[privong]

> How about something simpler - Make images load slowly using JS.

I do like this idea. However, as one of the minority of people who have disabled js by default, I'd hope this could be done in a way that doesn't break websites.

[err4nt]

I don't know how to say it without being blunt, but I mean no offense, I'm just curious. I've heard of this mythical type of user (no-JS) but never heard their side of the coin before.

I dislike ad tracking, information culling, and I think that JavaScript underpins and makes possible many of the things I dislike about the modern web. We agree on that I'm sure. But so does a web browser. So does the operating system it runs on. Turning off JavaScript only protects you from the parts of the web you don't like by breaking all of the web so much that nothing runs as it's supposed to - but what's the point in browsing a shattered web?

I am a front-end dev, and I've hit the extent that CSS will allow me to style and lay out pages. I need per-element @media queries, and the ability for elements to peek inside and count their contents so I can make it fit into the space better. JavaScript lets me to do that, but I'm afraid that if you disable JavaScript from today forward you're going to run into this a lot more.

It doesn't take a whole ton of JavaScript to supercharge a CSS layout, but if you block all JS you're going to be looking at a broken page.

I use text-mode browsers on the command-line, and for checking the source of pages from the command-line so I understand when there's a time and place for restricted browsing and it's less useful than a full browser to me because of it.

Having said all that, would you mind explaining why you choose to break your exerience of the web by disabling JavaScript, and what gains you perceive from the exercise. I'm genuinely curious but can't find any of you no-JSers in person anywhere.

[chill1]

Allow me to list a few reasons I run with JS disabled by default:

- Poorly written JavaScript that causes my system to stall for a time, to the point where I have to kill all my browser's processes manually; more common than you'd think.

- Websites that attempt to mine cryptocurrencies using my browser with JavaScript; without my knowledge or permission.

- Then there's XSS and CSRF vulnerabilities that can leverage JavaScript to hijack active sessions.

And I am probably forgetting a few more reasons..

I do enable JavaScript for specific trusted websites, and I make temporary exceptions every now and then if necessary. But, I usually try to keep the list of exceptions short.

In regards to needing JavaScript for styling / design purposes.. Are you sure you need it? It might take you a bit longer to tweak and restructure the HTML and CSS to accomplish your design without JS, but it's well worth it.

[Theodores]

Mining bitcoins in javascript on someone else's computer. Surely it would be quicker to get the 386 computers out of the landfill and use them than to mine bitcoins in javascript remotely in some botnet of sorts.

I am intrigued. Can you send me a URL of somewhere that will mine bitcoins on my computer?

[chill1]

I don't have any websites bookmarked that employ such scripts, but DuckingIt (tm) yields the following links on that topic:

https://bitcointalk.org/index.php?topic=9042.0

http://www.bitcoinplus.com/miner/embeddable

https://github.com/progranism/Bitcoin-JavaScript-Miner

You should probably not embed such scripts into your website(s). If it's not illegal, it's certainly super shady, and an extremely inefficient method of mining bitcoins.

[sp332]

Quicker, probably :) but not cheaper! You can be as inefficient as you want if it's other people's resources you're wasting.

[err4nt]

Oh trust me, I use regular expressions in my CSS, when I reach for JavaScript to accomplish something it's because CSS4 (or CSS5) aren't out yet ;)

[wldlyinaccurate]

I only have some second-hand, anecdotal explanations. In my freelancing days (several years ago), I had clients who insisted that their websites work flawlessly without JavaScript -- some would even insist that there was no JavaScript at all. When I asked these clients why they wanted this, the answer would always be because they have disabled JavaScript in their browser, so why would they want any JavaScript on their website?

When I asked why they disabled JavaScript, it was rare to get any sort of coherent answer. Usually they would just mumble about viruses, or occasionally about privacy, but every single one of them cited "a friend" as the original source of whatever reason they had.

So my theory is that most people disable JavaScript "just because". Reminds me a bit of the five monkeys and a ladder experiment.

[josho]

For those, like me, unfamiliar with the monkey/ladder reference, it's an interesting fable. Read more here http://skeptics.stackexchange.com/questions/6828/was-the-exp...

