5 ms·

All the more reason to block all JS by default with add-ons like NoScript or uBO and manage a whitelist. It's a bit annoying the first few days, but then the u

All the more reason to block all JS by default with add-ons like NoScript or uBO and manage a whitelist. It's a bit annoying the first few days, but then the usual sites you frequent will all be whitelisted and all that's left are random sites you come across infrequently.

mindslight 1y ago
Investing in NoScript can actually make pages faster, even if you end up enabling a bunch of javascript for functionality. For example, I remember having to whitelist only about half the resources used by homedepot.com. The rest was just shameless surveillance bloat, continually backhauling gobs of data as you were merely viewing the page. The site loaded and scrolled much quicker without it.
- bogwog 1y ago
  FYI, uBlock Origin has javascript blocking features just like NoScript, so if you're already using it as your ad blocker, you don't need a separate extension to block javascript too
  - lemoncookiechip 1y ago
    This is absolutely true. But personally I find NoScript's UI more intuitive to use for JS domain blocking (mostly because I've been using it for years now). I also used to use uMatrix by the same author as uBO before it was deprecated on Chromium browsers.
gruez 1y ago
>It's a bit annoying the first few days, but then the usual sites you frequent will all be whitelisted and all that's left are random sites you come across infrequently. How does this work in reality? Do you just whitelist every site you come across if it's broken? What's the security advantage here? Or do you bail if it requires javascript? What about the proliferation of sites that don't really need javascript, but you need to enable it anyways because the site's security provider needs it to verify you're not a bot?
- ndriscoll 1y ago
  > Or do you bail if it requires javascript? It depends, but frequently, yes. e.g. If I were about to read a tech blog, and see it's from someone that can't make a couple paragraphs work without scripting, then that raises the chance that whatever they had to say was not going to be valuable since they evidently don't know the basics. It's the frontend version of people writing about distributed clusters to handle a load that a single minipc could comfortably handle.
  - gruez 1y ago
    >It depends, but frequently, yes. e.g. If I were about to read a tech blog, and see it's from someone that can't make a couple paragraphs work without scripting, then that raises the chance that whatever they had to say was not going to be valuable since they evidently don't know the basics. Seems only narrowly applicable. I can see how you can use this logic to discount articles like "how to make a good blog" or whatever, but that's presumably only a tiny minority of article you'd read. If the topic is literally anything else it doesn't really hold. It doesn't seem fair to discount whatever an AI engineer or DBA has to say because they don't share the same fanaticism of lightweight sites as you. On the flip side I see plenty of AI generated slop that works fine with javascript disabled, because they're using some sort of SaaS (think medium) or static site generator.
    - rep_lodsb 1y ago
      A bit of fanaticism might be exactly what is needed to push back against the web becoming completely unusable.
    - JohnFen 1y ago
      > because they don't share the same fanaticism of lightweight sites as you. For me, it's not about sites being lightweight, it's about sites not being trustworthy enough to allow them to run code on my machine.
    - ndriscoll 1y ago
      Generally speaking, getting good performance out of a database mostly comes down to understanding how the thing works and then not making it do a stupid amount of unnecessary work. I expect someone who understands that would also not e.g. fetch a script that then fetches the actual text instead of just sending the text. For example Markus Winand's sites work just fine with javascript off. For ML stuff I'd let e.g. mathjax fly, but I expect the surrounding prose to show up first to get me interested enough to enable scripts. It's not an exact filter, but it gives some signal to feed into the "is this worth my time" model. It's also odd to characterize it as fanaticism: scriptless sites are the default. If you just type words, it will work. You have to go out of your way to make a Rube Goldberg machine. I'm not interested in Rube Goldberg machines or the insights of the people that enjoy making them. Like if you own a restaurant and make your menu so that it's only available on a phone, I'll just leave. I don't appreciate the gimmick. Likewise for things that want me to install an app or use a cloud. Not happening.
Santosh83 1y ago
This used to be the case many years ago. But these days practically every site pulls in content from several other sites, sometimes dozens. Fine tuning noscript to get such a site to work without obscure breakage will take a long time of trial & error, reloading again & again. Now consider that you've to do this for every one of your regular sites. Noscript is just too painful for people who want to just browse the web. Its the gentoo of browser extensions. People with massive time & patience can do it yes, but the rest of us are best served by uBlock & standard browser protections.
- edoceo 1y ago
  > the gentoo of browser extensions I was already convinced, you don't need to keep selling it ;)
- zahlman 1y ago
  > But these days practically every site pulls in content from several other sites, sometimes dozens. They do, but as a long-time NoScript user I can tell you from personal experience that this content rarely does anything important, and leaving it out often improves your UX. Problems like you describe pop up... from time to time, for individual sites, maybe a few times a year, and definitely not on "regular sites".
  - mjevans 1y ago
    I have an entirely separate browser profile for when I absolutely need to use a site and just don't have the time to tinker around with script permissions.
    - yjftsjthsd-h 1y ago
      Depending on how you've set up, you can also just use private browsing / incognito to drop extensions.
- JohnFen 1y ago
  > But these days practically every site pulls in content from several other sites, sometimes dozens. And excluding that content almost invariably improves the page.
grishka 1y ago
Disabling third-party cookies also gets rid of lots of potential abuse vectors with negligible impact on useful functionality.

