9 ms·

I must say, I don't understand the disable JS movement. I browse with JS on, and uBlock Origin to block ads. It's rare that I have any javascript-related proble

I must say, I don't understand the disable JS movement. I browse with JS on, and uBlock Origin to block ads. It's rare that I have any javascript-related problems in my web browsing. On the other hand, I definitely use a number of sites that rely on javascript for useful purposes. If you're worried about tracking, you can block ads and tracking scripts without disabling javascript. If you're worried about viruses, well, all I can say there is that in my experience and understanding, if you keep your browser updated, the odds of getting a virus via browser JS are exceedingly low. Doubly so if you're not frequenting sketchy sites. I don't know, it seems to me like advice from a time before security was a priority for browser makers, and high-quality ad blockers existed. At this point, I really don't see the value.

deleted 6y ago
[deleted]
zamalek 6y ago
> If you're worried about viruses [...] Not to mention that a host of vulnerabilities were image related a few years back (one of the original rookits exploited a TGA bug). > uBlock Origin Honestly, this is the antivirus of the web. I helped my niece set up my old computer for Minecraft today, and she was explaining how her friend had installed viruses (adware, really) 3 times. Every one of those instances was caused by download link confusion for Minecraft mods. Disabling JavaScript isn't going to save you from being tricked into downloading shady software, only an adblocker will.
- sam0x17 6y ago
  In my experience Brave Browser (chrome based) runs circles around uBlock origin FYI
  - sicromoft 6y ago
    Can you say more? I’m a happy uBlock user — what am I missing by not using Brave?
    - movedx 6y ago
      https://brave.com/ https://brave.com/
      - judge2020 6y ago
        In case the OP wanted to know exactly how Brave's adblock is different from uBlock Origin instead of a link to the marketing page with links to other things like cryptocurrencies: Brave's browser claims a speedup over AdBlock plus, but was inspired by UBO, so the performance is fairly similar, but is baked into the browser instead of being an extension. > We therefore rebuilt our ad-blocker taking inspiration from uBlock Origin and Ghostery’s ad-blocker approach. https://brave.com/improved-ad-blocker-performance/ https://brave.com/improved-ad-blocker-performance/
        square_usual 6y ago
        It's also written in Rust for performance.
        scaladev 6y ago
        I use a 6 year old desktop which wasn't that great even when I built it, and a pretty terrible 8 year old laptop, and I don't have any problems with uBlock Origin's performance. I have almost every filter list enabled (except for some regional ones), which results in 153486 network and 173646 cosmetic filters total.
        sicromoft 6y ago
        Same here. My take away from these replies is that I'm not missing anything by sticking with uBlock.
        sam0x17 6y ago
        With uBlock origin you're at the whim of the changes Google pushes through to chrome/chromium to nerf it.
  - stjohnswarts 6y ago
    No it doesn't. I use Firefox with ubo and Brave (without extensions) for work and I notice no "running circles around" by either browser. While I'm sure brave's native blocking is faster, in human perception the time difference is essentially nil.
  - reciprocity 6y ago
    "In my experience", followed by "for your information" - what an empty comment. You've not breathed any substance into your opinion with this post.
- matheusmoreira 6y ago
  Yeah! After I install uBlock Origin, people seem to stop downloading malware for some reason. Funny how that works...
- billyhoffman 6y ago
  > one of the original root kits exploited a TGA bug As a lover of old image formats and the security issues they can cause* this sounds fascinating, but some quick google searches don’t seem to surface what you are referencing. Can you share any more details? * I once fell into discovering a memory disclosure flaw with Firefox and XBM images
  - edgyquant 6y ago
    There was the github ddos that existed (iirc) as an image that made a request when viewed (I think it actually ran a script) and a couple smaller botnets that used similar functionality in 2018.
  - zamalek 6y ago
    Wish I could edit that, I meant jailbreak - which did give root access, technically allowing a host of nefarious use cases.
dx87 6y ago
I keep it disabled just so sites load faster. Except for 1 or 2 sites, I don't care about anything except for the main text on a page, so it's a waste of time to let a ton of javascript run and load/format things that I don't care about.
- intrasight 6y ago
