Add limits to amount of JavaScript that can be loaded by a website

> "The site example.com uses 5 MB of scripting. Allow it?"

Oh God, no. Please don't do this.

1) We know that users presented with these kinds of dialogs don't read them. They just blindly click "OK" to get the dialog to go away. So now you're just annoying people to no good purpose.

2) Even if the user does read this dialog, how is she supposed to know how much JavaScript is too much? There's no context to tell her whether 5MB is a lot, or how it compares to payloads delivered by similar sites. ("The site example.com wants to load more code than 99.99% of other sites you visit" would be slightly more helpful, but only slightly.) It just expects her to have a strong opinion on a subject that nobody who isn't a coder[1] themselves would have an opinion about.

3) If the problem we're trying to solve here is that code makes sites load slowly, making people click through a dialog isn't going to make the site load any faster. In fact it will almost certainly take the user more time to find and click the "OK" button than it would to just load the code.

4) It's measuring the wrong thing. 1 kilobyte of badly written code can do as much or more harm to the user experience than 1 megabyte of well written code will.

[1] With the possible exception of people on strictly capped data plans, but now we're solving a different problem.

But on the other hand, I love the idea of resource-limiting tabs by default, along all of:

- CPU usage (allow an initial burst, but after a few seconds dial down to max ~0.5% of CPU, with additional bursts allowed after any user interaction like click or keyboard)

- Number of HTTP requests (again, initial bursts allowed and in response to user interaction, but radically delay/queue requests for the sites that try to load a new ad every second even after the page has been loaded for 10 minutes)

- Memory usage (probably the hardest one to get right though)

I mean, every so often I've caught things like a Gmail tab in Chrome stuck at using 100% CPU indefinitely because it must be stuck in some infinite JavaScript loop due to a bug, as well as the occasional other random blog that uses constant 50% CPU for no discernable reason... and it would be nicer if this didn't suck up two hours of my laptop's remaining battery time before I discovered it.

If the browser had soft resource limits that just gradually slowed down code execution and HTTP requests to extreme levels, with a discreet pop-up warning in the corner "this site is attempting to use higher than normal resources, click here to allow temporarily/permanently" for the times you're opening a WebGL demo...

...it seems like it would be a big win for users.

I run adblock primarily because I don't want to see ads and get tracked by sketchy sources. Resource usage is a minor bonus. If that hurts peoples pockets then so be it, most ads are out of hand and need to be tempered. Most people who run adblock aren't going to click on the ads anyway.

With that said, I do hope we're able to figure out how to treat web "sites" and web "apps" differently - for the former, I want as little JS as possible since that just gets in the way of content, but for the latter, the JS is necessary to get the app running, and I don't mind if its a few megabytes in size.

Setting some arbitrary hard-limit is counter-productive and shortsighted. That quote is infamous for exactly the same reasons that this claim is flawed.

Lots of unanswered questions here, e.g. what happens if a 500byte javascript file then does a load of XHR requests that download more JS: what happens then? does the connection just get closed as soon as you pass 5mb? That will break the internet for lots of users. Plus what happens if I down load a couple of kilobytes of javascript that ends up allocating many gigabytes of memory? Is that ok because it was under 5mb of over-the-wire-bytes?

I can easily imagine a 5mb+ web application. Sure you might not like that, but it does not make that a bad situation.

If you don't like javascript, then the answer is simple: disable it. If you want to use javascript but feel like a particular website is using too much resources, then the answer is simple: dont visit it. You have choice.

Content blockers try their best do block and remove specific parts of the web page, surgically identifying them. You can’t just randomly block stuff and therefore break an insane amount of websites and call it a day.

What about web apps? Should there be a «this application wants to exceed the xMB quota» confirmation messages? Oh please no.

Not sure how I feel about a statement this broad. I work mostly with front end code and I try neat things and tricks to reduce resource use all the time. I also always push for the lightest way of doing things in PRs. I’m certain I’m not the only engineer who thinks like this.

This is a flawed assumption, I think. Sure, maybe _some_ people are blocking ads because all that JS and network IO eats up battery but I bet more people block ads either because they dislike advertisements generally or they dislike advertisements based on surveillance. Whether you manage to cram your ad serving code into 1Mb or 1Kb is irrelevant for the later two groups of people.

Do you accept our cookies, tracking and privacy policy?

Would you like to subscribe to our newsletter?

Please give us access to your location!

This site is way better if your download our app!

Please allow us to load another 30MB of JavaScript!

What I really want to see happen is WHATWG start a standard lib project. In my mind it would look something like this:

* Open source project that implements the standard library in Javascript only and holds the canonical test suite. Something akin to core-js but the 'official' version of it and with features outside the language spec.

* Every browser agrees to preload / cache all recent versions of the standard library (or most recent version for each major release assuming semver). This allows all programmers to load the version they need without concern for the performance hit.

* User loads the standard library via a script tag with src something like: https://ecmascript.org/stdlb/v1/lib.js. Doesn't really matter what it is, just some recognized url the browser knows about that encodes the version.

* Each browser can provide a native implementation of anything in the stdlib so long as it passes the spec. Browsers could even optimize which pieces of the stdlib it parses / loads based on this. e.g. If the browser has a native Promise implementation then it doesn't need to load the Promise code from the stdlib.

* Be reasonable but aggressive about adding to the stdlib. It's scope should be wide and cover common use cases. e.g. I shouldn't have to write a URL parsing class or a throttle function every time I start a new project (which is where we are today). There are plenty of projects to look at for learning what people need (lodash, etc).

