Hacker News Reader

Comment by pmoriarty | Hacker News Reader

Why not?

What exactly is the big deal with having just static content?

I don't have JS enabled when I read HN. I just hit reload to load and read new comments. What exactly is the problem with doing that?

When I read some article on some news site or web forum, I don't need JS to just read a bunch of text or look at an image. All of that can be and often is static. JS is totally superflouous here.

The only legitimate uses of JS I can think of are for things like games, or data that you really need to be updated in real-time like stock market tickers. But those are a relatively minor subset of the web and can be made in to standalone apps anyway. I'd much rather have a standalone app than expose myself to all the malware, spyware, and tracking that comes with a JS web ecosystem.

View on HN

I maintain a client dashboard for large ad vendors who need to visualize their data across multiple time spans. It's too much to sift through on mobile. Are you saying that in this brave new world you're envisioning, I'd have to build them a desktop app?

No, in the brave new world there would be no “large ad vendors” so your problem would not even exist

The only way for that to be an effective response is to argue that the only people who need large-scale data visualization on the fly are ad vendors.

>Why not?

>What exactly is the big deal with having just static content?

I don't read romance novels, so publishers shouldn't be allowed to print them.

The problem is that your personal opinion on the legitimate utility of javascript doesn't have any value beyond your own browser, and the entire rest of the world has decided that a purely static web is not what it wants.

> ... entire rest of the world ...

Speak for yourself! I certainly agree with the parent that the Web is for content. And I believe many here around do as well. You do realize you're commenting here on a site which is as non-PWA/SPA as it gets, don't you?

Content is still content when javascript is involved. Twitter serves content, so does facebook, so do wordpress blogs and medium and likely whatever other sites you think of when you think about how terrible javascript is, because "content" and "javascript" are not mutually opposed.

I like Hacker News (obviously, since I spend far too much time here,) but I also like that I can run software in my browser and stream video and audio and play games. FFS, I'm running DOOM in a DosBox emulator in another browser tab as I type this. How is that not qualitatively better in terms of the breadth of content that the web allows than having it be limited to basic text styling and embedded images?

Audio/video yes, but what's the point of running DOS emulators in a browser? What a browser can and cannot do should be very carefully balanced, or you end up with a tangled mess of Chrome-only content and security/privacy catastrophes.

>Audio/video yes, but what's the point of running DOS emulators in a browser?

The point is that if I want to play DOS games I only need a URL and a modern browser, just the same as with text, images and other media. That "software" becomes just another content type the web can provide, in a way that's transparent and easy for the end user. If nothing else, the browser can act as a sandbox for software that operating systems otherwise don't seem to provide. A developer can't sneak "rm -rf /*" into their javascript and have it work the way they could natively.

> What a browser can and cannot do should be very carefully balanced, or you end up with a tangled mess of Chrome-only content and security/privacy catastrophes.

I would argue things have gotten more stable, not less, over time. Flash is more or less dead, as are web applets, and a lot of security issues in javascript WRT overriding object primitives, high frequency timing, cross origin requests, etc, have been dealt with. It's not entirely the wild west anymore.

It’s like, how is it not better if my fridge can play music? Obviously I’d rather have music and cold food than just cold food.

I’m listening to Beethoven through my other fridge as I type this on my first fridge.

Yes... because a refrigerator playing music is just as absurd as a computer running software...

Twitter serves content,

Yeah, 140 bytes of content the user wants and 140k of JS that is entirely superfluous if not outright user hostile.

The "content" gets rendered either server-side or client-side. There's not that much difference between the browser filling in a template from a database vs a server filling in a template from a database. https://hnpwa.com/

It makes a world of a difference to equip a browser with these facilities in terms of security, privacy, accessibility, searchability, and content archival though.

That's true. Moving it client-side grants the end user more control over the content.

I consider myself an open-minded person, but I'm just astounded that people think a web without either JS or some other imperative, behavior-providing language would be better than the current web.

I think it's mostly nostalgia. People miss the old, quirky, simple web of their childhood, that felt like it had a distinct culture and wasn't so mainstream, and want it back.

And most of the rest of it is legitimate criticisms about the way javascript is used, but those are implementation and design decisions that are driven by culture, and can be changed by culture... and none of which really undermine the premise that computation in the browser has value.

> People miss the old, quirky, simple web of their childhood

No, we understand that answering the question "Is this Javascript I received from a unknown remote party safe to run and free of any malicious side effects?" is undecidable. If you want to defend the idea of running potentially hostile Turing complete code, you need to tell us how to answer that question or you are advocating that everybody should regularly accept the risk of running malicious code. I suggest first addressing the simpler question, "Does this Javascript program ever halt?"

> none of which really undermine the premise that computation in the browser has value.