  I generally visit web pages with JavaScript disabled and them immediately click "reader view". But there are certainly a lot of sites where content is loaded with script, and for those pages I must enabled JS. Q: Does anyone know of a Safari iOS add-in that allows for whitelisting of specific sites to run JS?
  - shadowoflight 6y ago
    Not sure if this solves your entire problem, but you can disable all content blockers for any sit in Safari for iOS[1]. [1]: https://www.macrumors.com/how-to/disable-content-blockers-safari-ios/ https://www.macrumors.com/how-to/disable-content-blockers-sa...
    - intrasight 6y ago
      So what I should then be looking for is a good content blocker - one that supports disabling JavaScript. Any recommendations?
      - shadowoflight 6y ago
        No clue on that one, sorry. I’ve been using Purify[1] for ages, but have no clue if it blocks JS - I suspect it blocks only some JS, because my experience of the web isn’t trash while using it, but I do have to disable it sometimes to use the heavily animated navigation systems that some sites implement. [1]: https://apps.apple.com/us/app/purify-block-ads-and-tracking/id1030156203 https://apps.apple.com/us/app/purify-block-ads-and-tracking/...
nop90 6y ago
I wouldn't say javascript serves a useful purpose anymore as it's being used to generate entire UIs. It's more a requirement, and performance is taking the heat.
matheusmoreira 6y ago
> I don't understand the disable JS movement Javascript is a privacy and security nightmare. It's almost equivalent to downloading and silently executing untrusted code on your machine. I say "almost" because Javascript code is virtualized and sandboxed. Though I have no doubt people have already discovered vulnerabilities that enable code to break out of the sandbox.
- jolux 6y ago
  The cost-benefit analysis of JavaScript usage comes down on the side of enabling it for most people, because of how much of the web is completely broken without it. Sandbox escapes are rare but extremely valuable, and they absolutely exist: https://www.computerworld.com/article/3186686/google-patches-chrome-bug-from-fizzled-pwn2own-hack.html https://www.computerworld.com/article/3186686/google-patches...
- kordlessagain 6y ago
  > Javascript is a privacy and security nightmare. AFAIK, JavaScript the language has neither privacy nor security issues of "nightmare" level. > It's almost equivalent to downloading and silently executing untrusted code on your machine. No it's not. The code is run in a VM, which is run in a browser. So, the code is limited in doing things to the browser, which itself is limited in what it can do to your computer (files and whatnot). So it's not at all like running untrusted code "on your machine". > I say "almost" because Javascript code is virtualized and sandboxed. It's virtualized (in the browser) such that all the code will run almost the same on different browsers and chipsets. Again, the browser code is what keeps the computer safe from any code it runs, including CSS code or other VMs it may use, like Java or Flash. Also the OS keeps the computer safe from the browser (or at least it should). So, no it's not JavaScript that is the boogeyman here.
  - jachee 6y ago
    My understanding is that JavaScript is the primary mechanism used in browser fingerprinting and cross-site user tracking/"analytics". Isn't that a rather large privacy and (personal, if not specifically "cyber") security risk?
dreamcompiler 6y ago
On a great many web sites I have to spend the first 60 seconds on the site clicking on "X" boxes in popups to make them go away. In many cases there are actually several layers of popups obscuring the content, and some are delayed so they only pop up after you start reading the content. No I do not want to subscribe to your mailing list. No I don't want to take your survey. No I do not want to "chat" with your bot-pretending-to-be-a-human. Yes this is my sixth article from you this month but I will not be paying for a subscription, because I have enough of those already. Yes cookies are OK but I want the minimal set. And no I will not disable my adblocker because doing so makes this whole bloody nightmare even worse. Disabling Javascript makes most of this insulting crap go away, and sometimes it is the only way to read the content.
- pkulak 6y ago
  I just hit reader mode on FF. I didn't know modern sites would even load without JS enabled.
  - 3gg 6y ago
    But you do get the irony, right? It's like a browser is not for reading by default anymore, like stepping into a car and putting it in "car mode".
    - pkulak 6y ago
      Oh yeah. Browsers are application runtimes. They have been for 20 years now.
- pugworthy 6y ago