[josephlord]

Edited to add summary

Summary

I generally browse the web to read things. I want a simple document reading environment with limited power over my computer and minimisation of who is informed of my activities particularly as they cross between different sites. Javascript is not needed and is in fact detrimental to these aims in the majority of cases.

--

I use NoScript so in many cases I enable scripts but in others I don't, it depends on the value of what I expect to see and to some extent on the trust in those the scripts are being loaded from.

Sometimes the page is broken although not fatally, most Washington Post links look broken but work fine if you scroll down to where the actual article is.

Some domains are whitelisted permanently but more often I will temporarily allow .

Reasons - Privacy and control

Some sites want me to load Javascript from dozens of different domains, many of which are advertisers and trackers. I don't want to be tracked and each script loaded could be reporting almost anything about the page I am viewing back to the associated domains.

Disabling Javascript disables most of the intrusive moving/audible adverts on the web and hopefully also much of the tracking and privacy invasion that goes along with them.

[SoftwareMaven]

This was my reason for running NoScript. Then I found Ghostery.

[marcosdumay]

Once in a while Firefox has a bug, and I have to reset its data in one environment. Almost without exception, I forget to install NoScript after that, and experiment the "fully functional" web. That experience is so disastrous that I always put NoScript back, and make notes to not forget it again (that I obviously do not follow next time).

The web with Javascript enabled is simply broken. Sites take ages to load, refuse to show you content, throw overlays all around the screen, or just stop working.

And then, there are security considerations. But as I said, I never remember them.

[zo1]

"[..]throw overlays all around the screen" They've adapted. I've seen sites in the wild that do the opposite. Use CSS to hide all the content, and then use JS to enable proper viewing.

[marcosdumay]

Those sites are usualy also the ones that behave worst when you enable Javascript. As a general rule, the best option is to simply not bother with them, and spend your time on some site that cares about you.

But, of course, there are always exceptions.

[logfromblammo]

All of the web is broken by default, because it is filled with black-hats trying to collect your personally-identifiable information and steal your passwords.

If your web page doesn't work without javascript, you are no longer publishing to the entire world. You are publishing to the subset of everybody who will trust a complete stranger to execute unknown code locally on their own computer--otherwise known as the gullible and the naive.

While it is true that most website authors will not abuse that trust, they may not be entirely responsible for all elements served to visitors, as there may be a compromised ad server, or the website itself might have been subverted without the author's knowledge.

I will often at least temporarily allow scripts to run from the domain I am currently visiting, but if a page is serving scripts from 30 different domains, I may spend some time researching those domains, or simply forget about the page and go elsewhere.

I want my computer to serve my desires, not those of strangers. And I go to the web for information, not fancy layouts.

Also, I sometimes browse over a SSH shell with links, a text-mode browser, and javascript support in that has been suspended indefinitely. Some browsers are simply incapable of rendering images or executing script. You shouldn't ever be tying the core functionality of your website to a user interface, any more than you should make the business logic of software dependant on the GUI.

[sp332]

trust a complete stranger to execute unknown code locally on their own computer

So, what OS do you run, exactly?

[logfromblammo]

I have to pick just one? Windows, Android, Linux, iOS, Wii, Xbox 360, etcetera.

I don't consider Microsoft, Google, Debian, Apple, Nintendo et al to be complete strangers. I don't trust them unconditionally (hence all the rooted, modded, and jailbroken devices in my home), but I do trust that if I do discover malfeasance, that I have some well-established path to seek redress, and that they have the bank accounts, insurance policies, and reputations necessary to make me whole again.

I'm not nearly as trustless as RMS, but I am at least aware enough of the problem to be skeptical even of the software I have actually paid for, and downright paranoid towards everything else. Even the stuff I write myself could be subverted by a compromised compiler or OS. But like the two friends fleeing from the tiger, you don't have to run faster than the tiger to escape; you just have to run faster than your friend.

If someone is likely to be more damaged by breaching public trust and getting caught at it than you are likely to be damaged by trusting them when you should not, you're probably safe to trust them. But then again, even Sony can install a rootkit. You can trust, but remember to verify.

[sp332]

Would you run JS in a sandbox, like Chrome's? Would you run JS from a "trusted" source, like Google's web font loader? Would you run code from a "stranger" that had been vouched for by Google, like angular.js served from Google's mirror?

