Honestly, it's bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.
Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.
Most websites would break, or not even display, without javascript. Sure, it's bonkers for you, but an alternative browser that can't immediately show a website that works perfectly well in Chrome wouldn't get much of a user base.
Most websites from when I was a kid did not need JavaScript. Heck, they didn’t even have any JavaScript on many of them! No CSS either, just HTML and images (which were very slow to load on dialup).
That's the problem though, why is it standard for websites to be built in such a way that their basic functionality depends on allowing such arbitrary scripts? Shouldn't there be some regulatory body that tells them that's against the rules or something?
Do you want regulatory overreach? Imagine forcing every small project or self-hoster to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.
To redirect your other question: you should ask the web developers. If they're honest, you'll get a dozen legitimate answers that can't be solved without locally running code. A chat web app, for example, needs to either poll the server at a given rate, or use a WebSocket to fetch incoming messages, both of which require Javascript. Then it needs to modify the DOM to display the new messages, which again requires Javascript. If it needs access to the microphone or webcam, it has to use some kind of local interface. I could go on. The point is, a lot of this arbitrary local code exists because there's no other way to implement many features without it. Imagine having to reload an instant messaging app if you want to see if you've received anything. It would be like writing a GUI application using Qt or GTK, but without using any events.
I don't view basic consumer rights as "regulatory overreach."
to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.
No and no. I never said it should be corporations setting the standard. That's the FCC's job, and comparable agencies in other countries. The FCC already regulates many things about the internet. Some things they don't regulate enough. Were you one of those people who viewed Net Neutrality as "regulatory overreach" too?
Sure, the current admin is corrupt and the current FCC can't be trusted, but that won't be forever.
Also, there's such thing as the IEEE. Standards for web development are not unheard of, and they're not categorically wrong. There need to be rules governing the rules that govern web development to ensure those rules aren't abused. But setting no rules or standards would be insane.
If they're honest, you'll get a dozen legitimate answers that can't be solved without locally running code.
That's not honesty. That's deflection and dissembling. Sure, you can think of a dozen different reasons why scripts need to be run locally. But that doesn't excuse using those scripts as a trojan horse for malicious data mining practices. Permissions can be atomized.
If a web developer can't compartmentalize the part of the script that loads an image on their website from the part of the script that harvests sensitive fingerprinting data that the website has no legitimate need for, then they're either a really bad developer who's never heard of modularity, or they're doing it deliberately and maliciously because they know they can get away with it and are choosing to make their website break for anyone who doesn't let them basically peep under their device's skirt.
I get your point, yeah.
I actually do think that scripts should've hugely modularized, compartmentalized, and browsers should've using OCaps instead of ACLs, or at least make more granular ACLs so you can finetune what can or what cannot do a given site and/or a given script.
Thank you! It seems pretty clear to me, modularity is supposed to be the modern standard for quality code, so why are we normalizing websites that use scripts with more arms than Cthulhu harvesting uniquely identifiable data from our personal devices by running arbitrary code locally? It seems insane to me...
"One tool for one job." It's pretty basic Unix philosophy. So why do we now have "One script for several hundred different fingerprint variables, oh and also the website's basic functionality"?
Most websites would break, or not even display, without javascript.
I use NoScript -- I'm well aware.
But a lot of those websites could function without javascript. A lot of websites use it unnecessarily, for reasons such as:
They want their ads and trackers and other malicious code (such as soft paywalls) to work as intended.
They want to add fancy cosmetic elements to the content and are too lazy to think about failing gracefully and still displaying the content if javascript isn't working.
They built the website in a framework that depends on javascript, and are again too lazy to bother worrying about graceful failure if javascript isn't working, even if their content could, in theory, be displayed just fine without it. (Or maybe the framework developers deserve a bit of the blame for that laziness, since they could have made graceful failure a feature of the framework, but chose not to.)
In a hypothetical world where most browsers didn't allow every website to run arbitrary code, then every website would be forced to take that into account and only depend on javascript when it's absolutely necessary for the website's core functions.
Just another piece of evidence that people care more about convenience than privacy, sadly. People aren't willing to put up with a single broken website
Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can't access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.
It doesn't mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don't know what site you're viewing.
Still can have issues with javascript crypto miners. And there's always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.
Most (all?) browsers throttle tabs that take too much cpu for too long (especially background). The actual numbers vary, but hidden cryptominers are not that effective anymore.
I went to see the thread in your instance because I thought it didn't federate properly. And the page for weird reasons loaded without css, which felt very appropriate for the thread.
Bottom left is a super-convenient built-in feature of Qubes OS, via qubes-whonix. I just click a button and a new disposable whonix qube is generated from the template, and it only takes seconds to boot. When I'm done with it, I close the window, and the disposable qube is automatically deleted.
Bottom right is my default, since I don't like broken sites.
Okay I just did some cursory research and it doesn't sound simple. Is it just installing qubes-whonix and creating a template (I'm guessing a yaml config or similar)?
As far as sites with JavaScript being "broken", that one puzzles me. I have tried turning off JavaScript in the past and probably 70% of websites became fully non functional. That shouldn't be the case, but it often is, and my impression has been that this has gotten worse, not better. I'm a web developer and no one talks about progressive enhancement anymore and frankly my coworkers have mostly thought it's silly to even try to support users who turn off JavaScript.
Okay I just did some cursory research and it doesn't sound simple. Is it just installing qubes-whonix and creating a template (I'm guessing a yaml config or similar)?
During the installation of Qubes OS, you can select a checkbox to have Whonix templates and qubes automatically installed. After installation, you can simply click a launcher to start an app like Tor browser in a new disposable whonix qube from the disposable whonix template. It really is that simple. Installing Qubes OS does take a while though.
As far as sites with JavaScript being "broken", that one puzzles me. I have tried turning off JavaScript in the past and probably 70% of websites became fully non functional.
Yes, those sites which become non-functional without javascripts are very much broken.
That shouldn't be the case, but it often is, and my impression has been that this has gotten worse, not better.
Yes, much of the web is broken. On a related note, much of the web is infested with malicious ads and trackers.
I'm a web developer and no one talks about progressive enhancement anymore and frankly my coworkers have mostly thought it's silly to even try to support users who turn off JavaScript.
That's a shame. And yeah, those are basically just dead sites. If they're non-functional then there's really no point for them to exist.
As the web continues to devolve, with a growing graveyard of dead sites (and an increasing prevalence of malicious scripts), I hope that more people wake up to the reality that this is bad. It's similar to the dead-end that is google's android. Eventually they'll pull it away and leave a lot of people scrambling for their next option. I think the modern web will go through a similar transformation one day. I hope so.
I will give qubes-whonix a shot, you have convinced me!
There are certain functionalities that cannot be done without JavaScript. In my perfect world either no one would abuse JavaScript with ads and other shitty design choices, or at least I'd have an easier time with toggling it off/on. For now I'm leaving JavaScript on because it's simply far too inconvenient otherwise. Browsers are pretty good about preventing actual harm if you have UBO installed though.