  I personally visit "a great many websites" daily, and rarely have this problem. Maybe it's uBlock doing it's job, or maybe it's the kind of site you go to?
  - dreamcompiler 6y ago
    Or maybe I need to try uBlock again rather than assuming my Pihole is as good as it gets. Thanks for the suggestion.
1vuio0pswjnm7 6y ago
I must say, honestly, I don't understand the JavaScript (JS) movement. I am not a web developer, perhaps that is the reason. IME, 9 times out of 10, web developers are using JS for non-necessary reasons. The user configurable settings of popular browsers make it easy to designate the small number of sites that actually require JS and keep JS disabled for all other sites. They anticipate that the user will not have one default JS policy for all websites. In other words, these web browsers do not expect that all users should just leave JS enabled/disabled for every website, they acknowledge there will be situations where it should be disabled. However as we all know most users probably never change settings. Doubtful it is a coincidence that all these browsers have JS enabled by default. The number of pages I visit that actually require JS for me to retrieve the content is so small that I can use a client that does not contain a JS interpreter. Warnings and such one finds on web pages informing users that "Javascript is required" are usually false IME. I can still retrieve the content with the use of an HTTP request and no JS. There is nothing inherently wrong with the use of JS. It is nice to have a built-in interpreter in a web browser for certain uses. For example, it makes web-based commerce much easier. However, I believe the largest use of JS today is to support the internet ad industry. Without having automatic execution of code by the browser without user review, approval or even interaction, I do not believe the internet ad "industry" would exist as we know it. I believe this not because I think having a JS or other interpreter is technically necessary, but because these companies have become wholly reliant upon it. That's why disabling JS stopsa remarkable amount of ads and tracking.
kordlessagain 6y ago
The idea that some remote server needs my processing power to display images and text is so ridiculous because it has become normal. These things don't need my processing power, nor do they have a right to it by default. I browse the web with JS disabled by default. If I encounter a site that has trouble with that, I enable it for that site until I can determine if it is worth leaving it enabled, which usually means at some point I'll be back there again and need it on. For the most part, it is a superior experience to what I was seeing before with just an ad blocker. The most noticeable thing about it is probably how many images simply don't load because developers lean on JS for loading and scaling them.
mcovalt 6y ago
Developers have been reimplementing W3C specs in Javascript. Forms don't work, password managers have no idea what's going on, back buttons are hijacked, and sometimes even scrolling is thought to be better handled by a 4MB JavaScript file than by the browser.
- tempestn 6y ago
  Whatever one thinks of that though, aren't those good reasons not to disable javascript?
  - kitsunesoba 6y ago
    They're an even better reason to find alternative sites.
numpad0 6y ago
I ain’t need no Turing complete sandbox on my box run random code from Internet while I skim through HyperText
- RReverser 6y ago
  CSS is Turing complete.
tractorattr 6y ago
really don't you really understand? this is not about how "you" do things, It is more about how it should be done! js is almost never provides want I want when I browse, I expect to get some information! I am not on the circus looking for adventures! people who love to use javascript to prove that they have some kind of taste about how ux etc. I think these people should use some other platform for people who are insterested in show bussniss. think of this as public transportation is designed based on who the driver is that day! is this sound ok to you? do you understand this one? web is just connection to other people, not a tool for others to bully you just bein' smart about "the code" they wrote is brilliant!
deadwisdom 6y ago
That's not the point of this. This is not about disabling JS as a user of websites. Heydon is a developer, and an influencer of developers. He's saying: web development is now absolutely obsessed with JavaScript, and it in no way has to be. The basics, HTML, CSS. That's what's important.
- tempestn 6y ago
  That's a fair take. I was mostly reacting to the other top level comments I saw here.
NautilusWave 6y ago
Seeing as how this site is in part for job opportunity self-promotion, it seems like a decent way to weed out non-technical employers.

