5 ms·

At the end unless Firefox doesn't block JavaScript, it won't have much effect. Actually it's also time to ban JavaScript after horrendous front end frameworks

At the end unless Firefox doesn't block JavaScript, it won't have much effect. Actually it's also time to ban JavaScript after horrendous front end frameworks made simple page loads slow, energy and time consuming.

tehlike 8y ago
That is the most pessimist comment on this thread. Javascript is useful, it is just a shame most people dont use it for good.
- anoncake 8y ago
  We cant ban just the bad Javascript, a browser cannot distinguish it from the good. And overall, Javascript does more harm than good.
  - dymk 8y ago
    We'll probably just have to agree to disagree re: "JS does more harm than good". I have at least 5 progressive webapps open right now, none of which could work without javascript. Of the other 20 websites I have open in other tabs, none are being annoying or aggressive, and I'm not even using an adblocker.
    - anoncake 8y ago
      They could be proper applications instead.
      - dymk 8y ago
        Not really. It's way harder (and therefore the barrier is higher, they'd be less likely to exist, etc) to develop cross platform native applications than it is to just implement them as webapps. If it was just as easy to write and distribute native applications, we'd be doing that, instead of bolting it onto the web. But it's pretty clearly not.
        anoncake 8y ago
        Its the other way round. If web apps didnt exist, there would be more pressure to develop tools that make it easy to write and distribute proper applications.
        dymk 8y ago
        Under what circumstances would webapps not exist in some form or another? It's a system for deploying applications via the web, and JavaScript is primarily the language that they're implemented in. I will bet you that in 99% of alternative timelines, we'd end up with something incredibly similar to what we've got today, and you'd still be complaining that applications aren't "native" enough, because practically nobody cares that a taskbar or button isn't a native OS component. They care that their application works, and can be quickly deployed and updated.
        anoncake 8y ago
        > Under what circumstances would webapps not exist in some form or another? Browsers not supporting nonsense like Javascript.
        geofft 8y ago
        Serious question: do you remember the late '90s and early '00s? Have you used Visual Basic, or Qt, or anything? There was an era before web apps existed, and there were tools that made it easy to write and distribute proper applications - are you claiming that that didn't happen, or what?
        anoncake 8y ago
        I didnt, dymk did.
        geofft 8y ago
        You're the one claiming that tools would exist to make it easy. I am saying that they did exist, and they were as easy as possible. What remains to be done, and why didn't it happen before the invention of XMLHTTPRequest? Could it get easier, and if so, how?
      - JoshTriplett 8y ago
        They are applications. They run in a safe sandbox in the browser, rather than being all-powerful programs running directly on the system. They allow nuances of trust ("I trust this application with the data I'm giving it") rather than absolute trust ("I trust this application with access to my entire system and all my data").
        anoncake 8y ago
        Proper applications follow OS UI conventions, they appear in the task bar, are launched from the application launcher etc. Proper applications can also be sandboxed, though Spectre makes it a bad idea to run untrusted code anyway.
        JoshTriplett 8y ago
        > Proper applications follow OS UI conventions (I'm going to ignore the use of "proper application" instead of "native (non-web) application"; it isn't helping your argument.) Native applications can choose whether they follow UI conventions or not; many games don't, for instance. Web applications have the same choice; they can use native controls provided by the browser, and I certainly agree that well-behaved web applications should if they don't have a good reason to do otherwise (e.g. use standard form controls for native look-and-feel and better integration/interaction). > they appear in the task bar So do progressive web apps (PWAs). > are launched from the application launcher PWAs are as well. (Likewise for many other aspects of integration with the rest of the system.) > Proper applications can also be sandboxed But there aren't yet standard mechanisms for that (outside of mobile platforms), and you can't necessarily trust that an application will sandbox itself. Current sandbox mechanisms mostly get used by applications to protect against exploits, not for users to protect themselves against applications.
        saagarjha 8y ago
