Show HN: Is JavaScript Enabled? | Hacker News Reader

Show HN: Is JavaScript Enabled?

isjsenabled.com

I made an extension and needed to be able to quickly validate whether js was enabled. Surprisingly, there weren't any stupid simple websites to do that so I set out to make one. A few hours later https://isjsenabled.com/ was online.

I had a lot of fun carefully picking the colors, coding the site from scratch and stopping all work to solve a very tiny problem. It reminded me, there's nothing better than the feeling of having made something, no matter how small it is.

Thought it would be fun to share.

Minor, but instead of:

    status.setAttribute('style', 'display:none');

I would suggest just writing:

    status.style.display = "none";

(and similarly for the other DOM modifications; see [0] for a discussion of setAttribute vs property syntax)

[0] https://stackoverflow.com/questions/3919291/when-to-use-seta...

I would recommend against using CSS to hide this information at all since a user might have both CSS and JavaScript disabled. In fact I would have used JS to manipulate all elements conveying the relevant information.

You are correct, I am going to fix this.

There is comment below where someone has a screenshot of how it looks in lynx, where CSS and JS don't exist. Instead of using CSS to swap visibility I am going to revert to how I initially had it where JS changes the text from 'disabled' to 'enabled'.

Edit: Fixed it, thank you.

I would also recommend against using the `<h1>` tag to convey the main information. Usually `<h1>` is used for the main heading—which I presume is the text ”is js enabled” which is located at the top, but wrapped inside a `<nav>`instead of a `<header>` to denote the document structor and `<h1>` to denote the text’s purpose as a main heading.

Instead I would use a `<strong>` tag to convey the main information, and a nested `<b>` (the Bring attention to element) to spell the word “enabled” or ”disabled”

</nitpick>

Definitely not just a nitpick. Proper header use is important for accessibility trees and robots.

Appreciated, I took the time to make these changes this morning.

If a user turns off CSS then virtually no websites will render correctly for them. Adding a specific detection for that fail state is really just unnecessary bloat.

You're kidding, right? Turning off CSS is used together with turning of CSS and images to improve the legibility of some websites.

For example, using Medium with everything on is a pain. But if you switch off JS, CSS and images, very often the whole text of an article fills in one screen, is quite clean and really fast. Using Medium in this way actually becomes a pleasure (unless the images are a apart of the article) - you can navigate the website rarely using the mouse. In any case, I'm not alone in using the web in this way - turning everything on is just a waste of time and resources. You can check it easily yourself with an extension like disable-HTML that allows turning off these thing instantly.

Here is how Medium looks without CSS:

https://i.imgur.com/MAalREE.png

If you find that more legible then all power to you, but nobody browses like that.

That appears to be the index page rather than the article and is not too bad. But that's just the default browser layout, sites usually look a lot better in reader mode.

Also, with js disabled your link is just an empty page, imgur is too incompetent to be able to show images without JS.

Reader modes are usually clever enough to grab content from <article> tags, so it doesn't actually have to render the whole page. Plus they insert their own CSS, of course.

You forgot to turn off the images. When you do, you'll see how readable and blazing fast the website is.

I think most text based browsers—for example Lynx—have CSS disabled. Also very few bots and almost no crawlers have CSS enabled.

Thanks, that is much cleaner. I'll spend some time tomorrow cleaning up the code.

This is what I get when viewed in Lynx which certainly has JS disabled.

        Picture of a browser window.

    Javascript is disabled in your browser.

    Javascript is enabled in your browser.

       This text is in a <noscript> tag and should display if JS is disabled.

https://imgur.com/a/RihgnoD

Good catch,

Initially this wasn't a problem because the script changed the text from 'disabled' to 'enabled'. Now the script sets 'display:none' and 'display:block' to control which element is visible. You bring up a good case to go back to the previous way.

Edit: Fixed it, thank you.

But... Why don't you just use the <noscript> tag?

https://developer.mozilla.org/en-US/docs/Web/HTML/Element/no...

I initially made this site to test an extension, I wanted to test for two things:

  - Javascript does not run.
  - noscript tags are swapped with divs.

Just because a noscript tag's content is visible, does not mean that javascript is disabled.

That's what the site uses:

    <noscript>This text is in a &lt;noscript&gt; tag and should display if JS is disabled.</noscript>

The site uses 2 methods: <noscript>, and javascript to hide an element and display a different one. This way you can tell if the methods disagree.

I browse JS disabled. And if some page doesn't render and really want to read it, toggle it on with a single click using a browser plugin for that site only.

I always get downvoted for saying I run NoScript with a whitelist but 90% of my browsing time is on sites I've been to before and I don't think any other single security measure reduces your attack surface as much as turning JS off does.

I think your downvoting has less to do with whether turning off JavaScript is a good or bad practice, and more to do with people just being sick of hearing about it.

In every story that’s even tangentially related, someone always feels the need to bring up the fact that they can’t believe anyone would ever have JS turned on, even if it’s totally irrelevant (like it is here).

It’s basically the Hacker News equivalent of people getting annoyed at vegans.

