6 ms·

I was already blocking ads via uBlock Origin, but now I may start blocking third-party scripts by default.

munk-a 7y ago
I switched into a block all scripts by default web stance a while back and am continuously amused by how operable different sites are, some degrading relatively gracefully, some just going white screen (usually SPA of some sort) other sites go totally wonky when they find themselves unable to rewrite the DOM and style rules to render the page as they want - sorta close to that old occurrence when CSS would fail to download and you'd have a giant <ul> block that was being restyled as a menu... but far more disappointing because there is really no reason to push styling into JS and so many out-of-the-box responsive style frameworks at this point.
- ceejayoz 7y ago
  The really fun ones are the ones that work better with the JS disabled.
  - OJFord 7y ago
    Best yet for me was 'client-side pricing' - I increased basket 'weight', and the web app neglected to correspondingly increase the price.
  - uhryks 7y ago
    A blogs website whose logo is a big M?
- danieldk 7y ago
  I use uMatrix on Linux and am continuously surprised how many blog-like websites could be plain HTML/CSS, since they just have text and images, but don't show any content at all with Javascript disabled. More and more often I'll just go back where I came from and don't bother with these sites anymore.
  - flukus 7y ago
    For non-technical blogs it's unfortunate because the authors don't know any better. For technical blogs it's a feature that lets you know someone is not worth listening to.
- craftyguy 7y ago
  > some just going white screen I find this happens with a lot of news sites. It's hilarious that a website made primarily for displaying text is absolutely defeated by turning off javascript.
  - LeoPanthera 7y ago
    CNN text only: https://lite.cnn.io/en https://lite.cnn.io/en NPR text only: https://text.npr.org https://text.npr.org And although not news, Facebook has a secret no-Javascript version here: https://mbasic.facebook.com https://mbasic.facebook.com
- zzzcpan 7y ago
  At least 1st party javascript usually fixes white screen, but sometimes blocking styles does. What I also found interesting is that disabling javascript with CSP can sometimes fix websites too that are hostile in their <noscript> tag and CSP prevented javascript doesn't run <noscript>.
  - munk-a 7y ago
    A surprising number of sites use third party cached versions of scripts - and a number still also use static domains... for instance stackoverflow.com uses sstatic.net I assume because all the stack sites refer to the same pool of scripts... this actually used to be a best practice for performant webpages since many browsers would limit the number of parallel resource downloads on a per-domain basis, so yahoo.com could render quicker if it has img3-yahoo.com and img2-yahoo.com and js-yahoo.com - though subdomains may have sufficed for that at that point, I can't quite recall.
    - zzzcpan 7y ago
      I have a keyboard shortcut for a "dangerous" mode that allows 3rd party images, 3rd party styles, but still only 1st party javascript. Works for stackoverflow.com, not that it doesn't show content without any of 3rd party stuff and any scripts. But I get what you are talking about, different, but still technically 1st party domains and separate CDN domains for some websites is the reason I have rules in my extension, it's like whitelisting adblocking.
    - zrm 7y ago
      A possible solution for this would be for the extension blocking third party scripts to have a list of domains that are known to be associated, like stackoverflow.com and sstatic.net, and then consider the latter to be first party for the former, pre-populated for all the major sites.
      - munk-a 7y ago
        If the list is domain based then you run into a "Who is paying to maintain the list" problem, and if it's self-registered (i.e. stackoverflow tells you sstatic.net is legit) then who verifies it was actually stackoverflow that told you that - and if you manager to verify that it came from someone within the domain or the registered owner... then how can you verify that sstatic isn't a domain serving malicious scripts and the owner isn't selling out users to the site to make a quick extra buck from some third party ad provider - or that it isn't the former owner who is acting maliciously - or that it isn't the current owner who is trying to undo the former owner who acted maliciously. I think you could quite sanely track a few sites, maybe the top 200 or 300... after that it'd get unwieldy. And, for fun, on the other side I believe a few years ago google's in house public hosting of jQuery received a bad push and was serving a tainted package for a while... even the good actors can mess this up. A peer vetting system might work well (like DNS) but it'd need a lot of careful thought.
- megous 7y ago
  And the SVG icons... lol. Devs can't be bothered to set a reasonable default size in the image itself, so you're greeted with a huuuge twitter icon accross the entire screen and the page is just 20000px of huge "social" icons with 500px of text somewhere there if you scroll carefully. Almost nobody actually cares about graceful degradation these days.
jniedrauer 7y ago
uMatrix is pretty effective. The web is noticeably less terrible with it, although you may have to re-enable scripts on some sites from time to time for them to work completely.
- ypcx 7y ago
  The constant necessity to re-enable turned me off from Matrix, and I'd guess many others. Perhaps the defaults should be much softer.