        > there aren't yet standard mechanisms for that (outside of mobile platforms) macOS certainly has one.
      - geofft 8y ago
        Having them be proper applications would be a huge problem for the security and therefore the computing autonomy of the average person. The fact that you don't generally download unsandboxed, unsigned apps from the internets any more (and don't run shrink-wrapped apps from the local CompUSA that are full of C string parsing vulnerabilities, either) is one of the most meaningful accomplishments in computer security in the last decade. If you want to throw it out, you personally can clean up the Bonzi Buddies on every Windows user's computer. The most malicious JavaScript web page still can't install Bonzi Buddy. We've even gotten to an era where most people don't need to install anti-virus, because moving everything to the web has fixed the fundamental problems with desktop OS design that required a quasi-snake-oil, theoretically-untenable approach to maintain a semblance of integrity. There's another alternative, which is curated and audited app stores à la iOS, but the fact that you can't use applications unless they're approved by a megacorporation would also be bad for people's computing autonomy. (Also, what makes you think that the developers of bloated JS apps won't make bloated desktop apps?)
        deleted 8y ago
        [deleted]
        anoncake 8y ago
        Thats a false dilemma. You can have sandboxing without running pseudo-applications in a document viewer and without walled gardens. > (Also, what makes you think that the developers of bloated JS apps won't make bloated desktop apps?) Nothing. Its possible to create garbage desktop apps. But its impossible to create non-garbage web apps.
        geofft 8y ago
        > You can have sandboxing without running pseudo-applications in a document viewer and without walled gardens. Please expand on this claim. What is a "pseudo-application" and what is a "document viewer"? In particular, how does having an app runtime outside a "document viewer" accomplish the goals you would like to see? > Its possible to create garbage desktop apps. But its impossible to create non-garbage web apps. Please expand on this claim. I've seen tons of non-garbage web apps.
      - hombre_fatal 8y ago
        That has downsides of its own. For example, url sharing / deep linking goes out the window. I can't share what I'm looking at in macOS' Maps.app like I can on the Google Maps website, pure downgrade. I also don't want to download an application for everything. Very few things deserve a permanent spot on my computer. I have much less control over desktop apps than I do a website. Or look at macOS' News.app. Another downgrade from reading news in a browser tab. It has no tabs. There's no right-click. It implemented its own back button. It only supports the few news sources that come preinstalled on it. I can't add my own. Why would I prefer this? Obviously native applications have their place, but let's not suggest there aren't trade-offs. What's odd about your posts is that you suggest it's an inconvenience that you might have to disable Javascript. Maybe you have to use NoScript or uMatrix or uBlock. But at least you have the option and this sort of control over the web browser. If a native application does something that you don't like, you have basically zero recourse beyond uninstalling it or begging the developer to change something you could've done in the browser with a quick browser extension or CSS tweak.
        anoncake 8y ago
        > For example, url sharing / deep linking goes out the window. Yes, thats the one good thing about the web. But there is no reason proper applications cannot support this. > Or look at macOS' News.app. Im not familiar with that app but I guess its some sort of reader for hypertext documents (published by news organizations)? The one thing a browser is good at?
        saagarjha 8y ago
        > I can't share what I'm looking at in macOS' Maps.app like I can on the Google Maps website, pure downgrade. But you can? For example, https://maps.apple.com/?ll=36.103117,-103.901438&spn=0.000989,0.002246&t=m https://maps.apple.com/?ll=36.103117,-103.901438&spn=0.00098... > Or look at macOS' News.app. Another downgrade from reading news in a browser tab. It has no tabs. There's no right-click. It implemented its own back button. It only supports the few news sources that come preinstalled on it. I can't add my own. Why would I prefer this? You shouldn't; you should be annoyed that Apple shipped this and demand that they give you better.
    - JohnFen 8y ago
      Fair enough. Personally, I avoid PWAs entirely due to (in part) security concerns. But I'm also one of those who views client-side scripting as a threat vector, and prevent it when at all possible.
  - tehlike 8y ago
