4 ms·

> I am almost willing to bet $$$ that they would be fine if they had JS disabled. I am fully willing to bet $$$$ that they would be fine if they had air gapped

> I am almost willing to bet $$$ that they would be fine if they had JS disabled. I am fully willing to bet $$$$ that they would be fine if they had air gapped their computer. Unfortunately, disabling JS is only marginally more practical than completely foregoing access to the web; and it is only going to get worse as more sites and services rely on JS.

superkuh 6y ago
It really depends on what you do. Amazon.com, for example, works perfectly fine with javascript disabled. They do it because they care about selling to everyone and know that even people with old computers and old software buy things. Web devs keep repeating to themselves that no one browses with JS off but you can't see the ones that have it off if all you use to survey is JS itself.
- g_p 6y ago
  Gov.UK is built around an assumption users have no or broken JavaScript, based on some of their research into how people use the site. When running at scale, they found about 1 in 93 visitors didn't have working JavaScript. [1] Mid startup hustle it makes sense for people to start ignoring this. But if you adopt a mindset of serving users, you'll quickly see why they went with this approach - progressive enhancement of the site based on the capabilities that work, with a fully functional experience extending from lynx and upwards. [2] [1] https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missing-out-on-javascript-enhancement/ https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missi... [2] https://technology.blog.gov.uk/2016/09/19/why-we-use-progressive-enhancement-to-build-gov-uk/ https://technology.blog.gov.uk/2016/09/19/why-we-use-progres...
  - saagarjha 6y ago
    “It’s just 1% of our users!”
  - andi999 6y ago
    Probably the 1 was an unidentified robot...
nickysielicki 6y ago
The real solution, which is perfectly practical and realistic, is to install umatrix and put it into strict mode, then whitelist domains that you trust and use often. Give it a week and you’ll find yourself very rarely having to make policy changes. We spend most of our time on just a handful of sites.
- everybodyknows 6y ago
  UMatrix is now “Archived” i.e. unsupported: https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix https://news.ycombinator.com/item?id=24532973 https://news.ycombinator.com/item?id=24532973
peteretep 6y ago
> disabling JS is only marginally more practical than completely foregoing access to the web Have you tried it, white-listing the sites that actually need it? Works pretty well
- superjan 6y ago
  I would love to be able to do that on iOS.
BelenusMordred 6y ago
> Unfortunately, disabling JS is only marginally more practical I've done it for years and it's fine if you are willing to put in 2 seconds of effort here and there, besides some redirects for online purchases it's mostly painless. Also no one needs to be making bets here, they were seemingly hit by something that Google still can't identify, from the article: > the researchers have followed a link on Twitter to a write-up hosted on blog.br0vvnn[.]io, and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server. At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions.

superkuh 6y ago

It really depends on what you do. Amazon.com, for example, works perfectly fine with javascript disabled. They do it because they care about selling to everyone and know that even people with old computers and old software buy things. Web devs keep repeating to themselves that no one browses with JS off but you can't see the ones that have it off if all you use to survey is JS itself.

g_p 6y ago
Gov.UK is built around an assumption users have no or broken JavaScript, based on some of their research into how people use the site. When running at scale, they found about 1 in 93 visitors didn't have working JavaScript. [1] Mid startup hustle it makes sense for people to start ignoring this. But if you adopt a mindset of serving users, you'll quickly see why they went with this approach - progressive enhancement of the site based on the capabilities that work, with a fully functional experience extending from lynx and upwards. [2] [1] https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missing-out-on-javascript-enhancement/ https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missi... [2] https://technology.blog.gov.uk/2016/09/19/why-we-use-progressive-enhancement-to-build-gov-uk/ https://technology.blog.gov.uk/2016/09/19/why-we-use-progres...
- saagarjha 6y ago
  “It’s just 1% of our users!”
- andi999 6y ago
  Probably the 1 was an unidentified robot...

nickysielicki 6y ago

The real solution, which is perfectly practical and realistic, is to install umatrix and put it into strict mode, then whitelist domains that you trust and use often. Give it a week and you’ll find yourself very rarely having to make policy changes. We spend most of our time on just a handful of sites.

everybodyknows 6y ago
UMatrix is now “Archived” i.e. unsupported: https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix https://news.ycombinator.com/item?id=24532973 https://news.ycombinator.com/item?id=24532973

peteretep 6y ago

> disabling JS is only marginally more practical than completely foregoing access to the web Have you tried it, white-listing the sites that actually need it? Works pretty well

superjan 6y ago
I would love to be able to do that on iOS.

BelenusMordred 6y ago

> Unfortunately, disabling JS is only marginally more practical I've done it for years and it's fine if you are willing to put in 2 seconds of effort here and there, besides some redirects for online purchases it's mostly painless. Also no one needs to be making bets here, they were seemingly hit by something that Google still can't identify, from the article: > the researchers have followed a link on Twitter to a write-up hosted on blog.br0vvnn[.]io, and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server. At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions.