[johannes1234321]

> JS is a security risk IMO.

A network connection is a security risk.

The question is whether the benefits outweighs the risk added by enabling it.

For me the benefit of disabling JS is more in privacy and disabling annoying user experience. JavaScriot runtimes are quite well audited meanwhile.

[zasdffaa]

And a turing complete language delivered from a third party over said network connection to be executed locally will exponentially increases that risk, no?

> JavaScriot runtimes are quite well audited meanwhile.

Given (for example) the leftpad trainwreck, is that really true?

[johannes1234321]

> > JavaScriot runtimes are quite well audited meanwhile.

> Given (for example) the leftpad trainwreck, is that really true?

That was that some (quite pointless) code was not available anymore as easily. Not a security issue.

[zasdffaa]

That's entirely irrelevant. It was available, got used, and things massively fell over when it was pulled. You've given no case to show things have changed - can you actually give any evidence that 'JavaScriot runtimes are quite well audited'.

[johannes1234321]

Correct, leftpad ia completely irrelevant for the discussion.

[zasdffaa]

And helloooo eternal september. You haven't a clue.

[vntok]

It really was a non-event.