    Citation needed. I dont believe gmail would be as useful eithout javascript, docs wouldnt really be possible, i dont think i could video chat with my family without extensions, and so on. Installing apps is really not aomething i want. I am trying to keep apps on my phone low for a reason, browser is actually perfect for most of what i do.
    - anoncake 8y ago
      Email clients, word processors and video chat would be very much possible without Javascript.
      - ceejayoz 8y ago
        Email clients, sure. Word processors? Only if you're requiring something like Markdown. Video chat seems right out, unless you're permitting a Flash solution, which would be severely cheating.
        thatfunkymunki 8y ago
        He's not talking about cancerous in-browser webapps. He's talking about actual clients.
        tehlike 8y ago
        You mean clients i can hardly update, and most often clunky as well? I dont see the improvement. I can use web apps on any platform without waiting for the company to do it. I refuse to install apps on my devices.
        anoncake 8y ago
        > You mean clients i can hardly update Yes! You dont have to update if you dont want to. Thats a feature. Of course, the rise of proprietary APIs over interoperable protocols has lessened that advantage.
        8y ago
  - snaky 8y ago
    > We cant ban just the bad Javascript Well, technically it's possible, and even some parts of the script could be allowed to run or not. > a browser cannot distinguish it from the good But the user can. And the machine could help, thanks to machine learning.
    - JohnFen 8y ago
      > But the user can. How? I don't think that users even agree what consists of "good" and "bad" JavaScript.
      - snaky 8y ago
        For the simplest possible example, ask any Noscript extension user. For the more advanced things, like identifying the part of Javascript code that brings e.g. 'the fancy eating 40% of the CPU scrollbar' user want to disable, some automation is needed.
        JohnFen 8y ago
        I am a NoScript user. I use it to block all JS by default. If a web site won't work properly that way, and the site is somehow really important, I'll work out what the minimum scripts necessary to let the site do what I need is, and just allow those. If the site isn't somehow critical, I just don't use the site. I have to do it that way because it's very difficult to determine which scripts are bad and which aren't without actually reviewing the JS itself. In my view, "bad" usually means that the script is phoning home in some way.
    - anoncake 8y ago
      Consider Javascript that replaces native browser functions. Web pages that are essentially static documents, but still dont work without Javascript. Is this good Javascript? I dont think so. Does disabling it on an individual level help? No.
deleted 8y ago
[deleted]
Bekwnn 8y ago
I already use noscript. So many websites work at 100% and load 2x as fast with only 1/3rd of scripts allowed.
- snaky 8y ago
  I wish there were browser extension to exchange the lists of allowed scripts for sites between the users. So Noscript could automatically preset this for you and you don't need to tune the list for every site by yourself.
  - kadal 8y ago
    I recently discovered that Umatrix has something like this. One of the buttons gives you the ability to click to enable common subsets e.g. "GitHub" , "reCAPTCHA" etc.
- benj111 8y ago
  Unfortunately many silently break, ok for news sites etc, not so good for your bank website.
geofft 8y ago
Much effect for what? If the claim is "much effect for not autoplaying audio," citation needed - the usual ways of blocking autoplaying audio work perfectly fine if the autoplay is triggered from JavaScript instead of from pure HTML.
ahoy 8y ago
If we just ban cars no one will get in any more wrecks.
- anoncake 8y ago
  While public transportation is safer than cars, I dont think accidents are completely avoidable.
morningmoon 8y ago
Agreed. I have yet to find a single use-case that can't be done without JavaScript, with the exception of chat. Like audio and video, chat could have easily been another HTML widget provided by the browser (imagine, standard declarative chat across the web!). I built my last webapp entirely without JavaScript. Users constantly praise how fast it is. There's no bugs with the back button. It's accessible out-of-the-box. Form inputs work correctly out-of-the-box. It's clear when data is being loaded/submitted and when it's not (since that's already built into the browser). And on and on and on... JavaScript is the worst thing to happen to UX, privacy, speed, caching, and accessibility. So much of the web's UX is broken because of JS. It's depressing because it was all unnecessary. We went from a standard declarative interface shared by all websites to an "anything goes" black box runtime.

