Honestly, it’s bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.
Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.
Most websites would break, or not even display, without javascript. Sure, it’s bonkers for you, but an alternative browser that can’t immediately show a website that works perfectly well in Chrome wouldn’t get much of a user base.
Most websites would break, or not even display, without javascript.
I use NoScript – I’m well aware.
But a lot of those websites could function without javascript. A lot of websites use it unnecessarily, for reasons such as:
They want their ads and trackers and other malicious code (such as soft paywalls) to work as intended.
They want to add fancy cosmetic elements to the content and are too lazy to think about failing gracefully and still displaying the content if javascript isn’t working.
They built the website in a framework that depends on javascript, and are again too lazy to bother worrying about graceful failure if javascript isn’t working, even if their content could, in theory, be displayed just fine without it. (Or maybe the framework developers deserve a bit of the blame for that laziness, since they could have made graceful failure a feature of the framework, but chose not to.)
In a hypothetical world where most browsers didn’t allow every website to run arbitrary code, then every website would be forced to take that into account and only depend on javascript when it’s absolutely necessary for the website’s core functions.
Most websites from when I was a kid did not need JavaScript. Heck, they didn’t even have any JavaScript on many of them! No CSS either, just HTML and images (which were very slow to load on dialup).
Just another piece of evidence that people care more about convenience than privacy, sadly. People aren’t willing to put up with a single broken website
That’s the problem though, why is it standard for websites to be built in such a way that their basic functionality depends on allowing such arbitrary scripts? Shouldn’t there be some regulatory body that tells them that’s against the rules or something?
Do you want regulatory overreach? Imagine forcing every small project or self-hoster to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.
To redirect your other question: you should ask the web developers. If they’re honest, you’ll get a dozen legitimate answers that can’t be solved without locally running code. A chat web app, for example, needs to either poll the server at a given rate, or use a WebSocket to fetch incoming messages, both of which require Javascript. Then it needs to modify the DOM to display the new messages, which again requires Javascript. If it needs access to the microphone or webcam, it has to use some kind of local interface. I could go on. The point is, a lot of this arbitrary local code exists because there’s no other way to implement many features without it. Imagine having to reload an instant messaging app if you want to see if you’ve received anything. It would be like writing a GUI application using Qt or GTK, but without using any events.
I don’t view basic consumer rights as “regulatory overreach.”
to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.
No and no. I never said it should be corporations setting the standard. That’s the FCC’s job, and comparable agencies in other countries. The FCC already regulates many things about the internet. Some things they don’t regulate enough. Were you one of those people who viewed Net Neutrality as “regulatory overreach” too?
Sure, the current admin is corrupt and the current FCC can’t be trusted, but that won’t be forever.
Also, there’s such thing as the IEEE. Standards for web development are not unheard of, and they’re not categorically wrong. There need to be rules governing the rules that govern web development to ensure those rules aren’t abused. But setting no rules or standards would be insane.
If they’re honest, you’ll get a dozen legitimate answers that can’t be solved without locally running code.
That’s not honesty. That’s deflection and dissembling. Sure, you can think of a dozen different reasons why scripts need to be run locally. But that doesn’t excuse using those scripts as a trojan horse for malicious data mining practices. Permissions can be atomized.
If a web developer can’t compartmentalize the part of the script that loads an image on their website from the part of the script that harvests sensitive fingerprinting data that the website has no legitimate need for, then they’re either a really bad developer who’s never heard of modularity, or they’re doing it deliberately and maliciously because they know they can get away with it and are choosing to make their website break for anyone who doesn’t let them basically peep under their device’s skirt.
I get your point, yeah.
I actually do think that scripts should’ve hugely modularized, compartmentalized, and browsers should’ve using OCaps instead of ACLs, or at least make more granular ACLs so you can finetune what can or what cannot do a given site and/or a given script.
Thank you! It seems pretty clear to me, modularity is supposed to be the modern standard for quality code, so why are we normalizing websites that use scripts with more arms than Cthulhu harvesting uniquely identifiable data from our personal devices by running arbitrary code locally? It seems insane to me…
“One tool for one job.” It’s pretty basic Unix philosophy. So why do we now have “One script for several hundred different fingerprint variables, oh and also the website’s basic functionality”?
Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can’t access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.
It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don’t know what site you’re viewing.
Still can have issues with javascript crypto miners. And there’s always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.
Most (all?) browsers throttle tabs that take too much cpu for too long (especially background). The actual numbers vary, but hidden cryptominers are not that effective anymore.
Honestly, it’s bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.
Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.
Most websites would break, or not even display, without javascript. Sure, it’s bonkers for you, but an alternative browser that can’t immediately show a website that works perfectly well in Chrome wouldn’t get much of a user base.