Out of curiosity, what harm are you concerned about JavaScript doing with an ad blocker and while loading sites within a container? That seems extreme to me.
I will give qubes-whonix a shot, you have convinced me!
You definitely shouldn't rush into Qubes OS. If you're seriously interested, I'd recommend checking out videos and reading about it so you can understand it a little deeper.
Out of curiosity, what harm are you concerned about JavaScript doing with an ad blocker and while loading sites within a container? That seems extreme to me.
Besides that fact that javascripts can be used to track and profile users, they also make the user experience of sites worse. I love static pages. Sites that require javascripts are the polar opposite of that. Useless blur effects and other "features" can cause pages to be significantly slower than static pages, and I absolutely hate it. I should be able to scroll smoothly and click buttons once the page has loaded, and I should be able to keep pages cached indefinitely. With javascripts, scrolling can often be laggy, buttons can appear and disappear in odd ways, and pages can be automatically reloaded without my consent, causing lots of frustrations. I cannot understand how anyone prefers browsing the web with javascripts. They are a fucking cancer, like 99% of the time.
RE: js, you're talking about the web as if it should only ever be what it was first conceived of: documents. In reality now it's used for full on software applications. It's not just used for animations and polish (and the shitty things you mention specifically), it's also used for dynamically updating the UI. A world you speak of would mean much worse order forms, paperwork for doctors, etc. I mean you do you, but you can't just not acknowledge that dynamic updates of a UI are better than filling out a long form then getting back "invalid data, you selected this and entered that, start over". It's literally useful.
The tracking concerns are mostly mitigated by vpns, ad blockers, and private browser features. I understand there are many flaws and issues I'm glossing over, but for the most part, the average person can just use those things, then opt to close the tab of a horrible website like you're describing.
tldr; you may prefer static documents, but modern society is built on forms and other types of vital apps, which would inevitably be worse without javascript.
I did web Dev when that was how sites worked, and they worked fine. No, it was never live updating, but the errors could be corrected and resubmitted just fine. I don't use QubeOS but this post has me intrigued.
In reality now it's used for full on software applications.
I think software applications are better made as actual applications instead of browser-based web-apps.
it's also used for dynamically updating the UI.
It might seem useful on the surface but is prone to the same sorts of breakage and annoyances I was talking about.
A world you speak of would mean much worse order forms, paperwork for doctors, etc. I mean you do you, but you can't just not acknowledge that dynamic updates of a UI are better than filling out a long form then getting back "invalid data, you selected this and entered that, start over".
That's an interesting example, because that's happened to both of my parents within the past few months from two different healthcare-related sites. The javascript elements frustrated them more than me, since they didn't understand why certain things weren't working, and I had to figure it out for them. And there were a few times when we had to start over due to the sites being poorly made.
That's really what I see in this reliance on javascripts, corner-cutting which causes problems. Properly-configured sites work better, and the ones reliant on javascript tend not to be.
I would prefer static order forms so that I can have the entire form and fill it out before submitting, while retaining a copy so that if there were issues I could more quickly and efficiently resubmit with the corrections.
Some people might prefer the dynamically updating UI stuff, but except for live chats I can't see a good use for it that static pages can't do better. And I think live chats are better in non-web apps which support end-to-end encryption anyway.
The tracking concerns are mostly mitigated by vpns, ad blockers, and private browser features.
The most useful and efficient private browsing feature is the ability to disable javascripts. Using vpns and ad-blockers protects against very specific vectors of surveillance, while javascripts allow a diverse set of surveillance capabilities, so blocking them protects against several forms of surveillance. And with more people disabling javascripts, we all blend together better.
you may prefer static documents, but modern society is built on forms and other types of vital apps, which would inevitably be worse without javascript.
Modern society is also built on ignorance, conformity, and exploitation, all of which make javascript-based sites more dangerous and prone to issues. It's the easy answer thrown at every problem, like "a.i." and is similarly dangerous.
Wasm seems like a good step towards a better web, and still is something really niche AFAIK.
I hope that it becomes standard, because is way more secure, and of course more performant than JS.
I do even think that the HTML+CSS+JS triad (and its single components, too) are a historical bad design decision, a HUGE one, and should've superseded.
What makes WASM more secure than JavaScript? I'd think that the main issue with JS is that it's a programming language that's running on the client-side, not that it's specifically JS.
The fact that WASM is NOT a programmimg language, and that WASM is intrinsically sandboxed and has really granular permissions (through WASI).
Also, how do you expect that, for example, a videoconference site (let's say, Jitsi Meet) will work if you don't execute any client-side code? And I'm not saying that all client-side code is permisible, justified or good, but rather that not all the client-side code is unpermisible, unjustified or bad, as you seem to imply.
And if you do use FLOSS, that's really paranoid, even if FLOSS isn't perfect.
NoScript is one of the oldest browser addons for selectively blocking/allowing scripts and some other things, and it's the only addon which comes preinstalled in Tor Browser. And yes, it has a dedicated toolbar button.
Had a look into the ublock settings.
The one I found seems to be more of a nuke-grade total disabling, as opposed to the fine-grained approach of the noscript extension.
UBlock's approach is that you disable it for every site in the settings and then whitelist per site. Seems sensible enough to me. How does noscript do it?
I guess I prefer the Unix philosophy of doing things:
Have a bunch of combinable small programs each being dedicated to a single function and doing that well instead of large complex monoliths.
When it comes to browser addons, it is generally recommended to have as few as possible in order to reduce attack surface, since a higher number increases the chance of having one that becomes compromised. It's especially relevant with browser addons because they tend to have lots of capabilities/permissions and can therefore do lots of damage.
I can't convince my wife to even use an add blocker, because it makes some (terrible) websites unusable (and you need an entire one additional click to disable it, it's too much effort), blocking JS would make the entire internet unusable for normies.
Pi-hole is a great project for network-wide dns-based blocking, yes. I was going to link to the official site, but it seems to be broken now, so I linked to the official github repo.
My wife loves our pihole setup so much I was forced to setup VPN access to the home network so she could block ads while traveling. Now our oldest daughter wants me to setup pihole for her house.
One thing that's really nice about pi-hole is that it gives a window into your network, allowing you to easily see dns requests as they happen, while also organizing them into useful charts and graphs.
I'm currently testing just outright blocking all scripts through uBO, and to be honest it is not usable. I will use it for a little longer, then for sure disable it. A lot of websites just refuse to load (thanks, SPAs), and those that do often have little interactions that break, thus making the pages hard to use or even outright unusable.
To give some examples for those that haven't tried this: images may refuse to load (js based lazy load implementation), dropdown menus almost never work, search option usually doesn't work (and if it does it's only because it goes to a different page, which is fair), comments probably won't show up, pretty much anything "live" won't work. Oh and let's not forget the captchas and all the proof-of-work blockers.
For me the only really interesting part about this experience is that imgur refuses to load, even if you have a direct link to an image.