tehlike 8y ago

That is the most pessimist comment on this thread. Javascript is useful, it is just a shame most people dont use it for good.

anoncake 8y ago
We cant ban just the bad Javascript, a browser cannot distinguish it from the good. And overall, Javascript does more harm than good.
- dymk 8y ago
  We'll probably just have to agree to disagree re: "JS does more harm than good". I have at least 5 progressive webapps open right now, none of which could work without javascript. Of the other 20 websites I have open in other tabs, none are being annoying or aggressive, and I'm not even using an adblocker.
  - anoncake 8y ago
    They could be proper applications instead.
    - dymk 8y ago
      Not really. It's way harder (and therefore the barrier is higher, they'd be less likely to exist, etc) to develop cross platform native applications than it is to just implement them as webapps. If it was just as easy to write and distribute native applications, we'd be doing that, instead of bolting it onto the web. But it's pretty clearly not.
      - anoncake 8y ago
        Its the other way round. If web apps didnt exist, there would be more pressure to develop tools that make it easy to write and distribute proper applications.
        dymk 8y ago
        Under what circumstances would webapps not exist in some form or another? It's a system for deploying applications via the web, and JavaScript is primarily the language that they're implemented in. I will bet you that in 99% of alternative timelines, we'd end up with something incredibly similar to what we've got today, and you'd still be complaining that applications aren't "native" enough, because practically nobody cares that a taskbar or button isn't a native OS component. They care that their application works, and can be quickly deployed and updated.
        anoncake 8y ago
        > Under what circumstances would webapps not exist in some form or another? Browsers not supporting nonsense like Javascript.
        geofft 8y ago
        Serious question: do you remember the late '90s and early '00s? Have you used Visual Basic, or Qt, or anything? There was an era before web apps existed, and there were tools that made it easy to write and distribute proper applications - are you claiming that that didn't happen, or what?
        anoncake 8y ago
        I didnt, dymk did.
        geofft 8y ago
        You're the one claiming that tools would exist to make it easy. I am saying that they did exist, and they were as easy as possible. What remains to be done, and why didn't it happen before the invention of XMLHTTPRequest? Could it get easier, and if so, how?
    - JoshTriplett 8y ago
      They are applications. They run in a safe sandbox in the browser, rather than being all-powerful programs running directly on the system. They allow nuances of trust ("I trust this application with the data I'm giving it") rather than absolute trust ("I trust this application with access to my entire system and all my data").
      - anoncake 8y ago
        Proper applications follow OS UI conventions, they appear in the task bar, are launched from the application launcher etc. Proper applications can also be sandboxed, though Spectre makes it a bad idea to run untrusted code anyway.
        JoshTriplett 8y ago
        > Proper applications follow OS UI conventions (I'm going to ignore the use of "proper application" instead of "native (non-web) application"; it isn't helping your argument.) Native applications can choose whether they follow UI conventions or not; many games don't, for instance. Web applications have the same choice; they can use native controls provided by the browser, and I certainly agree that well-behaved web applications should if they don't have a good reason to do otherwise (e.g. use standard form controls for native look-and-feel and better integration/interaction). > they appear in the task bar So do progressive web apps (PWAs). > are launched from the application launcher PWAs are as well. (Likewise for many other aspects of integration with the rest of the system.) > Proper applications can also be sandboxed But there aren't yet standard mechanisms for that (outside of mobile platforms), and you can't necessarily trust that an application will sandbox itself. Current sandbox mechanisms mostly get used by applications to protect against exploits, not for users to protect themselves against applications.
        saagarjha 8y ago
        > there aren't yet standard mechanisms for that (outside of mobile platforms) macOS certainly has one.
    - geofft 8y ago
      Having them be proper applications would be a huge problem for the security and therefore the computing autonomy of the average person. The fact that you don't generally download unsandboxed, unsigned apps from the internets any more (and don't run shrink-wrapped apps from the local CompUSA that are full of C string parsing vulnerabilities, either) is one of the most meaningful accomplishments in computer security in the last decade. If you want to throw it out, you personally can clean up the Bonzi Buddies on every Windows user's computer. The most malicious JavaScript web page still can't install Bonzi Buddy. We've even gotten to an era where most people don't need to install anti-virus, because moving everything to the web has fixed the fundamental problems with desktop OS design that required a quasi-snake-oil, theoretically-untenable approach to maintain a semblance of integrity. There's another alternative, which is curated and audited app stores à la iOS, but the fact that you can't use applications unless they're approved by a megacorporation would also be bad for people's computing autonomy. (Also, what makes you think that the developers of bloated JS apps won't make bloated desktop apps?)
      - deleted 8y ago
        [deleted]
      - anoncake 8y ago
        Thats a false dilemma. You can have sandboxing without running pseudo-applications in a document viewer and without walled gardens. > (Also, what makes you think that the developers of bloated JS apps won't make bloated desktop apps?) Nothing. Its possible to create garbage desktop apps. But its impossible to create non-garbage web apps.
