Live data from Hacker News

Why I'm turning JavaScript off by default

tommorris.org

41–50 of 79 posts

Re: Why I'm turning JavaScript off by default

#41

In case anyone feels like complaining about Persona depending on JavaScript: yes, it is true that it depends on JavaScript at present, but that JavaScript is only a crutch—a polyfill for something which is intended to undergo standardisation and formalisation as core browser functionality. Assuming that happens, Persona-based sites will thus in the end not depend on JavaScript.

"that JavaScript is only a crutch—a polyfill for something which is intended to undergo standardisation and formalisation as core browser functionality."

Thats excellent. However if the poster requires behaviour that's built into the browser, he may as well require behaviour that's supplied by the site.

Re: Why I'm turning JavaScript off by default

#42
Cross domain requests are the real problem. Usually, allowing "example.com" to run javascript fetched from "example.com" is not a problem. It's when "example.com" fetches javascript from 10 other domains that the web starts to behave horribly.

RequestPolicy for Firefox blocks all cross-domain requests. Even fetching images and css from different domains. It has a blacklist/whitelist system very similar to NoScripts, so you have to allow for example, twitter.com to fetch resources from twimg.com etc, but you only have to allow it once.

[edit] I use both NoScript and RequestPolicy, but I consider RequestPolicy to be a much more powerful and useful addon.

Re: Why I'm turning JavaScript off by default

#43
Why I'm turning "run attachment in emails" off by default.

No script is simply the sane alternative to treat JS as untrusted software trying to run on your device. Its a bit inconvenient, but thats the trade you have to make if you want to retain control. The other alternative is that web browser developers work towards a more feature rich Style sheet language, say CSS, So JS Turing completeness can be exclusively used only when it's needed.

Re: Why I'm turning JavaScript off by default

#44
post #18

The first thing that would fail is the ability to login to his own site, which uses Mozilla Persona and requires JavaScript. To be fair, I'm very much in favour of reducing the amount that the browser does and to send less stuff to the browser. I'm in favour of Tom's whitelisting approach and I used to believe this was the best way to consume the web. But that was back when most sites still had an idea of gracefully…

> The first thing that would fail is the ability to login to his own site, which uses Mozilla Persona and requires JavaScript. That's why I'd whitelist my own site. And the only person who that would fail for is me because I'm the only person who can post to my own site. :)

Yeah, sure.. what about the twitter button from articles or jQuery library included in your pages?

Re: Why I'm turning JavaScript off by default

#45

This smells a bit like linkbait to me (and amusingly similar to some of the items in the 4chan parody not so long ago.) I think this would be better as a blacklist. I definitely don't find as much abuse as is claimed, but it does happen occasionally. I don't want to return to a world where I have to refresh my email window to receive new email, or a world where collaborative google docs aren't possible or the whole p…

"Linkbait". I wrote a post on my own fucking blog on Friday. I was quite drunk at the time after a long week of working on web stuff.

Then someone else posted it on Hacker News.

Any chance I could write stuff on my personal blog in the future without being accused of clickbaiting or linkbaiting or whatever?

Re: Why I'm turning JavaScript off by default

#46
post #27

But there IS a distinction between web site and web app. Blogs, news, forums and the like should not be web apps, they shouldn't use client side rendering and fancy widgets. The Spotify web player however IS a web app, and it would suck tremendously if it wasn't built as such. Can we stop with the black and white reasoning already? Yes, many things that claim to be web apps today shouldn't be, but that doesn't mean t…

Spotify desktop app is awesome. There is no real need for a web app.

In my experience, the Spotify desktop app has spotty[1]-at-best linux support, but the webapp seems to do fine.

[1] HAH!

Re: Why I'm turning JavaScript off by default

#47
The entire posts reads like an old man complaining about kids on his lawn.

The justification is just .. dumb. First because the debate is over. People want to build web apps, and they want to consume web apps. You can certainly stay on the side-lines, complain and yearn for the 90s and those glorious days of geocities and 'proper' web pages, but the world has moved on.

Second, there is this arbitrary expectation of what the web should be. Who says the people of 1995 got the web completely right?! It's like we should have just ended innovation back in the mid 90s because the pinnacle of perfection has been reached.

>As Jeremy points out, a web app seems to be nothing but a web site that requires JavaScript.

No, it's not. A web application is an application that runs in the browser (I don't want to debate web page vs web app). We had web applications before Javascript client-side became big, except everything was rendered on the server, and required reloads for most state changes. It was a largely a shitty experience. It was shitty for developers who had to write it, and shitty for users, who had to use it. But still, it conveyed huge benefits over corresponding installed applications. Your quintessential web-app back in the day was web-mail.

The original vision of HTML as only hyper-linked document markup probably lasted all of a year before we began abusing it to build things outside of the original scope.

>Perhaps we could go a step further and share the whitelists and blacklists.

Definitely within the ethos of the web.

Re: Why I'm turning JavaScript off by default

#48
post #27

But there IS a distinction between web site and web app. Blogs, news, forums and the like should not be web apps, they shouldn't use client side rendering and fancy widgets. The Spotify web player however IS a web app, and it would suck tremendously if it wasn't built as such. Can we stop with the black and white reasoning already? Yes, many things that claim to be web apps today shouldn't be, but that doesn't mean t…

Spotify desktop app is awesome. There is no real need for a web app.

Except that web apps offer a lot of conveniences for both end users and developers. You never need to update your software on an end-users machine (or write complicated auto-update code) and you can be guaranteed that it will work on any random computer you come across without needing to install anything.

Re: Why I'm turning JavaScript off by default

#49
post #26

"JavaScript is becoming the new conduit for awfulness." - did not you hear? It's called "Open Web". It means you have no choice but to use a single hastily-designed script language. Or second-class-citizen transpilers.

There is no such thing as a "transpiler". This is moronic hipster word. Translating a "source" language to another source language is still COMPILATION. Get over it. No new hipster word required.

Re: Why I'm turning JavaScript off by default

#50
post #23

Earlier quoted context omitted.

Out of curiosity, how is Persona for this use-case?

Works great. I chose it because (a) I couldn't be arsed to write a username/password setup and (b) using things like Facebook/Twitter requires an API key and I can't be bothered. Optimizing for laziness, Persona sort of won out.

That's exactly what I was hoping to hear. I often build one-off web applications (server-side rendered, not JS-filled stuff unless its needed heh) and I hate handling the user/pass setup and flow. Cool to know that Persona will work well for that sort of thing, cheers!
Post reply on HN