Hacker News Reader

I don't know of any empirical evidence, but the story normally goes: There is a new Java exploit, and recommendations to remove/disable Java hit the wild. Then while people try to find out how to disable "Java" Find "Disable Javascript" and assume it's related. Perhaps this would be solved by renaming it "Disable Ecmascript" however.

I really have no idea how common this is, but have seen it once, from a user that's technically savy enough to be diging in options and worried about security, but not savy enough to know the difference between Java and Javascript.

Well, an extra phrase might be added in the menu where 'Disable Javascript' appears - '(Note: Javascript is not same as Java)'. If users don't know the difference between Diesel and Gasoline, better option is to educate them in context (e.g. handle of fuel pump) rather than closing down all Diesel pumps.

If people don't know the difference between diesel and gasoline, is a note that says "Note: Diesel is not the same as Gasoline" going to help? Doubt it.

The assertion is that 'configuration creep' is overwhelming for the unsophisticated user in the first place, adding even more notes and explanations to all the configuration options is not going to help.

>If people don't know the difference between diesel and gasoline, is a note that says "Note: Diesel is not the same as Gasoline" going to help? Doubt it.

Really? I would think that sign would help everyone who knew how to read, bothered to read, and wanted their car to run. A sign with a simple message like that was enough to fix one national timeclock system that I worked on. "Do not do X before 12:00 Noon unless Y." in English, Spanish, and Polish.

For the people who still messed it up that we found by using heuristics on all of the punch data, we sent reports to their managers that said that they had probably done something wrong. After 3 or 4 cycles of this, the failure rate went from 15-20% to 1-2%.

Unsophisticated users remain unsophisticated users if you systematically remove configuration until the application only does one thing one way, badly.

If they don't know the difference between diesel and gasoline, how do they know if the one they want is "diesel" or "gasoline"?

But, yes, clearly, the goal is removing configuration until the app does one thing well, not badly.

Only if you want 9000 apps, because then it becomes a question of which of those super narrowly focused apps will work to do what you want to do. An email client that only emails your mother is a good emailing your mother client, but a bad email client. If they take away configuration for people with stepmothers or two mothers, because it's only a 5% use case, it's even a bad emailing your mother client.

If you know your car runs on gasoline, and you don't know the difference between gasoline and diesel, then you see a sign that says "diesel is not gasoline," you know that diesel is not what you're looking for - even though you still don't know the difference.

I doubt anyone makes the diesel-gasoline mistake more than once. Browsing to a broken or insecure site (never mind that the brokenness or insecurity is due to javascript being off and on respectively), however, is done all the time.

Or make the option to disable Java accessible from there.

You want to add an option to disable a particular browser plugin in the core browser options? That doesn't seem like a good idea.

It's a shame that they didn't push "ecmascript" as the name ~15 years ago back when it was new. Now we're stuck with problems like this...

It wasn't an accident—they wanted to appear similar to Java (https://en.wikipedia.org/wiki/JavaScript#Birth_at_Netscape):

> The final choice of name caused confusion, giving the impression that the language was a spin-off of the Java programming language, and the choice has been characterized by many as a marketing ploy by Netscape to give JavaScript the cachet of what was then the hot new web programming language.

Is there any empirical evidence that the use of AdBlock + Ghostery or WOT or whatever privacy addons you're already using are any less secure than disabling JavaScript outright?

Disabling JavaScript has a few MAJOR disadvantages to proper web usage:

1. As the blog post has said, many web sites will fail in mysterious and unexpected ways. Some web apps may be rendered completely useless. In fact, you might as well just say goodbye to the modern web if you're gonna totally disable JS.

2. Since it's a "blanket fix", disabling JavaScript is a silly way to protect yourself from data miners. Instead, why not use an extension that has been proven to work, is actually available cross-browser, and gives you MUCH finer-grained control over what is displayed?

3. Since JavaScript is not the only thing that could potentially fuck up your web experience, disabling JavaScript doesn't even fix every problem related to privacy! You'd really have to disable JS, disable all plugins (Flash, Silverlight, Java, etc.), and pretty much block yourself out from a lot of the modern web just to be truly secure. At that point, you're really isolating yourself from a lot of the web's rich media, and doing so in spite of the plethora of tools available to combat the stealth data mining practices that these companies use.

Use AdBlock. Use Web Of Trust (WOT). Use Ghostery. At least know when sites are tracking you, and disable those tracking bugs when you see them. You don't need to turn off JavaScript and isolate yourself from an entire ecosystem of awesome, just to maintain control over what data you're sending out about yourself. The idea of turning off JavaScript has always been a silly concept to me, and I felt was simply there to please the more paranoid of us. But there has to be a time to face reality: It just doesn't work.

I run with Javascript off, via no-script. Most of the stuff that requires Javascript is tracking based and/or from third party domains.

tbh a global Javascript toggle is a bit useless. You really need the fine grain per-domain settings of No-script to navigate the modern web.

Ghostery has recently been found to be selling user data. ISTR there was a similar incident with AdBlock? I don't want to have to trust some random extension author to have got these things right.

AdBlock Plus started allowing some advertising they deemed "non-intrusive". This was a default setting and easily toggled in the settings, but there was still a big backlash.

I hadn't heard about Ghostery selling data. I read about the story at Mashable [1].

[1] http://mashable.com/2013/06/17/ad-blocker-helps-ad-industry/

> If there really is a problem, it may be worthwhile to move it to an "advanced settings" panel, but removing it entirely is a terrible idea.

