6 ms·

> Does the corporate firewall block JavaScript? Because loads of them still do. [citation needed] > Does their ISP or mobile operator interfere with downloade

> Does the corporate firewall block JavaScript? Because loads of them still do. [citation needed] > Does their ISP or mobile operator interfere with downloaded JavaScript? Sky accidentally block jQuery, Comcast insert ads into your script, and if you've never experienced this before, drive to an airport and use their wifi. Ever heard of HTTPS? > Do they have addons or plugins installed which inject script or alter the DOM in ways you didn't anticipate? There are thousands of browser extensions. Are you sure none interfere with your JS? If the user installs an extension that breaks the web, it’s the user’s fault, and the developers should not cater to them.

karma_pharmer 3y ago
Ever heard of HTTPS? Ever heard of SSL MITM Proxy? Required by law (and corporate compliance departments) in many industries. Also, cloudflare. They are the MITM for what, like 80% of the internet now?
- red_admiral 3y ago
  Cloudflare does not fiddle with or inject JS without the server's consent. They're not comcast.
  - karma_pharmer 3y ago
    /me laughs so hard that milk shoots out of his nose
    - nolist_policy 3y ago
      This. The Cloudflare captcha page exists and will send you in an endless loop while you're on a 3g connection.
      - username923409 3y ago
        Not sure if this is the same kind of "endless loop" that I've experience on the Cloudflare captcha page; while on a VPN, the only way I can get past the "I am a Human" captcha is to refresh the page and click the area where the checkbox appears as fast as I can with my mouse before it even appears. It might take two or three tries, but it hasn't failed yet. I have no idea why this works so well, but I haven't found another way (other than getting off of my VPN) to get past this screening page.
- zarzavat 3y ago
  This doesn’t work unless you have access to the device, which mobile ISPs surely don’t. Some countries might mandate it but I don’t think it’s a feature to make your websites police state approved.
  - bravetraveler 3y ago
    Corporate is the key part being missed here They provide the device(s), they have access to it. Countless ways to mess with the trust. If anyone thinks they're safe from their employer due to SSL, lol.
    - zarzavat 3y ago
      I know that but the original comment was in response to: > Does their ISP or mobile operator interfere with downloaded JavaScript? In any case, if some rogue corporate proxy breaks your website, then either they pay you to fix it or you tell them to get lost.
      - bravetraveler 3y ago
        Totally fair, not a judgement - just being a reminder down here in the thread
- apienx 3y ago
  > Required by law (and corporate compliance departments) in many industries. Could you please provide details about this?
  - 7bit 3y ago
    Also very curious about this. And yes, there are companies that do that - and then it's usually called Deep Packet Inspection or similar, not MITM, because that's a term attributed to malicious parties. And in that case, the proxy can both, manipulate the JS as well as the HTML, so the argument of the linked page is still faulty.
  - 7bit 3y ago
    Ndjd she eje
  - karma_pharmer 3y ago
    Here, knock yourself out: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query="ssl+inspection"&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=zscaler&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://finance.yahoo.com/news/zscaler-announces-fedramp-process-milestone-130000216.html https://finance.yahoo.com/news/zscaler-announces-fedramp-pro...
    - apienx 3y ago
      Thank you. I don’t doubt that certain governments twist the arms of companies for privileged access. From my understanding, however, those practices are not the norm in the west (and certainly not overtly codified). IMHO, 90%+ of the data captured in the “West” is from exploits and such.
- sccxy 3y ago
  > Also, cloudflare. They are the MITM for what, like 80% of the internet now? Please give source for that claim where Cloudflare implements man-in-the-middle attack.
