Most websites would break, or not even display, without javascript. Sure, it's bonkers for you, but an alternative browser that can't immediately show a website that works perfectly well in Chrome wouldn't get much of a user base.

Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can't access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.

The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.

It doesn't mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don't know what site you're viewing.

You guys turn on computers?

No. I load the webpages.

Bottom left is a super-convenient built-in feature of Qubes OS, via qubes-whonix. I just click a button and a new disposable whonix qube is generated from the template, and it only takes seconds to boot. When I'm done with it, I close the window, and the disposable qube is automatically deleted.

Bottom right is my default, since I don't like broken sites.

I tried it for a while. I got caught up in the 'privacy' crowd on Reddit and went all out for a bit. Even de-googled my Android phone at the time. It is inconvenient as fuck. And you're going to be spending more time tinkering and looking for workarounds and alternate software than actually ever getting anything done. All just to stop an advertising company from detecting what you clicked on, or for the website owner to never get any telemetry.

Gonna code up a plugin that adds a button to disable or enable JS on browsers.

I have never heard the bottom left take anywhere before, though.

✨️ until now ✨️

You can block JavaScript with uBlock, BTW!

I can't convince my wife to even use an add blocker…

Can you convince her to use a subtraction blocker?

Pi-hole might be an option.

Yes, OpenDyslexicAlta Bold ^^

This is so on-brand with the meme, bravo. Also you seem very thoughtful.

Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.

@Digit@lemmy.today This, I applaud. I aim similarly.

tyvm for the appreciation. and since I can't send upvotes directly, you get extra hearts: 🩷🩷🩷🩷🩷

Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.

This, I applaud. I aim similarly.

The company I worked for used to use SSR which was fine but the web scraping was relentless and the "free" thing we offered was relatively computationally expensive. Eventually we moved to SPA and bought into the CloudFlare protection racket. This didn't stop it of course but it made the low effort scrapers have to use a browser and hopefully bumped their costs us The advent of the LLM crawlers has made everything worse as well.

We got a bunch of complaints when we moved to the JS only site saying we were ruining the Internet and while I didn't disagree the practicalities make it a requirement.

To give some examples for those that haven't tried this: images may refuse to load (js based lazy load implementation), dropdown menus almost never work, search option usually doesn't work (and if it does it's only because it goes to a different page, which is fair), comments probably won't show up, pretty much anything "live" won't work.

All of those things work perfectly on non-broken sites like mbin instances. As far as captchas, I refuse to do them, as I don't consent to being used like that.

For me the only really interesting part about this experience is that imgur refuses to load, even if you have a direct link to an image.

imgur.com/something -> farside.link/rimgo/something

Not all of the rimgo instances work, but some do.

Edit: Well apparently farside has been shut down.

That makes it easier for dyslexics?

I find it awful to read - takes a lot more effort for me I'm surprised it helps with dyslexia.

This disabling scripts thing is really for hardcore privacy enthusiasts. Just install librewolf on your linux box, change the DNS on your router to block ads and you're good.

The reason i say it's for enthusiasts is that it will break everything as soon as you do it. And i mean it. The modern web is not useful without java script. Only websites designed specifically for working without javascript will still work.

It depends on the site. Some sites which leverage javascripts are still usable without the scripts. And there is a spectrum of usability. Lemmy is a good example. Most lemmy instances which are open to the public (without captchas or login) are generally usable without javascripts. Some features don't work, but knowing the path to the page allows manually getting there without javascript buttons. So like, adding /?sort=TopHour to the end of a lemmy instance's url sets the sorting for the page to top posts in the past hour. However, some other features don't seem to work at all. But then there are lemmy instances which utilize mlmym, which basically replicates old reddit and works 100% without javascripts. And then there are instances like mbin, which is designed to be a modern fediverse experience which does not require any javascripts, and it works very well.

When I load a site, any site, if I get a blank page or a bunch of placeholders for javascript elements, I just close the tab and move on. Sometimes if I'm curious, I'll switch from "Basic Page Style" to "No Style" (Alt+V Y N) to see if there's anything hidden beneath the surface.

I'm reading a lot of personal blogs that don't use JS at all, or at least are still functional with JS blocked. A somewhat surprising amount of websites work without it.

