4 ms·

> People who choose to turn off JS are excluding themselves. JS is part of the web platform, and there are tons of amazing things it allows you to do. People w

by zeveb 7y ago

> People who choose to turn off JS are excluding themselves. JS is part of the web platform, and there are tons of amazing things it allows you to do. People who choose to turn off JavaScript are protecting themselves, because JavaScript enables all sorts of attacks on one's security and privacy. JavaScript is not part of the web platform. The Web is a web (hence the name) of interlinked documents: the core requirements for a web of interlinked documents are a protocol (we have HTTP) and a document format (HTML); a style format (CSS) is nice too, albeit not strictly necessary (one can read unstyled documents in links, lynx, elinks, eww, w3m or whatever else just fine). There is absolutely no requirement for executing arbitrary, potentially malicious, unverified code from untrusted authors distributed globally. Are there great examples of cool JavaScript applications? Yes, certainly. Is JavaScript a core requirement to support a web of interlinked documents — i.e., the Web? No, not at all. To the contrary, JavaScript is murdering the Web, and this page's misuse is a prime example. JavaScript delenda est!

jefftk 7y ago
> JavaScript enables all sorts of attacks on one's security and privacy Could you say more about this?
- dredmorbius 7y ago
  https://duckduckgo.com/?q=javascript+security+privacy+risks&ia=qa https://duckduckgo.com/?q=javascript+security+privacy+risks&...
- danShumway 7y ago
  Not the original commentor, but I'll assume this is a sincere, open question. To start with, I'm not on the anti-Javascript hype train. I write Javascript for a living, I think it's the arguably the most important modern language of the last decade. It's made computers more accessible, it has good ideas, it's reasonably well sandboxed. I love Javascript. I do advocate for progressive enhancement for a lot of reasons, but in part because that's the foundation of web architecture, and I think it's still relevant today. The best web developers I know that I really respect all understand what progressive enhancement really means as an architectural pattern, and they don't dismiss it out of hand. Also to be clear, the browser is (unarguably) hands down the best consumer-facing sandbox that we've ever built. And I like sandboxes, a lot. I think sandboxing is the future of user-facing application security -- not trusted stores, or signing, or managing dependencies in a special way, or SaaS. Having said that, I'm also using the web as it exists today. And let's just very quickly list a few major security vulnerabilities that have happened within the past few years in browsers, all of which you would have been effectively immune from if you had disabled Javascript by default on even just most sites you visited: 1. Spectre/Meltdown 2. LastPass's browser extension leaking passwords to any page you visited. 3. Firefox's most recent 0-day (that is being actively exploited)[0]. 4. Targeted vulnerabilities in mobile Safari (that went unpatched for years)[1]. On top of the numerous browser vulnerabilities that pop up, disabling Javascript by default will protect you from a nontrivial number of phishing attacks and cookie-hijacking attacks. Yes, you can do these attacks without JS/ajax, but in practice a large number of them use JS/ajax. Disabling JS will also make you effectively immune from crypto-mining attacks. Even non-malicious pages are usually not coded well in terms of CPU-power. One way you can tell a browser disables JS by default is that the non-JS setup will gracefully handle several hundred tabs at the same time in normal everyday usage for extended periods (>1 month). The other browser will eventually get caught by a rogue tab that freezes everything and forces you to restart the browser. On the privacy front... I dunno, don't you work at Google? You should know this. Panoptoclick[2] tells me my current browser setup is leaking about 6.6 bytes of identifying information. That's low enough that with a decent VPN setup, I can browse the web (close to) anonymously in many situations. I would challenge you to get a better result than that without disabling Javascript -- especially if you're starting from the disadvantage of using an uncommon OS like Mac or Linux. ---- So there's an interesting philosophical conflict here, which is that the web is awesome, and browsers are awesome, and Javascript is awesome, but anyone who's both technical and privacy-minded should turn Javascript off by default. And this conflict is because where security is concerned, I am trying very, very hard to be a fox, not a hedgehog.[3] My general advice, notwithstanding my opinion on sandboxes, is that everyone should install Ublock Origin, no matter who they are. If you're technically inclined and understand the web, you should also install UMatrix, which will at least get rid of the most common attack vectors: third-party scripts. If you're technically inclined and understand the web and you worry a lot about privacy, you should use UMatrix to disable JS by default. That's not an ideological position about sandboxes or about the web. It's not saying native apps are better (native environments are in most cases objectively worse at security). It's purely an observation that roughly 75% of the sites I visit (including many major news sites) work fine without Javascript. It's based on the fact that I keep on seeing security vulnerabilities pop up where not running Javascript is an effective mitigation. It's based on practical concerns about privacy. So the foxy perspective on web security/privacy is if there's an easy, effective way to improve my security that works most of the time, why wouldn't I do that? And why wouldn't I encourage developers to make it easier for me to do that? It's not saying that nothing should run Javascript. It is saying that if you want to run Javascript, you should have a reasonably good justification, and if you're displaying pure text you should probably provide fallbacks when possible. [0]: https://arstechnica.com/information-technology/2020/01/firefox-gets-patch-for-critical-zeroday-thats-being-actively-exploited/ https://arstechnica.com/information-technology/2020/01/firef... [1]: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... [2]: Admittedly, Panoptoclick's usage numbers are skewed towards privacy-conscious users. In the real world, the pool of people like me will be smaller. However, people who use VPNs are also skewed towards privacy-conscious, which tilts that back in my favor a bit. [3]: https://en.wikipedia.org/wiki/The_Hedgehog_and_the_Fox https://en.wikipedia.org/wiki/The_Hedgehog_and_the_Fox
  - dredmorbius 7y ago
    Thank you. Excellent response and more patience than I could muster.
  - JohnFen 7y ago
    This is an excellent comment, thank you. You said much of what I failed to, especially this, which was my main point: > It's not saying that nothing should run Javascript. It is saying that if you want to run Javascript, you should have a reasonably good justification, and if you're displaying pure text you should probably provide fallbacks when possible.

