7 ms·

Is there any empirical evidence that suggests that people accidentally disabling JavaScript and then being confused as to why websites don't look right is a sig

by Gormo 13y ago

Is there any empirical evidence that suggests that people accidentally disabling JavaScript and then being confused as to why websites don't look right is a significant problem? The author of that article says: "Is it really worth having a preference panel that benefits fewer than 2% of users overall? — obvious spoiler alert: The answer is no." The answer is yes. If 2% of users have a purpose for it, perhaps it wouldn't have been high up on the priority list to implement as a new feature, but it's already there, and removing it requires extra work. Is it really worth removing features from an application to deal with some hypothetical problem that's been posited under the assumption that most users are idiots? If there really is a problem, it may be worthwhile to move it to an "advanced settings" panel, but removing it entirely is a terrible idea. It's worth noting that Chrome - a browser that's far less configurable and customizable than Firefox, overall - not only offers the ability to disable JavaScript globally, but has it as an option in the domain-specific permissions menu.

Arelius 13y ago
I don't know of any empirical evidence, but the story normally goes: There is a new Java exploit, and recommendations to remove/disable Java hit the wild. Then while people try to find out how to disable "Java" Find "Disable Javascript" and assume it's related. Perhaps this would be solved by renaming it "Disable Ecmascript" however. I really have no idea how common this is, but have seen it once, from a user that's technically savy enough to be diging in options and worried about security, but not savy enough to know the difference between Java and Javascript.
- netc 13y ago
  Well, an extra phrase might be added in the menu where 'Disable Javascript' appears - '(Note: Javascript is not same as Java)'. If users don't know the difference between Diesel and Gasoline, better option is to educate them in context (e.g. handle of fuel pump) rather than closing down all Diesel pumps.
  - jrochkind1 13y ago
    If people don't know the difference between diesel and gasoline, is a note that says "Note: Diesel is not the same as Gasoline" going to help? Doubt it. The assertion is that 'configuration creep' is overwhelming for the unsophisticated user in the first place, adding even more notes and explanations to all the configuration options is not going to help.
    - pessimizer 13y ago
      >If people don't know the difference between diesel and gasoline, is a note that says "Note: Diesel is not the same as Gasoline" going to help? Doubt it. Really? I would think that sign would help everyone who knew how to read, bothered to read, and wanted their car to run. A sign with a simple message like that was enough to fix one national timeclock system that I worked on. "Do not do X before 12:00 Noon unless Y." in English, Spanish, and Polish. For the people who still messed it up that we found by using heuristics on all of the punch data, we sent reports to their managers that said that they had probably done something wrong. After 3 or 4 cycles of this, the failure rate went from 15-20% to 1-2%. Unsophisticated users remain unsophisticated users if you systematically remove configuration until the application only does one thing one way, badly.
      - jrochkind1 13y ago
        If they don't know the difference between diesel and gasoline, how do they know if the one they want is "diesel" or "gasoline"? But, yes, clearly, the goal is removing configuration until the app does one thing well, not badly.
        pessimizer 13y ago
        Only if you want 9000 apps, because then it becomes a question of which of those super narrowly focused apps will work to do what you want to do. An email client that only emails your mother is a good emailing your mother client, but a bad email client. If they take away configuration for people with stepmothers or two mothers, because it's only a 5% use case, it's even a bad emailing your mother client. If you know your car runs on gasoline, and you don't know the difference between gasoline and diesel, then you see a sign that says "diesel is not gasoline," you know that diesel is not what you're looking for - even though you still don't know the difference.