The company I worked for used to use SSR which was fine but the web scraping was relentless and the "free" thing we offered was relatively computationally expensive. Eventually we moved to SPA and bought into the CloudFlare protection racket. This didn't stop it of course but it made the low effort scrapers have to use a browser and hopefully bumped their costs us The advent of the LLM crawlers has made everything worse as well.
We got a bunch of complaints when we moved to the JS only site saying we were ruining the Internet and while I didn't disagree the practicalities make it a requirement.
We got a bunch of complaints when we moved to the JS only site saying we were ruining the Internet
From my perspective, sites which move to javascript-only cease to be publicly accessible and essentially remove themselves from the internet. I do understand the necessity to do something about the scrapers, but going javascript-only is basically death of the site.
It's also just practicalities of the industry. You can write interactive elements on a site with minimal JS and some guys blog which could just be an MD file shouldn't need 10mb bundles of JS. However when you do need to shift more in to the application on the web side of things and you need front-end developers it's far cheaper and easier to source spa devs, there is just more of them.
To give some examples for those that haven't tried this: images may refuse to load (js based lazy load implementation), dropdown menus almost never work, search option usually doesn't work (and if it does it's only because it goes to a different page, which is fair), comments probably won't show up, pretty much anything "live" won't work.
All of those things work perfectly on non-broken sites like mbin instances. As far as captchas, I refuse to do them, as I don't consent to being used like that.
For me the only really interesting part about this experience is that imgur refuses to load, even if you have a direct link to an image.
Short answer: studies are limited and results are mixed but there's little to no peer reviewed evidence to suggest it provides much benefit, that said, people seem to like it, so do whatever makes you happy.
Quick question (just interested here) I'm pretty new to Linux (for 3 days now if I remember correctly) but if you guys disallow scripts how does that work on sites like my own website? Mine doesn't run any ads or trackers very conciously because i'm against it (and any type of commercialism, for that matter), however it does use a lot of script just in order to work.
This disabling scripts thing is really for hardcore privacy enthusiasts. Just install librewolf on your linux box, change the DNS on your router to block ads and you're good.
The reason i say it's for enthusiasts is that it will break everything as soon as you do it. And i mean it. The modern web is not useful without java script. Only websites designed specifically for working without javascript will still work.
This disabling scripts thing is really for hardcore privacy enthusiasts.
It also just makes things better. Javascripts tend to make for a worse browsing experience to me.
it will break everything as soon as you do it
Sites that don't work without javascripts are broken sites. It's not the lack of javascript functionality that causes them to break. They are in a broken state and should be updated to not rely on javascripts. Leaving scripts disables makes it clear which sites are broken and which sites are worth accessing.
The modern web is not useful without java script.
I disagree. The modern web is unusable with all the ads, trackers, captchas, and javascripts. The true modern web consists of the sites which don't have all of those drawbacks. Mbin is a good example of what the modern web can and should be. It's superior to all other fediverse instances I've known.
Only websites designed specifically for not working with javascript will still work.
Those are the sites worth accessing. ^^
Just install librewolf on your linux box, change the DNS on your router to block ads and you're good.
Hi, question, my own website pretty much only uses JavaScript in order to correctly display a list of my blogposts without me having to manually update the html. I did really want a way to have this without JavaScript (or backend services like PHP, I'm still hosted by neocities). Is there?
I am actually less-knowledgeable than you on these kinds of things, as I've still not yet setup my own services and know next-to-nothing about the dev part of web-dev. I have no real experience yet. The things I know come from a user perspective. Sorry to disappoint.
As a tiny webmaster myself I am very relieved to hear that. I do however also have the Commodore Amiga compatible version when you go on my site using an Amiga, which is completely without javascript. :) It automatically sends visitors to there when they visit on an Amiga computer.
It depends on the site. Some sites which leverage javascripts are still usable without the scripts. And there is a spectrum of usability. Lemmy is a good example. Most lemmy instances which are open to the public (without captchas or login) are generally usable without javascripts. Some features don't work, but knowing the path to the page allows manually getting there without javascript buttons. So like, adding /?sort=TopHour to the end of a lemmy instance's url sets the sorting for the page to top posts in the past hour. However, some other features don't seem to work at all. But then there are lemmy instances which utilize mlmym, which basically replicates old reddit and works 100% without javascripts. And then there are instances like mbin, which is designed to be a modern fediverse experience which does not require any javascripts, and it works very well.
When I load a site, any site, if I get a blank page or a bunch of placeholders for javascript elements, I just close the tab and move on. Sometimes if I'm curious, I'll switch from "Basic Page Style" to "No Style" (Alt+VYN) to see if there's anything hidden beneath the surface.
I was kinda hoping lemmy would work on an Amiga because it doesn't use any javascript, but sadly it doesn't due to the "https" it can't handle that. I just tested it.
I'm reading a lot of personal blogs that don't use JS at all, or at least are still functional with JS blocked. A somewhat surprising amount of websites work without it.
The issue with JS is that while I assume that your use of JS is relatively minimal and you're not malicious, I don't know that, and even if you're not actively malicious, your site might still be compromized by exploited JS vulnerabilities, site hacks or uninformed/negligent choices of third party libraries/plugins/CDNs (NPM is notorious for supply chain attacks and lots of otherwise alright sites include font CDNs or even analytics). I'm not super anal about not using any site that doesn't work without JS, but having it off by default is definitely good practice and sometimes I do decide that I don't want to see a site that badly.
Although I don't have any illusions that my website can't be hacked what I can tell you is that nothing on there is standard. Every single inch of my website is custom made by myself (graphics, code, music, everything) and since its closed off (there's no posting on it, nor any SQL) I THINK its relatively safe. I do strive to do that, heck it doesn't even write any cookies. (I did that deliberately since we have the cookie law around here, and I decided to go overboard and not have any cookies on AmigaCam at all, stateless)
I do agree with you though, I mean one can never be too safe.
The security issues are the reason that, if I do decide to enable javascript, it's in a disposable whonix qube. Which is basically what the bottom left panel of the meme is describing. Whereas the bottom right describes my general lack of desire to enable it at all.
I am also a bottom-right user. But browsers like Tor Browser and Mullvad Browser supposedly take care of javascript fingerprinting, at least if you check websites like amiunique.org. So I'm running out of reasons to disable javascript. What privacy reasons do you disable javascript for?
Bottom left text gives reasons that relate to security, which is also related to privacy. I don't trust arbitrary scripts, and I find it more convenient to simply disallow them. While css can theoretically be used to track mouse movements, that is typically done with javascripts, and I find that creepy af. I don't like the feeling that I'm being observed. I get enough of that whenever I go outside into this dystopic world.
So on that note, as I've said in some other comments within this thread, I prefer static pages from a UX perspective. Static pages feel comfy and safe, at least in comparison to the alternative. In contrast, javascripts tend to make the UX of sites worse in my view. So there aren't any compelling reasons for me to allow them most of the time.
