5 ms·

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad.

everdrive 3y ago
It's simple; the web becomes a much nicer place when you block javascript by default. Some things don't work, but they never compromise you, or bog down your computer, and throw huge ads and banners in your face. I could go on. I obviously see that JS can be used for good things, but it seems like people can't constrain themselves to that.
simion314 3y ago
>I'll never understand why the default stance on HN is always javascript bad. I am a web dev, and I agree that JS on the web is bad for pages that should be just documents like a news webpage or wiki page. JS makes sense for applications like a video game, video/audio/level/text editor, or some internal app that your company trust, but for random untrusted document pages JavaScript is a detriment, even if we only consider UX.
- andybak 3y ago
  You're a web developer but your mental map of the web consists of "documents" on one end and "applications like a video game, video/audio/level/text editor(s)" on the other? You haven't in your career, stumbled across web (sites/apps) that sit somewhere on the spectrum between the extremes of "document" vs "app"? It strikes me that there's a fairly even distribution between those two points - even if we discount all the misguided "could have been a static site but someone decided it had to be an app" decisions. I actually agree with you on reigning in javascript but I think much of the web is poorer without it. We had an answer for this years back and it was called "progressive enhancement".
  - simion314 3y ago
    Most links we opened daily are to read stuff not to interact with stuff, either read documentation, read news, read some social media page. Those pages should be readable without scripting but for some reason they do not load at all without JS.
    - andybak 3y ago
      Yes. That was the bit where I mentioned "progressive enhancement".
  - thedaly 3y ago
    > Progressive enhancement is a strategy in web design that puts emphasis on web content first, allowing everyone to access the basic content and functionality of a web page, whilst users with additional browser features or faster Internet access receive the enhanced version instead. Why isn't this still the norm?
    - andybak 3y ago
      The ascent of SPA frameworks and the inexorable allure of "Development by CV".
tremon 3y ago
I don't think it's a matter of trust and awareness, because your browser is already happily executing the javascript payload before you have decided whether to trust the website or not. And users are completely unaware of what the payload is doing unless it's spinning at 100% cpu or throwing UI elements in the user's face. It's a matter of convenience mostly, from my point of view. The HN population consists for a large part of computer power users and developers who are fully aware of the capabilities of browsers and the dangers of remote code execution. I'll never understand why the default stance on HN still mostly seems to be javascript good, if not for the convenience factor.
- dylan604 3y ago
  The browser had Javascript ON or Javascript OFF. If the browser had JS off for all until user whitelists the site, that would negate the need for plugins like uBO/NoScript/etc.
klyrs 3y ago
Your browser is a platform that downloads and runs arbitrary code on your local hardware. "JavaScript bad" doesn't capture the nuance I read in people's comments here, but history shows that JavaScript is a gaping maw of security nightmares.
- sublinear 3y ago
  Modern browsers are what have removed the nuance. Please tell me what about the Web API for JS is truly dangerous. Native apps and programmable documents (PDFs and spreadsheets for example) are the real security nightmare. The danger on the web lies squarely with easily fooled idiots visiting shady sites.
  - amelius 3y ago
    Fingerprinting is one example.
  - klyrs 3y ago
    For me personally it isn't as much "danger" as annoyance. Most of the web is hidden behind piles of modals, dickbars, autoplay videos, etc. Almost none of that happens without javascript. But don't dismiss those fools, they're inside sensitive networks around the world.

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad.

everdrive 3y ago

It's simple; the web becomes a much nicer place when you block javascript by default. Some things don't work, but they never compromise you, or bog down your computer, and throw huge ads and banners in your face. I could go on. I obviously see that JS can be used for good things, but it seems like people can't constrain themselves to that.

simion314 3y ago

>I'll never understand why the default stance on HN is always javascript bad. I am a web dev, and I agree that JS on the web is bad for pages that should be just documents like a news webpage or wiki page. JS makes sense for applications like a video game, video/audio/level/text editor, or some internal app that your company trust, but for random untrusted document pages JavaScript is a detriment, even if we only consider UX.

andybak 3y ago
You're a web developer but your mental map of the web consists of "documents" on one end and "applications like a video game, video/audio/level/text editor(s)" on the other? You haven't in your career, stumbled across web (sites/apps) that sit somewhere on the spectrum between the extremes of "document" vs "app"? It strikes me that there's a fairly even distribution between those two points - even if we discount all the misguided "could have been a static site but someone decided it had to be an app" decisions. I actually agree with you on reigning in javascript but I think much of the web is poorer without it. We had an answer for this years back and it was called "progressive enhancement".
- simion314 3y ago
  Most links we opened daily are to read stuff not to interact with stuff, either read documentation, read news, read some social media page. Those pages should be readable without scripting but for some reason they do not load at all without JS.
  - andybak 3y ago
    Yes. That was the bit where I mentioned "progressive enhancement".
- thedaly 3y ago
  > Progressive enhancement is a strategy in web design that puts emphasis on web content first, allowing everyone to access the basic content and functionality of a web page, whilst users with additional browser features or faster Internet access receive the enhanced version instead. Why isn't this still the norm?
  - andybak 3y ago
    The ascent of SPA frameworks and the inexorable allure of "Development by CV".

tremon 3y ago

I don't think it's a matter of trust and awareness, because your browser is already happily executing the javascript payload before you have decided whether to trust the website or not. And users are completely unaware of what the payload is doing unless it's spinning at 100% cpu or throwing UI elements in the user's face. It's a matter of convenience mostly, from my point of view. The HN population consists for a large part of computer power users and developers who are fully aware of the capabilities of browsers and the dangers of remote code execution. I'll never understand why the default stance on HN still mostly seems to be javascript good, if not for the convenience factor.

dylan604 3y ago
The browser had Javascript ON or Javascript OFF. If the browser had JS off for all until user whitelists the site, that would negate the need for plugins like uBO/NoScript/etc.

klyrs 3y ago

Your browser is a platform that downloads and runs arbitrary code on your local hardware. "JavaScript bad" doesn't capture the nuance I read in people's comments here, but history shows that JavaScript is a gaping maw of security nightmares.

sublinear 3y ago
Modern browsers are what have removed the nuance. Please tell me what about the Web API for JS is truly dangerous. Native apps and programmable documents (PDFs and spreadsheets for example) are the real security nightmare. The danger on the web lies squarely with easily fooled idiots visiting shady sites.
- amelius 3y ago
  Fingerprinting is one example.
- klyrs 3y ago
  For me personally it isn't as much "danger" as annoyance. Most of the web is hidden behind piles of modals, dickbars, autoplay videos, etc. Almost none of that happens without javascript. But don't dismiss those fools, they're inside sensitive networks around the world.