Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please disable JavaScript to view this site

heydonworks.com

Post reply on HN
Print view View original

171–180 of 281 posts

Re: Please disable JavaScript to view this site

#171

Post by eyelidlessness »

enw wrote: post #147

I’d love to get rid of JS for my personal sites, but I know of no clean and simple way to render dynamic content otherwise. Server-side rendering seems a bit messy. I want a clean REST API separate from the UI. How can I generate pages with dynamic content easily? Ideally with absolute minimal dependencies.

While it can definitely be a bit messy, out of the box SSG/SSR support on Next.js is trivial (it’s on by default and there’s an indicator that shows when a page will be built static and clear/simple APIs for dynamic SSR). Certainly not minimal dependencies, and you will hit a webpack wall if you need to change the build. That said, I’m working on simplifying this for my own site (Preact instead of React, static Markdown content, separate style loading, hopefully soon automatic partial hydration for whatever JS does end up on the wire) and I plan to break it all out into simple libraries so people can do similar with the same toolchain without the webpack nightmares I’ve experienced.

Re: Please disable JavaScript to view this site

#172

Post by 1vuio0pswjnm7 »

tempestn wrote: post #124

I must say, I don't understand the disable JS movement. I browse with JS on, and uBlock Origin to block ads. It's rare that I have any javascript-related problems in my web browsing. On the other hand, I definitely use a number of sites that rely on javascript for useful purposes. If you're worried about tracking, you can block ads and tracking scripts without disabling javascript. If you're worried about viruses, we…

I must say, honestly, I don't understand the JavaScript (JS) movement. I am not a web developer, perhaps that is the reason.

IME, 9 times out of 10, web developers are using JS for non-necessary reasons. The user configurable settings of popular browsers make it easy to designate the small number of sites that actually require JS and keep JS disabled for all other sites. They anticipate that the user will not have one default JS policy for all websites. In other words, these web browsers do not expect that all users should just leave JS enabled/disabled for every website, they acknowledge there will be situations where it should be disabled.

However as we all know most users probably never change settings. Doubtful it is a coincidence that all these browsers have JS enabled by default.

The number of pages I visit that actually require JS for me to retrieve the content is so small that I can use a client that does not contain a JS interpreter. Warnings and such one finds on web pages informing users that "Javascript is required" are usually false IME. I can still retrieve the content with the use of an HTTP request and no JS.

There is nothing inherently wrong with the use of JS. It is nice to have a built-in interpreter in a web browser for certain uses. For example, it makes web-based commerce much easier. However, I believe the largest use of JS today is to support the internet ad industry. Without having automatic execution of code by the browser without user review, approval or even interaction, I do not believe the internet ad "industry" would exist as we know it.

I believe this not because I think having a JS or other interpreter is technically necessary, but because these companies have become wholly reliant upon it.

That's why disabling JS stopsa remarkable amount of ads and tracking.

Re: Please disable JavaScript to view this site

#173

Post by Arnavion »

enw wrote: post #147

I’d love to get rid of JS for my personal sites, but I know of no clean and simple way to render dynamic content otherwise. Server-side rendering seems a bit messy. I want a clean REST API separate from the UI. How can I generate pages with dynamic content easily? Ideally with absolute minimal dependencies.

Depends on what you mean by "dynamic". Some "do something when the user clicks"-style things can be done with CSS. The best example I know of that is https://git-send-email.io/

Re: Please disable JavaScript to view this site

#176

Post by kordlessagain »

tempestn wrote: post #124

I must say, I don't understand the disable JS movement. I browse with JS on, and uBlock Origin to block ads. It's rare that I have any javascript-related problems in my web browsing. On the other hand, I definitely use a number of sites that rely on javascript for useful purposes. If you're worried about tracking, you can block ads and tracking scripts without disabling javascript. If you're worried about viruses, we…

The idea that some remote server needs my processing power to display images and text is so ridiculous because it has become normal. These things don't need my processing power, nor do they have a right to it by default.

