. We shouldn't try to fix badly bloated websites. We should RIDICULE badly bloated websites, and take our business elsewhere.
dredmorbius 11y ago
If you've found NoScript handy, try uMatrix. It's not for the faint-of-heart, but if you know what CSS, cookies, JS, iframes, XHD, and Internet domains are, it'll make sense. What you get is a matrix -- capabilities across the top, domains (and sites) down the side. Green is enabled, red disabled. You can save values. Enable what's needed to get a site working, know just what it is you're nuking. Much goodness to that feel.
- wtallis 11y ago
  uMatrix is a nice blocking tool, but it doesn't replace everything that NoScript does.
  - dredmorbius 11y ago
    In my experience it replaces everything NoScript does (blocking scripts by site) and then some. Or am I mistaken? If so, could you clarify as to how?
unimpressive 11y ago
I wrote a blog post about this: http://softholmsyndrome.com/2015/08/28/your-blog-does-not-need-a-splashscreen.html http://softholmsyndrome.com/2015/08/28/your-blog-does-not-ne...

mschuster91 11y ago

> But please, please, don't require Javascript to simply load an article and don't make a simple article 5MB. Why on Earth would you do that? No Javascript => no tracking/ads => force users to enable JS and (sometimes) disable their adblocker. It's all about money, never about technology.

toast0 11y ago
You can track without JavaScript, but you can't just include a 3rd party service, you actually have to do the work. Same thing for ads, JavaScript isn't required (especially for text ads, although few networks will let you do server side ad requests)
- cbsmith 11y ago
  No, you can still do a 3rd pay service without JavaScript. GA expressly supports it.
  - userbinator 11y ago
    Tracking can absolutely be done without JS, although the granularity of the data is bigger; these have been around ever since the very beginning of the Web: https://en.wikipedia.org/wiki/Web_beacon https://en.wikipedia.org/wiki/Web_beacon
madeofpalk 11y ago
Not necessarily - a lot of the time it's just laziness and incompetence.

vacri 11y ago

The problem with NoScript is that when you use a browser that doesn't have it installed, the internet seems so much noisier. :)

hyperdunc 11y ago

I've noticed quite a few simple article websites that have something like a class on the body that sets display: none - and then that class is removed only after all the JavaScript has loaded. It's very obnoxious.

toni 11y ago
There are also websites that show you a completely blank page if you have cookies disabled! That's amazingly terrible.
gengkev 11y ago
Probably to avoid the flash of unstyled content, but yeah, that could probably be handled better.

bootload 11y ago

"In the past couple years, however, I have noticed a new phenomenon. Remarkably - madly, in my view - there are webpages, webpages that should be simple, webpages by all appearances that consist of nothing more than a photo (maybe more than one), a byline, and a few hundred words of text, that require Javascript to load. As in, you will get a a blank page or an error message if you don't have their scripts enabled." I use noscript as default and I'm noticing the same thing. I post them to twitter. Here's a sample: - 'Here are the instructions how to enable #JavaScript in your #web #browser.' - 'For full functionality of this site it is necessary to enable #JavaScript.' - You must enable #javascript in order to use #Slack. You can do this in your #browser settings. - 'You appear to have #JavaScript disabled, or are running a non-JavaScript capable #web #browser.' - 'Please note: Many features of this site require #JavaScript.' - 'Tinkercad requires #HTML5/#WebGL to work properly. It looks like your #browser does not support WebGL.' - 'Warning: The NCBI web site requires #JavaScript to function. more...' - 'Whoops! Our site requires #JavaScript to operate. Please allow JavaScript in order to use our site.' - 'The #media could not be played.' - 'Notice: While #Javascript is not essential for this website, your interaction with the content will be limited.' - 'Powered by #Discourse, best viewed with #JavaScript enabled'

