sent from a disposable whonix qube
Okay, I’m going to reply to this message with my responses to various quoted comments from the big chain of comments which I can’t directly access from this instance, due to defederation with certain instances. I’m not going to respond to literally every message, but I hope you all know that I do appreciate you for participating in this thread and being part of a really fun and interesting chain.
Thanks for all the comments and sorry for not responding until now. Since I can’t upvote any of the comments in that chain, to all of you I provide lots of hearts: 🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷🩷
@OwOarchist@pawb.social Honestly, it’s bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.
This, this, 1000 times this! That is exactly how I feel and was hoping to convey.
@OwOarchist@pawb.social Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.
Yes, defense-in-depth includes minimizing threats rather than simply relying on protections. It shouldn’t be necessary to lower one’s shields constantly, and it’s better to avoid doing so if possible, from a security & privacy perspective.
@rtxn@lemmy.world Sure, it’s bonkers for you, but an alternative browser that can’t immediately show a website that works perfectly well in Chrome wouldn’t get much of a user base.
I think the main point is about what is default. People have been and continue to be trained by the defaults (tyranny of the default), and in this case they are trained to expect sites to utilize scripts, which is (imo) unhealthy for society. It would be better if scripts were denied by default and the user could allow them per-site with a single click, similar to how sites will ask the user to allow notifications or location services which the user is able to allow or deny.
Sure, most users simply allow everything. But kids are curious and would be more likely to read and understand such things if presented with the options, and that could translate into a more-informed adult population with better security practices. And overall, I think that’d make for a healthier and happier society which doesn’t continue to crumble into worse and worse outcomes.
If the default were to deny scripts, sites would have to at least look somewhat presentable without the scripts, so as to ask the user to enable them. And my hope is that people would prefer the sites that don’t pester them for permissions.
@chonglibloodsport@lemmy.world Most websites from when I was a kid did not need JavaScript. Heck, they didn’t even have any JavaScript on many of them! No CSS either, just HTML and images (which were very slow to load on dialup).
Simpler times
@OwOarchist@pawb.social But a lot of those websites could function without javascript. A lot of websites use it unnecessarily, for reasons such as:
-
They want their ads and trackers and other malicious code (such as soft paywalls) to work as intended.
-
They want to add fancy cosmetic elements to the content and are too lazy to think about failing gracefully and still displaying the content if javascript isn’t working.
-
They built the website in a framework that depends on javascript, and are again too lazy to bother worrying about graceful failure if javascript isn’t working, even if their content could, in theory, be displayed just fine without it. (Or maybe the framework developers deserve a bit of the blame for that laziness, since they could have made graceful failure a feature of the framework, but chose not to.)
In a hypothetical world where most browsers didn’t allow every website to run arbitrary code, then every website would be forced to take that into account and only depend on javascript when it’s absolutely necessary for the website’s core functions.
Perfect comment. No notes. <3
-
@hirihit640@sh.itjust.works Just another piece of evidence that people care more about convenience than privacy, sadly. People aren’t willing to put up with a single broken website
Au contraire. Most people put up with broken sites all the time. The problem is that those people generally aren’t aware that the sites are broken, because they’re also unaware of the concept of allowing/denying javascripts. If they denied javascripts by default, they’d notice that most of the sites they access are actually broken sites. The ones that function without javascripts are the unbroken ones.
@wonderingwanderer@sopuli.xyz That’s the problem though, why is it standard for websites to be built in such a way that their basic functionality depends on allowing such arbitrary scripts? Shouldn’t there be some regulatory body that tells them that’s against the rules or something?
@rtxn@lemmy.world Do you want regulatory overreach?
@wonderingwanderer@sopuli.xyz I don’t view basic consumer rights as “regulatory overreach.”
@rtxn@lemmy.world Imagine forcing every small project or self-hoster to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.
@wonderingwanderer@sopuli.xyz No and no. I never said it should be corporations setting the standard. That’s the FCC’s job, and comparable agencies in other countries. The FCC already regulates many things about the internet. Some things they don’t regulate enough. […]
[…]
Also, there’s such thing as the IEEE. Standards for web development are not unheard of, and they’re not categorically wrong. There need to be rules governing the rules that govern web development to ensure those rules aren’t abused. But setting no rules or standards would be insane.
@rtxn@lemmy.world To redirect your other question: you should ask the web developers. If they’re honest, you’ll get a dozen legitimate answers that can’t be solved without locally running code.