        geofft 8y ago
        > You can have sandboxing without running pseudo-applications in a document viewer and without walled gardens. Please expand on this claim. What is a "pseudo-application" and what is a "document viewer"? In particular, how does having an app runtime outside a "document viewer" accomplish the goals you would like to see? > Its possible to create garbage desktop apps. But its impossible to create non-garbage web apps. Please expand on this claim. I've seen tons of non-garbage web apps.
    - hombre_fatal 8y ago
      That has downsides of its own. For example, url sharing / deep linking goes out the window. I can't share what I'm looking at in macOS' Maps.app like I can on the Google Maps website, pure downgrade. I also don't want to download an application for everything. Very few things deserve a permanent spot on my computer. I have much less control over desktop apps than I do a website. Or look at macOS' News.app. Another downgrade from reading news in a browser tab. It has no tabs. There's no right-click. It implemented its own back button. It only supports the few news sources that come preinstalled on it. I can't add my own. Why would I prefer this? Obviously native applications have their place, but let's not suggest there aren't trade-offs. What's odd about your posts is that you suggest it's an inconvenience that you might have to disable Javascript. Maybe you have to use NoScript or uMatrix or uBlock. But at least you have the option and this sort of control over the web browser. If a native application does something that you don't like, you have basically zero recourse beyond uninstalling it or begging the developer to change something you could've done in the browser with a quick browser extension or CSS tweak.
      - anoncake 8y ago
        > For example, url sharing / deep linking goes out the window. Yes, thats the one good thing about the web. But there is no reason proper applications cannot support this. > Or look at macOS' News.app. Im not familiar with that app but I guess its some sort of reader for hypertext documents (published by news organizations)? The one thing a browser is good at?
      - saagarjha 8y ago
        > I can't share what I'm looking at in macOS' Maps.app like I can on the Google Maps website, pure downgrade. But you can? For example, https://maps.apple.com/?ll=36.103117,-103.901438&spn=0.000989,0.002246&t=m https://maps.apple.com/?ll=36.103117,-103.901438&spn=0.00098... > Or look at macOS' News.app. Another downgrade from reading news in a browser tab. It has no tabs. There's no right-click. It implemented its own back button. It only supports the few news sources that come preinstalled on it. I can't add my own. Why would I prefer this? You shouldn't; you should be annoyed that Apple shipped this and demand that they give you better.
  - JohnFen 8y ago
    Fair enough. Personally, I avoid PWAs entirely due to (in part) security concerns. But I'm also one of those who views client-side scripting as a threat vector, and prevent it when at all possible.
- tehlike 8y ago
  Citation needed. I dont believe gmail would be as useful eithout javascript, docs wouldnt really be possible, i dont think i could video chat with my family without extensions, and so on. Installing apps is really not aomething i want. I am trying to keep apps on my phone low for a reason, browser is actually perfect for most of what i do.
  - anoncake 8y ago
    Email clients, word processors and video chat would be very much possible without Javascript.
    - ceejayoz 8y ago
      Email clients, sure. Word processors? Only if you're requiring something like Markdown. Video chat seems right out, unless you're permitting a Flash solution, which would be severely cheating.
      - thatfunkymunki 8y ago
        He's not talking about cancerous in-browser webapps. He's talking about actual clients.
        tehlike 8y ago
        You mean clients i can hardly update, and most often clunky as well? I dont see the improvement. I can use web apps on any platform without waiting for the company to do it. I refuse to install apps on my devices.
        anoncake 8y ago
        > You mean clients i can hardly update Yes! You dont have to update if you dont want to. Thats a feature. Of course, the rise of proprietary APIs over interoperable protocols has lessened that advantage.
        8y ago
- snaky 8y ago
  > We cant ban just the bad Javascript Well, technically it's possible, and even some parts of the script could be allowed to run or not. > a browser cannot distinguish it from the good But the user can. And the machine could help, thanks to machine learning.
  - JohnFen 8y ago
    > But the user can. How? I don't think that users even agree what consists of "good" and "bad" JavaScript.
    - snaky 8y ago
      For the simplest possible example, ask any Noscript extension user. For the more advanced things, like identifying the part of Javascript code that brings e.g. 'the fancy eating 40% of the CPU scrollbar' user want to disable, some automation is needed.
      - JohnFen 8y ago
        I am a NoScript user. I use it to block all JS by default. If a web site won't work properly that way, and the site is somehow really important, I'll work out what the minimum scripts necessary to let the site do what I need is, and just allow those. If the site isn't somehow critical, I just don't use the site. I have to do it that way because it's very difficult to determine which scripts are bad and which aren't without actually reviewing the JS itself. In my view, "bad" usually means that the script is phoning home in some way.
  - anoncake 8y ago
    Consider Javascript that replaces native browser functions. Web pages that are essentially static documents, but still dont work without Javascript. Is this good Javascript? I dont think so. Does disabling it on an individual level help? No.