PhasmaFelis 11y ago
> I post them to twitter. Why?
- bootload 11y ago
  "> I post them to twitter. ...Why?" As a reminder to myself how lame some sites are and what happens when it's assumed JS is in use.
toomanybeersies 11y ago
It shouldn't be surprising that Tinkercad and Slack require JS.
- mistercow 11y ago
  Seriously, did they think Tinkercad was just going to be a pile of CSS transforms?

derefr 11y ago

It's sorta-kinda a good thing, implemented poorly. What's actually happening is that more things that used to serve HTML directly to the browser, are now just browser-oblivious HTTP REST-API servers. Which is good! API servers are great! The correct thing to do, after implementing one, though, is to then make a "browser gateway" server that makes requests to your API server on the one side, and then uses that to assemble HTML served to the browser on the other side. (This is the way that e.g. WordPress blogs now work.) What's happening instead is that the site authors are realizing that they can just get away with writing one static blob of Javascript to act as an in-browser API client for their API server, stuff that Javascript in an S3 bucket, put e.g. CloudFlare in front of it, and point the A record of their domain's apex at that CF-fronted-S3-bucket. Now requesting any page from their "website" actually downloads what's effectively a viewer app (that they don't have to think about the bandwidth costs of at all; they've pushed that entirely off to a third party), and then the viewer app starts up, looks at the URL path/query/fragment, uses it to make an API request to their server, and the response from that is then the rendered page. Kind of ridiculous, no? It does sort of make sense to me for sites like e.g. Twitter, where their bread-and-butter is running API servers and writing API clients that interact with those servers. The "web client" is just, then, another API client, written in Javascript and "zero-installed" into web browsers whenever they request a page from the site. But for, say, a newspaper site, or a blogging engine? Those sites should definitely care about serving HTML directly, even if only for Googlebot's sake.

hlandau 11y ago
I think you really don't get the point of the article. This kind of crazy overcomplexity seems like one of the many things the article author would lump into excessive complexity for the sake of complexity. Yes you can implement a REST API thingy and then an application server that templates it all, and maybe that logic is written in JavaScript and is the same code that executes on the browser so you basically have a sort of headless quasi-web-browser assembling pages to serve so you can reuse the same code on the client side to try and reimplement the browser's navigation logic with pushState etc. etc. in some dubious quest to outperform the browser's own navigation logic. I understand this sort of thing is actually done now. Or you can just serve HTML. And you miss the point of REST as well, I think. I'm increasingly convinced that nobody has the slightest clue what 'REST' actually means, but to the extent that I can determine what it means, it seems to essentially mean to design according to the original vision of at least HTTP. To use, e.g. content negotiation, HTTP methods, etc. as they were originally intended, rather than carving out some arbitrary path of what works arbitrarily choosing features of HTTP and bending them into some custom RPC system that you for some reason chose to implement over HTTP. A consequence of this is that the same endpoint should be as happy to respond to Accept: text/html as Accept: application/json, surely. (And obviously, not just with some bootstrap page for your JavaScript web page-viewing web application.) It means your URLs represent resources and don't change. It means resources have canonical URLs. (If an API has a version prefix like "/v1/", it isn't RESTful no matter what its authors claim.) I suppose you could proxy Accept: application/json requests without transformation to an API server, making the "browser gateway" server a conditional response transformation engine. In some ways that's kind of elegant, I think. But it also feels like overkill.

arcameron 11y ago

>I just want it to stop. You and I are kindred spirits. I feel it's getting worse. A large % of the links (mostly start-ups landing pages, not articles) I click on HN just present me with a completely blank white page. No <noscript>, nothing! If you're lucky, you see enough to realize that it's probably just a page that relies on JS. It's never a good first impression. It's getting progressively more annoying to whitelist the TLD as well as the myriads of CDNs that sites are using. Often it's a click gamble: a "Temporarily allow sketchy.domain.com", throwing in the towel and saying "Temporarily allow all this site". Site embeds a video? Good luck picking which domain to whitelist out of a list of 35 different domains ;) Temporarily allow one, reload, repeat a few times, close tab in anger and disappointment.

