5 ms·

I always get downvoted for saying I run NoScript with a whitelist but 90% of my browsing time is on sites I've been to before and I don't think any other single

I always get downvoted for saying I run NoScript with a whitelist but 90% of my browsing time is on sites I've been to before and I don't think any other single security measure reduces your attack surface as much as turning JS off does.

umanwizard 7y ago
I think your downvoting has less to do with whether turning off JavaScript is a good or bad practice, and more to do with people just being sick of hearing about it. In every story that’s even tangentially related, someone always feels the need to bring up the fact that they can’t believe anyone would ever have JS turned on, even if it’s totally irrelevant (like it is here). It’s basically the Hacker News equivalent of people getting annoyed at vegans.
- thethirdone 7y ago
  I think commenting about the linked page being completely broken without js enabled is relevant (especially if the page could be just as good without it). I don't think it merits much conversation want time, but remembering accessibility is good. Similarly, accessibility features for the (color)blind should be mentioned if they are bothering someone.
  - mkozlows 7y ago
    Javascript being enabled/disabled has nothing at all to do with accessibility. A site can be JS-heavy and fully accessible. (Most aren't. But it's because they're developing it poorly, not because they're using JS.)
    - thethirdone 7y ago
      > Javascript being enabled/disabled has nothing at all to do with accessibility. It does have to do with how well people with js turned off can access sites.
SquareWheel 7y ago
That's totally fine, and part of what makes the web great is that you're able to tweak things on the client like that. Really it only becomes a problem if you become one of those people that harasses web devs for not supporting noscript users. At the end of the day Javascript is a web standard, and it's developer's jobs to target those standards.
- userbinator 7y ago
  No, it should be the developer's job to make content accessible in the most efficient way and to the widest audience. JS can be, but often it really shouldn't be used and there is a simpler solution. Some sites really do need to be JS webapps, but most of them don't. Your users may not care whether you use JS or not, but they do care when your site is slow because you chose to "appify" it unnecessarily and make it require downloading and running JS to show the same content that could've been directly served as a static HTML page.
  - todd3834 7y ago
    I would argue that the developer’s job should be to determine whether or not supporting users without JavaScript would generate more money than it costs to maintain. It’s going to depend on the target audience and what you are developing. For example: Google Docs with JavaScript turned off makes no sense to me. Hacker News on the other hand could make sense. Much higher percentage of security concerned users and the amount of work to support it is likely not monumental.
- Causality1 7y ago
  That would be really stupid of me, yeah. It's their site and they can do it however they want. I wouldn't yell at someone for writing a book in Spanish just because I can't read it. Aside from that, almost every site I actually visit gets put on my whitelist. It's the ones accessed through ads that're dangerous. If I didn't regularly run into ads that make it past adblock I wouldn't bother blocking JS at all.
- iamnothere 7y ago
  To be fair, the noscript tag is also a standard, and supporting non-JS browsers is important for some disabled users.
sonnyblarney 7y ago
To be clear, is JS pragmatically a security problem though? Are there known vulnerabilities being exploited? I don't recall ever having a problem due to JS.
- Sir_Cmpwn 7y ago
  Virtually all browser bugs require JavaScript to exploit. Here's the first example that came up when I searched for "google chrome sandbox escape": https://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html https://googleprojectzero.blogspot.com/2019/04/virtually-unl... Don't you think that the turing complete language with a massive API surface would be the obvious place for vulnerabilities to appear?
  - CrowFly 7y ago
    This seems very off-topic for the subject at hand.
  - sonnyblarney 7y ago
    I'm not doubting that JS creates a greater attack surface. I'm doubting the realism of the treat. There are billions of people using browsers with JS enabled and I don't see serious concerns / problems as a result of it. Where are the examples of Chrome being compromised by arbitrary JS scripts, out in the wild, wherein people have been affected? Banks, insurance companies, security agencies - everyone is running browsers with JS enabled, so I don't see any reason to believe that it's a legitimate problem.
    - Sir_Cmpwn 7y ago
      The problem is less related to typical petty crime, but more about state actors hoarding vulnerabilities imo. State actors have already been shown exploiting JavaScript-related vulnerabilities in Tor to deanonymize pedophiles, for example.
      - sonnyblarney 7y ago
diminoten 7y ago
I'll happily accept the miniscule additional risk of running JS so I can use the web comfortably...
- jen729w 7y ago
  I'll say this only because I found out the other week and it blew my mind. No other reason, and I swear I'll never do it again. It's 'minuscule'. With a u in the middle. Mental.
  - umanwizard 7y ago
    Yeah, just like king is "actually" spelled cyning.[1] The variant miniscule has been attested since 1871. Given that almost every word that's been in English for long enough has had multiple spelling variants, what does it mean to say that miniscule is wrong and minuscule is right? [1]: The earliest known use of the word king in an English sentence is "Se cyning sealde & gebocade Wullafe fif sulung landes.", according to the OED.
    - jen729w 7y ago
      Mmm I get your point, and I’m all-in on the evolution of language, but I’m not sure you picked a great example here. ‘Cyning’ is, by any measure, no longer in use. ‘Miniscule’ is mostly recognised as an error. The word is spelled ‘minuscule’. It really is.
      - umanwizard 7y ago
        > I’m not sure you picked a great example here. Why, what's the difference? > ‘Miniscule’ is mostly recognised as an error. Recognized by whom? And, more importantly, what gives the people who claim to recognize it as such the authority to regulate language? > The word is spelled ‘minuscule’. It really is. Again, on what authority? I can find plenty of people who are okay spelling it "miniscule". On what grounds are the people who spell it the other way "more correct" ? By the way, apparently somebody looked at a corpus and found "the spelling miniscule now makes up around 52% of the total use of the word"[1]. I think actual corpus research is a lot more valid of a way to answer the question "what is English" than some teachers and style guide writers coming up with rules arbitrarily. Before you point out to me that the above citation includes the line "it hasn't yet become accepted as standard English and you should still treat it as an error to be avoided", I already know. Again, the writers of this blog post have no more authority to arbitrarily decide what is English than you or I do, and it's sad that they ignored their own quantitative research to attempt to do such a thing. [1]: https://en.oxforddictionaries.com/spelling/minuscule-or-miniscule https://en.oxforddictionaries.com/spelling/minuscule-or-mini...

