Do you want to go back to doing everything on the server again like the early 2000s?
Because that's what you'll end up with.
Because that's what you'll end up with.
Nobody's going to accept a non-interactive web, or even one with crippled interactivity[1]. They only tolerated it in the 90s due to hardware and bandwidth limitations, not to mention that the web was new technology back then. That ship has long since sailed.
Even back then, technologies such as Flash arose because people - initially website owners/creators and then, of course, users - wanted more interactivity than HTML 3.2 and 4.x, and slow/limited JavaScript, could deliver.
[1] With very few exceptions, the GP being one.
I don't talk about that: I talk about limiting web pages from using unreasonable amounts of client side resources.
We're not talking about a lack of interactivity. We're talking about webpages
- loading the page, then leaving the CPU alone
- not running crypto miners (at least not without asking)
- not having all the time in the world to run timing attacks
Something like Flash did make a comeback and it's just called JavaScript now. Pretty much exactly the same attack surface, but at least now its a hopelessly complicated "standard"!
I know, right? I almost miss Flash: it was certainly a lot simpler to work with. I'm not even sure about the "almost" in that sentence.
Flash exploits were a lot more commonplace and frankly embarrassing than what you see in JS engines these days, so I have trouble seeing it as the same attacking surface.
Suppose we devise a protocol that would allow browsers to directly do what we use JS for today? In other words, it would send a request to the server for every interaction with the page, but the response would be a DOM diff in some well-specified standard format, which the browser would apply to "refresh" the page.
At that point it feels like the main difference would be in latency for small page updates. How common are those, and how bad is it on a typical Internet connection? I'd expect there to be enough to break stuff like custom scrollbars and other such widgets, but many people would say good riddance to those.
I'm quite clear in the comment you replied to that I don't want to remove all possibilities for JavaScript.
I want to reduce attack surface significantly and as a nice bonus create a better browsing experience for everyone.
Even I realize Javascript has its place for now at least:
- autocomplete
- client side validation
- complex browser side apps, including games
What I want to curb is websites that keep exercising my CPU for no good reason (for me as a user) because they:
- are poorly written
- are busily loading and reloading ads and trackers
- etc
I don't see how you go from removing the worst abuses i.e. to "everything on the server again like the early 2000s"