4 ms·

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

0XAFFE 9y ago
You learn with the time and also sometimes when its not so obvious, what to activate and what not, I just close the tab and don't bother with the content.
dhimes 9y ago
It is tedious, but I do it. If I ever get lazy I always select "temporarily add..."
rjzzleep 9y ago
For the most part here are some patterns I've noticed: 1. when pages don't work at all, try looking for cloudflare links. They might have their JS and CSS hosted there 2. When you want to play videos or audio look for *cdn domains (aliexpress has alicdn for example). These ones I tend to add to my whitelist. 3. If you have something like google apis you can add it to the whitelist and add a sitespecific conditional in adblock or ublock.
freedomben 9y ago
It can be tedious; but so can waiting for somebody's poorly written javascript to lag your browser. I started blocking all JS by default for security, but I've actually found it to be a much better user experience as well. You deal with the annoyance of having to whitelist domains, and sure a lot of SPAs don't work at all until you enable JS for the client-side rendering, but many, many websites work far better because all the content I care about is server-side rendered and JS is used to load ads that disrupt the experience (this is especially true on mobile. For that I highly recommend the Brave browser). You'd be surprised how much better it can make parts of the web tho to have no JS :-)
disconnected 9y ago
Try uMatrix. The uMatrix UI makes managing this a lot easier.
- woogley 9y ago
  Yes, and it has a CSS-like flexibility. E.g. you can allow *.cloudfront.net _if_ the top-level site is one you trust
microcolonel 9y ago
I use the built-in script blocking in Chrome, it's fairly quick to whitelist any scripts i actually want to run. It's by domain though, so not really perfect. I also block ad servers at the DNS level, and run an an blocker. Until recently I didn't need the blocker, but ad networks have gotten better at serving from legitimate hosts, so I can't just block them anymore. There are lots of services I would be glad to outright pay for, or have some sort of flattr-type service attached to. I don't feel one iota guilty for blocking ads, given the risks and costs.
fwdpropaganda 9y ago
I always assumed that everyone on HN would be using uMatrix. Strangely it doesn't seem very popular. I don't run JS at all except for very few webpages (think gmail log in page, etc). EDIT: Now that I think about it, I haven't really stressed how good uMatrix is. It really has changed the way I use the internet.
- notzorbo3 9y ago
  > It really has changed the way I use the internet. I agree so much. I cannot recommend umatrix highly enough. It has put me completely back in control of what sites can and can't do. I block everything by default except for first-party CSS and images (e.g. *.ycombinator.com when I visit news.ycombinator). It's great, and not at all as bothersome as I thought. No more HTML5 pop-ups, deceptive ads, no more auto loading videos, no more sneaky audio, no more weird javascript that slows my browser to a crawl, no more tracking. Honestly people, give it a shot. It's amazing.
  - checkyoursudo 9y ago
    On my laptop, I block all images by default, while I don't on my desktop (like you, I load CSS and images there). I find myself more and more liking to use my laptop for browsing, which makes me think I could block images by default on my desktop as well and rarely ever notice it anymore.
arca_vorago 9y ago
Its a worthy of the time endeavor, trust me. White listing very carefully over time enhances the browser experience, but you are right there are sites that go excessive on the off-domain js callS, but I choose to just get content elsewhere. Its time people were pickier about this stuff and pushed back more to the companies.
Crontab 9y ago
Running NoScript is a real eye-opener, even if you don't stick with it, because the about of bullshit that is pulled down from visiting a common website is incredible.
- fghtr 9y ago
  Try RequestPolicy and you will see the other 80% of crap...
  - Crontab 9y ago
    I hadn't heard of that. Thanks.
notzorbo3 9y ago
I run umatrix, and I block everything. Cookies, CSS, images, scripts, media, XHR, etc. Everything, except for CSS and images from the thirst-party domain (e.g. *.ycombinator.com). Most sites actually work better with this. They're faster, there's less clutter, no ads, less risk. Some need a little convincing by unblocking some CSS or images. Umatrix makes this super easy. If a site requires javascript to run, I just skip that content. It's different for web apps like trello or github of course. Those get much more permissions. > How on earth do you navigate what to let through and what to block? umatrix gives a nice matrix (duh) that shows exactly what's trying to load. I dont often need to unblock things, but when I do, it's usually obvious right away. Takes maybe two clicks. Worth the effort IMHO
checkyoursudo 9y ago
On my Linux desktop, I run firefox with uMatrix and if a page isn't readable without javascript then I don't bother, except a very few handful of sites that are whitelisted. If it's content that I really feel like I need to see, then I run chromium with just an ad blocker. They are each run from separate chroot instances, though with firefox container tabs that won't be as necessary anymore maybe. On my macbook, I run Safari with no loading of JS or images at all, and firefox with uMatrix again. And again, if a page isn't readable without JS, then I don't read it, or I wait until I can use chromium on my desktop, assuming that I'm not going to allow the scripts in uMatrix, which I usually don't. On my phone, I run Safari with JS always disabled, which is actually perhaps surprisingly fine for the vast majority of mobile websites. And I run firefox for iOS with JS enabled if I really really need to look at something that doesn't work on non-JS Safari. You get used to it. Most JS on the web is junk anyway. I don't have any FOMO by avoiding JS almost entirely, but maybe that's just me (and people like me)?