I think commenting about the linked page being completely broken without js enabled is relevant (especially if the page could be just as good without it).

I don't think it merits much conversation want time, but remembering accessibility is good.

Similarly, accessibility features for the (color)blind should be mentioned if they are bothering someone.

Javascript being enabled/disabled has nothing at all to do with accessibility. A site can be JS-heavy and fully accessible.

(Most aren't. But it's because they're developing it poorly, not because they're using JS.)

> Javascript being enabled/disabled has nothing at all to do with accessibility.

It does have to do with how well people with js turned off can access sites.

That's totally fine, and part of what makes the web great is that you're able to tweak things on the client like that.

Really it only becomes a problem if you become one of those people that harasses web devs for not supporting noscript users. At the end of the day Javascript is a web standard, and it's developer's jobs to target those standards.

No, it should be the developer's job to make content accessible in the most efficient way and to the widest audience. JS can be, but often it really shouldn't be used and there is a simpler solution. Some sites really do need to be JS webapps, but most of them don't. Your users may not care whether you use JS or not, but they do care when your site is slow because you chose to "appify" it unnecessarily and make it require downloading and running JS to show the same content that could've been directly served as a static HTML page.

I would argue that the developer’s job should be to determine whether or not supporting users without JavaScript would generate more money than it costs to maintain. It’s going to depend on the target audience and what you are developing. For example: Google Docs with JavaScript turned off makes no sense to me. Hacker News on the other hand could make sense. Much higher percentage of security concerned users and the amount of work to support it is likely not monumental.

That would be really stupid of me, yeah. It's their site and they can do it however they want. I wouldn't yell at someone for writing a book in Spanish just because I can't read it. Aside from that, almost every site I actually visit gets put on my whitelist. It's the ones accessed through ads that're dangerous. If I didn't regularly run into ads that make it past adblock I wouldn't bother blocking JS at all.

To be fair, the noscript tag is also a standard, and supporting non-JS browsers is important for some disabled users.

I'll happily accept the miniscule additional risk of running JS so I can use the web comfortably...

I'll say this only because I found out the other week and it blew my mind. No other reason, and I swear I'll never do it again.

It's 'minuscule'. With a u in the middle. Mental.

Yeah, just like king is "actually" spelled cyning.[1]

The variant miniscule has been attested since 1871. Given that almost every word that's been in English for long enough has had multiple spelling variants, what does it mean to say that miniscule is wrong and minuscule is right?

[1]: The earliest known use of the word king in an English sentence is "Se cyning sealde & gebocade Wullafe fif sulung landes.", according to the OED.

Mmm I get your point, and I’m all-in on the evolution of language, but I’m not sure you picked a great example here.

‘Cyning’ is, by any measure, no longer in use. ‘Miniscule’ is mostly recognised as an error.

The word is spelled ‘minuscule’. It really is.

> I’m not sure you picked a great example here.

Why, what's the difference?

> ‘Miniscule’ is mostly recognised as an error.

Recognized by whom? And, more importantly, what gives the people who claim to recognize it as such the authority to regulate language?

> The word is spelled ‘minuscule’. It really is.

Again, on what authority? I can find plenty of people who are okay spelling it "miniscule". On what grounds are the people who spell it the other way "more correct" ?

By the way, apparently somebody looked at a corpus and found "the spelling miniscule now makes up around 52% of the total use of the word"[1]. I think actual corpus research is a lot more valid of a way to answer the question "what is English" than some teachers and style guide writers coming up with rules arbitrarily.

Before you point out to me that the above citation includes the line "it hasn't yet become accepted as standard English and you should still treat it as an error to be avoided", I already know. Again, the writers of this blog post have no more authority to arbitrarily decide what is English than you or I do, and it's sad that they ignored their own quantitative research to attempt to do such a thing.

[1]: https://en.oxforddictionaries.com/spelling/minuscule-or-mini...

If you google "miniscule" it comes up "minuscule".

That's enough for me!

https://www.google.com/search?q=miniscule

Right, and if you go to this website I just made, it says the opposite: https://umanwizard.com/grammar.html

Does whoever Google got to compile their dictionary have more authority than I do? If so, why?

Yes, because there's more of them than you, by many orders of magnitude.

More of who than me? Google engineers? It's unclear what you mean.

Anyway, if we're going by number of people, I posted above a link to a blog post by people who did corpus research and found that the spelling "miniscule" makes up 52% of uses of the word.

And, obviously, any normal dictionary will contain it, even if Google's doesn't. (Dictionaries typically are in the business of documenting uses of language, not declaring them right or wrong). Any one you care to check will contain "miniscule", note that it is a widely-used variant of "minuscule", and probably mention that some people consider it "wrong", which of course is not to say that it is wrong.

------------

Edit: I don't think I am getting my point across very clearly, so I will restate it here.

