[jsgyx]

I use NoScript, you can't see shit.

[Thorrez]

Here's a port scanning technique that doesn't use javascript:

https://blog.jeremiahgrossman.com/2006/11/browser-port-scann...

[dwb]

This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

[gnomewascool]

> This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.

[deadbunny]

Their routers do, along with an ever growing number of IoT devices people happily hook up to their WiFi without a second thought.

Given the long and gory history of companies releasing insecure by default devices methods like this are a legitimate entry point into a network.

[tinus_hn]

Most users have a modem or router that comes with a web interface, like just about everything in the internet of things.

[jsgyx]

That's like saying that people shouldn't have to run ad blockers, that instead ad networks should behave. Sit and wait.

[julienreszka]

You can't see shit neither

[vbsteven]

yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"

[larkeith]

Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with <noscript>, you just get a broken and/or blank page.

I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users.

(Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encounter several new sites daily.)

[vbsteven]

I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.

[larkeith]

Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.

[npsimons]

> Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.

Yes.

Joking aside, I will add that I've been a NoScript/FlashBlock user for quite some time (more than a decade? I honestly can't remember), and while I run into some things that are frustrating (just had to disable NoScript for a tab to order plane tickets), it is refreshingly uncommon.

Yes, you can browse with default deny to JS and Flash.

[icebraining]

Actually, they can: even if you enable JS, NoScript's ABE will prevent this attack: https://en.wikipedia.org/wiki/NoScript#Application_Boundarie...

[mrob]

Not anymore. It's not included in modern versions (after the changes in Add-Ons for Firefox's Quantum update).

[alfiedotwtf]

That was actually funny