@wonderingwanderer@sopuli.xyz That’s not honesty. That’s deflection and dissembling. Sure, you can think of a dozen different reasons why scripts need to be run locally. But that doesn’t excuse using those scripts as a trojan horse for malicious data mining practices. Permissions can be atomized.
If a web developer can’t compartmentalize the part of the script that loads an image on their website from the part of the script that harvests sensitive fingerprinting data that the website has no legitimate need for, then they’re either a really bad developer who’s never heard of modularity, or they’re doing it deliberately and maliciously because they know they can get away with it and are choosing to make their website break for anyone who doesn’t let them basically peep under their device’s skirt.
Oh la la!
@Kangae_Hishiryo@scribe.disroot.org I get your point, yeah. I actually do think that scripts should’ve hugely modularized, compartmentalized, and browsers should’ve using OCaps instead of ACLs, or at least make more granular ACLs so you can finetune what can or what cannot do a given site and/or a given script.
@wonderingwanderer@sopuli.xyz Thank you! It seems pretty clear to me, modularity is supposed to be the modern standard for quality code, so why are we normalizing websites that use scripts with more arms than Cthulhu harvesting uniquely identifiable data from our personal devices by running arbitrary code locally? It seems insane to me…
“One tool for one job.” It’s pretty basic Unix philosophy. So why do we now have “One script for several hundred different fingerprint variables, oh and also the website’s basic functionality”?
@Kangae_Hishiryo@scribe.disroot.org *A wild Systemd spawns*
@wonderingwanderer@sopuli.xyz You can’t escape!
This kinda brings the thread full-circle back to my os tier list :D
Oh, you made that one? I actually saved it because it’s legitimately helpful. A lot of tier lists really just reflect a person’s preference, but I liked how you grouped yours by category. I’ll be referencing it as I explore more distros
I feel kinda weird replying since my comment to which you replied was removed by a mod, and I have no idea why, as there is no reason given in the mod log. I had been trying to respond to the messages which I was and am unable to directly access, due to my instance’s defederation policies, but it seems that I’ve inadvertently upset someone and feel that I should probably stop interacting here, so as not to cause problems.
Thank you for your appreciation 🩷
Ah, that’s strange. Sorry that happened to you. Maybe the mod missed you’re top-level comment where you explained so they thought you were spamming.
Have a nice day
@Lev@europe.pub I hate javascript
Moi aussi
@OrganicMustard@lemmy.world There are protocols like gemini that only have text and files, no executing code.
I’ll have to check that out one day.
@cley_faye@lemmy.world Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. […]
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. […]
It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. […]
This reminds me of an interesting phenomenon: Some security-oriented people praise the security of the surveillance-advertising corporation’s browser engine (chromium), while proclaiming that gecko-based browsers (firefox) are unusable due to inferior security. Yet the main security threat I see is that fucking surveillance-advertising corporation which spreads unvetted and often malicious ads around the web without a care in the world.
Person A: “chromium-based browsers have superior security” Person B: “i use firefox-based browsers exclusively” Person A: “outrageous. it’s got inferior security” Person B: “i don’t allow scripts” Person A: “javascripts aren’t a major security concern” Person B: “firefox with scripts denied is more secure than chromium with scripts allowed” Person A: “javascripts are required for the modern web” Person B: “untrue, as evidenced by the fact that i access the modern web with scripts denied”
checkmate ♟️
I have never heard the bottom left take anywhere before, though.
Having said that, Firefox+ublock+noscript rules.You can block JavaScript with uBlock, BTW!
Had a look into the ublock settings.
The one I found seems to be more of a nuke-grade total disabling, as opposed to the fine-grained approach of the noscript extension.UBlock’s approach is that you disable it for every site in the settings and then whitelist per site. Seems sensible enough to me. How does noscript do it?
That is certainly a valid approach to using ublock origin, but the wiki outlines a few other blocking modes available.
Check out the wiki to see the different blocking modes available.
I guess I prefer the Unix philosophy of doing things:
Have a bunch of combinable small programs each being dedicated to a single function and doing that well instead of large complex monoliths.When it comes to browser addons, it is generally recommended to have as few as possible in order to reduce attack surface, since a higher number increases the chance of having one that becomes compromised. It’s especially relevant with browser addons because they tend to have lots of capabilities/permissions and can therefore do lots of damage.
I have never heard the bottom left take anywhere before, though.
✨️ until now ✨️
“You are, without doubt, the strangest online-script user I’ve ever heard of.”
“But you have heard of me!”;-)
[Edit: Sorry, slipped into wrong language before…]

What you’re saying is, it bears repeating!
:-D
Sometimes, I just love the Fediverse and its inhabitants! ❤️
Burning off your fingerprints makes you far more identifiable and then keeping them.