It comes down to this: What do I gain by allowing javascripts? What I see is largely nothing. What do I lose by allowing javascripts? Comfort, calm, and a relaxed experience.
🎵 One tab makes things larger 🎵
🎵 And one tab makes things small 🎵
🎵 And the one with javascripts disabled 🎵
🎵 Doesn't resize elements at all 🎵
🎵 Static pages 🎵
🎵 Not a captcha wall 🎵
For optimized privacy, Whonix should be able to be installed onto pretty much anything. It's a virtual machine pair. The gateway is configured to route all traffic through the tor network. The workstation contains all the applications and doesn't have its own networking, instead routing all network traffic to the gateway.
If Whonix is too much for you, another option is to configure a dedicated linux distribution in KVM or even Virtualbox. The point is to have a task-oriented virtual machine which is used exclusively for that task. So like, a vm for browsing the web, for instance, or one for using your fediverse account. You'd want to minimize the number of unnecessary packages installed in the vm.
And if you're at all like me (you're probably not), you might want to configure it in such a way that it's disposable via cloning from a template. So, you would create a vm based on a distro (Debian, for example), and then make sure to install the necessities for the vm's purpose and uninstall unnecessary packages. Then, shutdown the vm. When you want to use the vm, you would create a clone and use that. However, you'd need to manage updates in the template, not the clone.
In this fucked-up world, it turns out that I end up blending in, just not with other people. Users who disallow javascripts are often mistaken for bots nowadays. We don't stand out, and so we're assumed to be bots. I think that if more people browsed without javascript it'd eventually be easier to distinguish between bots and people, and captchas could maybe die out.
Hey, so there are a few threads I can't see from this instance due to defederations and I wanna respond anyway.
@Digit@lemmy.today
open dyslexia font?
nice touch.
Thanks. Yeah, it's OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.
@Onomatopoeia@lemmy.cafe
That makes it easier for dyslexics?
Possibly for some, as @Ludicrous0251@piefed.zip said. I think it would probably be more beneficial for those who are introduced to it at a young age. Otherwise it takes some time to get used to it, and I did end up falling back to the fonts I had been using. But I do like OpenDyslexicAlta font and think it makes a good meme font, so yeah.
Okay so that's my response to the chain of comments quoted above. Sorry I can't give y'all upvotes due to the defederation, and sorry it took me so long to realize there were comments which were hidden from me. I do try my best to respond to everything that seems directed at me or which I can offer a worthwhile response.
The next chain of comments is much longer (it's a really good one too), and I'm thinking I'll make one or more responses when I get back online a while from now.
140 Comments
OwOarchist@pawb.social · 74 pts · 23h
Honestly, it's bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.
Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.
rtxn@lemmy.world · 31 pts · 22h
Most websites would break, or not even display, without javascript. Sure, it's bonkers for you, but an alternative browser that can't immediately show a website that works perfectly well in Chrome wouldn't get much of a user base.
Lev@europe.pub · 32 pts · 22h
I hate javascript
nightwatch_admin@lemmy.world · 21 pts · 22h
I’m not sure why there is a downvote on this… unless the downvoter thinks you don’t hate javascript enough?
a_non_monotonic_function@lemmy.world · 6 pts · 18h
Got to pump up those hate numbers bro.
OrganicMustard@lemmy.world · 1 pts · 19h
There are protocols like gemini that only have text and files, no executing code. I wish there was more of the web moving towards that.
*Edited for wrong language autocorrect.
Quibblekrust@thelemmy.club · 0 pts · 17h
I think yoy ned to profred your comments more.
jerkface@lemmy.ca · 13 pts · 22h
Because we fucking designed it that stupid that way, that's exactly grandparent's point
chonglibloodsport@lemmy.world · 12 pts · 22h
Most websites from when I was a kid did not need JavaScript. Heck, they didn’t even have any JavaScript on many of them! No CSS either, just HTML and images (which were very slow to load on dialup).
wonderingwanderer@sopuli.xyz · 3 pts · 20h
That's the problem though, why is it standard for websites to be built in such a way that their basic functionality depends on allowing such arbitrary scripts? Shouldn't there be some regulatory body that tells them that's against the rules or something?
rtxn@lemmy.world · 2 pts · 19h
Do you want regulatory overreach? Imagine forcing every small project or self-hoster to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.
To redirect your other question: you should ask the web developers. If they're honest, you'll get a dozen legitimate answers that can't be solved without locally running code. A chat web app, for example, needs to either poll the server at a given rate, or use a WebSocket to fetch incoming messages, both of which require Javascript. Then it needs to modify the DOM to display the new messages, which again requires Javascript. If it needs access to the microphone or webcam, it has to use some kind of local interface. I could go on. The point is, a lot of this arbitrary local code exists because there's no other way to implement many features without it. Imagine having to reload an instant messaging app if you want to see if you've received anything. It would be like writing a GUI application using Qt or GTK, but without using any events.
wonderingwanderer@sopuli.xyz · 1 pts · 19h
I don't view basic consumer rights as "regulatory overreach."
No and no. I never said it should be corporations setting the standard. That's the FCC's job, and comparable agencies in other countries. The FCC already regulates many things about the internet. Some things they don't regulate enough. Were you one of those people who viewed Net Neutrality as "regulatory overreach" too?
Sure, the current admin is corrupt and the current FCC can't be trusted, but that won't be forever.
Also, there's such thing as the IEEE. Standards for web development are not unheard of, and they're not categorically wrong. There need to be rules governing the rules that govern web development to ensure those rules aren't abused. But setting no rules or standards would be insane.
That's not honesty. That's deflection and dissembling. Sure, you can think of a dozen different reasons why scripts need to be run locally. But that doesn't excuse using those scripts as a trojan horse for malicious data mining practices. Permissions can be atomized.
If a web developer can't compartmentalize the part of the script that loads an image on their website from the part of the script that harvests sensitive fingerprinting data that the website has no legitimate need for, then they're either a really bad developer who's never heard of modularity, or they're doing it deliberately and maliciously because they know they can get away with it and are choosing to make their website break for anyone who doesn't let them basically peep under their device's skirt.
Kangae_Hishiryo@scribe.disroot.org · 2 pts · 16h
I get your point, yeah. I actually do think that scripts should've hugely modularized, compartmentalized, and browsers should've using OCaps instead of ACLs, or at least make more granular ACLs so you can finetune what can or what cannot do a given site and/or a given script.
wonderingwanderer@sopuli.xyz · 2 pts · 16h
Thank you! It seems pretty clear to me, modularity is supposed to be the modern standard for quality code, so why are we normalizing websites that use scripts with more arms than Cthulhu harvesting uniquely identifiable data from our personal devices by running arbitrary code locally? It seems insane to me...
"One tool for one job." It's pretty basic Unix philosophy. So why do we now have "One script for several hundred different fingerprint variables, oh and also the website's basic functionality"?
