7 ms·

Lets be real, you need to be using JavaScript for the internet to be functional, even within Tor. Anybody claiming they regularly use the internet with JS disab

Lets be real, you need to be using JavaScript for the internet to be functional, even within Tor. Anybody claiming they regularly use the internet with JS disabled is just lying for some sort of feel of superiority.

capitainenemo 4y ago
Hm, this is probably a joke, but I do vast majority of my browsing without javascript (noscript+umatrix or w3m). It's especially pleasant on news sites which are crammed with junk the few times I carelessly open them on the JS-only profile I reserve for Google's app suite.
tragictrash 4y ago
I use brave and browse with JS disabled by default. Some sites don't work, some do. I regularly decide the info I'm looking for can be found somewhere else and back out of a broken site because of it. Some sites I enable and proceed with.
- deleted 4y ago
  [deleted]
- tlrobinson 4y ago
  > I use brave and browse with JS disabled by default. That’s hilarious given the founder of Brave (Brendan Eich) literally invented JavaScript.
  - tragictrash 4y ago
    I mean I'm not arguing JavaScript's utility. Its a tool with a time and place for proper usage.
    - tlrobinson 4y ago
      I'm not arguing, it's just amusing / ironic.
ziddoap 4y ago
For everyday browsing I use NoScript, and rarely allow JS to run (I don't have JS right now!). With Tor, JS is always disabled, 100% of the time. Tor is a niche use case, and not running JS is a cost that comes with the increased anonymity. I'm not using Tor to watch my "How to cook rice" videos or funny cat videos.
- deleted 4y ago
  [deleted]
- divbzero 4y ago
  Which major sites still work just fine without JS? Which ones do you have to avoid?
  - ziddoap 4y ago
    I mean, I don't have JS enabled for HN, although I don't know if you count that as "major". But I'm not really keeping track, honestly. If I come across a website that isn't working with JS, I make the decision "is this worth allowing JS?". Sometimes the answer is yes, sometimes it is no. Often it means enabling the first-party domain to run JS but no others. Conveniently, some of the paywalls on various news sites don't work with JS, but you can still read the article. So that'd be some of them that arguably work better without JS. I don't use Tor for everyday browsing, only for the times I need/want it. In those cases, the equation always equals "no JS" -- that's the reason Im using Tor in the first place. It's a balancing act, as all security always is.
- vinni2 4y ago
  Most important of all porn doesn’t work
  - loxias 4y ago
    I wouldn't be surprised if pornhub-dl exists. ;-)
    - 4y ago
deleted 4y ago
[deleted]
schroeding 4y ago
True, disabling Javascript and surfing the (mainstream) web is deep in the no-fun zone, maybe just above "using Lynx as a day-to-day browser". :D But what one could do is somewhat reduce the risk by only running JavaScript from the actual domain and it's subdomains by default, with something like µMatrix[1]. Most sites are already useable that way, and it's often obvious (to most people on this site) what domains have to be whitelisted to make it fully functual if they aren't. Or actually whitelist the domain for every website on the first visit. Tedious, but you only need to do it once per site. Doing so at least protects a bit against malicious iframes or injected scripts from 3rd party domains, doesn't it? :) [1] https://addons.mozilla.org/de/firefox/addon/umatrix/ https://addons.mozilla.org/de/firefox/addon/umatrix/
- btdmaster 4y ago
  uBlock Origin allows most of those things when it's opted in: https://github.com/gorhill/uBlock/wiki/Dynamic-filtering https://github.com/gorhill/uBlock/wiki/Dynamic-filtering
  - schroeding 4y ago
    Right, and uMatrix is actually not maintained anymore, so this is a better idea than installing uMatrix. :D
- account-5 4y ago
  Is uMatrix being maintained again?
  - schroeding 4y ago
    Oops. It isn't, thank you for the notice. So better don't install uMatrix and use uBlock, which has a similar feature. ^^
nonrandomstring 4y ago
> Lets be real, you need to be using JavaScript for the internet to be functional, Nonsense. I use w3m for browsing and much more than 90 percent of the web works fine. Fully 100 percemt of "the internet" works fine, because that has nothing to do with JavaScript. Please stop over-dramatising and catastrophising as a way to throw cold water on what is a very good security practice. More than one medium security environment I've worked in recently don't allow js (although admittedly the sites we are allowed to access from there are limited).
- sbf501 4y ago
  Wow, talk about proving the parent's point. I just read the top 100 website list and went to some of the top 20, like Yahoo, YouTube, Twitter, Instagram, Amazon, and Live.com (Microsoft). YouTube, Twitter and Instagram don't work at all. Live.com wouldn't let me log in without JS. Amazon worked until checkout. Yahoo worked until login. I think you are incorrect with your "nonsense" judgement, as this top-10 sampling is pretty sensible. EDIT: `ewzimm` makes a good criticism of my analysis: these aren't necessarily the top sites used by Tor. However, how many Tor users (in authoritarian countries or just regular users) don't use it to visit the banned sites on the Top-100 list?
  - Baloo 4y ago
    There are alternatives that will work without JS though.. obviously the majority of people use it by default, but if you don't want to have it enabled there is plenty of other options.
  - ewzimm 4y ago
    If I told you I don’t listen to the Billboard top 100 songs, would you say “nonsense, you don’t listen to music?” I also prefer w3m and find most of the web much better as text only, switching over to another browser when I want video or some other JS feature. Or I can use something like youtube-dl to fetch a video. And there’s much more out there than the top 100 websites.