In this fucked-up world, it turns out that I end up blending in, just not with other people. Users who disallow javascripts are often mistaken for bots nowadays. We don’t stand out, and so we’re assumed to be bots. I think that if more people browsed without javascript it’d eventually be easier to distinguish between bots and people, and captchas could maybe die out.
how so? Even if there’s only 2 people in the world with burned off fingerprints, there’s only one with your fingerprint
Honestly, it’s bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.
Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.
Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can’t access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.
It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don’t know what site you’re viewing.
Still can have issues with javascript crypto miners. And there’s always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.
Most (all?) browsers throttle tabs that take too much cpu for too long (especially background). The actual numbers vary, but hidden cryptominers are not that effective anymore.
Most websites would break, or not even display, without javascript. Sure, it’s bonkers for you, but an alternative browser that can’t immediately show a website that works perfectly well in Chrome wouldn’t get much of a user base.
Because we fucking designed it that stupid that way, that’s exactly grandparent’s point
Most websites from when I was a kid did not need JavaScript. Heck, they didn’t even have any JavaScript on many of them! No CSS either, just HTML and images (which were very slow to load on dialup).
That’s because they ran Flash, ActiveX, or shivers worse…
Oh no, I was along before Flash and ActiveX. Before Windows 95 even.
Most websites would break, or not even display, without javascript.
I use NoScript – I’m well aware.
But a lot of those websites could function without javascript. A lot of websites use it unnecessarily, for reasons such as:
-
They want their ads and trackers and other malicious code (such as soft paywalls) to work as intended.
-
They want to add fancy cosmetic elements to the content and are too lazy to think about failing gracefully and still displaying the content if javascript isn’t working.
-
They built the website in a framework that depends on javascript, and are again too lazy to bother worrying about graceful failure if javascript isn’t working, even if their content could, in theory, be displayed just fine without it. (Or maybe the framework developers deserve a bit of the blame for that laziness, since they could have made graceful failure a feature of the framework, but chose not to.)
In a hypothetical world where most browsers didn’t allow every website to run arbitrary code, then every website would be forced to take that into account and only depend on javascript when it’s absolutely necessary for the website’s core functions.
-
That’s the problem though, why is it standard for websites to be built in such a way that their basic functionality depends on allowing such arbitrary scripts? Shouldn’t there be some regulatory body that tells them that’s against the rules or something?
Do you want regulatory overreach? Imagine forcing every small project or self-hoster to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.
To redirect your other question: you should ask the web developers. If they’re honest, you’ll get a dozen legitimate answers that can’t be solved without locally running code. A chat web app, for example, needs to either poll the server at a given rate, or use a WebSocket to fetch incoming messages, both of which require Javascript. Then it needs to modify the DOM to display the new messages, which again requires Javascript. If it needs access to the microphone or webcam, it has to use some kind of local interface. I could go on. The point is, a lot of this arbitrary local code exists because there’s no other way to implement many features without it. Imagine having to reload an instant messaging app if you want to see if you’ve received anything. It would be like writing a GUI application using Qt or GTK, but without using any events.
I don’t view basic consumer rights as “regulatory overreach.”
to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.
No and no. I never said it should be corporations setting the standard. That’s the FCC’s job, and comparable agencies in other countries. The FCC already regulates many things about the internet. Some things they don’t regulate enough. Were you one of those people who viewed Net Neutrality as “regulatory overreach” too?
Sure, the current admin is corrupt and the current FCC can’t be trusted, but that won’t be forever.
Also, there’s such thing as the IEEE. Standards for web development are not unheard of, and they’re not categorically wrong. There need to be rules governing the rules that govern web development to ensure those rules aren’t abused. But setting no rules or standards would be insane.
If they’re honest, you’ll get a dozen legitimate answers that can’t be solved without locally running code.
That’s not honesty. That’s deflection and dissembling. Sure, you can think of a dozen different reasons why scripts need to be run locally. But that doesn’t excuse using those scripts as a trojan horse for malicious data mining practices. Permissions can be atomized.
If a web developer can’t compartmentalize the part of the script that loads an image on their website from the part of the script that harvests sensitive fingerprinting data that the website has no legitimate need for, then they’re either a really bad developer who’s never heard of modularity, or they’re doing it deliberately and maliciously because they know they can get away with it and are choosing to make their website break for anyone who doesn’t let them basically peep under their device’s skirt.
I get your point, yeah. I actually do think that scripts should’ve hugely modularized, compartmentalized, and browsers should’ve using OCaps instead of ACLs, or at least make more granular ACLs so you can finetune what can or what cannot do a given site and/or a given script.