deleted 8y ago

[deleted]

Bekwnn 8y ago

I already use noscript. So many websites work at 100% and load 2x as fast with only 1/3rd of scripts allowed.

snaky 8y ago
I wish there were browser extension to exchange the lists of allowed scripts for sites between the users. So Noscript could automatically preset this for you and you don't need to tune the list for every site by yourself.
- kadal 8y ago
  I recently discovered that Umatrix has something like this. One of the buttons gives you the ability to click to enable common subsets e.g. "GitHub" , "reCAPTCHA" etc.
benj111 8y ago
Unfortunately many silently break, ok for news sites etc, not so good for your bank website.

geofft 8y ago

Much effect for what? If the claim is "much effect for not autoplaying audio," citation needed - the usual ways of blocking autoplaying audio work perfectly fine if the autoplay is triggered from JavaScript instead of from pure HTML.

ahoy 8y ago

If we just ban cars no one will get in any more wrecks.

anoncake 8y ago
While public transportation is safer than cars, I dont think accidents are completely avoidable.

morningmoon 8y ago

Agreed. I have yet to find a single use-case that can't be done without JavaScript, with the exception of chat. Like audio and video, chat could have easily been another HTML widget provided by the browser (imagine, standard declarative chat across the web!). I built my last webapp entirely without JavaScript. Users constantly praise how fast it is. There's no bugs with the back button. It's accessible out-of-the-box. Form inputs work correctly out-of-the-box. It's clear when data is being loaded/submitted and when it's not (since that's already built into the browser). And on and on and on... JavaScript is the worst thing to happen to UX, privacy, speed, caching, and accessibility. So much of the web's UX is broken because of JS. It's depressing because it was all unnecessary. We went from a standard declarative interface shared by all websites to an "anything goes" black box runtime.