I browse the web with JS disabled by default. If I encounter a site that has trouble with that, I enable it for that site until I can determine if it is worth leaving it enabled, which usually means at some point I'll be back there again and need it on.

For the most part, it is a superior experience to what I was seeing before with just an ad blocker. The most noticeable thing about it is probably how many images simply don't load because developers lean on JS for loading and scaling them.

Re: Please disable JavaScript to view this site

#177

Post by judge2020 »

movedx wrote: post #175
sicromoft wrote: post #163

Earlier quoted context omitted.

Can you say more? I’m a happy uBlock user — what am I missing by not using Brave?

https://brave.com/

In case the OP wanted to know exactly how Brave's adblock is different from uBlock Origin instead of a link to the marketing page with links to other things like cryptocurrencies:

Brave's browser claims a speedup over AdBlock plus, but was inspired by UBO, so the performance is fairly similar, but is baked into the browser instead of being an extension.

> We therefore rebuilt our ad-blocker taking inspiration from uBlock Origin and Ghostery’s ad-blocker approach.

https://brave.com/improved-ad-blocker-performance/

Re: Please disable JavaScript to view this site

#178

Post by dbsmith83 »

sicromoft wrote: post #163
sam0x17 wrote: post #157

Earlier quoted context omitted.

In my experience Brave Browser (chrome based) runs circles around uBlock origin FYI

Can you say more? I’m a happy uBlock user — what am I missing by not using Brave?

Forced client updates

Re: Please disable JavaScript to view this site

#179

Post by kordlessagain »

matheusmoreira wrote: post #156
tempestn wrote: post #124

I must say, I don't understand the disable JS movement. I browse with JS on, and uBlock Origin to block ads. It's rare that I have any javascript-related problems in my web browsing. On the other hand, I definitely use a number of sites that rely on javascript for useful purposes. If you're worried about tracking, you can block ads and tracking scripts without disabling javascript. If you're worried about viruses, we…

> I don't understand the disable JS movement Javascript is a privacy and security nightmare. It's almost equivalent to downloading and silently executing untrusted code on your machine. I say "almost" because Javascript code is virtualized and sandboxed. Though I have no doubt people have already discovered vulnerabilities that enable code to break out of the sandbox.

> Javascript is a privacy and security nightmare.

AFAIK, JavaScript the language has neither privacy nor security issues of "nightmare" level.

> It's almost equivalent to downloading and silently executing untrusted code on your machine.

No it's not. The code is run in a VM, which is run in a browser. So, the code is limited in doing things to the browser, which itself is limited in what it can do to your computer (files and whatnot). So it's not at all like running untrusted code "on your machine".

> I say "almost" because Javascript code is virtualized and sandboxed.

It's virtualized (in the browser) such that all the code will run almost the same on different browsers and chipsets. Again, the browser code is what keeps the computer safe from any code it runs, including CSS code or other VMs it may use, like Java or Flash. Also the OS keeps the computer safe from the browser (or at least it should).

So, no it's not JavaScript that is the boogeyman here.

Re: Please disable JavaScript to view this site

#180

Post by usr1106 »

TJSomething wrote: post #62
usr1106 wrote: post #30

Earlier quoted context omitted.

Yes, I am aware of dev tools. I use them to look at network requests or to "steal" my own credentials for curl usage. Haven't really used the Javascript debugger, but my guess would be completely infeasible to follow everything a random "modern" Web site might do. And as you say some Javascript might be compressed or obfuscated. What I really would want is a somewhat higher level / more filtered approach: Like strace…

I'm not sure if it always works on all APIs or browsers, but you can wrap and replace DOM API objects with logging proxies. Additionally, you can set breakpoints on event handlers and Chromium has deobfuscation built in. You can usually tell approximately what's going on by stepping through the code and watching the variables in local scope.

> but you can wrap and replace DOM API objects with logging proxies.

Right, so you are describing the implementation of the tool I was looking for. Obviously I don't want to do that manually while tracing a page.

Post reply on HN