Thank you! It seems pretty clear to me, modularity is supposed to be the modern standard for quality code, so why are we normalizing websites that use scripts with more arms than Cthulhu harvesting uniquely identifiable data from our personal devices by running arbitrary code locally? It seems insane to me…
“One tool for one job.” It’s pretty basic Unix philosophy. So why do we now have “One script for several hundred different fingerprint variables, oh and also the website’s basic functionality”?
*A wild Systemd spawns*
I hate javascript
There are protocolos like gemini that only hace texto and files, no executing conde. I wish there was more of the web moving towards that.
I think yoy ned to profred your comments more.
There are valid use cases for JS and AJAX, but they are few. HTML/CSS is great, and has gotten many new features that can replace JavaScript in the long run: Popovers,
commandforetc. One thing I am missing is opening arbitrary popovers on a long hover. For that, you still needmousemoveevent listeners.
I’m not sure why there is a downvote on this… unless the downvoter thinks you don’t hate javascript enough?
Got to pump up those hate numbers bro.
Just another piece of evidence that people care more about convenience than privacy, sadly. People aren’t willing to put up with a single broken website
You are allowing webpages to load?
You guys turn on computers?
You guys have a computer?
You are guys?
I’m a rooster illusion
seductive tortoise is a rooster illusion? 🫦🐢🟰🐓❔️ idk what it means but i’m fascinated
On a scale from two to seven, how seduced are you? And which side is the seduced one?
lol, well i do love the odd scale, but there is a lack of emojis too, so i suppose i’d have to say about 3π/2
And which side is the seduced one?
good question :p
Do you exist?
I think not, Descartes.
So you think, therefore you do not exist?
I was actually tempted to respond to your first comment in this chain about existence/nonexistence, that knowledge doesn’t exist, that it can’t exist, that we can’t presume to know anything, and that we can’t presume to know that we think, which therefore would suggest that it’s possible we do not exist. But I held back from going off about seemingly nonsensical existential stuff here…until now
You guys use electricity?
Omg In this economy?
Onga booga ogg?
I went to see the thread in your instance because I thought it didn’t federate properly. And the page for weird reasons loaded without css, which felt very appropriate for the thread.
It showed up as a blank comment for me, which also felt appropriate.
Big Bang!
No. I load the webpages.
I am also a bottom-right user. But browsers like Tor Browser and Mullvad Browser supposedly take care of javascript fingerprinting, at least if you check websites like amiunique.org. So I’m running out of reasons to disable javascript. What privacy reasons do you disable javascript for?
Without js pages loads instantly
Bottom left text gives reasons that relate to security, which is also related to privacy. I don’t trust arbitrary scripts, and I find it more convenient to simply disallow them. While css can theoretically be used to track mouse movements, that is typically done with javascripts, and I find that creepy af. I don’t like the feeling that I’m being observed. I get enough of that whenever I go outside into this dystopic world.
So on that note, as I’ve said in some other comments within this thread, I prefer static pages from a UX perspective. Static pages feel comfy and safe, at least in comparison to the alternative. In contrast, javascripts tend to make the UX of sites worse in my view. So there aren’t any compelling reasons for me to allow them most of the time.
It comes down to this: What do I gain by allowing javascripts? What I see is largely nothing. What do I lose by allowing javascripts? Comfort, calm, and a relaxed experience.
That’s fair. My reasoning for avoiding Javascript is that I’m a bit paranoid about keystroke fingerprinting and mouse fingerprinting, and I honestly wonder if modern captchas are already using these techniques.
Those issues concern me too, and as I’ve said in another comment somewhere, while it’s technically possible to do the same using css, it is actively used via javascripts. I remember reading an article a long time ago about how google’s cursor-fingerprinting was able to accurately diagnose parkinson’s symptons that were too subtle to detect any other way. And I don’t think that google has ever made any attempt to inform such users. That is the character of google. That with their massive powers, they never bother to do good without profit or further control.
Y’all are running your PC’s un-airgapped?
My laptop is airgapped, that’s why I use WLAN
open dyslexia font?
nice touch.
That makes it easier for dyslexics?
I find it awful to read - takes a lot more effort for me I’m surprised it helps with dyslexia.
Not for this dyslexic.
I tried it for a little while, a while back, but went back to the fonts I made a long while back.
Short answer: studies are limited and results are mixed but there’s little to no peer reviewed evidence to suggest it provides much benefit, that said, people seem to like it, so do whatever makes you happy.