  - kachapopopow 3y ago
    [dead]
  - tasuki 3y ago
    The person you're replying to said cloudflare was the man in the middle. Not that they executed attacks.
- Kwpolska 3y ago
  Cloudflare may be MITM, but with the consent of the website owner. If they break JS (which I doubt they would), the website owner would certainly notice. Police states and "internet security" mal^H^H^Hsoftware may MITM stuff. If you're actually doing business with customers in those police states, you probably have someone local who can test. "Internet security" software is unlikely to break things just to insert ads (as the ISP mentioned in the post did over plain HTTP).
- deleted 3y ago
  [deleted]
lelanthran 3y ago
Yeah, agreed. The general tone of the flowchart is misleading: tons of paths lead to "cannot use javascript" and only one leads to "can use javascript" creates the misleading implication that the probability of the user having JS is low and the reverse probability is high. The articles point seems to be: if you're writing a webapp or anything interactive, then a mere 99.999% of visitors will be able to use the content.
- blowski 3y ago
  This whole topic is as interesting as "tabs vs spaces" or "emacs vs vim". There's a vocal minority of people that want to tell everybody else how the web should work, and everybody has ignored them for the last 20 years, and will continue to ignore them.
muxator 3y ago
> if the user installs an extension that breaks the web It does not break the web. It may break single sites that were written on naive assumptions; I see a lot of sites break because my extensions do not allow loading analytics libraries. This means their js was dependent on this libraries being actually active. I'd say this is case a case of _unbreaking_ the web.
- sccxy 3y ago
  Still user decides to use crappy extension to break websites. Some users send me email that they cannot see images on my website. They have adblocker rule where they block all images which contain ad. So dsa231dfsaade.jpg is blocked. And you say that is website developers fault?
  - radiospiel 3y ago
    Of course you can decide to not serve those visitors. But if you want to capture as much as possible of your target audience you might want to consider which users can’t see your website - and the OP raises a number of non-obvious ways where JS adoption might affect that.
    - sccxy 3y ago
      Sorry, but your comments text contained “target” it is blocked keyword and adblocker removed it. Can you reword your comment?
  - cqqxo4zV46cp 3y ago
    Your example is a bit extreme, and it sounds like you are talking about you are talking about your own website which, with all due respect, I doubt anyone else is remotely invested in the success of, so you as a developer have an unusual degree of freedom to be this dismissive. In the real world, anyone who is as dismissive as you is likely in a position where they’re going to have a boss telling them to pull their head in. The reality is the vast vast majority of users won’t know have a clue how ‘disrespectful’ the browser extension they’ve installed is of ‘the wishes of the developer’ or whatever, and a poor customer experience is a poor customer experience, no matter whose “fault” it is.
rasso 3y ago
So, you have found three points that might not apply. Does that make the point of the article invalid? I think it doesn‘t.
- Kwpolska 3y ago
  Those are the three arguments I find the least believable. Other arguments are also questionable in 2024. 2G networks are not really usable for Internet consumption. Outages or failures happen, but they can happen for a HTML-only page. Pages where the primary goal is content consumption should use progressive enhancement and limited scripting, but it doesn’t really make much sense for applications.
hilbert42 3y ago