Kangae_Hishiryo@scribe.disroot.org · 2 pts · 9h
*A wild Systemd spawns*
OwOarchist@pawb.social · 3 pts · 13h
I use NoScript -- I'm well aware.
But a lot of those websites could function without javascript. A lot of websites use it unnecessarily, for reasons such as:
They want their ads and trackers and other malicious code (such as soft paywalls) to work as intended.
They want to add fancy cosmetic elements to the content and are too lazy to think about failing gracefully and still displaying the content if javascript isn't working.
They built the website in a framework that depends on javascript, and are again too lazy to bother worrying about graceful failure if javascript isn't working, even if their content could, in theory, be displayed just fine without it. (Or maybe the framework developers deserve a bit of the blame for that laziness, since they could have made graceful failure a feature of the framework, but chose not to.)
In a hypothetical world where most browsers didn't allow every website to run arbitrary code, then every website would be forced to take that into account and only depend on javascript when it's absolutely necessary for the website's core functions.
hirihit640@sh.itjust.works · 1 pts · 10h
Just another piece of evidence that people care more about convenience than privacy, sadly. People aren't willing to put up with a single broken website
cley_faye@lemmy.world · 5 pts · 22h
Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can't access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.
It doesn't mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don't know what site you're viewing.
OwOarchist@pawb.social · 1 pts · 13h
Still can have issues with javascript crypto miners. And there's always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.
Tanoh@lemmy.world · 2 pts · 8h
Most (all?) browsers throttle tabs that take too much cpu for too long (especially background). The actual numbers vary, but hidden cryptominers are not that effective anymore.
aim4harmony@lemmy.world · 63 pts · 1d
You are allowing webpages to load?
axh@lemmy.world · 49 pts · 1d
You guys turn on computers?
Diplomjodler3@lemmy.world · 42 pts · 23h
You guys use electricity?
ladicius@lemmy.world · 41 pts · 23h
Onga booga ogg?
Natanox@discuss.tchncs.de · 26 pts · 23h
expatriado@lemmy.world · 16 pts · 23h
Big Bang!
Kangae_Hishiryo@scribe.disroot.org · 3 pts · 16h
kubica@fedia.io · 8 pts · 21h
I went to see the thread in your instance because I thought it didn't federate properly. And the page for weird reasons loaded without css, which felt very appropriate for the thread.
albbi@piefed.ca · 3 pts · 18h
It showed up as a blank comment for me, which also felt appropriate.
aim4harmony@lemmy.world · 3 pts · 19h
Omg In this economy?
aim4harmony@lemmy.world · 4 pts · 19h
You guys have a computer?
axh@lemmy.world · 6 pts · 19h
You are guys?
SeductiveTortoise@piefed.social · 4 pts · 17h
I'm a rooster illusion
keiko@fedia.io · 3 pts · 16h
seductive tortoise is a rooster illusion? 🫦🐢🟰🐓❔️ idk what it means but i'm fascinated
SeductiveTortoise@piefed.social · 3 pts · 16h
On a scale from two to seven, how seduced are you? And which side is the seduced one?
keiko@fedia.io · 3 pts · 16h
lol, well i do love the odd scale, but there is a lack of emojis too, so i suppose i'd have to say about 3π/2
good question :p
Kangae_Hishiryo@scribe.disroot.org · 2 pts · 16h
Do you exist?
MonkderVierte@lemmy.zip · 6 pts · 22h
No. I load the webpages.
TrickDacy@lemmy.world · 42 pts · 20h
Those last two panels are so far past the inconvenience I'd ever be willing to put up with. I'm not sure how it could ever be worth it.
keiko@fedia.io · 15 pts · 19h
Bottom left is a super-convenient built-in feature of Qubes OS, via qubes-whonix. I just click a button and a new disposable whonix qube is generated from the template, and it only takes seconds to boot. When I'm done with it, I close the window, and the disposable qube is automatically deleted.
Bottom right is my default, since I don't like broken sites.
TrickDacy@lemmy.world · 10 pts · 18h
Okay I just did some cursory research and it doesn't sound simple. Is it just installing qubes-whonix and creating a template (I'm guessing a yaml config or similar)?
As far as sites with JavaScript being "broken", that one puzzles me. I have tried turning off JavaScript in the past and probably 70% of websites became fully non functional. That shouldn't be the case, but it often is, and my impression has been that this has gotten worse, not better. I'm a web developer and no one talks about progressive enhancement anymore and frankly my coworkers have mostly thought it's silly to even try to support users who turn off JavaScript.
keiko@fedia.io · 10 pts · 18h
During the installation of Qubes OS, you can select a checkbox to have Whonix templates and qubes automatically installed. After installation, you can simply click a launcher to start an app like Tor browser in a new disposable whonix qube from the disposable whonix template. It really is that simple. Installing Qubes OS does take a while though.
Yes, those sites which become non-functional without javascripts are very much broken.
Yes, much of the web is broken. On a related note, much of the web is infested with malicious ads and trackers.
That's a shame. And yeah, those are basically just dead sites. If they're non-functional then there's really no point for them to exist.
As the web continues to devolve, with a growing graveyard of dead sites (and an increasing prevalence of malicious scripts), I hope that more people wake up to the reality that this is bad. It's similar to the dead-end that is google's android. Eventually they'll pull it away and leave a lot of people scrambling for their next option. I think the modern web will go through a similar transformation one day. I hope so.
TrickDacy@lemmy.world · 5 pts · 17h
I will give qubes-whonix a shot, you have convinced me!
There are certain functionalities that cannot be done without JavaScript. In my perfect world either no one would abuse JavaScript with ads and other shitty design choices, or at least I'd have an easier time with toggling it off/on. For now I'm leaving JavaScript on because it's simply far too inconvenient otherwise. Browsers are pretty good about preventing actual harm if you have UBO installed though.
Out of curiosity, what harm are you concerned about JavaScript doing with an ad blocker and while loading sites within a container? That seems extreme to me.
keiko@fedia.io · 2 pts · 16h
You definitely shouldn't rush into Qubes OS. If you're seriously interested, I'd recommend checking out videos and reading about it so you can understand it a little deeper.
Besides that fact that javascripts can be used to track and profile users, they also make the user experience of sites worse. I love static pages. Sites that require javascripts are the polar opposite of that. Useless blur effects and other "features" can cause pages to be significantly slower than static pages, and I absolutely hate it. I should be able to scroll smoothly and click buttons once the page has loaded, and I should be able to keep pages cached indefinitely. With javascripts, scrolling can often be laggy, buttons can appear and disappear in odd ways, and pages can be automatically reloaded without my consent, causing lots of frustrations. I cannot understand how anyone prefers browsing the web with javascripts. They are a fucking cancer, like 99% of the time.
TrickDacy@lemmy.world · 2 pts · 15h
I hear you on qubes.