The issue with JS is that while I assume that your use of JS is relatively minimal and you're not malicious, I don't know that, and even if you're not actively malicious, your site might still be compromized by exploited JS vulnerabilities, site hacks or uninformed/negligent choices of third party libraries/plugins/CDNs (NPM is notorious for supply chain attacks and lots of otherwise alright sites include font CDNs or even analytics). I'm not super anal about not using any site that doesn't work without JS, but having it off by default is definitely good practice and sometimes I do decide that I don't want to see a site that badly.

While technically correct, it’s a slightly shallow analysis. It’s like people complaining that companies put chemicals in the food, you could grow all of your your own food but it’s probably not feasible.

I'm confused (happens a lot). Is your comment responding to the meme or to some other comment? If the former, I am even more confused, since the meme isn't complaining about anything at all. It's poking fun some of the ways people view the web.

You can just not use someone else's software

That is what I am doing when I deny a site to run scripts on my computer, yes. And I love that I have the ability to make that choice.

yes the mainstream software companies are fucking assholes and they will take all of your data and privacy in exchange for a subscription to their software

lol yes. That's why I tend to avoid them and their products/services.

It's on you if you accept that deal.

Well I do still find it fucked-up that they prey on unsuspecting people who are ignorant of what's being done to them, including especially kids. It's not on them. They don't deserve the bad things done to them by the surveillance corporations. They can't be expected to know and understand.

i really wish raymond would restart umatrix.. it was the most flexible script blocker. noscript's 'per site' permissions takes far too many clicks to do (some of) what umatrix does from one toolbar icon drop-down.

Those are websites I don't want to use. As I've said in other comments, sites which break without javascript are what I consider broken sites. And I don't like to use broken sites.

Almost all websites stop working

Another way of saying this: Most websites are broken and not worth accessing.

Like, have you seen the web? Most sites suck. lol. The good ones don't bully/coerce me to change my behaviour.

Without js pages loads instantly

Bottom left text gives reasons that relate to security, which is also related to privacy. I don't trust arbitrary scripts, and I find it more convenient to simply disallow them. While css can theoretically be used to track mouse movements, that is typically done with javascripts, and I find that creepy af. I don't like the feeling that I'm being observed. I get enough of that whenever I go outside into this dystopic world.

So on that note, as I've said in some other comments within this thread, I prefer static pages from a UX perspective. Static pages feel comfy and safe, at least in comparison to the alternative. In contrast, javascripts tend to make the UX of sites worse in my view. So there aren't any compelling reasons for me to allow them most of the time.

It comes down to this: What do I gain by allowing javascripts? What I see is largely nothing. What do I lose by allowing javascripts? Comfort, calm, and a relaxed experience.

how so? Even if there's only 2 people in the world with burned off fingerprints, there's only one with your fingerprint

In this fucked-up world, it turns out that I end up blending in, just not with other people. Users who disallow javascripts are often mistaken for bots nowadays. We don't stand out, and so we're assumed to be bots. I think that if more people browsed without javascript it'd eventually be easier to distinguish between bots and people, and captchas could maybe die out.

One tab per laptop, with each laptop in a Faraday cage, obviously.

For optimized privacy, Whonix should be able to be installed onto pretty much anything. It's a virtual machine pair. The gateway is configured to route all traffic through the tor network. The workstation contains all the applications and doesn't have its own networking, instead routing all network traffic to the gateway.

If Whonix is too much for you, another option is to configure a dedicated linux distribution in KVM or even Virtualbox. The point is to have a task-oriented virtual machine which is used exclusively for that task. So like, a vm for browsing the web, for instance, or one for using your fediverse account. You'd want to minimize the number of unnecessary packages installed in the vm.

And if you're at all like me (you're probably not), you might want to configure it in such a way that it's disposable via cloning from a template. So, you would create a vm based on a distro (Debian, for example), and then make sure to install the necessities for the vm's purpose and uninstall unnecessary packages. Then, shutdown the vm. When you want to use the vm, you would create a clone and use that. However, you'd need to manage updates in the template, not the clone.

My laptop is airgapped, that’s why I use WLAN

@OwOarchist@pawb.social Honestly, it’s bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.

This, this, 1000 times this! That is exactly how I feel and was hoping to convey.

@OwOarchist@pawb.social Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.

Yes, defense-in-depth includes minimizing threats rather than simply relying on protections. It shouldn't be necessary to lower one's shields constantly, and it's better to avoid doing so if possible, from a security & privacy perspective.