- simonbrown 13y ago
  Or make the option to disable Java accessible from there.
  - tempestn 13y ago
    You want to add an option to disable a particular browser plugin in the core browser options? That doesn't seem like a good idea.
- nnnnni 13y ago
  It's a shame that they didn't push "ecmascript" as the name ~15 years ago back when it was new. Now we're stuck with problems like this...
  - JadeNB 13y ago
    It wasn't an accident—they wanted to appear similar to Java (https://en.wikipedia.org/wiki/JavaScript#Birth_at_Netscape https://en.wikipedia.org/wiki/JavaScript#Birth_at_Netscape): > The final choice of name caused confusion, giving the impression that the language was a spin-off of the Java programming language, and the choice has been characterized by many as a marketing ploy by Netscape to give JavaScript the cachet of what was then the hot new web programming language.
ubernostrum 13y ago
"Advanced settings" dialogs tend to indicate poorly-thought-out interface design. Rather than demonstrating careful attention to what features are useful and important enough to ship, they become dumping grounds for "something someone asked for once".
- nightski 13y ago
  So well thought out interface design is ignoring subsets of users and unifying everyone to one common set of behavior. Imagine if Excel employed this philosophy. It wouldn't be useful to anyone.
  - tracker1 13y ago
    I wasn't aware I could set a field to SUM(..) etc from the gui... Most of the features in Excel are a bit under the covers.. and far more so than about:config... maybe the "advanced settings" tab should be a button that just takes you to about:config with a warning?
    - hysan 13y ago
      Err... I just opened up Excel (2002 since that is all I have at work), selected a cell, clicked on the SUM button (sure it uses the mathematical symbol for sum but if you hover over it, it says SUM), and then was able to click and drag (or CRTL + click for nonconsecutive cells) to select cells for the sum. This is all via the GUI. I'm not sure how this is hidden. Heck, I did this in a Japanese version of Office which I can't read. Is this different in Office 2010 or any of the newer versions of Office? I mostly use LibreOffice and even there it has the same "all GUI" functionality.
      - tracker1 13y ago
        Honestly, didn't know, I rarely use excel, but do know a lot of people who do a ton of VBA code to connect to database resources to create interactive spreadsheets.. and a lot of that is far from common, button-click functionality. And in any case, for those that want it, it's in about:config ... I doubt anyone who should be disabling JS would be looking around for it in a config frame, and not do a quick google search. I've generally adjusted most of my settings via about:config, mostly cache related for me, but if I'm playing with js settings etc.. it's easier to keep a tab open with about:config than a modal.
grannyg00se 13y ago
"If there really is a problem, it may be worthwhile to move it to an "advanced settings" panel, but removing it entirely is a terrible idea." I'd like to see the evidence as well. Perhaps there are dozens of bug reports coming in every week that can be traced back to disabled javascript. They did leave it as an option in about:config though so at least it can still be disabled via javascript.enabled=false
BoyWizard 13y ago
> If there really is a problem, it may be worthwhile to move it to an "advanced settings" panel, but removing it entirely is a terrible idea. Is this not the equivalent of 'about:config'? In reality it is the advanced settings panel, just without the pretty dialog to go with it.
- kunil 13y ago
  But about:config voids my warranty.
  - SilasX 13y ago
    Then ask for a refund.
tomphoolery 13y ago
