6 ms·

Another red flag Doc doesn't mention here is the fact that Mozilla now requires extraordinary knowledge to disable JavaScript in Firefox. There are broadly use

by natch 13y ago

Another red flag Doc doesn't mention here is the fact that Mozilla now requires extraordinary knowledge to disable JavaScript in Firefox. There are broadly useful reasons to have this available as a toggle in the common UI (such as when you want to save an image from a site that uses JavaScript to prevent right clicks), yet it's hidden inside of the cryptic (to most users) about:config. And why might this be? There could be several reasons all in play at once, including an attempt to protect users from themselves (think: The Nanny Browser), but I would just point out that the advertising infrastructure Mozilla increasingly relies on, with its cross-site user tracking, leans heavily on JavaScript. It would appear that with that as a counter incentive, Mozilla has chosen to side with the ad networks, instead of with the users, in choosing which options to expose for easy control.

middus 13y ago
Ordinary users do not want to disable JavaScript. Hell, they don't even know what it is. Advanced users like you can still use NoScript or about:config.
- jakub_g 13y ago
  This was exactly the explanation from Mozilla side and it makes sense. The reason for the decision was people telling "my internet stopped working" (white pages) once they've disabled JS by accident.
  - 72deluxe 13y ago
    It's an interesting thought: should we be dumbing down everything or just engaging in a bit of education instead and helping people understand what JavaScript does and its use on web pages? The manual for my car mentions things that must be done for maintenance. They don't dumb it down. Meanwhile in computer land we hide all options and dumb everything down to "protect" the user. There is a difference between being easy to use and molly-coddling. It is a difficult balance to get it seems!
    - AndrewDucker 13y ago
      Exactly. In order to do complex tasks you get out the manual, open the hood, and get to work. And in order to do something equally complex in Mozilla you grab the help, open about:config and get to work. Your car doesn't put complex details on the dashboard, and neither should Mozilla.
    - masklinn 13y ago
      > It's an interesting thought: should we be dumbing down everything This is not a case of "dumbing down everything", the ability to remove javascript is still there, what is not there is one (of formerly 3) often inadvertently used method for it. > The manual for my car mentions things that must be done for maintenance. Disabling javascript is not maintenance, it's a significant structural change in the browser's abilities, like removing the car's suspension. And it makes no sense to put that as a switch on the car's dash.
    - quanticle 13y ago
      >The manual for my car mentions things that must be done for maintenance. Your car has a manual that describes maintenance. It doesn't have a button next to the radio that ejects the engine.
    - varkson 13y ago
      Who reads a car manual? If you want to continue that, you could consider the manual to be about:config. No one is stopping you from reading the manual or going to about:config, but it's not required.
    - pjc50 13y ago
      If you want something used by millions of people, you have to make it as simple as possible. Insisting that people learn about the invisible internals is more likely to put them off using it than to result in them learning.
  - kijin 13y ago
    Too many people mistakenly disable JavaScript every time a Java vulnerability hits the news, and there was a period not too long ago when a new Java vuln seemed to appear every other week. It was around this time that the "disable JavaScript" option disappeared from Firefox.
- blisterpeanuts 13y ago
  >> Ordinary users do not want to disable JavaScript But sometimes "ordinary" users do need to disable Javascript. Wouldn't it make more sense to put in a pop-up "Disabling Javascript will potentially break lots of websites. Are you sure? Y/N" It's perhaps a tempest in a teapot, since these ordinary blokes will simply follow a different set of connect-the-dots instructions they found while searching for "how do I save an image from XYZ website?"
jamespo 13y ago
Or you could just install noscript. Do you think your average user would know to click a "disable javascript" button when they find right-clicking an image blocked anyway?
- natch 13y ago
  Yes you could, if you knew about it and trusted it. I think there's a spectrum of skills, not a binary split amongst user skills. Hard to say where the average user is with disabling JavaScript, because skill levels are multidimensional.
  - crististm 13y ago
    Resistance is futile - we'll be assimilated. In the mean time, the GNU fork is looking promising if they actually start working on it.
keeperofdakeys 13y ago
Removing the settings option for javascript was almost certainly not a move for advertising/tracking. The simple fact is, too many web pages are turning into web applications, so turning off javascript has no use on the modern web. Therefore they took away the option.
stephen_g 13y ago