deleted 6y ago

[deleted]

zamalek 6y ago

> If you're worried about viruses [...] Not to mention that a host of vulnerabilities were image related a few years back (one of the original rookits exploited a TGA bug). > uBlock Origin Honestly, this is the antivirus of the web. I helped my niece set up my old computer for Minecraft today, and she was explaining how her friend had installed viruses (adware, really) 3 times. Every one of those instances was caused by download link confusion for Minecraft mods. Disabling JavaScript isn't going to save you from being tricked into downloading shady software, only an adblocker will.

sam0x17 6y ago
In my experience Brave Browser (chrome based) runs circles around uBlock origin FYI
- sicromoft 6y ago
  Can you say more? I’m a happy uBlock user — what am I missing by not using Brave?
  - movedx 6y ago
    https://brave.com/ https://brave.com/
    - judge2020 6y ago
      In case the OP wanted to know exactly how Brave's adblock is different from uBlock Origin instead of a link to the marketing page with links to other things like cryptocurrencies: Brave's browser claims a speedup over AdBlock plus, but was inspired by UBO, so the performance is fairly similar, but is baked into the browser instead of being an extension. > We therefore rebuilt our ad-blocker taking inspiration from uBlock Origin and Ghostery’s ad-blocker approach. https://brave.com/improved-ad-blocker-performance/ https://brave.com/improved-ad-blocker-performance/
      - square_usual 6y ago
        It's also written in Rust for performance.
        scaladev 6y ago
        I use a 6 year old desktop which wasn't that great even when I built it, and a pretty terrible 8 year old laptop, and I don't have any problems with uBlock Origin's performance. I have almost every filter list enabled (except for some regional ones), which results in 153486 network and 173646 cosmetic filters total.
        sicromoft 6y ago
        Same here. My take away from these replies is that I'm not missing anything by sticking with uBlock.
        sam0x17 6y ago
        With uBlock origin you're at the whim of the changes Google pushes through to chrome/chromium to nerf it.
- stjohnswarts 6y ago
  No it doesn't. I use Firefox with ubo and Brave (without extensions) for work and I notice no "running circles around" by either browser. While I'm sure brave's native blocking is faster, in human perception the time difference is essentially nil.
- reciprocity 6y ago
  "In my experience", followed by "for your information" - what an empty comment. You've not breathed any substance into your opinion with this post.
matheusmoreira 6y ago
Yeah! After I install uBlock Origin, people seem to stop downloading malware for some reason. Funny how that works...
billyhoffman 6y ago
> one of the original root kits exploited a TGA bug As a lover of old image formats and the security issues they can cause* this sounds fascinating, but some quick google searches don’t seem to surface what you are referencing. Can you share any more details? * I once fell into discovering a memory disclosure flaw with Firefox and XBM images
- edgyquant 6y ago
  There was the github ddos that existed (iirc) as an image that made a request when viewed (I think it actually ran a script) and a couple smaller botnets that used similar functionality in 2018.
- zamalek 6y ago
  Wish I could edit that, I meant jailbreak - which did give root access, technically allowing a host of nefarious use cases.

dx87 6y ago

I keep it disabled just so sites load faster. Except for 1 or 2 sites, I don't care about anything except for the main text on a page, so it's a waste of time to let a ton of javascript run and load/format things that I don't care about.