Obviously Javascript - and computation in general - has value. I have never seen anybody suggest otherwise. Lots of things have value. The problem is that running Turing complete code is always going to be a risk, because describing the behavior of any grammar more complex than deterministic context-free is provably undecidable.

> If you want to defend the idea of running potentially hostile Turing complete code, you need to tell us how to answer that question or you are advocating that everybody should regularly accept the risk of running malicious code.

I don't really have to. Javascript has been a part of the web for over twenty years. Almost everyone else already runs it, and has already accepted that risk. You, rather, have to defend the premise that all of those people are wrong for doing so, given that most malicious code on the web comes from email attachments, downloaded binaries, and Internet Explorer.

I submit that blocking scripts will block ads (most of the time) and analytics and make sites (that work at all without it) run faster, but it won't really make you that much safer.

You're already running millions or billions of lines of potentially hostile Turing complete code that can do things javascript couldn't even dream of, and I doubt you've compiled all of it from source, or read all of the source if you have. The risk presented by javascript relative to every other programming language and runtime in existence is minimal.

>I suggest first addressing the simpler question, "Does this Javascript program ever halt?"

Yes. Hit escape, F5 or when the browser tells you a script appears to be hanging, have it kill the script.

I know you're referencing the halting problem there, but in practical terms it's not even an issue. You can, of course, just turn it off.

> Javascript has been a part of the web for over twenty years. Almost everyone else already runs it, and has already accepted that risk.

A lot of people without a CS background believing industry exaggerations and lies about security for many years does not mean they are acting safely. The frequent security issues is proof the risks exist. There were several decades where a lot of people smoked cigarettes, but we finally were able to make decent progress on educating everybody about that risk.

> most malicious code on the web comes from email attachments

The most malicious code in the long term is probably Google Analytics. The only reason it hasn't become a huge problem already is thanks to Google taking security seriously and not leaking everyone's browsing habits. An email virus/trojan at worst probably only ruins your computer and, in extreme cases, your bank account (i.e. with a keylogger). That's bad, but databases of your reading habits (and porn/etc habits) are a blackmail/manipulation risk that never goes away. The recent FB/CA drama should be seen as a warning about what can be done with enough data about you. It will be interesting when someone decides to steal GA (or other browsing history DBs) to sell it to insurance companies (possibly as a "risk evaluation" service so the insurance companies never have stolen data).

I don't expect you will strongly disagree and ignore this type of risk if your income is dependent on spyware continuing to exist.

> and I doubt you've compiled all of it from source

Actually, I have. Some of us do have the required technical background to understand this type of risk; the general public has to rely on someone else's word.

> The risk presented by javascript relative to every other programming language and runtime in existence is minimal.

Even if it was "minimal" (it isn't), you're taking that risk again every time you reload a webpage. I do not need to regularly compile new code simply to use the software I've previously installed.

> Yes. Hit escape,

Obviously, that interrupts the program, which is different from the program stopping (by reaching the end or running halt/exit).

> practical terms it's not even an issue.

Then please, in practical terms, tell me how I can answer the original question: is this random Javascript safe? My point is that this question is provably impossible to answer The halting problem is merely the easiest behavior to analyze; you cannot prove that a program will have any behavior in the general case.

https://archive.org/details/The_Science_of_Insecurity_

You're fooling yourself if you think that ad networks wouldn't have been built if Javascript didn't exist. The only difference would be that they'd be embedded into native apps.

You only need to look at the Android app ecosystem to see this. Ironically, because adblockers don't really work well on non-rooted phones, using native apps actually exposes me to a great deal more tracking than most of the websites I visit.

I would absolutely rather use Facebook, Twitter, or Reddit as websites than as native apps. And it's a great deal easier for me to block Google Analytics (just blacklist the domain) than it is for me to stop Google Maps, Uber, or Lyft from spying on me.

> Then please, in practical terms, tell me how I can answer the original question: is this random Javascript safe?

The only way to declare random code safe is to sandbox it. The web is one of the better sandboxes out there (although of course it's not perfect yet).

This is (one of) the reasons why we're starting to move towards Wayland in the Linux world - because we've realized that security by curation doesn't work for 99.9% of the population, and putting a sensible permissions model on top of applications is one of the few ways we can actually protect both advanced and average users.

If you're looking for 100% security, it doesn't exist, even for your self-compiled programs where you rigorously audited the source and all of the dependencies. Unless you've also taken steps to mitigate Trusting Trust?

Or that native apps are better.

Their problems with javascript aren't the technologies, its the ways they're abused. That's not a web problem or a javascript problem. I just kicked Facebook Messenger off my phone because every time I opened it, it would demand access to my address book.

Reply on news.ycombinator.com