RE: js, you're talking about the web as if it should only ever be what it was first conceived of: documents. In reality now it's used for full on software applications. It's not just used for animations and polish (and the shitty things you mention specifically), it's also used for dynamically updating the UI. A world you speak of would mean much worse order forms, paperwork for doctors, etc. I mean you do you, but you can't just not acknowledge that dynamic updates of a UI are better than filling out a long form then getting back "invalid data, you selected this and entered that, start over". It's literally useful.
The tracking concerns are mostly mitigated by vpns, ad blockers, and private browser features. I understand there are many flaws and issues I'm glossing over, but for the most part, the average person can just use those things, then opt to close the tab of a horrible website like you're describing.
tldr; you may prefer static documents, but modern society is built on forms and other types of vital apps, which would inevitably be worse without javascript.
Individual_Orchid@sh.itjust.works · 3 pts · 14h
I did web Dev when that was how sites worked, and they worked fine. No, it was never live updating, but the errors could be corrected and resubmitted just fine. I don't use QubeOS but this post has me intrigued.
keiko@fedia.io · 1 pts · 14h
I think software applications are better made as actual applications instead of browser-based web-apps.
It might seem useful on the surface but is prone to the same sorts of breakage and annoyances I was talking about.
That's an interesting example, because that's happened to both of my parents within the past few months from two different healthcare-related sites. The javascript elements frustrated them more than me, since they didn't understand why certain things weren't working, and I had to figure it out for them. And there were a few times when we had to start over due to the sites being poorly made.
That's really what I see in this reliance on javascripts, corner-cutting which causes problems. Properly-configured sites work better, and the ones reliant on javascript tend not to be.
I would prefer static order forms so that I can have the entire form and fill it out before submitting, while retaining a copy so that if there were issues I could more quickly and efficiently resubmit with the corrections.
Some people might prefer the dynamically updating UI stuff, but except for live chats I can't see a good use for it that static pages can't do better. And I think live chats are better in non-web apps which support end-to-end encryption anyway.
The most useful and efficient private browsing feature is the ability to disable javascripts. Using vpns and ad-blockers protects against very specific vectors of surveillance, while javascripts allow a diverse set of surveillance capabilities, so blocking them protects against several forms of surveillance. And with more people disabling javascripts, we all blend together better.
Modern society is also built on ignorance, conformity, and exploitation, all of which make javascript-based sites more dangerous and prone to issues. It's the easy answer thrown at every problem, like "a.i." and is similarly dangerous.
Kangae_Hishiryo@scribe.disroot.org · 3 pts · 16h
Wasm seems like a good step towards a better web, and still is something really niche AFAIK.
I hope that it becomes standard, because is way more secure, and of course more performant than JS.
I do even think that the HTML+CSS+JS triad (and its single components, too) are a historical bad design decision, a HUGE one, and should've superseded.
rumschlumpel@feddit.org · 5 pts · 13h
What makes WASM more secure than JavaScript? I'd think that the main issue with JS is that it's a programming language that's running on the client-side, not that it's specifically JS.
Kangae_Hishiryo@scribe.disroot.org · 2 pts · 9h
The fact that WASM is NOT a programmimg language, and that WASM is intrinsically sandboxed and has really granular permissions (through WASI).
Also, how do you expect that, for example, a videoconference site (let's say, Jitsi Meet) will work if you don't execute any client-side code? And I'm not saying that all client-side code is permisible, justified or good, but rather that not all the client-side code is unpermisible, unjustified or bad, as you seem to imply.
And if you do use FLOSS, that's really paranoid, even if FLOSS isn't perfect.
forkDestroyer@infosec.pub · 1 pts · 19h
Gonna code up a plugin that adds a button to disable or enable JS on browsers.
ColonelThirtyTwo@pawb.social · 13 pts · 19h
NoScript?
forkDestroyer@infosec.pub · 2 pts · 7h
If it's a dedicated toolbar button I'm about to download it
keiko@fedia.io · 1 pts · 7h
NoScript is one of the oldest browser addons for selectively blocking/allowing scripts and some other things, and it's the only addon which comes preinstalled in Tor Browser. And yes, it has a dedicated toolbar button.
diaphragmwp@discuss.tchncs.de · 9 pts · 18h
Uhhhhhhhhhhhh you are kinda late on this idea
Multiplexer@discuss.tchncs.de · 27 pts · 1d
I have never heard the bottom left take anywhere before, though.
Having said that, Firefox+ublock+noscript rules.
keiko@fedia.io · 28 pts · 1d
✨️ until now ✨️
Multiplexer@discuss.tchncs.de · 23 pts · 23h
"You are, without doubt, the strangest online-script user I've ever heard of."
"But you have heard of me!"
;-)
[Edit: Sorry, slipped into wrong language before...]
keiko@fedia.io · 24 pts · 23h
Multiplexer@discuss.tchncs.de · 6 pts · 21h
:-D
Sometimes, I just love the Fediverse and its inhabitants! ❤️
Onomatopoeia@lemmy.cafe · 4 pts · 20h
What you're saying is, it bears repeating!
rumschlumpel@feddit.org · 8 pts · 22h
You can block JavaScript with uBlock, BTW!
Multiplexer@discuss.tchncs.de · 7 pts · 21h
Had a look into the ublock settings.
The one I found seems to be more of a nuke-grade total disabling, as opposed to the fine-grained approach of the noscript extension.
rumschlumpel@feddit.org · 6 pts · 21h
UBlock's approach is that you disable it for every site in the settings and then whitelist per site. Seems sensible enough to me. How does noscript do it?
keiko@fedia.io · 3 pts · 21h
That is certainly a valid approach to using ublock origin, but the wiki outlines a few other blocking modes available.
keiko@fedia.io · 4 pts · 21h
Check out the wiki to see the different blocking modes available.
Multiplexer@discuss.tchncs.de · 2 pts · 16h
I guess I prefer the Unix philosophy of doing things:
Have a bunch of combinable small programs each being dedicated to a single function and doing that well instead of large complex monoliths.
keiko@fedia.io · 3 pts · 16h
When it comes to browser addons, it is generally recommended to have as few as possible in order to reduce attack surface, since a higher number increases the chance of having one that becomes compromised. It's especially relevant with browser addons because they tend to have lots of capabilities/permissions and can therefore do lots of damage.
axh@lemmy.world · 24 pts · 21h
I can't convince my wife to even use an add blocker, because it makes some (terrible) websites unusable (and you need an entire one additional click to disable it, it's too much effort), blocking JS would make the entire internet unusable for normies.
W98BSoD@lemmy.dbzer0.com · 14 pts · 20h
Can you convince her to use a subtraction blocker?
mirshafie@europe.pub · 6 pts · 20h
A subraction facilitator. It enables the surgical excision of unwanted, harmful and stupefying noise.
Staff@piefed.world · 10 pts · 20h
Pi-hole might be an option.
keiko@fedia.io · 4 pts · 20h
Pi-hole is a great project for network-wide dns-based blocking, yes. I was going to link to the official site, but it seems to be broken now, so I linked to the official github repo.
axh@lemmy.world · 4 pts · 19h
I'm in the process of setting up pi-hole at the moment.
