10 ms·

I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only

I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?

tree_of_item 8y ago
You're misunderstanding: you browse with JS disabled by default. Random sites shouldn't be running programs on your computer. If you trust the site, you whitelist it.
- diminoten 8y ago
  You're acting like "running programs on your computer" is a bad thing. It's not.
  - vageli 8y ago
    Running untrusted code on your machine _is_ a bad thing though.
    - diminoten 8y ago
      Yeah, because permissions, sandboxing, and access controls don't exist. Oh wait, they do, and they work, so you're wrong.
      - cesarb 8y ago
        Even setting aside things like rowhammer and spectre, something like half of the browser vulnerabilities need Javascript to be exploited.
      - hueving 8y ago
        No, they don't always work. We have bullet proof vests but it's still not safe to put one on and have someone start shooting you.
        diminoten 8y ago
        Do you wear a bulletproof vest every time you go outside? No? Interesting.
        Dylan16807 8y ago
        >Do you wear a bulletproof vest every time you go outside? No? Interesting. You realize the bulletproof vest is the sandbox, right? You've just made an argument against enabling all javascript.
        diminoten 8y ago
        No, it's not. The lack of availability of guns is the sandbox, the cultural more of not killing people is the access controls. "Bulletproof vest" in this analogy is "extraordinary activity designed to keep you safe". You don't "wear a bulletproof vest" (a stand-in for "take extraordinary measures") to prevent yourself from "getting shot" (a stand-in for "thing that happens very rarely"). In other words, your assessment of the risk of JavaScript running in a browser is higher than it actually is.
        hueving 8y ago
        I'm not sure you understand how many entities are trying to get into your computer to track you/steal data/mine bitcoin/etc. These are active attacks against your computer every day if you are a regular user clicking viral shit on Facebook, random ads for things, etc. Look at how many 3rd party JS libraries get loaded from remote sites for metrics, frameworks, tracking, ads, etc for something like a newspaper site. There are probably 15 servers involved, most of which run by companies with limited security expertise (if any) so frequently they end up compromised to inject garbage into visitors' browsers. There is absolutely no lack of availability of guns or people attempting to use them on you in this analogy. The bullet proof vests are good, but that doesn't mean there isn't someone attempting to shoot you in the chest every time you go out. Look at spectre/meltdown. Arbitrary code execution is not safe. Not in a browser sandbox, not in a kernel namespace, not in a hypervisor. You're protected from common thugs most of the time, but your bullet proof vest will fail if someone with a powerful gun takes aim. There is a reason the CIA doesn't use the same AWS servers as the public and it's the same reason you can't view Facebook from inside a secure military network. Sandboxes are just a protection mechanism from well-understood attacks, they don't provide anything near the level of real isolation that Internet companies would love you to believe.
      - shakna 8y ago
        > and they work ... They break about as often as they work. [0][1] There are a lot of vulnerabilities that appear in web browser protections, and almost all of them get exploited via JavaScript. Running untrusted software is not safe. [0] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox
        diminoten 8y ago
        This is factually incorrect. It is entirely safe to run JavaScript in your browser. Your definition of "a lot" doesn't fit this conversation, because it doesn't represent constant and regular vulnerabilities. Browsers are very safe. Not perfectly safe, but very safe. Thinking otherwise is paranoia, just like not running JavaScript by default in your browser is paranoid.
    - quickthrower2 8y ago
      Putting security to one side, disabling JS is an easy way to performance optimise their pages on their behalf.
  - jazzyjackson 8y ago
    Well I don't want to run EVERYone's program on my computer, I want to run MY programs on my computer. Most websites are made of text, I usually want the text, not whatever program they're running.
smadge 8y ago
I have JavaScript disabled by default (incidentally I also disable cookies). I do this for page load speeds, security from malicious JavaScript, disabling of most advertisements, and privacy from ad tracking networks. Best practices is to serve static content and then progressively enhance that content with browser features like JavaScript. Unfortunately many sites disregard this. I routinely encounter things like an entirely blank page, missing images, broken forms (of course if I am logging on to a site I will re-enable cookies). If I think the site is trustworthy enough and I really am interested in the content I will whitelist that site. Otherwise I just hit back.
gvb 8y ago
I browse with JavaScript disabled (NoScript) with a few sites that I care about whitelisted. Most web sites work fine although their layout is sometimes not what the web designer intended. Some sites don't work at all... for those sites I generally hit the "back" button. When I enable JS to view "JS required" sites, I usually hit the "back" button before it finishes loading anyway so why bother. NoScript makes a big difference with my laptop and a HUGE difference with my phone.
