16 ms·

I'm pretty sure there's no "intended way" to use the web. The developer of the website dictates this. If he wishes to use JS-only, that is his choice. He may lo

I'm pretty sure there's no "intended way" to use the web. The developer of the website dictates this. If he wishes to use JS-only, that is his choice. He may lose you as a user/reader, but he certainly is using the web "as intended". The choice to block JS seems a bit weird to me. JS, to my eyes, is very different to binary code running in userland. It is a sandboxed language with very clear restrictions to what it may do, it is easily read and verified (view source, pass it through a prettifier, and all that's left to fix is the variable names), and even hackable (we get a JS console in browsers). What is it that makes JS so dangerous it must be blocked 100% ?

dyladan 11y ago
Many browser exploits that break out of the sandbox take advantage of javascript. Disabling it prevents entire classes of exploits. Also, a lot of ad networks use javascript as a tracking tool.
- nqzero 11y ago
  citation for your exploits claim ? you've worded it in an awkward manner that makes it sound like a red herring specifically, are there javascript-only (or js+css+html only) exploits in recent chrome or firefox ?
- dyladan 11y ago
  After about 20 seconds of googling chrome: https://www.cvedetails.com/cve/CVE-2011-1186/ https://www.cvedetails.com/cve/CVE-2011-1186/ firefox: https://www.cvedetails.com/cve/CVE-2015-4509/ https://www.cvedetails.com/cve/CVE-2015-4509/
  - andrewstuart2 11y ago
    I don't think most people would consider 2011 recent.
PavlovsCat 11y ago
Going from a web of documents to black boxes that put pixels on the screen is regression plain and simple. Use it when necessary for the things that cannot be otherwise done, but don't ruin a good thing that works fine just because you can. Thanks.
s986s 11y ago
There is an intended way though. Html documents allow for parseable data. We are lucky google now runs javascript, but javascript pages are very similar to flash pages.

dyladan 11y ago

Many browser exploits that break out of the sandbox take advantage of javascript. Disabling it prevents entire classes of exploits. Also, a lot of ad networks use javascript as a tracking tool.

nqzero 11y ago
citation for your exploits claim ? you've worded it in an awkward manner that makes it sound like a red herring specifically, are there javascript-only (or js+css+html only) exploits in recent chrome or firefox ?
dyladan 11y ago
After about 20 seconds of googling chrome: https://www.cvedetails.com/cve/CVE-2011-1186/ https://www.cvedetails.com/cve/CVE-2011-1186/ firefox: https://www.cvedetails.com/cve/CVE-2015-4509/ https://www.cvedetails.com/cve/CVE-2015-4509/
- andrewstuart2 11y ago
  I don't think most people would consider 2011 recent.

PavlovsCat 11y ago

Going from a web of documents to black boxes that put pixels on the screen is regression plain and simple. Use it when necessary for the things that cannot be otherwise done, but don't ruin a good thing that works fine just because you can. Thanks.

s986s 11y ago

There is an intended way though. Html documents allow for parseable data. We are lucky google now runs javascript, but javascript pages are very similar to flash pages.