ReluctantMuskrat@lemmy.world · 5 pts · 19h
My wife loves our pihole setup so much I was forced to setup VPN access to the home network so she could block ads while traveling. Now our oldest daughter wants me to setup pihole for her house.
keiko@fedia.io · 4 pts · 19h
One thing that's really nice about pi-hole is that it gives a window into your network, allowing you to easily see dns requests as they happen, while also organizing them into useful charts and graphs.
rumschlumpel@feddit.org · 2 pts · 19h
AFAIK some sites are so terrible that they won't work even if you use DNS-based adblocking instead of browser extension-based adblocking ...
Definitely worth trying, though.
cmnybo@discuss.tchncs.de · 2 pts · 13h
Another option is to point your DNS to one of the public ad blocking DNS servers.
keiko@fedia.io · 23 pts · 22h
bonus meme:
Ertain@feddit.online · 12 pts · 17h
Does this comic use that dyslexic font? If so, nice touch.
keiko@fedia.io · 13 pts · 17h
Yes, OpenDyslexicAlta Bold ^^
Diurnambule@jlai.lu · 5 pts · 14h
Really readable, love it. <3
PinkiePieYay2707@pawb.social · 9 pts · 19h
I'm currently testing just outright blocking all scripts through uBO, and to be honest it is not usable. I will use it for a little longer, then for sure disable it. A lot of websites just refuse to load (thanks, SPAs), and those that do often have little interactions that break, thus making the pages hard to use or even outright unusable.
To give some examples for those that haven't tried this: images may refuse to load (js based lazy load implementation), dropdown menus almost never work, search option usually doesn't work (and if it does it's only because it goes to a different page, which is fair), comments probably won't show up, pretty much anything "live" won't work. Oh and let's not forget the captchas and all the proof-of-work blockers.
For me the only really interesting part about this experience is that imgur refuses to load, even if you have a direct link to an image.
tempest@lemmy.ca · 5 pts · 18h
The company I worked for used to use SSR which was fine but the web scraping was relentless and the "free" thing we offered was relatively computationally expensive. Eventually we moved to SPA and bought into the CloudFlare protection racket. This didn't stop it of course but it made the low effort scrapers have to use a browser and hopefully bumped their costs us The advent of the LLM crawlers has made everything worse as well.
We got a bunch of complaints when we moved to the JS only site saying we were ruining the Internet and while I didn't disagree the practicalities make it a requirement.
keiko@fedia.io · 4 pts · 18h
From my perspective, sites which move to javascript-only cease to be publicly accessible and essentially remove themselves from the internet. I do understand the necessity to do something about the scrapers, but going javascript-only is basically death of the site.
tempest@lemmy.ca · 1 pts · 17h
It's also just practicalities of the industry. You can write interactive elements on a site with minimal JS and some guys blog which could just be an MD file shouldn't need 10mb bundles of JS. However when you do need to shift more in to the application on the web side of things and you need front-end developers it's far cheaper and easier to source spa devs, there is just more of them.
keiko@fedia.io · 3 pts · 18h
All of those things work perfectly on non-broken sites like mbin instances. As far as captchas, I refuse to do them, as I don't consent to being used like that.
imgur.com/something->farside.link/rimgo/somethingNot all of the rimgo instances work, but some do.
Edit: Well apparently farside has been shut down.
Digit@lemmy.today · 9 pts · 22h
open dyslexia font?
nice touch.
Onomatopoeia@lemmy.cafe · 6 pts · 20h
That makes it easier for dyslexics?
I find it awful to read - takes a lot more effort for me I'm surprised it helps with dyslexia.
Ludicrous0251@piefed.zip · 2 pts · 16h
Short answer: studies are limited and results are mixed but there's little to no peer reviewed evidence to suggest it provides much benefit, that said, people seem to like it, so do whatever makes you happy.
Digit@lemmy.today · 1 pts · 15h
Not for this dyslexic.
I tried it for a little while, a while back, but went back to the fonts I made a long while back.
MiRRoRMaN@ani.social · 8 pts · 21h
Quick question (just interested here) I'm pretty new to Linux (for 3 days now if I remember correctly) but if you guys disallow scripts how does that work on sites like my own website? Mine doesn't run any ads or trackers very conciously because i'm against it (and any type of commercialism, for that matter), however it does use a lot of script just in order to work.
richardisaguy@lemmy.world · 13 pts · 21h
This disabling scripts thing is really for hardcore privacy enthusiasts. Just install librewolf on your linux box, change the DNS on your router to block ads and you're good.
The reason i say it's for enthusiasts is that it will break everything as soon as you do it. And i mean it. The modern web is not useful without java script. Only websites designed specifically for working without javascript will still work.
pineapplelover@lemmy.dbzer0.com · 8 pts · 21h
I use noscript extension and so every new site I access I have to whitelist it if I don't find it too sus
snw@feddit.nl · 6 pts · 21h
exactly this, I've been using noscript for at least 15 years by now, probably longer. It's annoying, sometimes. But it's worth it always.
keiko@fedia.io · 3 pts · 20h
It also just makes things better. Javascripts tend to make for a worse browsing experience to me.
Sites that don't work without javascripts are broken sites. It's not the lack of javascript functionality that causes them to break. They are in a broken state and should be updated to not rely on javascripts. Leaving scripts disables makes it clear which sites are broken and which sites are worth accessing.
I disagree. The modern web is unusable with all the ads, trackers, captchas, and javascripts. The true modern web consists of the sites which don't have all of those drawbacks. Mbin is a good example of what the modern web can and should be. It's superior to all other fediverse instances I've known.
Those are the sites worth accessing. ^^
I do agree that this is good advice <3
Inkstainthebat@pawb.social · 2 pts · 15h
Hi, question, my own website pretty much only uses JavaScript in order to correctly display a list of my blogposts without me having to manually update the html. I did really want a way to have this without JavaScript (or backend services like PHP, I'm still hosted by neocities). Is there?
rumschlumpel@feddit.org · 3 pts · 13h
A good option are static site generators like Hugo.
keiko@fedia.io · 1 pts · 14h
I am actually less-knowledgeable than you on these kinds of things, as I've still not yet setup my own services and know next-to-nothing about the dev part of web-dev. I have no real experience yet. The things I know come from a user perspective. Sorry to disappoint.
