3 ms·

In general, one should serve HTML on the web unless you're doing something that requires JavaScript. JS is a big security/privacy risk. At the moment, I keep JS

In general, one should serve HTML on the web unless you're doing something that requires JavaScript. JS is a big security/privacy risk. At the moment, I keep JS and CSS off by default on my main browsing profile, overriding it with umatrix when a site requires it and it looks useful enough to bother.

shrimpx 9y ago
That's bezerk. You should turn off the CPU in your computer, too, and just use the screen and keyboard. The CPU is where all the security breaches happen.
- JoshMnem 9y ago
  That's like saying that you shouldn't bother eating healthily because if you're really concerned about heart disease you should just have heart removal surgery.
allover 9y ago
In general, one should consider the audience of the content, not NoScript users, in this case. > JS is a big security/privacy risk. No, 3rd party JS (and 3rd party cookies, JS regardless) allow you to be tracked. And ad-blockers deal with that. Blocking 1st party JS is of tenuous benefit w.r.t security/privacy.
- Amezarak 9y ago
  > Blocking 1st party JS is of tenuous benefit w.r.t security/privacy. Blocking all JS lets me click on any link fearlessly.
  - arbie 9y ago
    What is your primary fear with JS enabled? Tracking/keylogging/cryptomining?
- JoshMnem 9y ago
  Sometimes "3rd party" JS is served from within the page. Also many sites are hacked and will cloak the JS depending on how you visit the site. It's especially common with hacked WordPress sites.
captn3m0 9y ago
off topic, but how do you turn off first-party JS in umatrix? I switched from NoScript recently, and haven't figured it out yet.
- JoshMnem 9y ago
  In the top left of the matrix, click on the `.com` part of the domain. I think that will change the scope to all sites rather than the current domain. Then block the JS column. It should then be blocked by default when you go to new sites.
- gorhill 8y ago
  Create a block (red) rule for `script` in global scope. I wrote is a guide for this, "How to block 1st party scripts everywhere by default" (link below) https://github.com/gorhill/uMatrix/wiki/How-to-block-1st-party-scripts-everywhere-by-default https://github.com/gorhill/uMatrix/wiki/How-to-block-1st-par...

shrimpx 9y ago

That's bezerk. You should turn off the CPU in your computer, too, and just use the screen and keyboard. The CPU is where all the security breaches happen.

JoshMnem 9y ago
That's like saying that you shouldn't bother eating healthily because if you're really concerned about heart disease you should just have heart removal surgery.

allover 9y ago

In general, one should consider the audience of the content, not NoScript users, in this case. > JS is a big security/privacy risk. No, 3rd party JS (and 3rd party cookies, JS regardless) allow you to be tracked. And ad-blockers deal with that. Blocking 1st party JS is of tenuous benefit w.r.t security/privacy.

Amezarak 9y ago
> Blocking 1st party JS is of tenuous benefit w.r.t security/privacy. Blocking all JS lets me click on any link fearlessly.
- arbie 9y ago
  What is your primary fear with JS enabled? Tracking/keylogging/cryptomining?
JoshMnem 9y ago
Sometimes "3rd party" JS is served from within the page. Also many sites are hacked and will cloak the JS depending on how you visit the site. It's especially common with hacked WordPress sites.

captn3m0 9y ago

off topic, but how do you turn off first-party JS in umatrix? I switched from NoScript recently, and haven't figured it out yet.

JoshMnem 9y ago
In the top left of the matrix, click on the `.com` part of the domain. I think that will change the scope to all sites rather than the current domain. Then block the JS column. It should then be blocked by default when you go to new sites.
gorhill 8y ago
Create a block (red) rule for `script` in global scope. I wrote is a guide for this, "How to block 1st party scripts everywhere by default" (link below) https://github.com/gorhill/uMatrix/wiki/How-to-block-1st-party-scripts-everywhere-by-default https://github.com/gorhill/uMatrix/wiki/How-to-block-1st-par...