    - sbf501 4y ago
sneak 4y ago
Ed Snowden said to turn off the fucking scripts. So I did. Most of the web works fine.
omoikane 4y ago
I regularly browse internet via Lynx, which does not support JavaScript. A lot of sites appear to be actively hostile toward Lynx but there are some sites that are very functional and even enjoyable.
mardifoufs 4y ago
Actually some DNMs heavily encourage you or even force you to turn off Javascript before they let you log in/interact with the website. So while I think that JS is probably necessary for most of the regular web, that's not really the case here. It's only true if you use Tor to browse the clear net, which is probably not recommended anyways.
easrng 4y ago
If a hidden service doesn't work without JS it's probably run by feds.
potatototoo99 4y ago
You say that on a website where you don't need JavaScript either.
- kube-system 4y ago
  Rumor is that there are dozens of websites that work without JavaScript.
egberts1 4y ago
Pffft. Even JavaScript is now letting script kiddies make persistent JS things of dubious nature, now that you can write JS to store files.
jason0597 4y ago
> Lets be real, you need to be using JavaScript for the internet to be functional, even within Tor That's incorrect, especially the last part. Dark services work very hard to design their websites to work without JS, due to these exact vulnerabilities. Nobody on the dark web trusts JS, at all.
elipsey 4y ago
I just thought no js just made the internet work better sometimes, and now you're telling me I can be smug about it too? Now how much would you pay? :)
HideousKojima 4y ago
Nonsense. I was hired freelance to create a web forum for someone who wanted it to run on Tor and making everything work without JavaScript was the top requirement. The guy wanted an option to enable JS for those who were willing to trust it, but it was disabled by default and I designed all parts of the forum to run without JS.
- ihattendorf 4y ago
  No one said it's possible to design a site without JavaScript, just that for the vast majority of the internet, including sites user's rely on, it's unusable without it enabled.
  - HideousKojima 4y ago
    I was replying to a poster claiming JS is needed "even within tor"
    - ihattendorf 4y ago
      I understand. And if anyone wants to use one of the sites that requires JavaScript within tor, then JS is needed within tor for them. Just because some random forum was developed to work without JS doesn't help if they want to use a site that wasn't developed to work without JS.
autoexec 4y ago
> Anybody claiming they regularly use the internet with JS disabled is just lying for some sort of feel of superiority. Nope. I do, and I'm not lying. I started because it was required for my work and I just got used to it and now do it everywhere. The internet with NoScript is the best way to browse 90% of the time. Even today, the vast majority of the sites I visit (including the one linked to in this post) work just fine (for what I want) without JS. That means the text I clicked to read is displayed and is readable, the images I clicked to view are displayed, etc. Other parts of the site may not work (menus for example), but if I'm just following a link to an article I want to read and I can read it without javascript why do I care if the menus on the site are broken or if i can't leave a comment? For the sites I regularly visit that really do need JS I enable only the JS files needed to accomplish the things that I want and that's only necessary to do one time for each site. NoScript remembers my preferences on each domain. For those rare occasions I actually need to enable JS to get the functionality I want on a site I'm visiting only once I can just temp allow only the scripts I need to get the content I want and the next time I close my browser (or clear those temp permissions by hand) that site is no longer allowed to use JS. Ill admit that for some random sites I wasn't that interested in in the first place, there are times where I'll still just close the tab and move on. I really don't understand why people think it's so hard to use the web with NoScript. Overall, websites load much faster and look cleaner without JS and I'm much much more secure. Most of the time, it's really not a problem. I will say, I do have an add-on called NukeAnything that lets you right click and remove whatever you want from webpages (only until the page is reloaded) and that occasionally does help fix some issues for sites that don't handle the lack of JS gracefully. If somebody's poorly designed JS heavy menu is spewed all over the page and covering the content I want to see, I can just right click and remove it. Same with obnoxious "we use cookies" banners that I refuse to interact with. Honesty it's the other things I've done to harden the browser (disabling redirects, service workers, WebGL, WebRTC, Wasm, location sharing, DRM, plugins, cookies, web storage, etc.) that cause the most problems with sites, and I do keep another unhardened browser around (brave atm) to handle the sites I absolutely need to access that depend on that junk.
deleted 4y ago
[deleted]
1vuio0pswjnm7 4y ago
I use a text-only browser that has no suport for JS or CSS. I use it to read and comment on HN and to read every website submitted to HN. I have no idea what these websites look like in graphical browsers, but I can read 100% of them. I do not see fonts, images, layout, etc. I just read text and download files. For searching and downloading video from YouTube, I do not even use a text-only browser. I do everything from the command line. The only time I use a graphical browser that runs Javascript is for online shopping, banking and so forth. That is a very small percentage of overall internet use for me.
1vuio0pswjnm7 4y ago
Wikipedia does not require Javascript to be "functional". Also, the "internet" is much more than the www. The majority of protocols used on the internet do not rely on Javascript to be functional.

