Ask HN: Do you block JavaScript? why? | Hacker News Reader

Ask HN: Do you block JavaScript? why?

In 2013 gov.uk did a test to see how many people received ran their site's javascript[1].

They found that for 1.1% of visitors the javascript didn't run.

0.9% was because of errors — network errors, browser-extensions breaking the code, a mobile user going through a tunnel.

0.2% was people who actively blocked javascript.

I'm writing an small article about making sure websites work for that 0.2%.

1. https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missing-out-on-javascript-enhancement/

View on HN

I set NoScript to disallow all JavaScript by default and whitelist those that I "trust" as I go, I have been doing that for a few years now.

The friction in surfing doesn't get lower over time, not least because my exposure to most non-whitelisted websites are through websites like HN, but it's also not high enough that I would consider not blocking JavaScript by default.

Websites that use a lot of third-party JavaScript are red flags to me; more often than not, they are unrelated to critical functionalities (such as payment), and they add absolutely no value to the client.

Perhaps one thing that is worth noting is that modern frameworks that are SSG-focused or hybrids like Next.js make developing websites for JavaScript-blocking clients a bit easier. I haven't personally looked into this too closely, but at least with the website projects that I have work on with Next.js, you would still get a presentable bare-minimum with little effort when JavaScript is turned off, it's also not difficult to implement a reasonable fallback for JavaScript-blocking clients.

The above of course depends on how much server data need to be fetched dynamically to render a page, which again depends on the nature of the content on a website. If I'm not mistaken, there are functionalities that simply can't be implemented, or very impractical to implement, without JavaScript; in those cases the question of "making it work for that 0.2%" is probably moot.

I use NoScript and block scripts by default. The main reason is security - reducing browsers vulnerability surface and tracking/fingerprinting methods. As an added bonus it reduces significantly all kinds of annoyances like ads and popups. Also the pages load much faster and are lighter for cpu.

However, it is sad how few pages work without javascript these days. Nevertheless, I very rarely enable it for any site. Instead, if there is a page I really want to use, I "fix" it using a userscript. Sometimes it's as simple as modifying the CSS to reveal the hidden content. Sometimes it involves parsing some inline json from the document, doing XHR to get the content and building the html from scratch to show it. I suspect I'm in the minority even amongst the 0.2%.

Yes; for (1) speed, and (2) security.

* The gain of speed is noticeable. I love it.

* The benefits of security is qualitative/theoretical. I do not have any quantifiable data here.

* The change of UX is usually acceptable. I consume mostly textual information.

A few website's contents and/or services are valuable enough so that I whitelist them. For example, GitHub, YouTube, and HN.

What percentage of your development effort will you budget to serve that 0.2% client? Would it be more than 4 hours a year? How much extra support would the types of clients who actively turn off JavaScript require? How much extra business will these types of clients generate or influence?

I am not saying it is not worth the effort, but I am saying you should clearly set expectations and measure to be sure that this juice is worth the squeeze. If your motivation is because it is the "right thing" to do and not because you can quantify that the effort is worth it, then it almost certainly is not. On the other hand, your business analysis might show that this type of client is 10x more likely to subscribe/buy your product and supporting them is a no brainer.

Note, that I am assuming we are talking about a smaller client base and dev team. Social media size sites might for example consider this 0.2% of their perspective userbase as a critical mass and devote thousands of hours to supporting them. You might also feel in your case that the use of JavaScript hinders assistive technologies and their support is critical to your success.

For what it is worth, I do not disable Javascript myself, nor do I build sites that specifically work without it though I do try to build clean HTML to the extent it is practical and I would rather solve a problem with CSS than with Javascript.

I'm just interested really, happy to spend lots of time doing it for fun.

Generally when you build clean HTML like you say, it benefits everybody, including the developers.

There's also plenty of applications that simply wouldn't work without javascript.

I'd advocate for at least having a <noscript> tag explaining briefly why it doesn't work.

No, but I often close a website before it can load. In my experience, most of the websites I close out of frustration load slowly because they’re JavaScript monstrosities.