hlandau 11y ago

Indeed. I have used Adblock and Noscript for years. My browsing the web is not an invitation for websites to serve a webpage viewing webapp so that they can (poorly, buggily, in a more error-prone manner) reimplement a browser's navigation logic. (Ever had to reload a website which uses the pushState API because you clicked a link and for whatever reason the XMLHTTPRequest it made to fetch the page didn't work and it just hung and ignored all future link clicks? Dear chickenshit webdevs, if you think you can implement navigation better than an actual web browser, you're probably wrong.) The vast majority of the time when I come to an article which is a blank page without JavaScript, I don't enable JavaScript; I just make a mental note that the web developers are beyond incompetence and move on. I'm starting to respond to this trend with a more aggressive refusenik approach. For example, CSS is now so powerful that you can cause excessive CPU load with it alone. So I now have a shortcut configured to disable CSS for a site. This also makes many sites readable which otherwise wouldn't be, because they're doing something insane like blanking out content with CSS under the expectation that it'll be shown using JavaScript. And of course all of these recent 'ad-blocker-blockers' (http://youtu.be/Iw3G80bplTg http://youtu.be/Iw3G80bplTg) seem to rely on JavaScript. Sometimes the content is loaded via JavaScript and so this won't work. Amazingly, for some years now there is a Blogger template which does this, which demonstrates that this brain-damaged approach has spread even to Google. But the greatest irony is that you can work around these sites, quite often, using the Google cached copy. Googlebot has supported JavaScript for some time (actually sort of unfortunate, in the sense that it removes an incentive for webdevs to design sites sanely), and it appears that cached copies are now some sort of DOM dump. Which has the hilarious consequence that you can now use Google to fix broken Google web design. There are *.blogspot.com sites which are blank pages, but the cached version is readable. My own weblog is very spartan, being rather of the motherfuckingwebsite.com school of non-design. bettermotherfuckingwebsite.com was linked below, but I don't think I agree with it. Ultimately, in terms of the original vision of the hypertext web, I'm not sure web designers should be dictating the rendering of their websites at all; that is, I'm not sure web designers should exist. So basically, imagine surfing the web with CSS disabled, but for your own user styles, that format absolutely all content the way you like it. Your own personal typographic practices are unilaterally adopted. bettermotherfuckingwebsite.com might be right as regards to typographic excellence, but it's wrong about where those decisions should be made. Unfortunately it's undeniable that this is a lost battle. Browsers used to let you choose default background, foreground and link colours, as well as fonts, font sizes, etc. I think you can still choose default fonts. But the idea of the web browser as providing a user-controlled rendering of semantic, designless text is long abandoned. That ship died with XHTML2 - I think I'm about the only person who mourned its cancellation.

ocdtrekkie 11y ago

A lot of times, that's just more effort than I want to deal with. I have Privacy Badger on a PC or two, and have reported things broken... probably a dozen times because I forgot I was on a computer with it enabled. We shouldn't try to fix badly bloated websites. We should RIDICULE badly bloated websites, and take our business elsewhere.

dredmorbius 11y ago

If you've found NoScript handy, try uMatrix. It's not for the faint-of-heart, but if you know what CSS, cookies, JS, iframes, XHD, and Internet domains are, it'll make sense. What you get is a matrix -- capabilities across the top, domains (and sites) down the side. Green is enabled, red disabled. You can save values. Enable what's needed to get a site working, know just what it is you're nuking. Much goodness to that feel.

wtallis 11y ago
uMatrix is a nice blocking tool, but it doesn't replace everything that NoScript does.
- dredmorbius 11y ago
  In my experience it replaces everything NoScript does (blocking scripts by site) and then some. Or am I mistaken? If so, could you clarify as to how?

unimpressive 11y ago

I wrote a blog post about this: http://softholmsyndrome.com/2015/08/28/your-blog-does-not-need-a-splashscreen.html http://softholmsyndrome.com/2015/08/28/your-blog-does-not-ne...