I think if you want to disable JavaScript, you probably know what about:config is and how to use Google... I think it does make sense to hide an option that pretty much breaks most of the Internet. As long as it's still in about:config I think that's reasonable. By the way, you can download any image on the page from the Media tab in Page Properties, if I remember correctly.
- jacquesm 13y ago
  It's actually a pretty bad development that most websites will no longer function without javascript. Graceful degradation was once one of the hallmarks of good tradecraft, and imo it should remain that way. The server should adapt to the client, not the other way around.
  - mike-cardwell 13y ago
    That's not true. Most websites function fine without javascript.
    - okasaki 13y ago
      If you turn off javascript, most sites become at best read-only. A good chunk don't work at all or partially break in ways that make the site unusable even for viewing (e.g. flickr). I'm trying to think of sites of that degrade nicely. I can only really think of HN and gmail.
      - mike-cardwell 13y ago
        "If you turn off javascript, most sites become at best read-only" No. That is not the case. People keep saying this, but it is false.
        jessaustin 13y ago
        Do you have some other counterexamples?
bradgessler 13y ago
http://limi.net/checkboxes-that-kill/ http://limi.net/checkboxes-that-kill/ does a great job explaining why Mozilla killed the checkbox for disabling JavaScript.
- Grue3 13y ago
  No, it does a terrible job at explaining this. The browser's job is to display the webpage under the constraints set by the user, "javascript off" being one of the common constraints. If the page works incorrectly under this constraint, this is the problem of the webmaster who created it. The whole idea that Javascript is absolutely necessary for browsing is what's killing Internet with extremely slow websites and makes it insecure.
  - sp332 13y ago
    JavaScript is not slow. If I set a constraint "Don't use the letter 'e' on this page" and the text is garbled, is that the fault if the webmaster? Disabling the letter 'e' intentionally is very uncommon. If Firefox ships the option, they will have to support all the people who complain that pages are broken because they forgot or didn't know about the "feature."
  - zimpenfish 13y ago
    But when you say "one of the common constraints", do you have any figures for how common? How many people as a %age of Firefox users, for example, switch Javascript off? If it's less than 5%, removing the checkbox is a perfectly fine decision.
kevingadd 13y ago
Turning off JS ruins the internet. I say this as an avid NoScript fan (been running it for nearly a year) - the vast majority of websites will fail (often mysteriously) with JS disabled, even if you use some curated whitelist. You need a lot of technical knowledge and debugging sense to figure out what you can/can't disable.
- varkson 13y ago
  That's why I stopped using NoScript long ago. Things should just work, and NoScript doesn't let things just work. It'd be good if it had a list or something, but I have no clue what it would actually block/allow, since that's specific to the user's purpose.
  - Ygg2 13y ago
    I enjoy the challenge of figuring out how to disable some parts of site. It's a trial and error affair, but very interesting sometimes. It helps you realize how sites are built. It's not for faint of heart though.
    - varkson 13y ago
      I can understand that. I'm a webdev by trade, mainly maintenance so that's more or less what I do day in day out.
- crististm 13y ago
  No, it doesn't break the Internet. It breaks a large majority of sites that transform our PCs into computing black holes sucking all free CPU cycles into nothingness. I guess you are right...
okasaki 13y ago
Since we're on the topic. I wish they would at least create an option that makes the javascript part operate in a way that I don't have to disable PaX on Firefox. It is both the most critical desktop application to be protected and one of the very few that can't be. Even X.Org works fine with PaX these days.
- gphilip 13y ago
  What is PaX?
  - aaronem 13y ago
    "PaX is a patch for the Linux kernel that implements least privilege protections for memory pages. The least-privilege approach allows computer programs to do only what they have to do in order to be able to execute properly, and nothing more. PaX was first released in 2000." [1] [1] http://en.wikipedia.org/wiki/PaX http://en.wikipedia.org/wiki/PaX
- KMag 13y ago
  PaX prevents pages from being marked executable if they were ever writable, even if they are first (or simultaneously) marked non-executable. This means that no JITs are compatible with PaX. Not allowing pages to be simultaneously executable and writable has a lot of merit, but the stricter restrictions of PaX are a hard sell. It would be nice if PaX had an option to just disallow pages that are simultaneously writable and executable. It would be interesting to see a model where processes that were very restricted via the Linux Capabilities framework were allowed to execute pages that were once (but no longer) writable. This would allow programs such as browsers to run JITs in OS-level sandboxes. Edit: actually, I wonder if PaX allows shared pages that are executable in one process and writable in another. That would be another interesting model.