- PhantomGremlin 8y ago
  I browse same as you: Firefox & NoScript, very few sites on by default. My experience matches yours with one other thing you didn't mention: When I get a blank page, I do: View Page Style No Style usually fixes things quite well. E.g. seattletimes.com is blank by default but turning off Page Style gives me both text and images. Just not formatted very well, but I'm willing to accept that tradeoff.
deleted 8y ago
[deleted]
Tade0 8y ago
I do sometimes. Mostly to read articles on sites with a poorly implemented paywall that simply doesn't work with JS disabled and shows the whole content. As a bonus often half of the ads are not served as well.
yetanotherjosh 8y ago
It's a pretty extreme practice, and only something a tiny fraction of very technical users will do. I think in general the people who turn off JS do it in a way that they allow it on sites they really have to use that really don't work without it. Asking this question on HN will have an extreme selection bias, sort of like asking "who really thinks aliens are vising Earth and abducting people?" in the Roswell UFO museum staff meeting.
greycol 8y ago
I'm not sure if it quite qualifies as browsing with JS disabled but I run UMatrix with the default settings set to disable all scripts on a site. Then I've set some common domains I trust that greatly improve usability (things like ytimg, paypal, some common 3rd party scripts). I'd say I browse the web normally. Plenty of sites load normally with scripts disabled (and may even be more pleasant to browse). Maybe a 25 to 40% of sites I hit I'll happily enable 1st party scripts and a couple of known CDNs that'll will be enough to have the site working. For I'd say 5% or less of sites I'll have to actually engage and think if the calls to a 3rd party api are required or if the cloudflare/amazon are actually part of the domain and there for a good purpose or may be being used to serve up nefarious code. One of the things to consider about the above numbers is that they only really apply for the first time I visit a site. With exceptions for when a site changes how it's implemented (or a3rd party script calls a new domain) which is nice to know anyway. (Or when the tool I'm using to block scripts changes (3-4 times over the last 15 years + another couple for not transferring whitelist data to new machines)). I wouldn't really recommend my approach as something to get into for 2 main reasons. Firstly because the web does work much nicer when you just turn scripts on and say 'to hell with the privacy and security concerns'. Secondly there is a fair bit of otherwise useless knowledge built up over the years of doing this that mean this set up is significantly less onerous than it would be for someone who only just starts doing it and needs to look up every 3rd party domain. Having said that I would highly recommend that you should install some script management with the default more permissible settings (rather than my more draconian ones) as it breaks very little, takes little effort to fix most of the things it does break and will stop well known tracking and malicious sites.
- TeMPOraL 8y ago
  > Firstly because the web does work much nicer when you just turn scripts on and say 'to hell with the privacy and security concerns'. OTOH, web works faster with uMatrix. You can probably get an extra couple years of your computer if you're aggressive about disabling ads and superfluous JS.
flukus 8y ago
Most websites work fine, you have to be truly incompetent to make a text+image heavy website that doesn't work without JS. Web apps are a different story. The ones that do break tend to be the ones invading your privacy.
superkuh 8y ago
I used to think the same thing about people who browse with auto-loading plugins. Then browsers caught on and started click-to-play'ing them. Javascript is the new plugins (so much host OS functionality exposed now) and it requires a new click-to-play. I'd like to think they'll eventually integrate something like NoScript into the browser as a standard. This free for all code running is too much now that the browser is an OS. But it's difficult to get browser companies to understand something when their income depends on not understanding it.
DevoidSimo 8y ago
I browse with 3rd party frames and JS disabled. Not as extreme as all JS so it doesn't break most things. Occasionally I need to whitelist a CDN or related domain for that site to get things working.
Dylan16807 8y ago
> Wouldn't 99.9999% of the web basically break? What leads you to a number like that? I can tell you that you're wrong, but I'm much more interested in how you got there. Youtube needs javascript, and images or sometimes body text on badly-designed blogs need javascript. Most sites are fine. HN is fine, for the most obvious example.
ndnxhs 8y ago
I have umateix installed and set to block 3rd party scripts. Almost all websites work fine or even better like this but sometimes I have to enable a CDN to get the website to work.
jgaa 8y ago
I do. Most sites I use works fine without js. The few sites I need, that require js, are accessed from isolated, virtual machines dedicated to just that site. The sites I don't absolutely need, that require js, don't really exist in my world. That was a choice they made.

