Yah, but what if I want to be able to log into my account using a script? I know I'm in a tiny minority, but I have on several occasions had to use selenium to automate actions on a web app. For this reason, captchas are similarly annoying to me.
JavaScript is now required to sign in to Google
161–170 of 529 posts
Re: JavaScript is now required to sign in to Google
#162I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?
Most websites work fine, you have to be truly incompetent to make a text+image heavy website that doesn't work without JS. Web apps are a different story.
The ones that do break tend to be the ones invading your privacy.
Re: JavaScript is now required to sign in to Google
#163coming soon: we noticed you are in private browsing mode. to keep your browsing secure, please sign in with history enabled.
Re: JavaScript is now required to sign in to Google
#164Yah, but what if I want to be able to log into my account using a script? I know I'm in a tiny minority, but I have on several occasions had to use selenium to automate actions on a web app. For this reason, captchas are similarly annoying to me.
no hax0r, no soup for you!
Re: JavaScript is now required to sign in to Google
#165Earlier quoted context omitted.
What version of Firefox are you running? You are either exaggerating greatly or have other issues with your system. I run the latest stable release of Firefox and the performance of Gmail (particularly the features you mention) is fine. I’d be happy to upload a screen recording to verify.
He's not the only one. It's a recurring comment here on hacker news and a problem I've encountered as well, and I'm running the latest stable release.
Same here, I run the latest Firefox on both Windows and Linux. Gmail always takes at least 5 seconds to load.
Re: JavaScript is now required to sign in to Google
#166How is this nonsense upvoted on hackernews..?
"Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something."
Re: JavaScript is now required to sign in to Google
#167ITT: people dramatically under-estimating the risk to their accounts from credential stuffing and dramatically over-estimating their security benefits from not running JS. They're probably right that not running JS is privacy accretive, but only if you consider their individual privacy, and not the net increase in privacy for all users by being able to defend accounts against cred stuffing using JS. The privacy loss…
Calling other people, or their opinions, shortsighed and self-centered is usually not the start of a good conversation.
I mean, why not cut to the chase?
Re: JavaScript is now required to sign in to Google
#168I'm genuinely curious who actually browses the web in 2018 with JS disabled, though. Wouldn't 99.9999% of the web basically break? Like, if you do, do you only stick to a few basic sites, or?
I browse with JavaScript disabled (NoScript) with a few sites that I care about whitelisted. Most web sites work fine although their layout is sometimes not what the web designer intended. Some sites don't work at all... for those sites I generally hit the "back" button. When I enable JS to view "JS required" sites, I usually hit the "back" button before it finishes loading anyway so why bother. NoScript makes a big…
I browse same as you: Firefox & NoScript, very few sites on by default. My experience matches yours with one other thing you didn't mention:
When I get a blank page, I do:
View
Page Style
No Style
Re: JavaScript is now required to sign in to Google
#169Earlier quoted context omitted.
The security bugs found during Pwn2Own are usually kept under embargo, and only published later by the browser developers. Here's an article about a Chrome bug found in 2017's Pwn2Own: https://www.computerworld.com/article/3186686/web-browsers/g... and it does involve JavaScript. Could you provide some recent examples of the sort of browser exploits you mean, that don't require JavaScript? (I assume you're not includ…
Sure: https://www.cvedetails.com/vulnerability-list/vendor_id-1224... . Also look at Google Project Zero writeups, and similar CVE details for Firefox and Safari. Some are related to JavaScript (notably, it's hard to exploit V8 if the browser isn't processing any JavaScript!). But the vast majority are memory corruption and sandbox escape issues. Disabling JavaScript insulates you from a nontrivial - but nontheless m…
Of the first 28 vulnerabilities listed on that page (representing the past 5 years of CVEs for Chrome), I count only 7 that don't mention V8, JavaScript, PDFs, plugins, or "unspecified vectors".
If someone is choosing to disable JavaScript in their browser, I think it is reasonable to expect they are also disabling plugins for other formats like Flash and PDF.
We might disagree about whether to include disabling plugins as part of disabling JavaScript, or how to count the "unspecified vectors" CVEs, but the clearest minority is this 25% of vulnerabilities that a JavaScript (and plugins) disabling user would fail to insulate themselves from.
Re: JavaScript is now required to sign in to Google
#170Earlier quoted context omitted.
You're acting like "running programs on your computer" is a bad thing. It's not.
Running untrusted code on your machine _is_ a bad thing though.
Putting security to one side, disabling JS is an easy way to performance optimise their pages on their behalf.