I switched into a block all scripts by default web stance a while back and am continuously amused by how operable different sites are, some degrading relatively gracefully, some just going white screen (usually SPA of some sort) other sites go totally wonky when they find themselves unable to rewrite the DOM and style rules to render the page as they want - sorta close to that old occurrence when CSS would fail to download and you'd have a giant <ul> block that was being restyled as a menu... but far more disappointing because there is really no reason to push styling into JS and so many out-of-the-box responsive style frameworks at this point.

ceejayoz 7y ago
The really fun ones are the ones that work better with the JS disabled.
- OJFord 7y ago
  Best yet for me was 'client-side pricing' - I increased basket 'weight', and the web app neglected to correspondingly increase the price.
- uhryks 7y ago
  A blogs website whose logo is a big M?
danieldk 7y ago
I use uMatrix on Linux and am continuously surprised how many blog-like websites could be plain HTML/CSS, since they just have text and images, but don't show any content at all with Javascript disabled. More and more often I'll just go back where I came from and don't bother with these sites anymore.
- flukus 7y ago
  For non-technical blogs it's unfortunate because the authors don't know any better. For technical blogs it's a feature that lets you know someone is not worth listening to.
craftyguy 7y ago
> some just going white screen I find this happens with a lot of news sites. It's hilarious that a website made primarily for displaying text is absolutely defeated by turning off javascript.
- LeoPanthera 7y ago
  CNN text only: https://lite.cnn.io/en https://lite.cnn.io/en NPR text only: https://text.npr.org https://text.npr.org And although not news, Facebook has a secret no-Javascript version here: https://mbasic.facebook.com https://mbasic.facebook.com
zzzcpan 7y ago
At least 1st party javascript usually fixes white screen, but sometimes blocking styles does. What I also found interesting is that disabling javascript with CSP can sometimes fix websites too that are hostile in their <noscript> tag and CSP prevented javascript doesn't run <noscript>.
- munk-a 7y ago
  A surprising number of sites use third party cached versions of scripts - and a number still also use static domains... for instance stackoverflow.com uses sstatic.net I assume because all the stack sites refer to the same pool of scripts... this actually used to be a best practice for performant webpages since many browsers would limit the number of parallel resource downloads on a per-domain basis, so yahoo.com could render quicker if it has img3-yahoo.com and img2-yahoo.com and js-yahoo.com - though subdomains may have sufficed for that at that point, I can't quite recall.
  - zzzcpan 7y ago
    I have a keyboard shortcut for a "dangerous" mode that allows 3rd party images, 3rd party styles, but still only 1st party javascript. Works for stackoverflow.com, not that it doesn't show content without any of 3rd party stuff and any scripts. But I get what you are talking about, different, but still technically 1st party domains and separate CDN domains for some websites is the reason I have rules in my extension, it's like whitelisting adblocking.
  - zrm 7y ago
    A possible solution for this would be for the extension blocking third party scripts to have a list of domains that are known to be associated, like stackoverflow.com and sstatic.net, and then consider the latter to be first party for the former, pre-populated for all the major sites.
    - munk-a 7y ago
      If the list is domain based then you run into a "Who is paying to maintain the list" problem, and if it's self-registered (i.e. stackoverflow tells you sstatic.net is legit) then who verifies it was actually stackoverflow that told you that - and if you manager to verify that it came from someone within the domain or the registered owner... then how can you verify that sstatic isn't a domain serving malicious scripts and the owner isn't selling out users to the site to make a quick extra buck from some third party ad provider - or that it isn't the former owner who is acting maliciously - or that it isn't the current owner who is trying to undo the former owner who acted maliciously. I think you could quite sanely track a few sites, maybe the top 200 or 300... after that it'd get unwieldy. And, for fun, on the other side I believe a few years ago google's in house public hosting of jQuery received a bad push and was serving a tainted package for a while... even the good actors can mess this up. A peer vetting system might work well (like DNS) but it'd need a lot of careful thought.
megous 7y ago
And the SVG icons... lol. Devs can't be bothered to set a reasonable default size in the image itself, so you're greeted with a huuuge twitter icon accross the entire screen and the page is just 20000px of huge "social" icons with 500px of text somewhere there if you scroll carefully. Almost nobody actually cares about graceful degradation these days.

jniedrauer 7y ago

uMatrix is pretty effective. The web is noticeably less terrible with it, although you may have to re-enable scripts on some sites from time to time for them to work completely.

ypcx 7y ago
The constant necessity to re-enable turned me off from Matrix, and I'd guess many others. Perhaps the defaults should be much softer.