Obviously this would not cover everything; it's not going to add `await` to browsers that don't support it. But I think we're at the point where what we are most in need of is not language features (and mostly these are transpilable anyway), but stdlib functionality.

Perhaps we just let quality rise to the top? If your website is full of ads and slow, then someone else with better, less annoying execution will eventually win more users.

What is going to be the limit?

Who is going to be setting it?

How is it going to be calculated? Is it the amount of loaded files? What if the page is small but then loads more dynamically later?

How I, as a developer, make sure my website works everywhere?

What with sites that use a lot of code but still work fast? The amount of code does not directly translate to slowness. You can have little code and slow website or a lot of code and fast website. As an example, single page applications tend to load all of its code but still manage to be responsive.

"But there's a downside to this content blocking: it's hurting many smaller sites that rely on advertising to keep the lights on. More and more of these sites are pleading to disable content blockers"

The solution proposed is unworkable for all the reasons others propose. But there really is a baby/bathwater situation with ad blockers that attempt to kill all advertisements.

I don't know what the solution is, but I think it is an important problem and deserving of a more sophisticated solution than ad blockers or ones like the solution proposed. People here are smart, I hope people can do more than just state reasons why we can't do better than what we are doing.

I've got another way to solve this problem.

Content blockers should operate on a blacklist instead of a whitelist. Advertisements appear by default, but if a given site annoys you enough, you can go into your ad blocker's preferences and add it to your blacklist, and then you'll never see any ads on that site again.

Why is this not even an option in any of the major adblockers? I know it's possible in Ublock Origin via tweaking advanced settings[1], but it should be a built-in, user friendly feature.

[1] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-tu...

Remember those popups in IE "Do you want to continue running scripts on this page?" Nobody knew what they were, where they came from, or what they were talking about. Even wose than that was the fact that nobody knew what the Yes/No button was for and if you clicked "Yes" sometimes it would just keep popping up over and over again.

They got rid of that for a good reason (although its still alive and well in MSHTA.exe). It sucked and offered nothing of value to most users.

On the other hand, the New York Times's website has 5 external scripts that total over 1mb of just text. They've got their CMS, 4 DIFFERENT ad agencies, analytics, and some other crap the site problably never "needed" before 2010. That's disgusting. And that's what you get from a $300m+ company that RELIES on technology to stay in business. Missing a feature? Fuck it, just have the client pull down another 400kb of js from a sixth CDN. Nevermind the actual CONTENT that attracted the user in the first place is measured in bytes.

So while I think this is horribly misguided, I do agree that something needs to be done to deincentivize lazy Javascript programmers pasting all their problems away. Perhaps the lock icon in the address bar should also turn yellow or red to reflect external script resources? Or maybe whenever multiple frameworks are combined or multiple ad networks used?

Almost every page of my WP website has just 8 internal resources and a page size of <310kb. There's no reason NYT can't stay in that ball park with their deep pockets. Megabytes of tracking and bullshit for basically a white page with text is disingenuous.

"This page will cost $0.02 to retrieve. Pay by running 20FLOPs of code?"

"OK"

"This page will cost $0.05 to retrieve. Pay by running 500FLOPs of code?"

"No, pay via $fiat_transfer_method"

* A number of seconds on page load,

* a fraction of a second in response to network activity (eg. image loads),

* a small number of frames in response to significant user interaction (mouse clicks, typing),

* one frame after less-significant user interaction (mouse movement), limited only to local operations (no network activity).

The vast majority of sites should need nothing more than this, so opt-in to unlimited usage should be fine. Sites where the user has enabled extra permissions like notifications should be allowed extra time for those.

I think this is a great idea. It puts pressure on developers and makes experiences better for users. The average American Internet speed is sub-100 Mbps, but average LTE speeds are closer to 12 Mbps, with websites opting usually to use responsive layouts over separate mobile sites. This means you're downloading the full resources of a desktop site, and the mobile device is adjusting to media queries.

5 MB / 12 Mbps is over 3 seconds. That's bullshit. Put pressure on developers, make a better web.

Base it on the content of the page, not the person visiting. I've never clicked on a retargrted ad for sneakers that follows me to a tech site, but an ad for (for example) DataGrip on an article about SQL tooling might actually interest me!

Given that, I don't see any point trying anything that somehow keeps ads around. Intrusive online advertising doesn't really need to exist.

A lot of people use their phones to access the Internet and have hard data caps, and webpages don't need to load several MB of JS to display 55k of text. There's certainly use cases for JS that justify that amount of script to load, but shoving ads, trackers, and widgets aren't those uses.

https://www.igvita.com/2016/03/01/control-groups-cgroups-for...

It's aimed at limiting resource usage of 3rd parties (ads), and pages voluntary limiting their usage, but presumably browser extensions could add the limits too.

Also I fear that a lot of this is javascript phobia formed by the mindset that the web is supposed to be documents not full blown applications, after all why complain about 2 megs of js when the page has a 10mb banner image and an autoplaying 40mb HD video?

Smaller sites could avoid farming their content out to 2 or 20 locations on the cloud.

The user can already add limits. Try using uBlock Origin with scripts open to inline and first-party scripts and images everywhere ... and nothing else.

If the page comes up blank, bye-bye. Don't visit it any more. They made their choices, let them live with it.

> The situation I'm envisioning is that a site can show me any advertising they want as long as they keep the overall size under a fixed amount, say one megabyte per page.

With minification/compression, I don't see how 1MB could work...

A build tool that scans your JS code, and includes only the jQuery functions that it has found to be using; or equivalent library etc.

Whoever wrote that comment was a liar and a peddler of nonsense.