3 ms·

I’m tired of SPAs and webpages that don’t render without JavaScript. The web is supposed to degrade gracefully if you are missing browser features, up to and i

by sneak 1y ago

I’m tired of SPAs and webpages that don’t render without JavaScript. The web is supposed to degrade gracefully if you are missing browser features, up to and including images turned off. Now, web developers give you a blank page if you don’t run a megabyte of their shitty code. No thank you.

zzo38computer 1y ago
> The web is supposed to degrade gracefully if you are missing browser features, up to and including images turned off. I agree. (This should also include CSS, TLS, cookies, and many other things; I often disable CSS, and it should work just as well if CSS is disabled just as much as if pictures or JavaScripts or cookies are disabled.) However, there are some uses where JavaScripts may be helpful e.g. if a web page has a calculations or something like that implemented by JavaScripts; but that is not an excuse to prevent the documentation from being displayed if JavaScripts are disabled. They should really make documentation and as much other stuff to work even if JavaScripts are disabled (and, depending on what it does, may provide a description of the calculation or of the rules of the game being implemented, or a link to API documentation, or something else like that). Pictures also might be useful in some articles (but are often overused); but even then, if the picture is not displayed you could use an external program to display them. However, if it can be explained in the text, then it should be explained in the text if possible so that even if you do not have a suitable program to display that picture (or do not want to display that picture, e.g. the file size is too big; or maybe you are using text to speech or a braille display or something else like that) then it will still work. TLS also should not always be mandatory, either. For things that require user authentication, and for writing, it can be useful to be mandatory (especially if you are using X.509 client authentication; this will be better than using cookies or other methods for authentication, anyways); but for read-only access to public data, TLS should be optional (but the server should still allow it in case the client wants to use TLS for read-only access to public data too).
- sneak 1y ago
  No, TLS should always be required. We should be moving away from plaintext anything on the wire, if for no other reason than privacy (but also for integrity, injecting scripts into an HTTP response is a nasty attack surface).
  - tzebco 1y ago
    I feel the same way, although I do struggle with excluding people who use older technology. I suppose TLS 1.2 is fairly old at this point ...
  - int_19h 1y ago
    TLS shouldn't be required for as long as it remains a heavily centralized thing; to require it would give undue power to root certificate authorities.
    - vaylian 1y ago
      Do you have an idea how this could be decentralized?
      - int_19h 1y ago
        It would have to be some kind of web of trust thing. But no, I don't have any specific suggestions to that effect (which is why I believe that HTTP should remain an option).
        vaylian 1y ago
        What about self-signed certificates? That's still better than plain HTTP.
        int_19h 1y ago
        What benefits does a self-signed certificate give over plain HTTP? They don't prevent MITM injection, which is the thing you raised in other thread.

by sneak 1y ago

zzo38computer 1y ago

> The web is supposed to degrade gracefully if you are missing browser features, up to and including images turned off. I agree. (This should also include CSS, TLS, cookies, and many other things; I often disable CSS, and it should work just as well if CSS is disabled just as much as if pictures or JavaScripts or cookies are disabled.) However, there are some uses where JavaScripts may be helpful e.g. if a web page has a calculations or something like that implemented by JavaScripts; but that is not an excuse to prevent the documentation from being displayed if JavaScripts are disabled. They should really make documentation and as much other stuff to work even if JavaScripts are disabled (and, depending on what it does, may provide a description of the calculation or of the rules of the game being implemented, or a link to API documentation, or something else like that). Pictures also might be useful in some articles (but are often overused); but even then, if the picture is not displayed you could use an external program to display them. However, if it can be explained in the text, then it should be explained in the text if possible so that even if you do not have a suitable program to display that picture (or do not want to display that picture, e.g. the file size is too big; or maybe you are using text to speech or a braille display or something else like that) then it will still work. TLS also should not always be mandatory, either. For things that require user authentication, and for writing, it can be useful to be mandatory (especially if you are using X.509 client authentication; this will be better than using cookies or other methods for authentication, anyways); but for read-only access to public data, TLS should be optional (but the server should still allow it in case the client wants to use TLS for read-only access to public data too).

sneak 1y ago
No, TLS should always be required. We should be moving away from plaintext anything on the wire, if for no other reason than privacy (but also for integrity, injecting scripts into an HTTP response is a nasty attack surface).
- tzebco 1y ago
  I feel the same way, although I do struggle with excluding people who use older technology. I suppose TLS 1.2 is fairly old at this point ...
- int_19h 1y ago
  TLS shouldn't be required for as long as it remains a heavily centralized thing; to require it would give undue power to root certificate authorities.
  - vaylian 1y ago
    Do you have an idea how this could be decentralized?
    - int_19h 1y ago
      It would have to be some kind of web of trust thing. But no, I don't have any specific suggestions to that effect (which is why I believe that HTTP should remain an option).
      - vaylian 1y ago
        What about self-signed certificates? That's still better than plain HTTP.
        int_19h 1y ago
        What benefits does a self-signed certificate give over plain HTTP? They don't prevent MITM injection, which is the thing you raised in other thread.