by natch 13y ago

middus 13y ago

Ordinary users do not want to disable JavaScript. Hell, they don't even know what it is. Advanced users like you can still use NoScript or about:config.

jakub_g 13y ago
This was exactly the explanation from Mozilla side and it makes sense. The reason for the decision was people telling "my internet stopped working" (white pages) once they've disabled JS by accident.
- 72deluxe 13y ago
  It's an interesting thought: should we be dumbing down everything or just engaging in a bit of education instead and helping people understand what JavaScript does and its use on web pages? The manual for my car mentions things that must be done for maintenance. They don't dumb it down. Meanwhile in computer land we hide all options and dumb everything down to "protect" the user. There is a difference between being easy to use and molly-coddling. It is a difficult balance to get it seems!
  - AndrewDucker 13y ago
    Exactly. In order to do complex tasks you get out the manual, open the hood, and get to work. And in order to do something equally complex in Mozilla you grab the help, open about:config and get to work. Your car doesn't put complex details on the dashboard, and neither should Mozilla.
  - masklinn 13y ago
    > It's an interesting thought: should we be dumbing down everything This is not a case of "dumbing down everything", the ability to remove javascript is still there, what is not there is one (of formerly 3) often inadvertently used method for it. > The manual for my car mentions things that must be done for maintenance. Disabling javascript is not maintenance, it's a significant structural change in the browser's abilities, like removing the car's suspension. And it makes no sense to put that as a switch on the car's dash.
  - quanticle 13y ago
    >The manual for my car mentions things that must be done for maintenance. Your car has a manual that describes maintenance. It doesn't have a button next to the radio that ejects the engine.
  - varkson 13y ago
    Who reads a car manual? If you want to continue that, you could consider the manual to be about:config. No one is stopping you from reading the manual or going to about:config, but it's not required.
  - pjc50 13y ago
    If you want something used by millions of people, you have to make it as simple as possible. Insisting that people learn about the invisible internals is more likely to put them off using it than to result in them learning.
- kijin 13y ago
  Too many people mistakenly disable JavaScript every time a Java vulnerability hits the news, and there was a period not too long ago when a new Java vuln seemed to appear every other week. It was around this time that the "disable JavaScript" option disappeared from Firefox.
blisterpeanuts 13y ago
>> Ordinary users do not want to disable JavaScript But sometimes "ordinary" users do need to disable Javascript. Wouldn't it make more sense to put in a pop-up "Disabling Javascript will potentially break lots of websites. Are you sure? Y/N" It's perhaps a tempest in a teapot, since these ordinary blokes will simply follow a different set of connect-the-dots instructions they found while searching for "how do I save an image from XYZ website?"

jamespo 13y ago

Or you could just install noscript. Do you think your average user would know to click a "disable javascript" button when they find right-clicking an image blocked anyway?

natch 13y ago
Yes you could, if you knew about it and trusted it. I think there's a spectrum of skills, not a binary split amongst user skills. Hard to say where the average user is with disabling JavaScript, because skill levels are multidimensional.
- crististm 13y ago
  Resistance is futile - we'll be assimilated. In the mean time, the GNU fork is looking promising if they actually start working on it.

keeperofdakeys 13y ago

Removing the settings option for javascript was almost certainly not a move for advertising/tracking. The simple fact is, too many web pages are turning into web applications, so turning off javascript has no use on the modern web. Therefore they took away the option.

stephen_g 13y ago

I think if you want to disable JavaScript, you probably know what about:config is and how to use Google... I think it does make sense to hide an option that pretty much breaks most of the Internet. As long as it's still in about:config I think that's reasonable. By the way, you can download any image on the page from the Media tab in Page Properties, if I remember correctly.