Why should my computer do the work? Server-side only
Hey, so there are a few threads I can’t see from this instance due to defederations and I wanna respond anyway.
@Digit@lemmy.today open dyslexia font? nice touch.
Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.
@Onomatopoeia@lemmy.cafe That makes it easier for dyslexics?
Possibly for some, as @Ludicrous0251@piefed.zip said. I think it would probably be more beneficial for those who are introduced to it at a young age. Otherwise it takes some time to get used to it, and I did end up falling back to the fonts I had been using. But I do like OpenDyslexicAlta font and think it makes a good meme font, so yeah.
Okay so that’s my response to the chain of comments quoted above. Sorry I can’t give y’all upvotes due to the defederation, and sorry it took me so long to realize there were comments which were hidden from me. I do try my best to respond to everything that seems directed at me or which I can offer a worthwhile response.
The next chain of comments is much longer (it’s a really good one too), and I’m thinking I’ll make one or more responses when I get back online a while from now.
🩷
Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.
@Digit@lemmy.today This, I applaud. I aim similarly.
tyvm for the appreciation. and since I can’t send upvotes directly, you get extra hearts: 🩷🩷🩷🩷🩷
This is so on-brand with the meme, bravo. Also you seem very thoughtful.
I have a brand??! 🫨 (seriously tyvm 🩷) I’m currently going through my notifications and responding to stuff before using another qube to find that other chain of comments (and any new ones too). I am pretty obsessive ^^’ (and maybe trying to show more of myself here in the hopes that people can truly see me when I say things that matter)
bonus meme:

Its not related to this but Tempermonkey amd scripts is insanely good experience.
Im not super tech saavy, especially compared to the lemmy userbase, but every complaint about software just reads to me like whining about something you chose to install on your computer. You can just not use someone else’s software, yes the mainstream software companies are fucking assholes and they will take all of your data and privacy in exchange for a subscription to their software. It’s on you if you accept that deal.
I’m confused (happens a lot). Is your comment responding to the meme or to some other comment? If the former, I am even more confused, since the meme isn’t complaining about anything at all. It’s poking fun some of the ways people view the web.
You can just not use someone else’s software
That is what I am doing when I deny a site to run scripts on my computer, yes. And I love that I have the ability to make that choice.
yes the mainstream software companies are fucking assholes and they will take all of your data and privacy in exchange for a subscription to their software
lol yes. That’s why I tend to avoid them and their products/services.
It’s on you if you accept that deal.
Well I do still find it fucked-up that they prey on unsuspecting people who are ignorant of what’s being done to them, including especially kids. It’s not on them. They don’t deserve the bad things done to them by the surveillance corporations. They can’t be expected to know and understand.
I guess im identifying with the bottom right corner lol
While technically correct, it’s a slightly shallow analysis. It’s like people complaining that companies put chemicals in the food, you could grow all of your your own food but it’s probably not feasible.
And yet ultimately the answer is to refuse to buy from those companies.
We’re both here on Lemmy so it’s safe to assume we’re both doing our best, but I’m willing to bet all my money that you are not sourcing all of your tech needs from ethical companies or the open source community. You probably use an Apple or Google made phone, your work might lock you into Microsoft operating systems, the list goes on. It’s not wrong for people to demand better solutions from companies that have managed to establish a monopoly and who use their vast resources to maintain that monopoly.
I can’t convince my wife to even use an add blocker, because it makes some (terrible) websites unusable (and you need an entire one additional click to disable it, it’s too much effort), blocking JS would make the entire internet unusable for normies.
I can’t convince my wife to even use an add blocker…
Can you convince her to use a subtraction blocker?
A subraction facilitator. It enables the surgical excision of unwanted, harmful and stupefying noise.
Pi-hole might be an option.
AFAIK some sites are so terrible that they won’t work even if you use DNS-based adblocking instead of browser extension-based adblocking …
Definitely worth trying, though.
Another option is to point your DNS to one of the public ad blocking DNS servers.
Pi-hole is a great project for network-wide dns-based blocking, yes. I was going to link to the official site, but it seems to be broken now, so I linked to the official github repo.
I’m in the process of setting up pi-hole at the moment.
My wife loves our pihole setup so much I was forced to setup VPN access to the home network so she could block ads while traveling. Now our oldest daughter wants me to setup pihole for her house.
One thing that’s really nice about pi-hole is that it gives a window into your network, allowing you to easily see dns requests as they happen, while also organizing them into useful charts and graphs.
The last two Images are basically the same. Meme failed.














