Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please disable JavaScript to view this site

heydonworks.com

Post reply on HN
Print view View original

91–100 of 281 posts

Re: Please disable JavaScript to view this site

#91

Post by wrboyce »

deckard1 wrote: post #90
darkwater wrote: post #58

Earlier quoted context omitted.

IP behind NAT or CGNAT is not that useful, but many mobile browsers (especially cheap Androids) leak so many trackable details through headers that makes easier to uniquely identify devices/users

back in the '90s I was into connecting to IRC servers using spoofed IP addresses. The way it worked is you told the software what OS you were connecting to (or it would figure it out itself, I can't recall). Each OS had a unique way of generating TCP sequence numbers, which allowed the software to guess which number would come next. Nowadays OSes have protection for this sort of thing. But I'd imagine you could still…

How are you going from guessing TCP sequences to spoofing IP addresses on TCP connections? Did you breeze over a step or am I missing something obvious?

Re: Please disable JavaScript to view this site

#92

Post by LunaSea »

user638251 wrote: post #88
devwastaken wrote: post #57

Earlier quoted context omitted.

Ye olde days of tracking just used invisible .gifs and every click was a different webpage so they just tracked which ones were requested to gain interaction metrics. JS doesn't have any magic to it, location information is opt-in, but your IP is a much better advertising identifier.

> JS doesn't have any magic to it Canvas fingerprinting, WebGL fingerprinting, GPU, fonts etc etc etc. Please, stop arguing, JS is a nightmare for privacy. Period

So are DNS and HTTP caches.

Re: Please disable JavaScript to view this site

#94

Post by gruez »

LunaSea wrote: post #92
user638251 wrote: post #88

Earlier quoted context omitted.

> JS doesn't have any magic to it Canvas fingerprinting, WebGL fingerprinting, GPU, fonts etc etc etc. Please, stop arguing, JS is a nightmare for privacy. Period

So are DNS and HTTP caches.

>DNS

most people don't run their own resolvers, so at best you're fingerprinting DNS server of the ISP.

>http caches

can be easily cleared, or mitigated entirely by extensions or browser (eg. multi account containers).

Re: Please disable JavaScript to view this site

#95

Post by mr_toad »

bangonkeyboard wrote: post #54
wizzwizz4 wrote: post #42

Earlier quoted context omitted.

It's an inline SVG image. That alphanumeric soup is the coordinates of the points (and handles) of a line. Scroll past that, and you get the website. I have no idea why they made the SVG image inline but the CSS style external, though. That same image is used on every page.

Only inlined SVG can have its elements styled by CSS.

And in-line SVG can have it’s DOM modified, allowing the image to be interactive.

Of course, you’d need to have JavaScript enabled to do that...

Re: Please disable JavaScript to view this site

#96

Post by tyu2 »

Joeboy wrote: post #32
pmontra wrote: post #23

Earlier quoted context omitted.

I disabled it with 4 taps in uBlock Origin, Firefox Android. Open menu, Add-ons, uBlock Origin, the JavaScript icon. Then another tap to reload the page, the back button and the site did show.

Fair enough. For me, using the "Toggle js on and off" extension on Firefox 83.0 on Ubuntu, I see a blank page.

The reason you see a blank page is because the website wraps content into a tag and by "disabling javascript" it wants you to render content, not actually disable javascript. But it's a bad idea in practice. Most websites work better out of the box if you disable javascript, but not render , and also disable CSS, and inject some custom style to fix size of embedded icons. I'm not sure if there is a public extension that does that though.

Re: Please disable JavaScript to view this site

#98

Post by fastball »

Joeboy wrote: post #37
fastball wrote: post #28

Earlier quoted context omitted.

It's a personal CV-type website. Here[1] is the link to disabling JS for a site in Chromium. [1] chromium://settings/content/javascript

When I enter that into my address bar in Chromium I get a duckduckgo search, but I managed to turn off js from "site settings" and see the site.

Ye whoops, it's actually:

chrome://settings/content/javascript

Re: Please disable JavaScript to view this site

#99

Post by KMnO4 »

userbinator wrote: post #73
brianzelip wrote: post #56

Earlier quoted context omitted.

Stop using chrome

I wonder if there's a "please downgrade your browser to view this site" variation...

Please take a seat before clicking this. And yes, it is still actively used by Walgreens.

https://webapp.walgreens.com/SupplierNet/login.htm

Re: Please disable JavaScript to view this site

#100

Post by jraph »

I expected this to be implemented with something like document.body.textContent = "Please disable JavaScript to view this site" on page load. Which would be enough to work. It's actually exactly it, but with the extra precaution of wrapping the entire page inside a noscript tag. Hilarious. I guess it's useful to avoid having a chance to see the content during a flash, before the script executes.

A good contrast with web pages which are not apps telling you "This app requires Javascript to run".

Post reply on HN