mindslight 1y ago

Investing in NoScript can actually make pages faster, even if you end up enabling a bunch of javascript for functionality. For example, I remember having to whitelist only about half the resources used by homedepot.com. The rest was just shameless surveillance bloat, continually backhauling gobs of data as you were merely viewing the page. The site loaded and scrolled much quicker without it.

bogwog 1y ago
FYI, uBlock Origin has javascript blocking features just like NoScript, so if you're already using it as your ad blocker, you don't need a separate extension to block javascript too
- lemoncookiechip 1y ago
  This is absolutely true. But personally I find NoScript's UI more intuitive to use for JS domain blocking (mostly because I've been using it for years now). I also used to use uMatrix by the same author as uBO before it was deprecated on Chromium browsers.

gruez 1y ago

>It's a bit annoying the first few days, but then the usual sites you frequent will all be whitelisted and all that's left are random sites you come across infrequently. How does this work in reality? Do you just whitelist every site you come across if it's broken? What's the security advantage here? Or do you bail if it requires javascript? What about the proliferation of sites that don't really need javascript, but you need to enable it anyways because the site's security provider needs it to verify you're not a bot?

ndriscoll 1y ago
> Or do you bail if it requires javascript? It depends, but frequently, yes. e.g. If I were about to read a tech blog, and see it's from someone that can't make a couple paragraphs work without scripting, then that raises the chance that whatever they had to say was not going to be valuable since they evidently don't know the basics. It's the frontend version of people writing about distributed clusters to handle a load that a single minipc could comfortably handle.
- gruez 1y ago
  >It depends, but frequently, yes. e.g. If I were about to read a tech blog, and see it's from someone that can't make a couple paragraphs work without scripting, then that raises the chance that whatever they had to say was not going to be valuable since they evidently don't know the basics. Seems only narrowly applicable. I can see how you can use this logic to discount articles like "how to make a good blog" or whatever, but that's presumably only a tiny minority of article you'd read. If the topic is literally anything else it doesn't really hold. It doesn't seem fair to discount whatever an AI engineer or DBA has to say because they don't share the same fanaticism of lightweight sites as you. On the flip side I see plenty of AI generated slop that works fine with javascript disabled, because they're using some sort of SaaS (think medium) or static site generator.
  - rep_lodsb 1y ago
    A bit of fanaticism might be exactly what is needed to push back against the web becoming completely unusable.
  - JohnFen 1y ago
    > because they don't share the same fanaticism of lightweight sites as you. For me, it's not about sites being lightweight, it's about sites not being trustworthy enough to allow them to run code on my machine.
  - ndriscoll 1y ago
    Generally speaking, getting good performance out of a database mostly comes down to understanding how the thing works and then not making it do a stupid amount of unnecessary work. I expect someone who understands that would also not e.g. fetch a script that then fetches the actual text instead of just sending the text. For example Markus Winand's sites work just fine with javascript off. For ML stuff I'd let e.g. mathjax fly, but I expect the surrounding prose to show up first to get me interested enough to enable scripts. It's not an exact filter, but it gives some signal to feed into the "is this worth my time" model. It's also odd to characterize it as fanaticism: scriptless sites are the default. If you just type words, it will work. You have to go out of your way to make a Rube Goldberg machine. I'm not interested in Rube Goldberg machines or the insights of the people that enjoy making them. Like if you own a restaurant and make your menu so that it's only available on a phone, I'll just leave. I don't appreciate the gimmick. Likewise for things that want me to install an app or use a cloud. Not happening.

Santosh83 1y ago

This used to be the case many years ago. But these days practically every site pulls in content from several other sites, sometimes dozens. Fine tuning noscript to get such a site to work without obscure breakage will take a long time of trial & error, reloading again & again. Now consider that you've to do this for every one of your regular sites. Noscript is just too painful for people who want to just browse the web. Its the gentoo of browser extensions. People with massive time & patience can do it yes, but the rest of us are best served by uBlock & standard browser protections.

edoceo 1y ago
> the gentoo of browser extensions I was already convinced, you don't need to keep selling it ;)
zahlman 1y ago
> But these days practically every site pulls in content from several other sites, sometimes dozens. They do, but as a long-time NoScript user I can tell you from personal experience that this content rarely does anything important, and leaving it out often improves your UX. Problems like you describe pop up... from time to time, for individual sites, maybe a few times a year, and definitely not on "regular sites".
- mjevans 1y ago
  I have an entirely separate browser profile for when I absolutely need to use a site and just don't have the time to tinker around with script permissions.
  - yjftsjthsd-h 1y ago
    Depending on how you've set up, you can also just use private browsing / incognito to drop extensions.
JohnFen 1y ago
> But these days practically every site pulls in content from several other sites, sometimes dozens. And excluding that content almost invariably improves the page.

grishka 1y ago

Disabling third-party cookies also gets rid of lots of potential abuse vectors with negligible impact on useful functionality.