capitainenemo 4y ago

Hm, this is probably a joke, but I do vast majority of my browsing without javascript (noscript+umatrix or w3m). It's especially pleasant on news sites which are crammed with junk the few times I carelessly open them on the JS-only profile I reserve for Google's app suite.

tragictrash 4y ago

I use brave and browse with JS disabled by default. Some sites don't work, some do. I regularly decide the info I'm looking for can be found somewhere else and back out of a broken site because of it. Some sites I enable and proceed with.

deleted 4y ago
[deleted]
tlrobinson 4y ago
> I use brave and browse with JS disabled by default. That’s hilarious given the founder of Brave (Brendan Eich) literally invented JavaScript.
- tragictrash 4y ago
  I mean I'm not arguing JavaScript's utility. Its a tool with a time and place for proper usage.
  - tlrobinson 4y ago
    I'm not arguing, it's just amusing / ironic.

ziddoap 4y ago

For everyday browsing I use NoScript, and rarely allow JS to run (I don't have JS right now!). With Tor, JS is always disabled, 100% of the time. Tor is a niche use case, and not running JS is a cost that comes with the increased anonymity. I'm not using Tor to watch my "How to cook rice" videos or funny cat videos.

deleted 4y ago
[deleted]
divbzero 4y ago
Which major sites still work just fine without JS? Which ones do you have to avoid?
- ziddoap 4y ago
  I mean, I don't have JS enabled for HN, although I don't know if you count that as "major". But I'm not really keeping track, honestly. If I come across a website that isn't working with JS, I make the decision "is this worth allowing JS?". Sometimes the answer is yes, sometimes it is no. Often it means enabling the first-party domain to run JS but no others. Conveniently, some of the paywalls on various news sites don't work with JS, but you can still read the article. So that'd be some of them that arguably work better without JS. I don't use Tor for everyday browsing, only for the times I need/want it. In those cases, the equation always equals "no JS" -- that's the reason Im using Tor in the first place. It's a balancing act, as all security always is.
vinni2 4y ago
Most important of all porn doesn’t work
- loxias 4y ago
  I wouldn't be surprised if pornhub-dl exists. ;-)
  - 4y ago