Is there any empirical evidence that the use of AdBlock + Ghostery or WOT or whatever privacy addons you're already using are any less secure than disabling JavaScript outright? Disabling JavaScript has a few MAJOR disadvantages to proper web usage: 1. As the blog post has said, many web sites will fail in mysterious and unexpected ways. Some web apps may be rendered completely useless. In fact, you might as well just say goodbye to the modern web if you're gonna totally disable JS. 2. Since it's a "blanket fix", disabling JavaScript is a silly way to protect yourself from data miners. Instead, why not use an extension that has been proven to work, is actually available cross-browser, and gives you MUCH finer-grained control over what is displayed? 3. Since JavaScript is not the only thing that could potentially fuck up your web experience, disabling JavaScript doesn't even fix every problem related to privacy! You'd really have to disable JS, disable all plugins (Flash, Silverlight, Java, etc.), and pretty much block yourself out from a lot of the modern web just to be truly secure. At that point, you're really isolating yourself from a lot of the web's rich media, and doing so in spite of the plethora of tools available to combat the stealth data mining practices that these companies use. Use AdBlock. Use Web Of Trust (WOT). Use Ghostery. At least know when sites are tracking you, and disable those tracking bugs when you see them. You don't need to turn off JavaScript and isolate yourself from an entire ecosystem of awesome, just to maintain control over what data you're sending out about yourself. The idea of turning off JavaScript has always been a silly concept to me, and I felt was simply there to please the more paranoid of us. But there has to be a time to face reality: It just doesn't work.
- lesslaw 13y ago
  I run with Javascript off, via no-script. Most of the stuff that requires Javascript is tracking based and/or from third party domains. tbh a global Javascript toggle is a bit useless. You really need the fine grain per-domain settings of No-script to navigate the modern web.
- lmm 13y ago
  Ghostery has recently been found to be selling user data. ISTR there was a similar incident with AdBlock? I don't want to have to trust some random extension author to have got these things right.
_pmf_ 13y ago
> Is there any empirical evidence that suggests that people accidentally disabling JavaScript and then being confused as to why websites don't look right is a significant problem? Of course not. Mozilla's agenda is determined by its main sponsor, Google, which has a vital interest for JS to be enabled. Any spin on this being somehow "for the user" is bullshit.
- icebraining 13y ago
  Apparently, the agenda of Google's own browser team isn't determined by Google, since they haven't removed this option.
legulere 13y ago
Implementation isn't the only cost of features. You need to test them so they don't break. Features can be a burden for the codebase and removal can lead to many edge cases becoming unnecessary. A magnitude of features can overwhelm users, especially occasional users. They steal attention from other features that you may find more important. And the most important point here: This feature really is broken as of today. Nobody can persuade me that they use it on their main browsers. I don't believe them.
- jejones3141 13y ago
  There are some web sites that use a Javascript to prevent one from right clicking on images to save them; disabling Javascript is a workaround for that. I wouldn't be surprised if that is in common use.
  - ubershmekel 13y ago
    Certain shopping sites disable right-click to prevent you from comparing prices. Certain lyrics sites disable right-click to prevent "theft". Certain sites disable right-click for aesthetics or to prevent me from seeing the page source. This news just makes me glad I'm on chrome.
  - legulere 13y ago
    But then deactivating javascript for the whole browser isn't the right solution, because it breaks everything. You simply use NoScript.
  - andrewaylett 13y ago
    But you don't need to disable JS altogether to prevent that, only disable replacing context menus. Unfortunately for that argument, updating to FF23 removes all of the 'advanced' JS options, not just the checkbox to disable it altogether.
mhaymo 13y ago
The option has not been removed entirely, it is in the advanced settings, which are called about:config.

