Disabling Javascript makes most of this insulting crap go away, and sometimes it is the only way to read the content.

Not to mention that a host of vulnerabilities were image related a few years back (one of the original rookits exploited a TGA bug).

> uBlock Origin

Honestly, this is the antivirus of the web. I helped my niece set up my old computer for Minecraft today, and she was explaining how her friend had installed viruses (adware, really) 3 times. Every one of those instances was caused by download link confusion for Minecraft mods. Disabling JavaScript isn't going to save you from being tricked into downloading shady software, only an adblocker will.

IME, 9 times out of 10, web developers are using JS for non-necessary reasons. The user configurable settings of popular browsers make it easy to designate the small number of sites that actually require JS and keep JS disabled for all other sites. They anticipate that the user will not have one default JS policy for all websites. In other words, these web browsers do not expect that all users should just leave JS enabled/disabled for every website, they acknowledge there will be situations where it should be disabled.

However as we all know most users probably never change settings. Doubtful it is a coincidence that all these browsers have JS enabled by default.

The number of pages I visit that actually require JS for me to retrieve the content is so small that I can use a client that does not contain a JS interpreter. Warnings and such one finds on web pages informing users that "Javascript is required" are usually false IME. I can still retrieve the content with the use of an HTTP request and no JS.

There is nothing inherently wrong with the use of JS. It is nice to have a built-in interpreter in a web browser for certain uses. For example, it makes web-based commerce much easier. However, I believe the largest use of JS today is to support the internet ad industry. Without having automatic execution of code by the browser without user review, approval or even interaction, I do not believe the internet ad "industry" would exist as we know it.

I believe this not because I think having a JS or other interpreter is technically necessary, but because these companies have become wholly reliant upon it.

That's why disabling JS stopsa remarkable amount of ads and tracking.

I browse the web with JS disabled by default. If I encounter a site that has trouble with that, I enable it for that site until I can determine if it is worth leaving it enabled, which usually means at some point I'll be back there again and need it on.

For the most part, it is a superior experience to what I was seeing before with just an ad blocker. The most noticeable thing about it is probably how many images simply don't load because developers lean on JS for loading and scaling them.

Heydon is a developer, and an influencer of developers. He's saying: web development is now absolutely obsessed with JavaScript, and it in no way has to be. The basics, HTML, CSS. That's what's important.

Javascript is a privacy and security nightmare. It's almost equivalent to downloading and silently executing untrusted code on your machine. I say "almost" because Javascript code is virtualized and sandboxed. Though I have no doubt people have already discovered vulnerabilities that enable code to break out of the sandbox.

this is not about how "you" do things, It is more about how it should be done! js is almost never provides want I want when I browse, I expect to get some information! I am not on the circus looking for adventures!

people who love to use javascript to prove that they have some kind of taste about how ux etc. I think these people should use some other platform for people who are insterested in show bussniss. think of this as public transportation is designed based on who the driver is that day! is this sound ok to you? do you understand this one?

web is just connection to other people, not a tool for others to bully you just bein' smart about "the code" they wrote is brilliant!

I forget about the back button. By default, I always open links in new tabs which means back button has no data. Also, SPAs have hijacked the back button or just broken it completely, so I've been trained to not count on it behaving as expected. There's also mobile experience where getting to the back button itself is often painful after the UI hides navigation from you.

Otherwise, I am 100% in agreement. If a page is so user hostile to not making a friendly non-JS page, the tab gets closed

Things like this are seriously creepy: https://www.crazyegg.com/blog/mouse-recorder/

JS doesn't have any magic to it, location information is opt-in, but your IP is a much better advertising identifier.

The other rule is that the JS is all hand-written. No frameworks or other dependencies.

https://support.apple.com/en-gb/guide/mac-help/mchlp2271/mac

If someone knows how to achieve the same on Linux for Chrome and Firefox, I'd love to hear it (browser plugins are a bit of a security and stability shitshow, so non-plugin solution would be preferred, all else being equal).

Open your browser's developer tools, go to the Script/Debugger tab and have at it. It's just about as obtuse to use as a tool as gdb, but you'll see exactly what it does. Chrome dev tools has automatic formatting of the code, maybe firefox too. But you'll be stuck with shitty variable names if they been mangled. Although you could try http://www.jsnice.org/, I had variable luck with using it.

It would be interesting to have a browser tool that is like strace and you could filter by calls, so you can see exactly where window.navigator is being used for example, or localStorage.setItem. For now best you can do is searching for "navigator" which works, but can be minified/hidden away by coder as well.

Almost all modern browsers have debug panels that will list all of the requests made by a page, assets cached, cookies and local db, and of course it's trivial to just view the source of a site and read the javascript if it isn't compressed.

You still need Ajax (at least) for truly dynamic content. The bad news is that Ajax requires client-side JS. The good news is minimal Ajax functionality only takes about 30 lines of pure Javascript. The bad news is you will need to write those 30 lines yourself because every JS library is at least 100x bigger than that and packed with cruft you don't need.

My advice is to pretend React doesn't exist, learn Javascript, and write just the Javascript you need and no more.

In other news, possibly the best designed website of 2020: http://www.muskfoundation.org/

BTW, you probably want to move off of uM given gorhill has abandoned it in favor of uBO. (I converted all my rules to a mix of uBO dynamic rules for JS and static rules for everything else, except for cookies which I still use uM for because uBO can't manage them.)

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

Takes max 10 seconds, on any site. Can you do it in less than 10 seconds using that validator?

I have no idea why they made the SVG image inline but the CSS style external, though. That same image is used on every page.

Here[1] is the link to disabling JS for a site in Chromium.

[1] chromium://settings/content/javascript

My philosophy is: set a good example, make the benefit clear, and communicate with other devs who might not realize the horror show they’re sending down the wire/executing in their users’ browsers. But forcing people to figure out how to disable something increasingly hard to disable before they can even hear you is not good communication.

I only clicked the link because I was hoping there would be a regular site under default config and some special treat with JS disabled. Progressive enhancement. That would have been a clever and compelling execution.

First, go to "Site settings" and disable it globally.

To make a site-wide exception, click on the icon in the address bar and enable it for the site there.

It used to be crippled and unusable, but they fixed it recently.

I also recommend Bromite on Android.

    fetch("https://heydonworks.com").then(x => x.text()).then(x => { 
      var f = document.createElement("iframe"); 
      document.body.append(f); 
      f.style.left = "0px";
      f.style.top = "0px";
      f.style.width = "100%";
      f.style.height = "100%";
      f.style.position = "absolute"; 
      f.style.border = 0;
      x = x.replace(/\<\/?noscript\>/gi, ""); 
      x = x.replace(/\<script\>.*\<\/script\>/gi, ""); 
      f.contentDocument.write(x); 
    });