deleted 4y ago

[deleted]

schroeding 4y ago

True, disabling Javascript and surfing the (mainstream) web is deep in the no-fun zone, maybe just above "using Lynx as a day-to-day browser". :D But what one could do is somewhat reduce the risk by only running JavaScript from the actual domain and it's subdomains by default, with something like µMatrix[1]. Most sites are already useable that way, and it's often obvious (to most people on this site) what domains have to be whitelisted to make it fully functual if they aren't. Or actually whitelist the domain for every website on the first visit. Tedious, but you only need to do it once per site. Doing so at least protects a bit against malicious iframes or injected scripts from 3rd party domains, doesn't it? :) [1] https://addons.mozilla.org/de/firefox/addon/umatrix/ https://addons.mozilla.org/de/firefox/addon/umatrix/

btdmaster 4y ago
uBlock Origin allows most of those things when it's opted in: https://github.com/gorhill/uBlock/wiki/Dynamic-filtering https://github.com/gorhill/uBlock/wiki/Dynamic-filtering
- schroeding 4y ago
  Right, and uMatrix is actually not maintained anymore, so this is a better idea than installing uMatrix. :D
account-5 4y ago
Is uMatrix being maintained again?
- schroeding 4y ago
  Oops. It isn't, thank you for the notice. So better don't install uMatrix and use uBlock, which has a similar feature. ^^

nonrandomstring 4y ago

> Lets be real, you need to be using JavaScript for the internet to be functional, Nonsense. I use w3m for browsing and much more than 90 percent of the web works fine. Fully 100 percemt of "the internet" works fine, because that has nothing to do with JavaScript. Please stop over-dramatising and catastrophising as a way to throw cold water on what is a very good security practice. More than one medium security environment I've worked in recently don't allow js (although admittedly the sites we are allowed to access from there are limited).

sbf501 4y ago
Wow, talk about proving the parent's point. I just read the top 100 website list and went to some of the top 20, like Yahoo, YouTube, Twitter, Instagram, Amazon, and Live.com (Microsoft). YouTube, Twitter and Instagram don't work at all. Live.com wouldn't let me log in without JS. Amazon worked until checkout. Yahoo worked until login. I think you are incorrect with your "nonsense" judgement, as this top-10 sampling is pretty sensible. EDIT: `ewzimm` makes a good criticism of my analysis: these aren't necessarily the top sites used by Tor. However, how many Tor users (in authoritarian countries or just regular users) don't use it to visit the banned sites on the Top-100 list?
- Baloo 4y ago
  There are alternatives that will work without JS though.. obviously the majority of people use it by default, but if you don't want to have it enabled there is plenty of other options.
- ewzimm 4y ago
  If I told you I don’t listen to the Billboard top 100 songs, would you say “nonsense, you don’t listen to music?” I also prefer w3m and find most of the web much better as text only, switching over to another browser when I want video or some other JS feature. Or I can use something like youtube-dl to fetch a video. And there’s much more out there than the top 100 websites.
  - sbf501 4y ago

sneak 4y ago

Ed Snowden said to turn off the fucking scripts. So I did. Most of the web works fine.

omoikane 4y ago

I regularly browse internet via Lynx, which does not support JavaScript. A lot of sites appear to be actively hostile toward Lynx but there are some sites that are very functional and even enjoyable.

mardifoufs 4y ago

Actually some DNMs heavily encourage you or even force you to turn off Javascript before they let you log in/interact with the website. So while I think that JS is probably necessary for most of the regular web, that's not really the case here. It's only true if you use Tor to browse the clear net, which is probably not recommended anyways.

easrng 4y ago

If a hidden service doesn't work without JS it's probably run by feds.

potatototoo99 4y ago

You say that on a website where you don't need JavaScript either.

kube-system 4y ago
Rumor is that there are dozens of websites that work without JavaScript.

