Hacker News Reader

Comment by earlINmeyerkeg | Hacker News Reader

Use noscript. It's possibly one of the best add-ons out there now.

Not sure if this has changed but I ditched noscript when I discovered it doesn't block inline script execution. These days I use Ublock Origin:

Settings -> check 'I am an advanced user'. You should now be able to block 1st party, third party and inline JS from executing and save on a per-site basis. Hope this helps someone!

citation on the inline script claim?

I don't have one. I did use the web interface for Spotify though and it did some JS stuff when I left it for a bit; that's how I noticed.

Unfortunately there are too many sites that refuse to work without javascript, so any security benefits is negligible because it's very easy to be social engineered into enabling javascript.

You can get most to work by whitelisting one domain while keeping the cesspool of trackers off your computer. If it still doesn't work there are better things in life to spend time on than somebody's poorly constructed website.

This is what I do and I 100% agree about lazy people that aren't willing to make a halfway decent website. I'm not that old, but sometimes I just want a website with text. I don't need autoplaying videos with a billion slideshow images and shown how fantasmagical your company is.

There are surprisingly few, and importantly you don't have to enable all the adtech networks that may or may not have a good security track record.

What I would like is the ability to replace scripts (including (but not limited to) inline scripts) with my own versions.

It’s defense in depth. And most sites work fine with 90% of their script-serving domains blocked.

Or uMatrix (which I prefer in terms of UI but should be equal feature-wise)

... or use Chrome, which has a much better security track record.

Throw your privacy away? The privacy features in chrome are labeled bugs in firefox.

blegh.

...but it's not enough.

With some effort javascript from known sites could be fingerprinted and vetted.

An unexpected change could trigger a warning and blocking.

But with WASM we are really in trouble.

Reply on news.ycombinator.com