Hacker News Reader

Comment by bunderbunder | Hacker News Reader

In the spirit of cranky HN bikeshedding, I present: The page body, as seen by a NoScript user:

  <body>
    <div id=app></div>
    <script type=text/javascript src=/static/js/manifest.14a76fad9b304f57d579.js></script>
    <script type=text/javascript src=/static/js/vendor.ffa8aef8ba29f634abaf.js></script>
    <script type=text/javascript src=/static/js/app.08230312c2e739a44ea1.js></script>
  </body>

Web developers: Please, you can do better than this.

View on HN

The audience for this site is front-end developers.

Front-end developers don't tend to view the web with NoScript. Just like 99% of users don't view the web with NoScript.

Is it just for front-end developers?

I'm a back-end developer, but, when I wanted to indent that HTML in order to post it, I switched over to the instance of vscode that I virtually always having running in order to use its pretty printer.

> Is it just for front-end developers?

1 out of 15 examples (the Docker one) don't involve HTML or JS. (And backend JS devs are generally pro-JS so likely aren't using NoScript either).

Do you use NoScript? Maybe you do and you're the <1%, but fact is even if you do, both you and GPP turned it off to view the site already ...

There certainly should be a static page version. Especially since there is barely any interactive element to this, it's essentially just a list of links

It is certainly an interesting choice to use a fully fledged SPA framework to render a static page. And since it runs on Azure App Services, I'd say server side rendering should be possible.

It’s a page aimed at web devs, evangelizing an editor written in JS. If you want to read it, turn on JS. If you turn off a key component of the modern web, you should expect that things will break, and not complain about it.

I'm building a pipeline that sends pages like this out to splash and returns the js-rendered html to my browser.

Like holy shit, how can a webpage displaying text and videos slow my supercomputer to a halt. Truly a feat of technology.

It was pretty fast on my phone.

I'd replace the snark with additional details so the author could attempt to reproduce your issue.

Yeah, this could be a static HTML/CSS site but that's the state of the modern web for better or worse. Markup rendered by a framework like React/Vue and bundled up with Webpack. It's just easier to build that way.

Your criticism might be better understood with less prejudice; perhaps something like this instead:

"Websites should not unnecessarily require JavaScript."

Please know that no one really cares. You must realise you cannot expect to consume our applications but only on your own terms. Theres no contract saying you should ONLY serve HTML on the web.

I can't speak for gp, but the reason I whitelist Javascript is because the dozens of third party scripts pages load provide no benefits to me as a user and only waste my bandwidth and cpu while risking my security and privacy. Sometimes the first-party scripts do something useful and I enable them.

That a simple document with embedded videos "needs" js to load at all is sheer lunacy. The modern web is a massive house of cards. I don't want to be uncivil but I find it very hard to understand how anyone thinks they're doing good work after they create a simple (and useful!) web document that requires javascript to load.

If you're using Javascript to make a web application, fine, clearly there's no reasonable alternative. But if you need Javascript to produce a web document, what are you doing? I wonder how much more electricity is being consumed annually processing utterly pointless Javascript.

One of the increasingly popular uses of JS is to save bandwidth. Using JS, you can ask the browser if the user is on a metered connection or an unlimited one, what their estimated bandwidth capacity is, what their real resolution is, and load appropriate assets (or conditionally load content). With JS disabled, a user on a pay-per-kilobyte 360x640 cellphone is going to get assets deemed acceptable on the manager's 1440p desktop. There are already quite a few websites where disabling JS more than doubles your bandwidth usage -- and sites that are only even usable in third world countries because of JS like this -- and that's going to increase as screen and media quality grow.

Not to mention the huge accessibility benefits that can come from changing the way a site behaves (not just visually but in terms of things like tab and focus behaviour or separating components out) for disabled users. Doing that reliably and effectively for all content on all devices is much easier if you can identify the needs before downloading the content which means JS-loaded content and so it can come down to deciding whether to annoy NoScript users or disabled users.

That doubtless provides some reasonable bandwidth savings on certain media sites, but I'm pretty sure the whitelisting approach is going to come out far, far ahead in general, as most ads don't load and some Javascript assets are themselves megabytes in size.

Also, IME, disabled users hate javascript. But my experience is limited to a few vision impaired folks.

Why, if your goal is to save bandwidth, would you have the system default to loading the biggest assets when you can't ascertain these things, instead of loading the smallest ones?

That said, given my experience of running the web with NoScript, I'd be surprised if those sites that double the usage when they can't detect these things come anywhere close to eating up all the bandwidth I'm saving by not loading auto-playing video ads.

In general, one should serve HTML on the web unless you're doing something that requires JavaScript. JS is a big security/privacy risk. At the moment, I keep JS and CSS off by default on my main browsing profile, overriding it with umatrix when a site requires it and it looks useful enough to bother.

That's bezerk. You should turn off the CPU in your computer, too, and just use the screen and keyboard. The CPU is where all the security breaches happen.

That's like saying that you shouldn't bother eating healthily because if you're really concerned about heart disease you should just have heart removal surgery.

In general, one should consider the audience of the content, not NoScript users, in this case.

> JS is a big security/privacy risk.

No, 3rd party JS (and 3rd party cookies, JS regardless) allow you to be tracked. And ad-blockers deal with that. Blocking 1st party JS is of tenuous benefit w.r.t security/privacy.

> Blocking 1st party JS is of tenuous benefit w.r.t security/privacy.

Blocking all JS lets me click on any link fearlessly.

What is your primary fear with JS enabled? Tracking/keylogging/cryptomining?

Sometimes "3rd party" JS is served from within the page. Also many sites are hacked and will cloak the JS depending on how you visit the site. It's especially common with hacked WordPress sites.

off topic, but how do you turn off first-party JS in umatrix? I switched from NoScript recently, and haven't figured it out yet.

In the top left of the matrix, click on the `.com` part of the domain. I think that will change the scope to all sites rather than the current domain. Then block the JS column. It should then be blocked by default when you go to new sites.

Create a block (red) rule for `script` in global scope. I wrote is a guide for this, "How to block 1st party scripts everywhere by default" (link below)

https://github.com/gorhill/uMatrix/wiki/How-to-block-1st-par...

I popped over to a different browser to take a peek. That's not an "application". It's static page with some embedded YouTube videos, and some hyperlinks. It just happens to be one where it takes about 5 seconds (on my computer) before the hyperlinks become clickable, for some reason.

I do agree that there is no contract saying you should only serve HTML on the web. But still, you can do better than this.

Last time when nobody cared about a broken nest of security holes in the center of the Web, a small minority had organised a campaign to annoy people with complaints.

I mean Mozilla's campaign asking users to send complaints to each and every webmaster writing IE5-only sites. It somewhat worked.

I'm a true artist and no one understands my genius. Heathens!

That's the spirit of pointless, offtopic shitting all over a thread. You can and should do better than this.

you can't expect any one to invest money for the 0.000001 %

Reply on news.ycombinator.com