MiRRoRMaN@ani.social · 2 pts · 20h
As a tiny webmaster myself I am very relieved to hear that. I do however also have the Commodore Amiga compatible version when you go on my site using an Amiga, which is completely without javascript. :) It automatically sends visitors to there when they visit on an Amiga computer.
keiko@fedia.io · 6 pts · 20h
It depends on the site. Some sites which leverage javascripts are still usable without the scripts. And there is a spectrum of usability. Lemmy is a good example. Most lemmy instances which are open to the public (without captchas or login) are generally usable without javascripts. Some features don't work, but knowing the path to the page allows manually getting there without javascript buttons. So like, adding
/?sort=TopHourto the end of a lemmy instance's url sets the sorting for the page to top posts in the past hour. However, some other features don't seem to work at all. But then there are lemmy instances which utilize mlmym, which basically replicates old reddit and works 100% without javascripts. And then there are instances like mbin, which is designed to be a modern fediverse experience which does not require any javascripts, and it works very well.When I load a site, any site, if I get a blank page or a bunch of placeholders for javascript elements, I just close the tab and move on. Sometimes if I'm curious, I'll switch from "Basic Page Style" to "No Style" (
Alt+VYN) to see if there's anything hidden beneath the surface.MiRRoRMaN@ani.social · 2 pts · 20h
I was kinda hoping lemmy would work on an Amiga because it doesn't use any javascript, but sadly it doesn't due to the "https" it can't handle that. I just tested it.
rumschlumpel@feddit.org · 4 pts · 20h
I'm reading a lot of personal blogs that don't use JS at all, or at least are still functional with JS blocked. A somewhat surprising amount of websites work without it.
The issue with JS is that while I assume that your use of JS is relatively minimal and you're not malicious, I don't know that, and even if you're not actively malicious, your site might still be compromized by exploited JS vulnerabilities, site hacks or uninformed/negligent choices of third party libraries/plugins/CDNs (NPM is notorious for supply chain attacks and lots of otherwise alright sites include font CDNs or even analytics). I'm not super anal about not using any site that doesn't work without JS, but having it off by default is definitely good practice and sometimes I do decide that I don't want to see a site that badly.
MiRRoRMaN@ani.social · 3 pts · 19h
Although I don't have any illusions that my website can't be hacked what I can tell you is that nothing on there is standard. Every single inch of my website is custom made by myself (graphics, code, music, everything) and since its closed off (there's no posting on it, nor any SQL) I THINK its relatively safe. I do strive to do that, heck it doesn't even write any cookies. (I did that deliberately since we have the cookie law around here, and I decided to go overboard and not have any cookies on AmigaCam at all, stateless)
I do agree with you though, I mean one can never be too safe.
keiko@fedia.io · 3 pts · 20h
The security issues are the reason that, if I do decide to enable javascript, it's in a disposable whonix qube. Which is basically what the bottom left panel of the meme is describing. Whereas the bottom right describes my general lack of desire to enable it at all.
rumschlumpel@feddit.org · 2 pts · 19h
Quite sensible!
juipeltje@lemmy.world · 4 pts · 21h
Bottom right is basically RMS/extreme FOSS enthusiast lol
hirihit640@sh.itjust.works · 3 pts · 10h
I am also a bottom-right user. But browsers like Tor Browser and Mullvad Browser supposedly take care of javascript fingerprinting, at least if you check websites like amiunique.org. So I'm running out of reasons to disable javascript. What privacy reasons do you disable javascript for?
keiko@fedia.io · 1 pts · 10h
Bottom left text gives reasons that relate to security, which is also related to privacy. I don't trust arbitrary scripts, and I find it more convenient to simply disallow them. While css can theoretically be used to track mouse movements, that is typically done with javascripts, and I find that creepy af. I don't like the feeling that I'm being observed. I get enough of that whenever I go outside into this dystopic world.
So on that note, as I've said in some other comments within this thread, I prefer static pages from a UX perspective. Static pages feel comfy and safe, at least in comparison to the alternative. In contrast, javascripts tend to make the UX of sites worse in my view. So there aren't any compelling reasons for me to allow them most of the time.
It comes down to this: What do I gain by allowing javascripts? What I see is largely nothing. What do I lose by allowing javascripts? Comfort, calm, and a relaxed experience.
spacegoat@lemmy.world · 2 pts · 9h
Why should my computer do the work? Server-side only
JensSpahnpasta@feddit.org · 2 pts · 20h
So what's the best practice to let Firefox run in a virtualized system on Ubuntu?
KurtVonnegut@mander.xyz · 4 pts · 20h
One tab per laptop, with each laptop in a Faraday cage, obviously.
keiko@fedia.io · 7 pts · 19h
🎵 One tab makes things larger 🎵 🎵 And one tab makes things small 🎵 🎵 And the one with javascripts disabled 🎵 🎵 Doesn't resize elements at all 🎵 🎵 Static pages 🎵 🎵 Not a captcha wall 🎵
keiko@fedia.io · 4 pts · 20h
For optimized privacy, Whonix should be able to be installed onto pretty much anything. It's a virtual machine pair. The gateway is configured to route all traffic through the tor network. The workstation contains all the applications and doesn't have its own networking, instead routing all network traffic to the gateway.
If Whonix is too much for you, another option is to configure a dedicated linux distribution in KVM or even Virtualbox. The point is to have a task-oriented virtual machine which is used exclusively for that task. So like, a vm for browsing the web, for instance, or one for using your fediverse account. You'd want to minimize the number of unnecessary packages installed in the vm.
And if you're at all like me (you're probably not), you might want to configure it in such a way that it's disposable via cloning from a template. So, you would create a vm based on a distro (Debian, for example), and then make sure to install the necessities for the vm's purpose and uninstall unnecessary packages. Then, shutdown the vm. When you want to use the vm, you would create a clone and use that. However, you'd need to manage updates in the template, not the clone.
Forester@pawb.social · 2 pts · 10h
Burning off your fingerprints makes you far more identifiable then keeping them.
keiko@fedia.io · 1 pts · 10h
In this fucked-up world, it turns out that I end up blending in, just not with other people. Users who disallow javascripts are often mistaken for bots nowadays. We don't stand out, and so we're assumed to be bots. I think that if more people browsed without javascript it'd eventually be easier to distinguish between bots and people, and captchas could maybe die out.
keiko@fedia.io · 1 pts · 3h
Hey, so there are a few threads I can't see from this instance due to defederations and I wanna respond anyway.
Thanks. Yeah, it's OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.
Possibly for some, as @Ludicrous0251@piefed.zip said. I think it would probably be more beneficial for those who are introduced to it at a young age. Otherwise it takes some time to get used to it, and I did end up falling back to the fonts I had been using. But I do like OpenDyslexicAlta font and think it makes a good meme font, so yeah.
Okay so that's my response to the chain of comments quoted above. Sorry I can't give y'all upvotes due to the defederation, and sorry it took me so long to realize there were comments which were hidden from me. I do try my best to respond to everything that seems directed at me or which I can offer a worthwhile response.
The next chain of comments is much longer (it's a really good one too), and I'm thinking I'll make one or more responses when I get back online a while from now.
🩷
I_Clean_Here@lemmy.world · 1 pts · 21h
The last two Images are basically the same. Meme failed.
AnimalsDream@slrpnk.net · 1 pts · 10h
Y'all are running your PC's un-airgapped?
basxto@discuss.tchncs.de · 1 pts · 10h
My laptop is airgapped, that’s why I use WLAN