I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?

tree_of_item 8y ago

You're misunderstanding: you browse with JS disabled by default. Random sites shouldn't be running programs on your computer. If you trust the site, you whitelist it.

diminoten 8y ago
You're acting like "running programs on your computer" is a bad thing. It's not.
- vageli 8y ago
  Running untrusted code on your machine _is_ a bad thing though.
  - diminoten 8y ago
    Yeah, because permissions, sandboxing, and access controls don't exist. Oh wait, they do, and they work, so you're wrong.
    - cesarb 8y ago
      Even setting aside things like rowhammer and spectre, something like half of the browser vulnerabilities need Javascript to be exploited.
    - hueving 8y ago
      No, they don't always work. We have bullet proof vests but it's still not safe to put one on and have someone start shooting you.
      - diminoten 8y ago
        Do you wear a bulletproof vest every time you go outside? No? Interesting.
        Dylan16807 8y ago
        >Do you wear a bulletproof vest every time you go outside? No? Interesting. You realize the bulletproof vest is the sandbox, right? You've just made an argument against enabling all javascript.
        diminoten 8y ago
        No, it's not. The lack of availability of guns is the sandbox, the cultural more of not killing people is the access controls. "Bulletproof vest" in this analogy is "extraordinary activity designed to keep you safe". You don't "wear a bulletproof vest" (a stand-in for "take extraordinary measures") to prevent yourself from "getting shot" (a stand-in for "thing that happens very rarely"). In other words, your assessment of the risk of JavaScript running in a browser is higher than it actually is.
        hueving 8y ago
        I'm not sure you understand how many entities are trying to get into your computer to track you/steal data/mine bitcoin/etc. These are active attacks against your computer every day if you are a regular user clicking viral shit on Facebook, random ads for things, etc. Look at how many 3rd party JS libraries get loaded from remote sites for metrics, frameworks, tracking, ads, etc for something like a newspaper site. There are probably 15 servers involved, most of which run by companies with limited security expertise (if any) so frequently they end up compromised to inject garbage into visitors' browsers. There is absolutely no lack of availability of guns or people attempting to use them on you in this analogy. The bullet proof vests are good, but that doesn't mean there isn't someone attempting to shoot you in the chest every time you go out. Look at spectre/meltdown. Arbitrary code execution is not safe. Not in a browser sandbox, not in a kernel namespace, not in a hypervisor. You're protected from common thugs most of the time, but your bullet proof vest will fail if someone with a powerful gun takes aim. There is a reason the CIA doesn't use the same AWS servers as the public and it's the same reason you can't view Facebook from inside a secure military network. Sandboxes are just a protection mechanism from well-understood attacks, they don't provide anything near the level of real isolation that Internet companies would love you to believe.
    - shakna 8y ago
      > and they work ... They break about as often as they work. [0][1] There are a lot of vulnerabilities that appear in web browser protections, and almost all of them get exploited via JavaScript. Running untrusted software is not safe. [0] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox
      - diminoten 8y ago
        This is factually incorrect. It is entirely safe to run JavaScript in your browser. Your definition of "a lot" doesn't fit this conversation, because it doesn't represent constant and regular vulnerabilities. Browsers are very safe. Not perfectly safe, but very safe. Thinking otherwise is paranoia, just like not running JavaScript by default in your browser is paranoid.
  - quickthrower2 8y ago
    Putting security to one side, disabling JS is an easy way to performance optimise their pages on their behalf.
- jazzyjackson 8y ago
  Well I don't want to run EVERYone's program on my computer, I want to run MY programs on my computer. Most websites are made of text, I usually want the text, not whatever program they're running.

smadge 8y ago

I have JavaScript disabled by default (incidentally I also disable cookies). I do this for page load speeds, security from malicious JavaScript, disabling of most advertisements, and privacy from ad tracking networks. Best practices is to serve static content and then progressively enhance that content with browser features like JavaScript. Unfortunately many sites disregard this. I routinely encounter things like an entirely blank page, missing images, broken forms (of course if I am logging on to a site I will re-enable cookies). If I think the site is trustworthy enough and I really am interested in the content I will whitelist that site. Otherwise I just hit back.

gvb 8y ago

I browse with JavaScript disabled (NoScript) with a few sites that I care about whitelisted. Most web sites work fine although their layout is sometimes not what the web designer intended. Some sites don't work at all... for those sites I generally hit the "back" button. When I enable JS to view "JS required" sites, I usually hit the "back" button before it finishes loading anyway so why bother. NoScript makes a big difference with my laptop and a HUGE difference with my phone.