intrasight 6y ago
I generally visit web pages with JavaScript disabled and them immediately click "reader view". But there are certainly a lot of sites where content is loaded with script, and for those pages I must enabled JS. Q: Does anyone know of a Safari iOS add-in that allows for whitelisting of specific sites to run JS?
- shadowoflight 6y ago
  Not sure if this solves your entire problem, but you can disable all content blockers for any sit in Safari for iOS[1]. [1]: https://www.macrumors.com/how-to/disable-content-blockers-safari-ios/ https://www.macrumors.com/how-to/disable-content-blockers-sa...
  - intrasight 6y ago
    So what I should then be looking for is a good content blocker - one that supports disabling JavaScript. Any recommendations?
    - shadowoflight 6y ago
      No clue on that one, sorry. I’ve been using Purify[1] for ages, but have no clue if it blocks JS - I suspect it blocks only some JS, because my experience of the web isn’t trash while using it, but I do have to disable it sometimes to use the heavily animated navigation systems that some sites implement. [1]: https://apps.apple.com/us/app/purify-block-ads-and-tracking/id1030156203 https://apps.apple.com/us/app/purify-block-ads-and-tracking/...

nop90 6y ago

I wouldn't say javascript serves a useful purpose anymore as it's being used to generate entire UIs. It's more a requirement, and performance is taking the heat.

matheusmoreira 6y ago

> I don't understand the disable JS movement Javascript is a privacy and security nightmare. It's almost equivalent to downloading and silently executing untrusted code on your machine. I say "almost" because Javascript code is virtualized and sandboxed. Though I have no doubt people have already discovered vulnerabilities that enable code to break out of the sandbox.

jolux 6y ago
The cost-benefit analysis of JavaScript usage comes down on the side of enabling it for most people, because of how much of the web is completely broken without it. Sandbox escapes are rare but extremely valuable, and they absolutely exist: https://www.computerworld.com/article/3186686/google-patches-chrome-bug-from-fizzled-pwn2own-hack.html https://www.computerworld.com/article/3186686/google-patches...
kordlessagain 6y ago
> Javascript is a privacy and security nightmare. AFAIK, JavaScript the language has neither privacy nor security issues of "nightmare" level. > It's almost equivalent to downloading and silently executing untrusted code on your machine. No it's not. The code is run in a VM, which is run in a browser. So, the code is limited in doing things to the browser, which itself is limited in what it can do to your computer (files and whatnot). So it's not at all like running untrusted code "on your machine". > I say "almost" because Javascript code is virtualized and sandboxed. It's virtualized (in the browser) such that all the code will run almost the same on different browsers and chipsets. Again, the browser code is what keeps the computer safe from any code it runs, including CSS code or other VMs it may use, like Java or Flash. Also the OS keeps the computer safe from the browser (or at least it should). So, no it's not JavaScript that is the boogeyman here.
- jachee 6y ago
  My understanding is that JavaScript is the primary mechanism used in browser fingerprinting and cross-site user tracking/"analytics". Isn't that a rather large privacy and (personal, if not specifically "cyber") security risk?

dreamcompiler 6y ago

On a great many web sites I have to spend the first 60 seconds on the site clicking on "X" boxes in popups to make them go away. In many cases there are actually several layers of popups obscuring the content, and some are delayed so they only pop up after you start reading the content. No I do not want to subscribe to your mailing list. No I don't want to take your survey. No I do not want to "chat" with your bot-pretending-to-be-a-human. Yes this is my sixth article from you this month but I will not be paying for a subscription, because I have enough of those already. Yes cookies are OK but I want the minimal set. And no I will not disable my adblocker because doing so makes this whole bloody nightmare even worse. Disabling Javascript makes most of this insulting crap go away, and sometimes it is the only way to read the content.

pkulak 6y ago
I just hit reader mode on FF. I didn't know modern sites would even load without JS enabled.
- 3gg 6y ago
  But you do get the irony, right? It's like a browser is not for reading by default anymore, like stepping into a car and putting it in "car mode".
  - pkulak 6y ago
    Oh yeah. Browsers are application runtimes. They have been for 20 years now.
pugworthy 6y ago
I personally visit "a great many websites" daily, and rarely have this problem. Maybe it's uBlock doing it's job, or maybe it's the kind of site you go to?
- dreamcompiler 6y ago
  Or maybe I need to try uBlock again rather than assuming my Pihole is as good as it gets. Thanks for the suggestion.

