Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Create No-JavaScript friendly sites

garron.blog

Post reply on HN
Print view View original

31–40 of 129 posts

Re: Create No-JavaScript friendly sites

#31

Post by austincheney »

jchook wrote: post #23
mdoms wrote: post #12

I absolutely agree that JS is over-used, but for anything other than very static content I generally am not interested in kowtowing to the strict "no JS" folks. Javascript has become a fundamental part of the web, and for the same reason I won't put in extra work to make my sites work in IE, I also will not put in extra work to make my sites work for (a vanishingly small number of) people who pre-emptively block one…

JavaScript poses a large security and privacy risk. Think browser fingerprinting, XSS, JS-based analytics, poor or missing CSP + hijacked npm modules, etc. I generally keep JS disabled as much as possible.

You can perform analytics almost as well from just the HTTP headers, you don’t need JS at all for fingerprinting, and hijacked NPM modules are probably still present even if there is no JS pushed into the browser.

Re: Create No-JavaScript friendly sites

#32

Post by norenh »

hundchenkatze wrote: post #21
norenh wrote: post #9

Earlier quoted context omitted.

I am one of those dinosaurs that still surf with javascript (mostly) disabled. I use uMatrix to control where I accept it from and my default is to allow none to load. A remarkable amount of sites still work and you will always need to load some to get certain functions to work. However, I am always amazed how lazy devs are when it comes to purely informational sites as there should be no need to require javascript.…

You can access Ars' comments without JS by using the forum. https://arstechnica.com/civis/viewforum.php?f=2

Thanks! That is really helpful!

Re: Create No-JavaScript friendly sites

#33

Post by chewmieser »

jchook wrote: post #23
mdoms wrote: post #12

I absolutely agree that JS is over-used, but for anything other than very static content I generally am not interested in kowtowing to the strict "no JS" folks. Javascript has become a fundamental part of the web, and for the same reason I won't put in extra work to make my sites work in IE, I also will not put in extra work to make my sites work for (a vanishingly small number of) people who pre-emptively block one…

JavaScript poses a large security and privacy risk. Think browser fingerprinting, XSS, JS-based analytics, poor or missing CSP + hijacked npm modules, etc. I generally keep JS disabled as much as possible.

That's great and it's your choice to disable it but his point was don't expect developers that rely on JavaScript to power modern web experiences to develop their site to fit your strict requirements.

JS does way more then just fingerprint users and open up security vulnerabilities. You're in a minority that's asking for fall-backs in a world that's so far removed from simple fixes.

Re: Create No-JavaScript friendly sites

#34

Post by aaomidi »

boring_twenties wrote: post #30
mdoms wrote: post #12

I absolutely agree that JS is over-used, but for anything other than very static content I generally am not interested in kowtowing to the strict "no JS" folks. Javascript has become a fundamental part of the web, and for the same reason I won't put in extra work to make my sites work in IE, I also will not put in extra work to make my sites work for (a vanishingly small number of) people who pre-emptively block one…

> for anything other than very static content Honestly, that would be a damn good start. Just the other day I took a look at a job posting here on HN. It was nothing more than the company logo and the text of the rec. After JS was enabled, that is. Before that it was just the plain text string "You need JS enabled to run this app." What fucking app, lol?

Literally modern frontend frameworks that don't want to do SSR.

Is it that surprising?

Re: Create No-JavaScript friendly sites

#35

Post by chewmieser »

TedDoesntTalk wrote: post #22
dmortin wrote: post #11

You can use a tracker blocklist, so you don't have to disable javascript: https://github.com/notracking/hosts-blocklists

This looks like a dns-based solution? Most people are not going to install pihole at home. Other dns-based solutions require per-device configuration, and when you have a family with a dozen or more devices, this does not scale. That’s why ublock origin and friends are so popular.

Most people aren't going to outright block JS either. It's a workable solution for people that block JS due to trackers (albeit not a foolproof one).

Re: Create No-JavaScript friendly sites

#36

Post by matthoiland »

mdoms wrote: post #12

I absolutely agree that JS is over-used, but for anything other than very static content I generally am not interested in kowtowing to the strict "no JS" folks. Javascript has become a fundamental part of the web, and for the same reason I won't put in extra work to make my sites work in IE, I also will not put in extra work to make my sites work for (a vanishingly small number of) people who pre-emptively block one…

I've spent most of my career as a front end developer. We have three tools in our toolbox: HTML, CSS, and Javascript. We need them all and will push each to the extreme to create better experiences for our users and reimagine what the web can become.

I also work in the healthcare space with heavy HIPAA security requirements. Like any language/framework/platform there are best practices to follow for solid security and performance, and a good secops team should set meaningful requirements.

In short, I will show a "This site requires Javascript enabled" message 100% of the time if my site requires Javascript.

Re: Create No-JavaScript friendly sites

#37

Post by oAlbe »

codegeek wrote: post #29
forgotmypw17 wrote: post #14

Earlier quoted context omitted.

What percentage of city bus riders or public restaurant visitors do you think use the wheelchair ramp?

In my opinion, that is not a fair comparison. Wheelchair ramp usage percentage may be small but they are built because of laws and helps people who actually need it. People are not disabled by choice. Javascript disablers (and I have full sympathy as a dev. myself) are doing it by choice which is totally fine but it is still a choice, not a need.

I would argue that privacy is a need.

Re: Create No-JavaScript friendly sites

#38

Post by oAlbe »

1v1id wrote: post #28
forgotmypw17 wrote: post #14

Earlier quoted context omitted.

What percentage of city bus riders or public restaurant visitors do you think use the wheelchair ramp?

There's a difference between a small percentage needing something and a small percentage wanting something, though. If all wheelchair users could turn off their handicap at any time with no consequence, I think you'd be hard-pressed to find a wheelchair ramp anywhere.

If all JavaScript blockers users could turn on JavaScript at any time without consequences to their privacy and security, you'd be hard pressed to find JavaScript blockers as well.

Re: Create No-JavaScript friendly sites

#39

Post by maest »

AnonC wrote: post #27

Similar to the general negative experience with many Electron apps, I hate the JavaScript based rendering experience on some sites. I get very frustrated with reddit (the new UI) and Facebook, both flashing an animation or empty rectangles for a long time and me realizing that the content isn’t going to load at all and hitting the reload button to coax it to render the best time. The experience I get on these sites a…

You're probably aware, but just in case: old.reddit.com gives the old (js-free) interface.

Re: Create No-JavaScript friendly sites

#40

Post by throwaway_pdp09 »

matthoiland wrote: post #36
mdoms wrote: post #12

I absolutely agree that JS is over-used, but for anything other than very static content I generally am not interested in kowtowing to the strict "no JS" folks. Javascript has become a fundamental part of the web, and for the same reason I won't put in extra work to make my sites work in IE, I also will not put in extra work to make my sites work for (a vanishingly small number of) people who pre-emptively block one…

I've spent most of my career as a front end developer. We have three tools in our toolbox: HTML, CSS, and Javascript. We need them all and will push each to the extreme to create better experiences for our users and reimagine what the web can become. I also work in the healthcare space with heavy HIPAA security requirements. Like any language/framework/platform there are best practices to follow for solid security an…

> and will push each to the extreme to create better experiences for our users and reimagine what the web can become.

OMG. For this 'better experience' and 'reimagining what the web can become' did you bother to ask the users you pretend to cater for? No?

Listen carefully: the only experience I want from any website is to get to it, get the info I want, then I fuck off sharpish. I do not want 'experience' or any bloody 'reimagining' thank you. I have work to do.

Post reply on HN