4 ms·

Doesn't the tor browser disable javascript entirely?

by archontes 4y ago

checkyoursudo 4y ago
The user can enable javascript.
DoItToMe81 4y ago
It does not. Noscript is set by default to allow scripts.
- deleted 4y ago
  [deleted]
deleted 4y ago
[deleted]
jwilk 4y ago
https://support.torproject.org/tbb/tbb-34/ https://support.torproject.org/tbb/tbb-34/ > We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them.
- johnisgood 4y ago
  That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff. [1] https://openresty.org/ https://openresty.org/, https://github.com/openresty/lua-nginx-module https://github.com/openresty/lua-nginx-module
  - Scoundreller 4y ago
    What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it. (Fuck you imgur)
    - dvngnt_ 4y ago
      if I build a site using react, is there a way to fallback to plain HTML?
      - actualwitch 4y ago
        It's called SSR, but unless you invest a ton of effort into architecture, it won't fallback to the point where buttons and links still work without js, it will just render.
      - soiler 4y ago
        if it's statically generated, yes. you can write an entire site in React using eg GatsbyJS, and it will be built ahead of time, and pages will be available as static HTML.
    - nyanpasu64 4y ago
      LibRedirect (https://libredirect.github.io/ https://libredirect.github.io/) can proxy Imgur, Fandom, Medium, and other links to no-JS alternative proxies, though some of the proxies are down or have broken Fandom images, and you have to disable the specific websites so you won't be redirected again.
- seanw444 4y ago
  Yikes. I thought the point of Tor was uncompromising security? This is going to bite some less-experienced people in the ass.
  - Scoundreller 4y ago
    It has. The NoScript approach is dumb because it easily supports temporary and permanent white-listing of sites, which is agreeable to many (but still problematic depending on what your risk profile). With NoScript’s current approach, you get ruined when your JavaScript-free-optimized starts sending you nasty JavaScript.
  - CommitSyn 4y ago
    JavaScript used to be disabled by default but too many users were complaining about pages not working. It's not very useful if you're a CFO trying to leak financial documents to a journalist but the website won't work. Tech-literate people use JavaScript.enabled=false in about:config.
    - staringback 4y ago
      You don't even need to use about:config, it is as simple as setting Security level to "Highest" using the button on the toolbar

Doesn't the tor browser disable javascript entirely?

checkyoursudo 4y ago

The user can enable javascript.

DoItToMe81 4y ago

It does not. Noscript is set by default to allow scripts.

deleted 4y ago
[deleted]

deleted 4y ago

[deleted]

jwilk 4y ago

https://support.torproject.org/tbb/tbb-34/ https://support.torproject.org/tbb/tbb-34/ > We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them.

johnisgood 4y ago
That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff. [1] https://openresty.org/ https://openresty.org/, https://github.com/openresty/lua-nginx-module https://github.com/openresty/lua-nginx-module
- Scoundreller 4y ago
  What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it. (Fuck you imgur)
  - dvngnt_ 4y ago
    if I build a site using react, is there a way to fallback to plain HTML?
    - actualwitch 4y ago
      It's called SSR, but unless you invest a ton of effort into architecture, it won't fallback to the point where buttons and links still work without js, it will just render.
    - soiler 4y ago
      if it's statically generated, yes. you can write an entire site in React using eg GatsbyJS, and it will be built ahead of time, and pages will be available as static HTML.
  - nyanpasu64 4y ago
    LibRedirect (https://libredirect.github.io/ https://libredirect.github.io/) can proxy Imgur, Fandom, Medium, and other links to no-JS alternative proxies, though some of the proxies are down or have broken Fandom images, and you have to disable the specific websites so you won't be redirected again.
seanw444 4y ago
Yikes. I thought the point of Tor was uncompromising security? This is going to bite some less-experienced people in the ass.
- Scoundreller 4y ago
  It has. The NoScript approach is dumb because it easily supports temporary and permanent white-listing of sites, which is agreeable to many (but still problematic depending on what your risk profile). With NoScript’s current approach, you get ruined when your JavaScript-free-optimized starts sending you nasty JavaScript.
- CommitSyn 4y ago
  JavaScript used to be disabled by default but too many users were complaining about pages not working. It's not very useful if you're a CFO trying to leak financial documents to a journalist but the website won't work. Tech-literate people use JavaScript.enabled=false in about:config.
  - staringback 4y ago
    You don't even need to use about:config, it is as simple as setting Security level to "Highest" using the button on the toolbar