jacquesm 13y ago
It's actually a pretty bad development that most websites will no longer function without javascript. Graceful degradation was once one of the hallmarks of good tradecraft, and imo it should remain that way. The server should adapt to the client, not the other way around.
- mike-cardwell 13y ago
  That's not true. Most websites function fine without javascript.
  - okasaki 13y ago
    If you turn off javascript, most sites become at best read-only. A good chunk don't work at all or partially break in ways that make the site unusable even for viewing (e.g. flickr). I'm trying to think of sites of that degrade nicely. I can only really think of HN and gmail.
    - mike-cardwell 13y ago
      "If you turn off javascript, most sites become at best read-only" No. That is not the case. People keep saying this, but it is false.
      - jessaustin 13y ago
        Do you have some other counterexamples?

bradgessler 13y ago

http://limi.net/checkboxes-that-kill/ http://limi.net/checkboxes-that-kill/ does a great job explaining why Mozilla killed the checkbox for disabling JavaScript.

Grue3 13y ago
No, it does a terrible job at explaining this. The browser's job is to display the webpage under the constraints set by the user, "javascript off" being one of the common constraints. If the page works incorrectly under this constraint, this is the problem of the webmaster who created it. The whole idea that Javascript is absolutely necessary for browsing is what's killing Internet with extremely slow websites and makes it insecure.
- sp332 13y ago
  JavaScript is not slow. If I set a constraint "Don't use the letter 'e' on this page" and the text is garbled, is that the fault if the webmaster? Disabling the letter 'e' intentionally is very uncommon. If Firefox ships the option, they will have to support all the people who complain that pages are broken because they forgot or didn't know about the "feature."
- zimpenfish 13y ago
  But when you say "one of the common constraints", do you have any figures for how common? How many people as a %age of Firefox users, for example, switch Javascript off? If it's less than 5%, removing the checkbox is a perfectly fine decision.

kevingadd 13y ago

Turning off JS ruins the internet. I say this as an avid NoScript fan (been running it for nearly a year) - the vast majority of websites will fail (often mysteriously) with JS disabled, even if you use some curated whitelist. You need a lot of technical knowledge and debugging sense to figure out what you can/can't disable.

varkson 13y ago
That's why I stopped using NoScript long ago. Things should just work, and NoScript doesn't let things just work. It'd be good if it had a list or something, but I have no clue what it would actually block/allow, since that's specific to the user's purpose.
- Ygg2 13y ago
  I enjoy the challenge of figuring out how to disable some parts of site. It's a trial and error affair, but very interesting sometimes. It helps you realize how sites are built. It's not for faint of heart though.
  - varkson 13y ago
    I can understand that. I'm a webdev by trade, mainly maintenance so that's more or less what I do day in day out.
crististm 13y ago
No, it doesn't break the Internet. It breaks a large majority of sites that transform our PCs into computing black holes sucking all free CPU cycles into nothingness. I guess you are right...

okasaki 13y ago

Since we're on the topic. I wish they would at least create an option that makes the javascript part operate in a way that I don't have to disable PaX on Firefox. It is both the most critical desktop application to be protected and one of the very few that can't be. Even X.Org works fine with PaX these days.

gphilip 13y ago
What is PaX?
- aaronem 13y ago
  "PaX is a patch for the Linux kernel that implements least privilege protections for memory pages. The least-privilege approach allows computer programs to do only what they have to do in order to be able to execute properly, and nothing more. PaX was first released in 2000." [1] [1] http://en.wikipedia.org/wiki/PaX http://en.wikipedia.org/wiki/PaX
KMag 13y ago
PaX prevents pages from being marked executable if they were ever writable, even if they are first (or simultaneously) marked non-executable. This means that no JITs are compatible with PaX. Not allowing pages to be simultaneously executable and writable has a lot of merit, but the stricter restrictions of PaX are a hard sell. It would be nice if PaX had an option to just disallow pages that are simultaneously writable and executable. It would be interesting to see a model where processes that were very restricted via the Linux Capabilities framework were allowed to execute pages that were once (but no longer) writable. This would allow programs such as browsers to run JITs in OS-level sandboxes. Edit: actually, I wonder if PaX allows shared pages that are executable in one process and writable in another. That would be another interesting model.