by Gormo 13y ago

Arelius 13y ago

I don't know of any empirical evidence, but the story normally goes: There is a new Java exploit, and recommendations to remove/disable Java hit the wild. Then while people try to find out how to disable "Java" Find "Disable Javascript" and assume it's related. Perhaps this would be solved by renaming it "Disable Ecmascript" however. I really have no idea how common this is, but have seen it once, from a user that's technically savy enough to be diging in options and worried about security, but not savy enough to know the difference between Java and Javascript.

netc 13y ago
Well, an extra phrase might be added in the menu where 'Disable Javascript' appears - '(Note: Javascript is not same as Java)'. If users don't know the difference between Diesel and Gasoline, better option is to educate them in context (e.g. handle of fuel pump) rather than closing down all Diesel pumps.
- jrochkind1 13y ago
  If people don't know the difference between diesel and gasoline, is a note that says "Note: Diesel is not the same as Gasoline" going to help? Doubt it. The assertion is that 'configuration creep' is overwhelming for the unsophisticated user in the first place, adding even more notes and explanations to all the configuration options is not going to help.
  - pessimizer 13y ago
    >If people don't know the difference between diesel and gasoline, is a note that says "Note: Diesel is not the same as Gasoline" going to help? Doubt it. Really? I would think that sign would help everyone who knew how to read, bothered to read, and wanted their car to run. A sign with a simple message like that was enough to fix one national timeclock system that I worked on. "Do not do X before 12:00 Noon unless Y." in English, Spanish, and Polish. For the people who still messed it up that we found by using heuristics on all of the punch data, we sent reports to their managers that said that they had probably done something wrong. After 3 or 4 cycles of this, the failure rate went from 15-20% to 1-2%. Unsophisticated users remain unsophisticated users if you systematically remove configuration until the application only does one thing one way, badly.
    - jrochkind1 13y ago
      If they don't know the difference between diesel and gasoline, how do they know if the one they want is "diesel" or "gasoline"? But, yes, clearly, the goal is removing configuration until the app does one thing well, not badly.
      - pessimizer 13y ago
        Only if you want 9000 apps, because then it becomes a question of which of those super narrowly focused apps will work to do what you want to do. An email client that only emails your mother is a good emailing your mother client, but a bad email client. If they take away configuration for people with stepmothers or two mothers, because it's only a 5% use case, it's even a bad emailing your mother client. If you know your car runs on gasoline, and you don't know the difference between gasoline and diesel, then you see a sign that says "diesel is not gasoline," you know that diesel is not what you're looking for - even though you still don't know the difference.
simonbrown 13y ago
Or make the option to disable Java accessible from there.
- tempestn 13y ago
  You want to add an option to disable a particular browser plugin in the core browser options? That doesn't seem like a good idea.
nnnnni 13y ago
It's a shame that they didn't push "ecmascript" as the name ~15 years ago back when it was new. Now we're stuck with problems like this...
- JadeNB 13y ago
  It wasn't an accident—they wanted to appear similar to Java (https://en.wikipedia.org/wiki/JavaScript#Birth_at_Netscape https://en.wikipedia.org/wiki/JavaScript#Birth_at_Netscape): > The final choice of name caused confusion, giving the impression that the language was a spin-off of the Java programming language, and the choice has been characterized by many as a marketing ploy by Netscape to give JavaScript the cachet of what was then the hot new web programming language.

ubernostrum 13y ago

"Advanced settings" dialogs tend to indicate poorly-thought-out interface design. Rather than demonstrating careful attention to what features are useful and important enough to ship, they become dumping grounds for "something someone asked for once".

nightski 13y ago
So well thought out interface design is ignoring subsets of users and unifying everyone to one common set of behavior. Imagine if Excel employed this philosophy. It wouldn't be useful to anyone.
- tracker1 13y ago
  I wasn't aware I could set a field to SUM(..) etc from the gui... Most of the features in Excel are a bit under the covers.. and far more so than about:config... maybe the "advanced settings" tab should be a button that just takes you to about:config with a warning?
  - hysan 13y ago
    Err... I just opened up Excel (2002 since that is all I have at work), selected a cell, clicked on the SUM button (sure it uses the mathematical symbol for sum but if you hover over it, it says SUM), and then was able to click and drag (or CRTL + click for nonconsecutive cells) to select cells for the sum. This is all via the GUI. I'm not sure how this is hidden. Heck, I did this in a Japanese version of Office which I can't read. Is this different in Office 2010 or any of the newer versions of Office? I mostly use LibreOffice and even there it has the same "all GUI" functionality.
    - tracker1 13y ago
      Honestly, didn't know, I rarely use excel, but do know a lot of people who do a ton of VBA code to connect to database resources to create interactive spreadsheets.. and a lot of that is far from common, button-click functionality. And in any case, for those that want it, it's in about:config ... I doubt anyone who should be disabling JS would be looking around for it in a config frame, and not do a quick google search. I've generally adjusted most of my settings via about:config, mostly cache related for me, but if I'm playing with js settings etc.. it's easier to keep a tab open with about:config than a modal.

grannyg00se 13y ago

"If there really is a problem, it may be worthwhile to move it to an "advanced settings" panel, but removing it entirely is a terrible idea." I'd like to see the evidence as well. Perhaps there are dozens of bug reports coming in every week that can be traced back to disabled javascript. They did leave it as an option in about:config though so at least it can still be disabled via javascript.enabled=false