I don’t think users who bounce because of huge JS bundles are tracked very well, because often the bundle that hasn’t loaded is what does the tracking.

I have a separate browser profile for all general purpose (not Google, FB, or any account-based services) browsing. I use uBlock origin to block all first and third party JS, and also third party frames.

Most of the browsing I do in this profile is reading articles or visiting sites that are mostly text and images. The speed gains are enormous as is the improvement in performance on my lower powered laptop. I just don't see the need to enable JS unless the site breaks. If the site breaks it is either poorly written, in which case I have the option to bounce, or uses a JS framework like React or whatever in which case I allow at most first-party JS. If it works it works.

I disable it. It improves speed and avoids many things that I don't want (sometimes just annoyances of animations and commercials and keyboard overriding and other annoying stuff, sometimes malware; disabling scripts doesn't always remove all of these things, but it helps).

I also disable fonts; I like to specify my own fonts instead. I also disable favicons, since it is not a feature I use, and third-party cookies, and some other features.

Sometimes I disable CSS too, and sometimes this compensates for disabling JavaScripts. Sometimes I also use user scripts and user CSS.

Yes, I do, and I rarely unblock it. There are many reasons: security, performance, just plain consideration for my sanity.

But here is an unexpected side effect I noticed: Sites which require JS just to display correlate highly with low-quality content, which I usually regret wasting my time on having read.

This, above all the other reasons, is why I don't bother. Sure, I can unblock it with a quick three-key sequence, or I can use alternative access methods, but usually I just thank them for saving me the time and move on.

I enable javascript if I have a contract with a vendor. I am sure I am not representative of any significant group however. I expect the future to be dumb terminals, vaults and bottle caps.

I don’t block JavaScript. I enjoy using the internet more than I enjoy making some point about technology run amok.

I don’t block it, but if I did it would be for security and performance over a moral stance.

Most sites that don't work without javascript are unpleasant to use with it enabled anyway.

Also some portion of those 0.9% might be running librejs or noscript which has the user review each script file before running it and is much more aggressive about blocking cross site requests. With "disable js" removed from the firefox GUI a lot of the people "blocking javascript" probably show up as "errors."

I use this. The main reason is performance, my thinkpad is unusable if I let everyone's crap run wild on it. Also evaling every snippet of code you get over the network is absolute brain damage from a security perspective but no one actually cares anymore.

if i have a relationship of trust with you i will let you run _your script_ on >my< server if we need you to have access to such functionality.

abusive script, dark patterning and subversion of autonomy are major issues.

im hunching that .2% is a portion of machines that are in such a security stance that you have little hope of getting any of them to convert to allowing JS

I think the question is about users disabling JavaScript in their browsers rather than about sites running 3rd party javascript particularly remote dns supported (ad provider) javascript. Though I could be wrong.

Not exactly, but I use privacy badger and ublock origin, like I think a lot of people do, and that seems to block a lot of javascript, mainly the kind of stuff you don't want - tracking, ads, malware-ish etc.

I've been using uMatrix but it's discontinued, anyone have any alternatives with that fine grained of a blocking ability?

I block JS because the web is so much faster without it, especially text articles.

Maybe you know any good reason to use JS? It will not make the text you read any better and other multimedia like youtube is being consumed way better if downloaded via youtube-dl.

> Maybe you know any good reason to use JS?

Sure. The websites that require JS will run.

But what will you do if you will meet a website which requires you to cut your nose off?

Depends how much I want to use the website. More than I want to keep my nose?

I don't block it. But as a developer I try to minimize JS usage wherever I can (reasons: usually server side rendering is good enough).

By default I set NoScript to allow Javascript.

Site by site, I block javascript when it is in my way. Wikipedia for example. There is no alignment between my reasons for going to Wikipedia and the various reasons Wikipedia uses Javascript. Lazy pseudo-paywalls are another use case. Obnoxious "this site uses cookies" also.

Reply on news.ycombinator.com