1vuio0pswjnm7 6y ago

I must say, honestly, I don't understand the JavaScript (JS) movement. I am not a web developer, perhaps that is the reason. IME, 9 times out of 10, web developers are using JS for non-necessary reasons. The user configurable settings of popular browsers make it easy to designate the small number of sites that actually require JS and keep JS disabled for all other sites. They anticipate that the user will not have one default JS policy for all websites. In other words, these web browsers do not expect that all users should just leave JS enabled/disabled for every website, they acknowledge there will be situations where it should be disabled. However as we all know most users probably never change settings. Doubtful it is a coincidence that all these browsers have JS enabled by default. The number of pages I visit that actually require JS for me to retrieve the content is so small that I can use a client that does not contain a JS interpreter. Warnings and such one finds on web pages informing users that "Javascript is required" are usually false IME. I can still retrieve the content with the use of an HTTP request and no JS. There is nothing inherently wrong with the use of JS. It is nice to have a built-in interpreter in a web browser for certain uses. For example, it makes web-based commerce much easier. However, I believe the largest use of JS today is to support the internet ad industry. Without having automatic execution of code by the browser without user review, approval or even interaction, I do not believe the internet ad "industry" would exist as we know it. I believe this not because I think having a JS or other interpreter is technically necessary, but because these companies have become wholly reliant upon it. That's why disabling JS stopsa remarkable amount of ads and tracking.

kordlessagain 6y ago

The idea that some remote server needs my processing power to display images and text is so ridiculous because it has become normal. These things don't need my processing power, nor do they have a right to it by default. I browse the web with JS disabled by default. If I encounter a site that has trouble with that, I enable it for that site until I can determine if it is worth leaving it enabled, which usually means at some point I'll be back there again and need it on. For the most part, it is a superior experience to what I was seeing before with just an ad blocker. The most noticeable thing about it is probably how many images simply don't load because developers lean on JS for loading and scaling them.

mcovalt 6y ago

Developers have been reimplementing W3C specs in Javascript. Forms don't work, password managers have no idea what's going on, back buttons are hijacked, and sometimes even scrolling is thought to be better handled by a 4MB JavaScript file than by the browser.

tempestn 6y ago
Whatever one thinks of that though, aren't those good reasons not to disable javascript?
- kitsunesoba 6y ago
  They're an even better reason to find alternative sites.

numpad0 6y ago

I ain’t need no Turing complete sandbox on my box run random code from Internet while I skim through HyperText

RReverser 6y ago
CSS is Turing complete.

tractorattr 6y ago

really don't you really understand? this is not about how "you" do things, It is more about how it should be done! js is almost never provides want I want when I browse, I expect to get some information! I am not on the circus looking for adventures! people who love to use javascript to prove that they have some kind of taste about how ux etc. I think these people should use some other platform for people who are insterested in show bussniss. think of this as public transportation is designed based on who the driver is that day! is this sound ok to you? do you understand this one? web is just connection to other people, not a tool for others to bully you just bein' smart about "the code" they wrote is brilliant!

deadwisdom 6y ago

That's not the point of this. This is not about disabling JS as a user of websites. Heydon is a developer, and an influencer of developers. He's saying: web development is now absolutely obsessed with JavaScript, and it in no way has to be. The basics, HTML, CSS. That's what's important.

tempestn 6y ago
That's a fair take. I was mostly reacting to the other top level comments I saw here.

NautilusWave 6y ago

Seeing as how this site is in part for job opportunity self-promotion, it seems like a decent way to weed out non-technical employers.