"If the user installs an extension that breaks the web, it’s the user’s fault, and the developers should not cater to them." Likely so. My normal default is to browse the Web without JavaScript enabled, I've worked the Web this way since the 1990s. The reasons are: (a) The web runs just so much faster without JS, also those jitters, pauses and delays caused by JS simply disappear. If people knew how much faster the non-JS mode actually is then many more would partake of it. (b) These days, many web pages are enormous, it's not unusual to see pages that are over 7 or 8MB in size, they're so slow that one can just about have a coffee break before they load. Disable JS in one of these pages and its content can be well in excess of an order of magnitude smaller. (c) Without JS, ads are almost a thing of the past. I don't bother to run ad-blockers simply because I don't have to. Without JS ads simply don't download. (d) Without JS much of the online spying and tracking simply disappears. Those who want to track users can't help themselves from using JS (it seems to go with the territory). (e) Without JS, annoying audio and videos don't start automatically. That's good because if I want to watch the content I can just copy its link to say NewPipe and have a much more pleasant experience. (f) Without JS, pop-ups and messages such as those that ask for permission to accept cookies don't appear, similarly so for those asking for donations. Many web operators wait for a few seconds before displaying these messages, by that time one's already reading page content so the message is aimed to deliberately distract the viewer. Notable offenders are the Guardian and Wiki especially during its money drives, but there are thousands more just like them. (g) Web browsing sans JS is more secure, there's less chance of receiving nefarious scripts etc. It's not JavaScript that's the problem, rather it is web developers who actually abuse it to end users' considerable disadvantage. Turning off JS is my attempt to level the playing field. People ask how I manage with sites that have key functions that require JS to work and without which the sites are useless. Several answers: first, sometimes I do have to turn on JS but it's certainly more the exception than the rule. To turn JS on/off I just hit a toggle button on the browser that invokes say the QuickJava add-on (and I never bother using 'cantankerous' browsers such as Chrome, Edge, etc.). Second, when I come across a website that only displays a blank page if JS is disabled and or requires JS for some key function to work then I simply move onto somewhere else! If any web developers who adopt such practices are reading this then let me tell you categorically that there's nothing else that will get me off that site faster than that, in a sub-second I'm out of there. QED! Third, people say I'm missing out on many web enhancements by turning off JS. Often that's true but in most instances I just do not want them. I find most pages that use these visual enhancements distracting and or outright annoying. When I read a book I do not expect everything on the page to be continually popping in and out, same goes for webpages. What's nice about HN's website is that its pages are static and they carry no superfluous junk. That's how I like it. In my opinion prerequisite training for web developers ought to be a compulsory course on human ergonomics (they'd then perhaps better understand what Web surfers actually want to view and then design their pages accordingly). Finally, I'd add that I've noticed repeatedly over the years that websites with the largest size pages and those which include the most superfluous amount of junk are also the sites whose content I find least interesting. The fact is there's just so much content on the web that if 99% of websites were of the type that I've no interest in visiting then I still wouldn't have time to visit all the others in my lifetime (I can afford to be very choosy). In essence, on the Web it's easy to set one's own rules and be choosy about what one views. And I'm sure the reason for why not more act as I do is that many have been forced into using the narrow webcasting as offered by the big internet giants. They of course all require surfers to have JavaScript enabled.
6510 3y ago
It could be interesting to explore how things fail. If it is supper easy to fix ill do it.

