141–150 of 159 posts
I read HN a lot, this topic always comes up so I said “I’m going to build a site that makes these readers happy. Take all their advice, no JS at all. Everything done in HTML. Everything they’re asking for” Turns out the hardest thing to do is to get people to use your site.
Quoted post unavailable.
> a lot better than having your site break altogether. that's a humble baseline, isn't it?
So while Next & SSR isn't a perfect solution, it is often the only practical thing to do when the team or company doesn't want to spend resources on a no-JS solution.
Earlier quoted context omitted.
The differences between the browser I'm currently using and a random website with javascript on the web are: - The browser's source code is available so I can see what it does. - The browser is distributed by Debian who also distribute most other software I use so there is 1 organization to trust instead of 1000. - The browser is not downloaded and executed and upgraded automatically, so it's possible for me to know…
Modifying websites with userscripts, userstyles, and extensions is wayyyy easier than modifying native apps IMO, especially if they aren't open source.
Earlier quoted context omitted.
The differences between the browser I'm currently using and a random website with javascript on the web are: - The browser's source code is available so I can see what it does. - The browser is distributed by Debian who also distribute most other software I use so there is 1 organization to trust instead of 1000. - The browser is not downloaded and executed and upgraded automatically, so it's possible for me to know…
I guess I understand (and respect) the argument that you only want to run code that you can vet and easily modify. But I don't think most people feel that way - I think most people expect that they're getting some service (like a browser) by allowing developers to execute arbitrary code they've built on their device. I therefore don't think javascript is abusive in the way you describe it, because it follows the para…
This is not about me. It doesn't matter what most people feel or what they want to do. It's the situation where people are expected to run often invisible code written by untrustable people that is wrong. People should have the right to know and control what their computer is doing, even if they don't want to use that right. The current situation doesn't allow them to have that right.
> I think most people expect that they're getting some service (like a browser) by allowing developers to execute arbitrary code
The problem is that it's too easy for developers to use other peoples' computers for their own benefit when the current situation of the web is that people automatically let random people on the internet run code on their computers. It happens all the time. That's why they should not have this freedom.
Earlier quoted context omitted.
The differences between the browser I'm currently using and a random website with javascript on the web are: - The browser's source code is available so I can see what it does. - The browser is distributed by Debian who also distribute most other software I use so there is 1 organization to trust instead of 1000. - The browser is not downloaded and executed and upgraded automatically, so it's possible for me to know…
Any Javascript your browser runs is, by definition, available for you to see what it does.
Earlier quoted context omitted.
Something is not right just because it has been happening for a long time. > It's up to the user agent to decide whether or not to run the code. Yes, it should be. The problem is that things are constructed so that that solution doesn't work because most people don't know how to do it and if you do it a lot of things break. That forces people to let others take control over their computers when they may not actually…
>That forces people to let others take control over their computers when they may not actually want to do that. This is unnecessarily fear-laden hyperbole. Javascript doesn't force you to let others take control over your computer. And even if it did, for the sake of argument, then literally all code you run does the same, and likely takes far greater control than javascript is capable of.
Earlier quoted context omitted.
I don't care how many people there are that care about whether they are running javascript. The problem persists even if 0 people care about it. The problem is that people are getting abused, even if they don't care about it. They are unknowingly lending their computers to unknown people who use them as their tools by running code on them. My computer is my tool and nobody else's. If website owners think it's totally…
Then, don't visit their websites? If you want to run only things you trust, then do so. Others (both users and website creators) are free to make their own decisions.
> Others (both users and website creators) are free to make their own decisions.
I don't know how much of a free decision it is when the user can't know or control what the code is doing.
Earlier quoted context omitted.
I don't care how many people there are that care about whether they are running javascript. The problem persists even if 0 people care about it. The problem is that people are getting abused, even if they don't care about it. They are unknowingly lending their computers to unknown people who use them as their tools by running code on them. My computer is my tool and nobody else's. If website owners think it's totally…
Lmao are you serious? You're specifically visiting their website. You are explicitly requesting whatever they're serving up. It's akin to complaining that a program you downloaded is gasp executing code on YOUR computer!
It would be preferable if I could visit a website without having to trust them to run code on my computer. In general, it's preferable to make things as little intrusive as possible.
> a program you downloaded is gasp executing code on YOUR computer
The same is true for programs people download too. There is too much abusive code, both on the web and in other programs.
When I download a program I do it from a trusted source. The program has the source code available and I (and everyone else) have the right to read and modify that code. The web can't work like this because:
1. Websites are so many that I can't trust all of them.
2. Even if the javascript is readable, it is tied to the rest of the website and can change at any time so any modifications or rewrites will stop working.
The real pertinent reason to regulate and to get noscript/basic (x)html web portals (at least on "critical" online services) is that "javascript" requires a grotesquely and absurdely massive and complex web engine, including its SDK. The only web engines today are blink/geeko, financed by google(vanguard/blackrock), and webkit financed by apple(vanguard/blackrock). They are all written using c++ which has also a grot…
Quickjs exists, and serenity OS' browser (ladybird) show that js engines, and js-able browsers, are doable by developers outside giant corporations.
It would have been much more interesting to have ladybird written in plain and simple C (with the right compile-time and runtime function tables and NOT compiling with only gcc or clang). Maybe it is not too late to fix that.
That said the real core of the pb, is the "javascript-ed" web itself, bazillions (if not all) of critical online services should work with noscript/basic (x)html browsers.
QuickJS shows that the issue is actually the "javascript-ed" webengine and the c++ language, not solo "javascript".