[oblio]

We're so lucky that this has changed (narrator: it hasn't).

It definitely doesn't happen anymore (narrator: it still happens).

And it definitely doesn't happen in absolutely every browser out there and it can't really be blocked (narrator: it does, it is just done with JavaScript, which only hermits disable).

[throwaway_pdp09]

You acknowledge javascript has all the serious downsides of flash, then denigrate us who disable it for the very reasons you've given?

[oblio]

I'm making fun of you because it's not very realistic to disable it, especially due to network effects.

All the popular sites, including many intranet sites in every company I've worked for, use Javascript. I mean, you can disable it/enable it selectively, maybe I should try it with some Firefox extension. But I expect 95% of the web to break if I disable it.

So it's kind of a revolutionary attitude, which works out if you have nothing to lose, I guess. Or if you're trying to prove a point, but along the way you're probably hurting yourself, too.

[doodpants]

> I mean, you can disable it/enable it selectively, maybe I should try it with some Firefox extension.

The one I use is called, appropriately enough, Disable JavaScript [0]. It puts a simple toggle button in the toolbar, and remembers the setting on a per-domain basis. If a website has annoying behavior, it's little effort to switch JavaScript off to see if the site is still usable that way, or to re-enable it briefly to glance at some missing content. I recommend it; it's surprising how many sites I've disabled JS on, and left that way because there's no major breakage.

[0] https://addons.mozilla.org/en-US/firefox/addon/disable-javas...

[throwaway_pdp09]

> maybe I should try it with some Firefox extensions

So you're making fun of me although you haven't tried it. Yeah, okay.

> But I expect 95% of the web to break if I disable it

And you'll be wrong, it is much lower than that (except if you're talking about adverts failing to display, then I guess yes, in that respect it does).

I don't give a damn about other sites (and I don't browse intranet sites on my home machine -- if I'm in an office I use their office machine). If they don't work I don't use them except in rare cases when I really need to in which case they get run in a VM.

> you're probably hurting yourself, too

That's deeply patronising from somebody who admits they haven't even tried doing what I do, nor has even asked why I and others do it (hint: it's for many of the reasons you described). It sounds like you're talking to a rather stupid child.

[oblio]

I have tried it a long time ago (4, maybe 5 years ago?). Many, many things broke and I didn't have time to fix them all.

I already use the strictest Tracking Protection stuff in Firefox, for example, and I do hit sites that don't work correctly.

Maybe it's worth revisiting but something tells me that the web uses more JavaScript, not less, since I last tried this experiment.

And regarding the patronizing aspect, let's say your bank's website uses JavaScript, what do you do?

Edit, actually, sorry, I re-read your comment and you answered my question:

> I don't give a damn about other sites (and I don't browse intranet sites on my home machine -- if I'm in an office I use their office machine). If they don't work I don't use them except in rare cases when I really need to in which case they get run in a VM.

Q.e.d.

I'll just rephrase things to something less offensive: you're not "hurting" yourself, you're limiting yourself, sometimes with drawbacks not everyone is able/willing to endure.

[throwaway_pdp09]

> let's say your bank's website uses JavaScript, what do you do

Well mate, take a guess :) I do it on the phone only (and I don't mean smartphone). I've had a little exposure to bank's competence from the inside 20 years ago (large UK bank, mortgages), they couldn't find their own arse with a torch, arrows, diagrams and a PhD in arse-finding.

> 'll just rephrase things to something less offensive: you're not "hurting" yourself, you're limiting yourself, sometimes with drawbacks not everyone is able/willing to endure.

That's much more accurate. We can agree, however consider that that 'limiting [my]self' means limiting my exposure to ads, abuse of my CPU, tracking, most dark patterns, nag screens, malware and more. The tradeoff's very ok for me, and I've experience the web on both sides. Oh yes it's worth it! (for me).

[stephenr]

Name one browser-embedded technology in distribution today that has had even half as many security vulnerabilities as Flash has had over its lifetime?

If your world view is "block javascript or let any and all javascript run", I don't know how to help you, because that isn't reality.

[oblio]

> Name one browser-embedded technology in distribution today that has had even half as many security vulnerabilities as Flash has had over its lifetime?

Why should I name a "browser-embedded technology"? I can just point out browser vulnerabilities.

https://www.cvedetails.com/product/3264/Mozilla-Firefox.html...

https://www.cvedetails.com/product/15031/Google-Chrome.html?...

If anything, they're not that great against Flash:

https://www.cvedetails.com/product/6761/Adobe-Flash-Player.h...

Keep in mind that Flash itself was a runtime, much as a browser is. More limited, but still pretty big.

> If your world view is "block javascript or let any and all javascript run", I don't know how to help you, because that isn't reality.

You can't help me, I think no one can. For now we can still kind of run ad blockers, even though Chrome is working hard on stealthily removing them.

But for regular users, who don't run them (probably 99% of users out there), how do they protect themselves from cryptominers? From nasty ads?

[est31]

10 years ago, it was nearly impossible to browse the web with Flash disabled. Which means that most people had it installed, and thus a vulnerability in Flash would mean all users were exploitable. Browser vulnerabilities only mean the users of that browser are exploitable, which limits its scope somewhat. Of course, the Chrome monoculture that has established itself doesn't help here :).

[stephenr]

> For now we can still kind of run ad blockers, even though Chrome is working hard on stealthily removing them.

You're using a browser build by a giant privacy abusing ad company, and you wonder why it isn't so friendly to ad-blocking/privacy-protecting plugins?

COLOUR ME SURPRISED.

[oblio]

I'm using Firefox...

[stephenr]

Great. So your two comments taken together prove my point. Don't use technology that's actively working against your best interests, and your interests will be better served..

[oblio]

No, you're just completely missing the point. By a mile.

You can't bury your hand in the sand and pretend that everything is fine. It's not.

Almost every browser out there is dying, everything is being taken over by Chrome/Chromium/Blink. The alternative is Webkit/Safari, which comes with its own limitations.

Firefox's market share is 5% and dwindling. Web developers have stopped caring about Firefox. Many sites are slow or barely working in Firefox. Firefox bugs aren't being fixed.

Soon I'll be forced to use Chrome because the alternatives won't allow me to do my job.

Open Source browser alternatives can't keep up. And even though Chromium itself is Open Source, it's not a complete browser for the modern web (see DRM).

So we're all going to be using Chrome or browsers built by corporations with the same incentives as Google (Microsoft also has an ad network, Opera is now owned by a semi-shady Chinese VPN company). And these browsers are gutting ad blocking.

Plus ads are getting smarter and we're not that far off from a point where ad blocking in its current form is no longer efficient. See for example stuff like the DNS over HTTPS changes.

And if it would only be about this, you'd be missing the point by "only" half a mile.

The other half a mile is that many people are forced to use a certain browser. At work, at school, etc. Or they don't know how to change their browser or what a browser even is. We're all in this together, the internet is one big network.

And for regular people, modern browsers are just as bad as Flash. Maybe even worse, at least Flash had a modicum of design as a platform. The web platform is a huge mishmash.

[virgilp]

So tell me. Which browser(s) should I use? Don't be so mysterious.

[Doctor_Fegg]

Depends if you view pervasive tracking as a security vulnerability.