0XAFFE 9y ago

You learn with the time and also sometimes when its not so obvious, what to activate and what not, I just close the tab and don't bother with the content.

dhimes 9y ago

It is tedious, but I do it. If I ever get lazy I always select "temporarily add..."

rjzzleep 9y ago

For the most part here are some patterns I've noticed: 1. when pages don't work at all, try looking for cloudflare links. They might have their JS and CSS hosted there 2. When you want to play videos or audio look for *cdn domains (aliexpress has alicdn for example). These ones I tend to add to my whitelist. 3. If you have something like google apis you can add it to the whitelist and add a sitespecific conditional in adblock or ublock.

freedomben 9y ago

It can be tedious; but so can waiting for somebody's poorly written javascript to lag your browser. I started blocking all JS by default for security, but I've actually found it to be a much better user experience as well. You deal with the annoyance of having to whitelist domains, and sure a lot of SPAs don't work at all until you enable JS for the client-side rendering, but many, many websites work far better because all the content I care about is server-side rendered and JS is used to load ads that disrupt the experience (this is especially true on mobile. For that I highly recommend the Brave browser). You'd be surprised how much better it can make parts of the web tho to have no JS :-)

disconnected 9y ago

Try uMatrix. The uMatrix UI makes managing this a lot easier.

woogley 9y ago
Yes, and it has a CSS-like flexibility. E.g. you can allow *.cloudfront.net _if_ the top-level site is one you trust

microcolonel 9y ago

I use the built-in script blocking in Chrome, it's fairly quick to whitelist any scripts i actually want to run. It's by domain though, so not really perfect. I also block ad servers at the DNS level, and run an an blocker. Until recently I didn't need the blocker, but ad networks have gotten better at serving from legitimate hosts, so I can't just block them anymore. There are lots of services I would be glad to outright pay for, or have some sort of flattr-type service attached to. I don't feel one iota guilty for blocking ads, given the risks and costs.

fwdpropaganda 9y ago

I always assumed that everyone on HN would be using uMatrix. Strangely it doesn't seem very popular. I don't run JS at all except for very few webpages (think gmail log in page, etc). EDIT: Now that I think about it, I haven't really stressed how good uMatrix is. It really has changed the way I use the internet.

notzorbo3 9y ago
> It really has changed the way I use the internet. I agree so much. I cannot recommend umatrix highly enough. It has put me completely back in control of what sites can and can't do. I block everything by default except for first-party CSS and images (e.g. *.ycombinator.com when I visit news.ycombinator). It's great, and not at all as bothersome as I thought. No more HTML5 pop-ups, deceptive ads, no more auto loading videos, no more sneaky audio, no more weird javascript that slows my browser to a crawl, no more tracking. Honestly people, give it a shot. It's amazing.
- checkyoursudo 9y ago
  On my laptop, I block all images by default, while I don't on my desktop (like you, I load CSS and images there). I find myself more and more liking to use my laptop for browsing, which makes me think I could block images by default on my desktop as well and rarely ever notice it anymore.

arca_vorago 9y ago

Its a worthy of the time endeavor, trust me. White listing very carefully over time enhances the browser experience, but you are right there are sites that go excessive on the off-domain js callS, but I choose to just get content elsewhere. Its time people were pickier about this stuff and pushed back more to the companies.

Crontab 9y ago

Running NoScript is a real eye-opener, even if you don't stick with it, because the about of bullshit that is pulled down from visiting a common website is incredible.

fghtr 9y ago
Try RequestPolicy and you will see the other 80% of crap...
- Crontab 9y ago
  I hadn't heard of that. Thanks.

notzorbo3 9y ago

I run umatrix, and I block everything. Cookies, CSS, images, scripts, media, XHR, etc. Everything, except for CSS and images from the thirst-party domain (e.g. *.ycombinator.com). Most sites actually work better with this. They're faster, there's less clutter, no ads, less risk. Some need a little convincing by unblocking some CSS or images. Umatrix makes this super easy. If a site requires javascript to run, I just skip that content. It's different for web apps like trello or github of course. Those get much more permissions. > How on earth do you navigate what to let through and what to block? umatrix gives a nice matrix (duh) that shows exactly what's trying to load. I dont often need to unblock things, but when I do, it's usually obvious right away. Takes maybe two clicks. Worth the effort IMHO

checkyoursudo 9y ago

On my Linux desktop, I run firefox with uMatrix and if a page isn't readable without javascript then I don't bother, except a very few handful of sites that are whitelisted. If it's content that I really feel like I need to see, then I run chromium with just an ad blocker. They are each run from separate chroot instances, though with firefox container tabs that won't be as necessary anymore maybe. On my macbook, I run Safari with no loading of JS or images at all, and firefox with uMatrix again. And again, if a page isn't readable without JS, then I don't read it, or I wait until I can use chromium on my desktop, assuming that I'm not going to allow the scripts in uMatrix, which I usually don't. On my phone, I run Safari with JS always disabled, which is actually perhaps surprisingly fine for the vast majority of mobile websites. And I run firefox for iOS with JS enabled if I really really need to look at something that doesn't work on non-JS Safari. You get used to it. Most JS on the web is junk anyway. I don't have any FOMO by avoiding JS almost entirely, but maybe that's just me (and people like me)?