[anthony_d]

I turn off Javascript because it tends to be poorly written and doesn't provide any value to me. I'm primarily interested in the information part of the internet, so those limits of CSS layout just don't matter to me.

Of course there is a difference between web applications and information sharing. I don't mind Javascript for an application that needs it but I tend to prefer non-web apps anyway.

It seems odd to me how much work goes into making a web page do things that don't need to be done.

[TeMPOraL]

> why you choose to break your exerience of the web

Because this "experience" is not designed with me (the user) in mind. Most of the times it is created to extract value from me, not to provide it for me. Aside from webapps, which use JavaScript to drive the program doing things useful for the users, JS serves two main purposes:

- so that advertisers can better target ads for me (their ads are mostly worthless, I don't want them anyway)

- so that the website author's sales team can "convert" me easier (I want to be "converted" by value of what they offer, not by cheap "experience" tricks)

JavaScript is mostly detrimental to the main goal I browse web for: to learn, read stuff I care about and participate in meaningful discussions.

Unfortunately Internet today is one big marketing event. The real value is being drowned by all that startups and companies trying to sell me some half-baked nonsolution to my nonproblems.

[privong]

It looks like a bunch of the other replies to your query have touched on most of the points I would make, but I thought it might still be worth my response.

The majority of the content I consume online doesn't _need_ js. In the sense that it's easily possible to design websites to display text and writings without needing js. So from a practical standpoint, I think js is mostly unnecessary. There are obviously services which wouldn't be possible without js (e.g., openstreetmaps), and I do un-block js for those sites.

You are of course correct that js is not the only way users can be tracked, however it is one of major components in tracking.

Looking at the EFF's panopticlick [0], with js blocked: > Within our dataset of several million visitors, only one in 57,814 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 15.82 bits of identifying information.

With js enabled: > Your browser fingerprint appears to be unique among the 4,104,774 tested so far. Currently, we estimate that your browser has a fingerprint that conveys at least 21.97 bits of identifying information.

So even something as simple as disabling javascript turns my online fingerprint from being unique to being one of 5% of users who have used that site. So while disabling js doesn't make one immune to tracking, it does make it more diffuclt.

In summary, for most of my use of the web, js is unnecessary and does more harm (tracking) than good (it's not needed for consuming text). I enable it on a case-by-case basis for some websites, if it's needed. But unless the js is truly critical to the presentation of the information, I won't enable it and I'll likely leave the site. Because, yes, much of the web is broken without js; but that's frequently due to (in my opinion) poor site design which doesn't fail gracefully in the absense of (usually unnecessary) js.

[err4nt]

The reason I do it is because of shortfalls within CSS. I USE JavaScript for styling, really simple stuff, but my sites WILL be broken if you can't run 4-10 lines of JavaScript. I don't think that's outrageous to ask for from a resource standpoint, and to rule out JavaScript because some bad things can be written in it to me sounds like ignoring English because some bad or hurtful things can be spoken in it.

I'm not sure what to do about the people who turn JavaScript off, the reason I reach for it are when HTML and CSS can't do something.

[wutbrodo]

I turn off JS on a blacklist basis, but I've ended up disabling it for pretty much most publishers. For me it was 100% about speed: I have a relatively high-end laptop, but with the amount of tabs I keep open and the way Chrome uses CPU in the main browser process, I would literally be waiting for 5-6 seconds before I could scroll down and start reading an article (Washington Post, New York Times, New Yorker, wired; pretty much any publication I've visited has this issue, and a handful of other kinds of sites too). Turning off JS for any site that misbehaves is an immense difference in speed, and the layout is usually not too broken (the exception being WP, where you have to scroll down past a page-length of whitespace before reaching the text).

[ibmthrowaway218]

I don't think you get exactly what he meant by "js disabled by default".

I use No-Script and whitelist sites as required, it's just a click or two, but for any new site I go to JavaScript is disabled.

[Thasc]

Nothing too odd, I think: I get to feel that little bit more insulated against the wacky stuff that malicious JS can do, and if I break a site I want to see, I can make an exception for it.

[hrjet]

It comes down to this equation: security & privacy versus fancy look and feel. The non-JS crowd picks the former.

There are many blogs that don't work at all without JS. I don't bother reading them. Those blogs might be very informative; but my security is worth more than that.