I use NoScript – I’m well aware.
But a lot of those websites could function without javascript. A lot of websites use it unnecessarily, for reasons such as:
They want their ads and trackers and other malicious code (such as soft paywalls) to work as intended.
They want to add fancy cosmetic elements to the content and are too lazy to think about failing gracefully and still displaying the content if javascript isn’t working.
They built the website in a framework that depends on javascript, and are again too lazy to bother worrying about graceful failure if javascript isn’t working, even if their content could, in theory, be displayed just fine without it. (Or maybe the framework developers deserve a bit of the blame for that laziness, since they could have made graceful failure a feature of the framework, but chose not to.)
In a hypothetical world where most browsers didn’t allow every website to run arbitrary code, then every website would be forced to take that into account and only depend on javascript when it’s absolutely necessary for the website’s core functions.
I hate javascript
I’m not sure why there is a downvote on this… unless the downvoter thinks you don’t hate javascript enough?
Brave users
Got to pump up those hate numbers bro.
There are protocols like gemini that only have text and files, no executing code. I wish there was more of the web moving towards that.
*Edited for wrong language autocorrect.
I think yoy ned to profred your comments more.
Most websites from when I was a kid did not need JavaScript. Heck, they didn’t even have any JavaScript on many of them! No CSS either, just HTML and images (which were very slow to load on dialup).
That’s because they ran Flash, ActiveX, or shivers worse…
Just another piece of evidence that people care more about convenience than privacy, sadly. People aren’t willing to put up with a single broken website
And I mean, you should be able to have both, but… Welp.
Because we fucking designed it that stupid that way, that’s exactly grandparent’s point
That’s the problem though, why is it standard for websites to be built in such a way that their basic functionality depends on allowing such arbitrary scripts? Shouldn’t there be some regulatory body that tells them that’s against the rules or something?
Do you want regulatory overreach? Imagine forcing every small project or self-hoster to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.
To redirect your other question: you should ask the web developers. If they’re honest, you’ll get a dozen legitimate answers that can’t be solved without locally running code. A chat web app, for example, needs to either poll the server at a given rate, or use a WebSocket to fetch incoming messages, both of which require Javascript. Then it needs to modify the DOM to display the new messages, which again requires Javascript. If it needs access to the microphone or webcam, it has to use some kind of local interface. I could go on. The point is, a lot of this arbitrary local code exists because there’s no other way to implement many features without it. Imagine having to reload an instant messaging app if you want to see if you’ve received anything. It would be like writing a GUI application using Qt or GTK, but without using any events.
I don’t view basic consumer rights as “regulatory overreach.”
No and no. I never said it should be corporations setting the standard. That’s the FCC’s job, and comparable agencies in other countries. The FCC already regulates many things about the internet. Some things they don’t regulate enough. Were you one of those people who viewed Net Neutrality as “regulatory overreach” too?
Sure, the current admin is corrupt and the current FCC can’t be trusted, but that won’t be forever.
Also, there’s such thing as the IEEE. Standards for web development are not unheard of, and they’re not categorically wrong. There need to be rules governing the rules that govern web development to ensure those rules aren’t abused. But setting no rules or standards would be insane.
That’s not honesty. That’s deflection and dissembling. Sure, you can think of a dozen different reasons why scripts need to be run locally. But that doesn’t excuse using those scripts as a trojan horse for malicious data mining practices. Permissions can be atomized.
If a web developer can’t compartmentalize the part of the script that loads an image on their website from the part of the script that harvests sensitive fingerprinting data that the website has no legitimate need for, then they’re either a really bad developer who’s never heard of modularity, or they’re doing it deliberately and maliciously because they know they can get away with it and are choosing to make their website break for anyone who doesn’t let them basically peep under their device’s skirt.
I get your point, yeah. I actually do think that scripts should’ve hugely modularized, compartmentalized, and browsers should’ve using OCaps instead of ACLs, or at least make more granular ACLs so you can finetune what can or what cannot do a given site and/or a given script.
Thank you! It seems pretty clear to me, modularity is supposed to be the modern standard for quality code, so why are we normalizing websites that use scripts with more arms than Cthulhu harvesting uniquely identifiable data from our personal devices by running arbitrary code locally? It seems insane to me…
“One tool for one job.” It’s pretty basic Unix philosophy. So why do we now have “One script for several hundred different fingerprint variables, oh and also the website’s basic functionality”?
*A wild Systemd spawns*
You can’t escape!
Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can’t access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.
It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don’t know what site you’re viewing.
Still can have issues with javascript crypto miners. And there’s always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.
Most (all?) browsers throttle tabs that take too much cpu for too long (especially background). The actual numbers vary, but hidden cryptominers are not that effective anymore.