karma_pharmer 3y ago

Ever heard of HTTPS? Ever heard of SSL MITM Proxy? Required by law (and corporate compliance departments) in many industries. Also, cloudflare. They are the MITM for what, like 80% of the internet now?

red_admiral 3y ago
Cloudflare does not fiddle with or inject JS without the server's consent. They're not comcast.
- karma_pharmer 3y ago
  /me laughs so hard that milk shoots out of his nose
  - nolist_policy 3y ago
    This. The Cloudflare captcha page exists and will send you in an endless loop while you're on a 3g connection.
    - username923409 3y ago
      Not sure if this is the same kind of "endless loop" that I've experience on the Cloudflare captcha page; while on a VPN, the only way I can get past the "I am a Human" captcha is to refresh the page and click the area where the checkbox appears as fast as I can with my mouse before it even appears. It might take two or three tries, but it hasn't failed yet. I have no idea why this works so well, but I haven't found another way (other than getting off of my VPN) to get past this screening page.
zarzavat 3y ago
This doesn’t work unless you have access to the device, which mobile ISPs surely don’t. Some countries might mandate it but I don’t think it’s a feature to make your websites police state approved.
- bravetraveler 3y ago
  Corporate is the key part being missed here They provide the device(s), they have access to it. Countless ways to mess with the trust. If anyone thinks they're safe from their employer due to SSL, lol.
  - zarzavat 3y ago
    I know that but the original comment was in response to: > Does their ISP or mobile operator interfere with downloaded JavaScript? In any case, if some rogue corporate proxy breaks your website, then either they pay you to fix it or you tell them to get lost.
    - bravetraveler 3y ago
      Totally fair, not a judgement - just being a reminder down here in the thread
apienx 3y ago
> Required by law (and corporate compliance departments) in many industries. Could you please provide details about this?
- 7bit 3y ago
  Also very curious about this. And yes, there are companies that do that - and then it's usually called Deep Packet Inspection or similar, not MITM, because that's a term attributed to malicious parties. And in that case, the proxy can both, manipulate the JS as well as the HTML, so the argument of the linked page is still faulty.
- 7bit 3y ago
  Ndjd she eje
- karma_pharmer 3y ago
  Here, knock yourself out: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query="ssl+inspection"&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=zscaler&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://finance.yahoo.com/news/zscaler-announces-fedramp-process-milestone-130000216.html https://finance.yahoo.com/news/zscaler-announces-fedramp-pro...
  - apienx 3y ago
    Thank you. I don’t doubt that certain governments twist the arms of companies for privileged access. From my understanding, however, those practices are not the norm in the west (and certainly not overtly codified). IMHO, 90%+ of the data captured in the “West” is from exploits and such.
sccxy 3y ago
> Also, cloudflare. They are the MITM for what, like 80% of the internet now? Please give source for that claim where Cloudflare implements man-in-the-middle attack.
- kachapopopow 3y ago
  [dead]
- tasuki 3y ago
  The person you're replying to said cloudflare was the man in the middle. Not that they executed attacks.
Kwpolska 3y ago
Cloudflare may be MITM, but with the consent of the website owner. If they break JS (which I doubt they would), the website owner would certainly notice. Police states and "internet security" mal^H^H^Hsoftware may MITM stuff. If you're actually doing business with customers in those police states, you probably have someone local who can test. "Internet security" software is unlikely to break things just to insert ads (as the ISP mentioned in the post did over plain HTTP).
deleted 3y ago
[deleted]

lelanthran 3y ago

Yeah, agreed. The general tone of the flowchart is misleading: tons of paths lead to "cannot use javascript" and only one leads to "can use javascript" creates the misleading implication that the probability of the user having JS is low and the reverse probability is high. The articles point seems to be: if you're writing a webapp or anything interactive, then a mere 99.999% of visitors will be able to use the content.

blowski 3y ago
This whole topic is as interesting as "tabs vs spaces" or "emacs vs vim". There's a vocal minority of people that want to tell everybody else how the web should work, and everybody has ignored them for the last 20 years, and will continue to ignore them.

muxator 3y ago

> if the user installs an extension that breaks the web It does not break the web. It may break single sites that were written on naive assumptions; I see a lot of sites break because my extensions do not allow loading analytics libraries. This means their js was dependent on this libraries being actually active. I'd say this is case a case of _unbreaking_ the web.

sccxy 3y ago
Still user decides to use crappy extension to break websites. Some users send me email that they cannot see images on my website. They have adblocker rule where they block all images which contain ad. So dsa231dfsaade.jpg is blocked. And you say that is website developers fault?
- radiospiel 3y ago
  Of course you can decide to not serve those visitors. But if you want to capture as much as possible of your target audience you might want to consider which users can’t see your website - and the OP raises a number of non-obvious ways where JS adoption might affect that.
  - sccxy 3y ago
    Sorry, but your comments text contained “target” it is blocked keyword and adblocker removed it. Can you reword your comment?
- cqqxo4zV46cp 3y ago
  Your example is a bit extreme, and it sounds like you are talking about you are talking about your own website which, with all due respect, I doubt anyone else is remotely invested in the success of, so you as a developer have an unusual degree of freedom to be this dismissive. In the real world, anyone who is as dismissive as you is likely in a position where they’re going to have a boss telling them to pull their head in. The reality is the vast vast majority of users won’t know have a clue how ‘disrespectful’ the browser extension they’ve installed is of ‘the wishes of the developer’ or whatever, and a poor customer experience is a poor customer experience, no matter whose “fault” it is.

rasso 3y ago

So, you have found three points that might not apply. Does that make the point of the article invalid? I think it doesn‘t.