I am bothered by people policing language for three main reasons:

(1) It is logically meaningless. Language is a cultural phenomenon, not a formalized set of rules from some authority. It is absolutely impossible to define what it means for a given use of language to be "correct" or "incorrect" beyond "what is used and understood by the community of language users". Claiming that a widely-used spelling variant is "wrong" makes no more sense than claiming that rock music is "wrong" because it diverges from blues and whatever else came before. Or saying that Japanese people celebrate Christmas "wrong" because it diverges from how Catholics celebrate it (which in turn diverges from how pre-Christian populations celebrated various solstice festivals).

(2) It neuters the study of language, which is an extremely rich and interesting field. It'd be much more interesting to ask why the variant arose, from a scientific perspective. The best theory is that it is a combination of two factors: confusion with the word "miniature", and sound changes in English that have cause unstressed vowels to be pronounced indistinguishably (i.e., unless you are trying very hard to enunciate, there is no perceptible difference between an unstressed "i" sound and an unstressed "u" sound).

Now we're getting into questions of etymology, phonology, psycho-linguistic issues like "what information about words in our lexicon do we carry in our brain", etc., all absolutely fascinating topics in their own right. Just saying "miniscule is wrong" obscures all of this.

By the way, the case of "miniscule" is by no means unusual. There are absolutely loads of words that changed for reasons with no etymological justification. One example is island -- the "s" has no etymological justification, at all, and the current spelling gradually became more common than the earlier "iland" (and various other variants) between 1500 and 1700 by analogy with the probably unrelated Latin word insula. Words changing because of phonological perception effects is very common too: apron comes from an earlier "napron", because of "a napron" getting re-analyzed as "an apron".

For those of us who are interested in the sorts of things that happened to apron and island centuries ago, it's cool to witness a similar phenomenon in progress today.

(3) Language policing is very closely connected with classism and, in some countries (including the US), racism. I'm not accusing anyone in this thread of that, but it's a good reason to be sensitive about it.

Sources. There are more sources.

I have to be honest, I didn't read most of your comment, because there's literally nothing you can say to change the immutable fact that language is defined by its population, and you, as an individual, have very little say in that (and for good reason).

It's "minuscule". That's it.

You might want to try actually reading my comment, rather than assuming you know what it says and arguing against a strawman. I certainly don't disagree that "language is defined by its population".

Okay I did, and I was right; you're wasting my time, possibly on purpose.

Hah, I appreciate this note, TIL!

To be clear, is JS pragmatically a security problem though? Are there known vulnerabilities being exploited? I don't recall ever having a problem due to JS.

Virtually all browser bugs require JavaScript to exploit. Here's the first example that came up when I searched for "google chrome sandbox escape":

https://googleprojectzero.blogspot.com/2019/04/virtually-unl...

Don't you think that the turing complete language with a massive API surface would be the obvious place for vulnerabilities to appear?

I'm not doubting that JS creates a greater attack surface.

I'm doubting the realism of the treat.

There are billions of people using browsers with JS enabled and I don't see serious concerns / problems as a result of it.

Where are the examples of Chrome being compromised by arbitrary JS scripts, out in the wild, wherein people have been affected?

Banks, insurance companies, security agencies - everyone is running browsers with JS enabled, so I don't see any reason to believe that it's a legitimate problem.

The problem is less related to typical petty crime, but more about state actors hoarding vulnerabilities imo. State actors have already been shown exploiting JavaScript-related vulnerabilities in Tor to deanonymize pedophiles, for example.

Being de-anonymized by state actors snuffing out child predators is not a concern for most people.

>Virtually all browser bugs require JavaScript to exploit.

I'm sure that's true. But understand that doesn't mean that Javascript is inherently unsafe. Even Specter, one of the nastiest vulnerabilities to hit in years was mitigated almost immediately by browsers.

A suggestion:

Given the recent news that Chrome will soon prevent ad blocking and given ads can run untrusted JavaScript, the only sane choice is to disable JavaScript in the browser.

I suggest that you change the "enabled" colour to red, to highlight the user's risky behavior.

>Given the recent news that Chrome will soon prevent ad blocking

I think you misinterpreted a headline. Chrome is not preventing ad blocking. Chrome is changing the content blocking APIs to match Safari's. Ad blockers will of course still exist.

Also, red as a color for "yes, enabled" is completely contrary to user expectation.

I've seen plenty of "you have JS disabled, please enable it for a better experience" warnings[1], but I wonder how many have a "you have JS enabled, please disable it for a better experience" warning; obviously, I would not see them, but perhaps others here might've come across such before.

[1] I once listened to one and turned JS on for a try, only to be bombarded with a bunch of ads, hover-overs, something that kept following the cursor, and other disturbing crap. That was definitely a lesson I won't repeat...

Thanks for the feedback, I've been debating this. In my earliest version I had the colors as you suggested but later decided that most users would expect it the other way. I'm open to changing it, but I'll need to think about it.

You made the right choice.

“Is javascript enabled?” is a true/false question. Just like with a traffic light which answers the question “may I proceed?”, green commonly stands for true and red for false.

If you make isjavascriptdisabled.com than colors should be switched.

Why not switch to another browser or implement a DNS-level blocking?

Reply on news.ycombinator.com