PhantomGremlin 8y ago
I browse same as you: Firefox & NoScript, very few sites on by default. My experience matches yours with one other thing you didn't mention: When I get a blank page, I do: View Page Style No Style usually fixes things quite well. E.g. seattletimes.com is blank by default but turning off Page Style gives me both text and images. Just not formatted very well, but I'm willing to accept that tradeoff.

deleted 8y ago

[deleted]

Tade0 8y ago

I do sometimes. Mostly to read articles on sites with a poorly implemented paywall that simply doesn't work with JS disabled and shows the whole content. As a bonus often half of the ads are not served as well.

yetanotherjosh 8y ago

It's a pretty extreme practice, and only something a tiny fraction of very technical users will do. I think in general the people who turn off JS do it in a way that they allow it on sites they really have to use that really don't work without it. Asking this question on HN will have an extreme selection bias, sort of like asking "who really thinks aliens are vising Earth and abducting people?" in the Roswell UFO museum staff meeting.

greycol 8y ago

I'm not sure if it quite qualifies as browsing with JS disabled but I run UMatrix with the default settings set to disable all scripts on a site. Then I've set some common domains I trust that greatly improve usability (things like ytimg, paypal, some common 3rd party scripts). I'd say I browse the web normally. Plenty of sites load normally with scripts disabled (and may even be more pleasant to browse). Maybe a 25 to 40% of sites I hit I'll happily enable 1st party scripts and a couple of known CDNs that'll will be enough to have the site working. For I'd say 5% or less of sites I'll have to actually engage and think if the calls to a 3rd party api are required or if the cloudflare/amazon are actually part of the domain and there for a good purpose or may be being used to serve up nefarious code. One of the things to consider about the above numbers is that they only really apply for the first time I visit a site. With exceptions for when a site changes how it's implemented (or a3rd party script calls a new domain) which is nice to know anyway. (Or when the tool I'm using to block scripts changes (3-4 times over the last 15 years + another couple for not transferring whitelist data to new machines)). I wouldn't really recommend my approach as something to get into for 2 main reasons. Firstly because the web does work much nicer when you just turn scripts on and say 'to hell with the privacy and security concerns'. Secondly there is a fair bit of otherwise useless knowledge built up over the years of doing this that mean this set up is significantly less onerous than it would be for someone who only just starts doing it and needs to look up every 3rd party domain. Having said that I would highly recommend that you should install some script management with the default more permissible settings (rather than my more draconian ones) as it breaks very little, takes little effort to fix most of the things it does break and will stop well known tracking and malicious sites.

TeMPOraL 8y ago
> Firstly because the web does work much nicer when you just turn scripts on and say 'to hell with the privacy and security concerns'. OTOH, web works faster with uMatrix. You can probably get an extra couple years of your computer if you're aggressive about disabling ads and superfluous JS.

flukus 8y ago

Most websites work fine, you have to be truly incompetent to make a text+image heavy website that doesn't work without JS. Web apps are a different story. The ones that do break tend to be the ones invading your privacy.

superkuh 8y ago

I used to think the same thing about people who browse with auto-loading plugins. Then browsers caught on and started click-to-play'ing them. Javascript is the new plugins (so much host OS functionality exposed now) and it requires a new click-to-play. I'd like to think they'll eventually integrate something like NoScript into the browser as a standard. This free for all code running is too much now that the browser is an OS. But it's difficult to get browser companies to understand something when their income depends on not understanding it.

DevoidSimo 8y ago

I browse with 3rd party frames and JS disabled. Not as extreme as all JS so it doesn't break most things. Occasionally I need to whitelist a CDN or related domain for that site to get things working.

Dylan16807 8y ago

> Wouldn't 99.9999% of the web basically break? What leads you to a number like that? I can tell you that you're wrong, but I'm much more interested in how you got there. Youtube needs javascript, and images or sometimes body text on badly-designed blogs need javascript. Most sites are fine. HN is fine, for the most obvious example.

ndnxhs 8y ago

I have umateix installed and set to block 3rd party scripts. Almost all websites work fine or even better like this but sometimes I have to enable a CDN to get the website to work.

jgaa 8y ago

I do. Most sites I use works fine without js. The few sites I need, that require js, are accessed from isolated, virtual machines dedicated to just that site. The sites I don't absolutely need, that require js, don't really exist in my world. That was a choice they made.