egberts1 4y ago

Pffft. Even JavaScript is now letting script kiddies make persistent JS things of dubious nature, now that you can write JS to store files.

jason0597 4y ago

> Lets be real, you need to be using JavaScript for the internet to be functional, even within Tor That's incorrect, especially the last part. Dark services work very hard to design their websites to work without JS, due to these exact vulnerabilities. Nobody on the dark web trusts JS, at all.

elipsey 4y ago

I just thought no js just made the internet work better sometimes, and now you're telling me I can be smug about it too? Now how much would you pay? :)

HideousKojima 4y ago

Nonsense. I was hired freelance to create a web forum for someone who wanted it to run on Tor and making everything work without JavaScript was the top requirement. The guy wanted an option to enable JS for those who were willing to trust it, but it was disabled by default and I designed all parts of the forum to run without JS.

ihattendorf 4y ago
No one said it's possible to design a site without JavaScript, just that for the vast majority of the internet, including sites user's rely on, it's unusable without it enabled.
- HideousKojima 4y ago
  I was replying to a poster claiming JS is needed "even within tor"
  - ihattendorf 4y ago
    I understand. And if anyone wants to use one of the sites that requires JavaScript within tor, then JS is needed within tor for them. Just because some random forum was developed to work without JS doesn't help if they want to use a site that wasn't developed to work without JS.

autoexec 4y ago

> Anybody claiming they regularly use the internet with JS disabled is just lying for some sort of feel of superiority. Nope. I do, and I'm not lying. I started because it was required for my work and I just got used to it and now do it everywhere. The internet with NoScript is the best way to browse 90% of the time. Even today, the vast majority of the sites I visit (including the one linked to in this post) work just fine (for what I want) without JS. That means the text I clicked to read is displayed and is readable, the images I clicked to view are displayed, etc. Other parts of the site may not work (menus for example), but if I'm just following a link to an article I want to read and I can read it without javascript why do I care if the menus on the site are broken or if i can't leave a comment? For the sites I regularly visit that really do need JS I enable only the JS files needed to accomplish the things that I want and that's only necessary to do one time for each site. NoScript remembers my preferences on each domain. For those rare occasions I actually need to enable JS to get the functionality I want on a site I'm visiting only once I can just temp allow only the scripts I need to get the content I want and the next time I close my browser (or clear those temp permissions by hand) that site is no longer allowed to use JS. Ill admit that for some random sites I wasn't that interested in in the first place, there are times where I'll still just close the tab and move on. I really don't understand why people think it's so hard to use the web with NoScript. Overall, websites load much faster and look cleaner without JS and I'm much much more secure. Most of the time, it's really not a problem. I will say, I do have an add-on called NukeAnything that lets you right click and remove whatever you want from webpages (only until the page is reloaded) and that occasionally does help fix some issues for sites that don't handle the lack of JS gracefully. If somebody's poorly designed JS heavy menu is spewed all over the page and covering the content I want to see, I can just right click and remove it. Same with obnoxious "we use cookies" banners that I refuse to interact with. Honesty it's the other things I've done to harden the browser (disabling redirects, service workers, WebGL, WebRTC, Wasm, location sharing, DRM, plugins, cookies, web storage, etc.) that cause the most problems with sites, and I do keep another unhardened browser around (brave atm) to handle the sites I absolutely need to access that depend on that junk.

deleted 4y ago

[deleted]

1vuio0pswjnm7 4y ago

I use a text-only browser that has no suport for JS or CSS. I use it to read and comment on HN and to read every website submitted to HN. I have no idea what these websites look like in graphical browsers, but I can read 100% of them. I do not see fonts, images, layout, etc. I just read text and download files. For searching and downloading video from YouTube, I do not even use a text-only browser. I do everything from the command line. The only time I use a graphical browser that runs Javascript is for online shopping, banking and so forth. That is a very small percentage of overall internet use for me.

1vuio0pswjnm7 4y ago

Wikipedia does not require Javascript to be "functional". Also, the "internet" is much more than the www. The majority of protocols used on the internet do not rely on Javascript to be functional.