umanwizard 7y ago

I think your downvoting has less to do with whether turning off JavaScript is a good or bad practice, and more to do with people just being sick of hearing about it. In every story that’s even tangentially related, someone always feels the need to bring up the fact that they can’t believe anyone would ever have JS turned on, even if it’s totally irrelevant (like it is here). It’s basically the Hacker News equivalent of people getting annoyed at vegans.

thethirdone 7y ago
I think commenting about the linked page being completely broken without js enabled is relevant (especially if the page could be just as good without it). I don't think it merits much conversation want time, but remembering accessibility is good. Similarly, accessibility features for the (color)blind should be mentioned if they are bothering someone.
- mkozlows 7y ago
  Javascript being enabled/disabled has nothing at all to do with accessibility. A site can be JS-heavy and fully accessible. (Most aren't. But it's because they're developing it poorly, not because they're using JS.)
  - thethirdone 7y ago
    > Javascript being enabled/disabled has nothing at all to do with accessibility. It does have to do with how well people with js turned off can access sites.

SquareWheel 7y ago

That's totally fine, and part of what makes the web great is that you're able to tweak things on the client like that. Really it only becomes a problem if you become one of those people that harasses web devs for not supporting noscript users. At the end of the day Javascript is a web standard, and it's developer's jobs to target those standards.

userbinator 7y ago
No, it should be the developer's job to make content accessible in the most efficient way and to the widest audience. JS can be, but often it really shouldn't be used and there is a simpler solution. Some sites really do need to be JS webapps, but most of them don't. Your users may not care whether you use JS or not, but they do care when your site is slow because you chose to "appify" it unnecessarily and make it require downloading and running JS to show the same content that could've been directly served as a static HTML page.
- todd3834 7y ago
  I would argue that the developer’s job should be to determine whether or not supporting users without JavaScript would generate more money than it costs to maintain. It’s going to depend on the target audience and what you are developing. For example: Google Docs with JavaScript turned off makes no sense to me. Hacker News on the other hand could make sense. Much higher percentage of security concerned users and the amount of work to support it is likely not monumental.
Causality1 7y ago
That would be really stupid of me, yeah. It's their site and they can do it however they want. I wouldn't yell at someone for writing a book in Spanish just because I can't read it. Aside from that, almost every site I actually visit gets put on my whitelist. It's the ones accessed through ads that're dangerous. If I didn't regularly run into ads that make it past adblock I wouldn't bother blocking JS at all.
iamnothere 7y ago
To be fair, the noscript tag is also a standard, and supporting non-JS browsers is important for some disabled users.

sonnyblarney 7y ago

To be clear, is JS pragmatically a security problem though? Are there known vulnerabilities being exploited? I don't recall ever having a problem due to JS.

Sir_Cmpwn 7y ago
Virtually all browser bugs require JavaScript to exploit. Here's the first example that came up when I searched for "google chrome sandbox escape": https://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html https://googleprojectzero.blogspot.com/2019/04/virtually-unl... Don't you think that the turing complete language with a massive API surface would be the obvious place for vulnerabilities to appear?
- CrowFly 7y ago
  This seems very off-topic for the subject at hand.
- sonnyblarney 7y ago
  I'm not doubting that JS creates a greater attack surface. I'm doubting the realism of the treat. There are billions of people using browsers with JS enabled and I don't see serious concerns / problems as a result of it. Where are the examples of Chrome being compromised by arbitrary JS scripts, out in the wild, wherein people have been affected? Banks, insurance companies, security agencies - everyone is running browsers with JS enabled, so I don't see any reason to believe that it's a legitimate problem.
  - Sir_Cmpwn 7y ago
    The problem is less related to typical petty crime, but more about state actors hoarding vulnerabilities imo. State actors have already been shown exploiting JavaScript-related vulnerabilities in Tor to deanonymize pedophiles, for example.
    - sonnyblarney 7y ago

diminoten 7y ago

I'll happily accept the miniscule additional risk of running JS so I can use the web comfortably...

jen729w 7y ago
I'll say this only because I found out the other week and it blew my mind. No other reason, and I swear I'll never do it again. It's 'minuscule'. With a u in the middle. Mental.
- umanwizard 7y ago
  Yeah, just like king is "actually" spelled cyning.[1] The variant miniscule has been attested since 1871. Given that almost every word that's been in English for long enough has had multiple spelling variants, what does it mean to say that miniscule is wrong and minuscule is right? [1]: The earliest known use of the word king in an English sentence is "Se cyning sealde & gebocade Wullafe fif sulung landes.", according to the OED.
  - jen729w 7y ago
    Mmm I get your point, and I’m all-in on the evolution of language, but I’m not sure you picked a great example here. ‘Cyning’ is, by any measure, no longer in use. ‘Miniscule’ is mostly recognised as an error. The word is spelled ‘minuscule’. It really is.
    - umanwizard 7y ago
      > I’m not sure you picked a great example here. Why, what's the difference? > ‘Miniscule’ is mostly recognised as an error. Recognized by whom? And, more importantly, what gives the people who claim to recognize it as such the authority to regulate language? > The word is spelled ‘minuscule’. It really is. Again, on what authority? I can find plenty of people who are okay spelling it "miniscule". On what grounds are the people who spell it the other way "more correct" ? By the way, apparently somebody looked at a corpus and found "the spelling miniscule now makes up around 52% of the total use of the word"[1]. I think actual corpus research is a lot more valid of a way to answer the question "what is English" than some teachers and style guide writers coming up with rules arbitrarily. Before you point out to me that the above citation includes the line "it hasn't yet become accepted as standard English and you should still treat it as an error to be avoided", I already know. Again, the writers of this blog post have no more authority to arbitrarily decide what is English than you or I do, and it's sad that they ignored their own quantitative research to attempt to do such a thing. [1]: https://en.oxforddictionaries.com/spelling/minuscule-or-miniscule https://en.oxforddictionaries.com/spelling/minuscule-or-mini...