by zeveb 7y ago

jefftk 7y ago

> JavaScript enables all sorts of attacks on one's security and privacy Could you say more about this?

dredmorbius 7y ago
https://duckduckgo.com/?q=javascript+security+privacy+risks&ia=qa https://duckduckgo.com/?q=javascript+security+privacy+risks&...
danShumway 7y ago
Not the original commentor, but I'll assume this is a sincere, open question. To start with, I'm not on the anti-Javascript hype train. I write Javascript for a living, I think it's the arguably the most important modern language of the last decade. It's made computers more accessible, it has good ideas, it's reasonably well sandboxed. I love Javascript. I do advocate for progressive enhancement for a lot of reasons, but in part because that's the foundation of web architecture, and I think it's still relevant today. The best web developers I know that I really respect all understand what progressive enhancement really means as an architectural pattern, and they don't dismiss it out of hand. Also to be clear, the browser is (unarguably) hands down the best consumer-facing sandbox that we've ever built. And I like sandboxes, a lot. I think sandboxing is the future of user-facing application security -- not trusted stores, or signing, or managing dependencies in a special way, or SaaS. Having said that, I'm also using the web as it exists today. And let's just very quickly list a few major security vulnerabilities that have happened within the past few years in browsers, all of which you would have been effectively immune from if you had disabled Javascript by default on even just most sites you visited: 1. Spectre/Meltdown 2. LastPass's browser extension leaking passwords to any page you visited. 3. Firefox's most recent 0-day (that is being actively exploited)[0]. 4. Targeted vulnerabilities in mobile Safari (that went unpatched for years)[1]. On top of the numerous browser vulnerabilities that pop up, disabling Javascript by default will protect you from a nontrivial number of phishing attacks and cookie-hijacking attacks. Yes, you can do these attacks without JS/ajax, but in practice a large number of them use JS/ajax. Disabling JS will also make you effectively immune from crypto-mining attacks. Even non-malicious pages are usually not coded well in terms of CPU-power. One way you can tell a browser disables JS by default is that the non-JS setup will gracefully handle several hundred tabs at the same time in normal everyday usage for extended periods (>1 month). The other browser will eventually get caught by a rogue tab that freezes everything and forces you to restart the browser. On the privacy front... I dunno, don't you work at Google? You should know this. Panoptoclick[2] tells me my current browser setup is leaking about 6.6 bytes of identifying information. That's low enough that with a decent VPN setup, I can browse the web (close to) anonymously in many situations. I would challenge you to get a better result than that without disabling Javascript -- especially if you're starting from the disadvantage of using an uncommon OS like Mac or Linux. ---- So there's an interesting philosophical conflict here, which is that the web is awesome, and browsers are awesome, and Javascript is awesome, but anyone who's both technical and privacy-minded should turn Javascript off by default. And this conflict is because where security is concerned, I am trying very, very hard to be a fox, not a hedgehog.[3] My general advice, notwithstanding my opinion on sandboxes, is that everyone should install Ublock Origin, no matter who they are. If you're technically inclined and understand the web, you should also install UMatrix, which will at least get rid of the most common attack vectors: third-party scripts. If you're technically inclined and understand the web and you worry a lot about privacy, you should use UMatrix to disable JS by default. That's not an ideological position about sandboxes or about the web. It's not saying native apps are better (native environments are in most cases objectively worse at security). It's purely an observation that roughly 75% of the sites I visit (including many major news sites) work fine without Javascript. It's based on the fact that I keep on seeing security vulnerabilities pop up where not running Javascript is an effective mitigation. It's based on practical concerns about privacy. So the foxy perspective on web security/privacy is if there's an easy, effective way to improve my security that works most of the time, why wouldn't I do that? And why wouldn't I encourage developers to make it easier for me to do that? It's not saying that nothing should run Javascript. It is saying that if you want to run Javascript, you should have a reasonably good justification, and if you're displaying pure text you should probably provide fallbacks when possible. [0]: https://arstechnica.com/information-technology/2020/01/firefox-gets-patch-for-critical-zeroday-thats-being-actively-exploited/ https://arstechnica.com/information-technology/2020/01/firef... [1]: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... [2]: Admittedly, Panoptoclick's usage numbers are skewed towards privacy-conscious users. In the real world, the pool of people like me will be smaller. However, people who use VPNs are also skewed towards privacy-conscious, which tilts that back in my favor a bit. [3]: https://en.wikipedia.org/wiki/The_Hedgehog_and_the_Fox https://en.wikipedia.org/wiki/The_Hedgehog_and_the_Fox
- dredmorbius 7y ago
  Thank you. Excellent response and more patience than I could muster.
- JohnFen 7y ago
  This is an excellent comment, thank you. You said much of what I failed to, especially this, which was my main point: > It's not saying that nothing should run Javascript. It is saying that if you want to run Javascript, you should have a reasonably good justification, and if you're displaying pure text you should probably provide fallbacks when possible.