Kwpolska 3y ago
Those are the three arguments I find the least believable. Other arguments are also questionable in 2024. 2G networks are not really usable for Internet consumption. Outages or failures happen, but they can happen for a HTML-only page. Pages where the primary goal is content consumption should use progressive enhancement and limited scripting, but it doesn’t really make much sense for applications.

hilbert42 3y ago

"If the user installs an extension that breaks the web, it’s the user’s fault, and the developers should not cater to them." Likely so. My normal default is to browse the Web without JavaScript enabled, I've worked the Web this way since the 1990s. The reasons are: (a) The web runs just so much faster without JS, also those jitters, pauses and delays caused by JS simply disappear. If people knew how much faster the non-JS mode actually is then many more would partake of it. (b) These days, many web pages are enormous, it's not unusual to see pages that are over 7 or 8MB in size, they're so slow that one can just about have a coffee break before they load. Disable JS in one of these pages and its content can be well in excess of an order of magnitude smaller. (c) Without JS, ads are almost a thing of the past. I don't bother to run ad-blockers simply because I don't have to. Without JS ads simply don't download. (d) Without JS much of the online spying and tracking simply disappears. Those who want to track users can't help themselves from using JS (it seems to go with the territory). (e) Without JS, annoying audio and videos don't start automatically. That's good because if I want to watch the content I can just copy its link to say NewPipe and have a much more pleasant experience. (f) Without JS, pop-ups and messages such as those that ask for permission to accept cookies don't appear, similarly so for those asking for donations. Many web operators wait for a few seconds before displaying these messages, by that time one's already reading page content so the message is aimed to deliberately distract the viewer. Notable offenders are the Guardian and Wiki especially during its money drives, but there are thousands more just like them. (g) Web browsing sans JS is more secure, there's less chance of receiving nefarious scripts etc. It's not JavaScript that's the problem, rather it is web developers who actually abuse it to end users' considerable disadvantage. Turning off JS is my attempt to level the playing field. People ask how I manage with sites that have key functions that require JS to work and without which the sites are useless. Several answers: first, sometimes I do have to turn on JS but it's certainly more the exception than the rule. To turn JS on/off I just hit a toggle button on the browser that invokes say the QuickJava add-on (and I never bother using 'cantankerous' browsers such as Chrome, Edge, etc.). Second, when I come across a website that only displays a blank page if JS is disabled and or requires JS for some key function to work then I simply move onto somewhere else! If any web developers who adopt such practices are reading this then let me tell you categorically that there's nothing else that will get me off that site faster than that, in a sub-second I'm out of there. QED! Third, people say I'm missing out on many web enhancements by turning off JS. Often that's true but in most instances I just do not want them. I find most pages that use these visual enhancements distracting and or outright annoying. When I read a book I do not expect everything on the page to be continually popping in and out, same goes for webpages. What's nice about HN's website is that its pages are static and they carry no superfluous junk. That's how I like it. In my opinion prerequisite training for web developers ought to be a compulsory course on human ergonomics (they'd then perhaps better understand what Web surfers actually want to view and then design their pages accordingly). Finally, I'd add that I've noticed repeatedly over the years that websites with the largest size pages and those which include the most superfluous amount of junk are also the sites whose content I find least interesting. The fact is there's just so much content on the web that if 99% of websites were of the type that I've no interest in visiting then I still wouldn't have time to visit all the others in my lifetime (I can afford to be very choosy). In essence, on the Web it's easy to set one's own rules and be choosy about what one views. And I'm sure the reason for why not more act as I do is that many have been forced into using the narrow webcasting as offered by the big internet giants. They of course all require surfers to have JavaScript enabled.

6510 3y ago

It could be interesting to explore how things fail. If it is supper easy to fix ill do it.