BoyWizard 13y ago

> If there really is a problem, it may be worthwhile to move it to an "advanced settings" panel, but removing it entirely is a terrible idea. Is this not the equivalent of 'about:config'? In reality it is the advanced settings panel, just without the pretty dialog to go with it.

kunil 13y ago
But about:config voids my warranty.
- SilasX 13y ago
  Then ask for a refund.

tomphoolery 13y ago

Is there any empirical evidence that the use of AdBlock + Ghostery or WOT or whatever privacy addons you're already using are any less secure than disabling JavaScript outright? Disabling JavaScript has a few MAJOR disadvantages to proper web usage: 1. As the blog post has said, many web sites will fail in mysterious and unexpected ways. Some web apps may be rendered completely useless. In fact, you might as well just say goodbye to the modern web if you're gonna totally disable JS. 2. Since it's a "blanket fix", disabling JavaScript is a silly way to protect yourself from data miners. Instead, why not use an extension that has been proven to work, is actually available cross-browser, and gives you MUCH finer-grained control over what is displayed? 3. Since JavaScript is not the only thing that could potentially fuck up your web experience, disabling JavaScript doesn't even fix every problem related to privacy! You'd really have to disable JS, disable all plugins (Flash, Silverlight, Java, etc.), and pretty much block yourself out from a lot of the modern web just to be truly secure. At that point, you're really isolating yourself from a lot of the web's rich media, and doing so in spite of the plethora of tools available to combat the stealth data mining practices that these companies use. Use AdBlock. Use Web Of Trust (WOT). Use Ghostery. At least know when sites are tracking you, and disable those tracking bugs when you see them. You don't need to turn off JavaScript and isolate yourself from an entire ecosystem of awesome, just to maintain control over what data you're sending out about yourself. The idea of turning off JavaScript has always been a silly concept to me, and I felt was simply there to please the more paranoid of us. But there has to be a time to face reality: It just doesn't work.

lesslaw 13y ago
I run with Javascript off, via no-script. Most of the stuff that requires Javascript is tracking based and/or from third party domains. tbh a global Javascript toggle is a bit useless. You really need the fine grain per-domain settings of No-script to navigate the modern web.
lmm 13y ago
Ghostery has recently been found to be selling user data. ISTR there was a similar incident with AdBlock? I don't want to have to trust some random extension author to have got these things right.

_pmf_ 13y ago

> Is there any empirical evidence that suggests that people accidentally disabling JavaScript and then being confused as to why websites don't look right is a significant problem? Of course not. Mozilla's agenda is determined by its main sponsor, Google, which has a vital interest for JS to be enabled. Any spin on this being somehow "for the user" is bullshit.

icebraining 13y ago
Apparently, the agenda of Google's own browser team isn't determined by Google, since they haven't removed this option.

legulere 13y ago

Implementation isn't the only cost of features. You need to test them so they don't break. Features can be a burden for the codebase and removal can lead to many edge cases becoming unnecessary. A magnitude of features can overwhelm users, especially occasional users. They steal attention from other features that you may find more important. And the most important point here: This feature really is broken as of today. Nobody can persuade me that they use it on their main browsers. I don't believe them.

jejones3141 13y ago
There are some web sites that use a Javascript to prevent one from right clicking on images to save them; disabling Javascript is a workaround for that. I wouldn't be surprised if that is in common use.
- ubershmekel 13y ago
  Certain shopping sites disable right-click to prevent you from comparing prices. Certain lyrics sites disable right-click to prevent "theft". Certain sites disable right-click for aesthetics or to prevent me from seeing the page source. This news just makes me glad I'm on chrome.
- legulere 13y ago
  But then deactivating javascript for the whole browser isn't the right solution, because it breaks everything. You simply use NoScript.
- andrewaylett 13y ago
  But you don't need to disable JS altogether to prevent that, only disable replacing context menus. Unfortunately for that argument, updating to FF23 removes all of the 'advanced' JS options, not just the checkbox to disable it altogether.

mhaymo 13y ago

The option has not been removed entirely, it is in the advanced settings, which are called about:config.