Is this not the equivalent of 'about:config'? In reality it is the advanced settings panel, just without the pretty dialog to go with it.

But about:config voids my warranty.

Then ask for a refund.

"Advanced settings" dialogs tend to indicate poorly-thought-out interface design.

Rather than demonstrating careful attention to what features are useful and important enough to ship, they become dumping grounds for "something someone asked for once".

So well thought out interface design is ignoring subsets of users and unifying everyone to one common set of behavior.

Imagine if Excel employed this philosophy. It wouldn't be useful to anyone.

I wasn't aware I could set a field to SUM(..) etc from the gui... Most of the features in Excel are a bit under the covers.. and far more so than about:config... maybe the "advanced settings" tab should be a button that just takes you to about:config with a warning?

Err... I just opened up Excel (2002 since that is all I have at work), selected a cell, clicked on the SUM button (sure it uses the mathematical symbol for sum but if you hover over it, it says SUM), and then was able to click and drag (or CRTL + click for nonconsecutive cells) to select cells for the sum. This is all via the GUI. I'm not sure how this is hidden. Heck, I did this in a Japanese version of Office which I can't read.

Is this different in Office 2010 or any of the newer versions of Office? I mostly use LibreOffice and even there it has the same "all GUI" functionality.

Honestly, didn't know, I rarely use excel, but do know a lot of people who do a ton of VBA code to connect to database resources to create interactive spreadsheets.. and a lot of that is far from common, button-click functionality.

And in any case, for those that want it, it's in about:config ... I doubt anyone who should be disabling JS would be looking around for it in a config frame, and not do a quick google search. I've generally adjusted most of my settings via about:config, mostly cache related for me, but if I'm playing with js settings etc.. it's easier to keep a tab open with about:config than a modal.

While you may know a lot of people who do VBA code in Excel, that is actually far from the norm for the average corporate user. From my non-CS friends who have worked in both large and small companies, I have heard tons of horror stories of the insane spreadsheets that low-to-average users make using just the GUI functionality. Huge spreadsheets with formulas spanning tons of sheets to simulate what could be done in a simple function. These spreadsheets get huge over time as coworkers slowly add/update functionality over time. All using the GUI which makes it a cluster fuck (my friends' words) to understand.

And all of this actually is equivalent to the "uncommon" VBA coding that you hear of. I wouldn't be surprised if all of the VBA code / spreadsheets you hear about evolved from one of these massive GUI created spreadsheets. Why? Anecdote time:

Those VBA sheets tend to come into existence when a non-programmer decides to learn about macros, updates one of these sheets to be simpler (less data entry), and it actually works. One of my friends was one such employee and she ended up converting a few of the inefficient spreadsheets into a single faster (though still slow) one. Due to cutting down the amount of manual data entry and processing time, it made what used to take a few days of work into a single day of work (mostly to have the sheet run calculations). If this creation gets useful enough, it can take a life of its own in the company and eventually some manager might make it the responsibility of an "IT" guy to update the code. Usually because the original employee got promoted (or left for a better job) due to killing their performance reviews. My friend was one such employee who left and actually did this at more than 1 company leading to a pretty damn well paying job at a young age. Last she heard, her original spreadsheet was still being used and semi-maintained by IT. And this it how I believe a lot of those VBA coding projects come into existence.

How this all connects back to FF and the javascript option, I have no idea. What I do know is that non-technical users can be pretty goddamn creative when it comes to finding ways to simulate uncommon functionality when needed. All via the GUI.

My dad takes great pride in complex VBA code. Unfortunately, this can backfire. A few years ago he was brought in to help manage a particular support system for a large telecoms company here in the UK, which involved a lot of Excel donkey work. He understandably figured out a way to automate about 50% of the work of the entire system.

This meant that he freed up plenty of time for the entire team he was on. Unfortunately, this meant that they now had surplus staff, and as the newest arrival, he was the first to let go.

Yeah, incredibly backwards internal politics, but I swear it's true.

I've been one of those VBA/Excel automators, and almost every project you get done causes layoffs. They're crappy jobs, usually, but it doesn't feel very good. Vive la productivity gains?

100% believe you because this was one of the concerns my friend had about sharing her work. Only management didn't go the firing route. They ended up giving the employees even more work because of their newly found free time.

That depends how large the subset is. If it's 2% or lower, then yes. Hell, I might even go as high as 10% depending on what the particular bit of behaviour is.

Do you think 2% of Excel users (or 10%) use Pivot tables? Do you think Excel would be the massively powerful tool it is today without that?

Same for scatter plot, import csv files delimited with % marks, and the ipmt() function?

A fair point but misleading - they're not a simple checkbox which can break your everyday experience. In fact, none of them are UI relevant at all, really.

What makes you say "Advanced settings" dialogs mean poorly thought out UI? I think it's a very good way to tell novice users, "don't open this panel if you don't know what you are doing". And if they still do it and something wrong happens, they'd immediately know the reason.

User has trouble with software. User says that software is "too hard to use". A usability/interaction team are tasked with making the software "easier to use" and set off to find "confusing and infrequently used" features they can kill off.

Obviously anything on the 'Advanced...' dialog makes an easy target.

Humm .... I don't believe that just the presence of an "Advanced" button somewhere in the settings makes a software hard to use. May be FF usability experts do. :)

I'm pretty sure that Disable Javascript is not something asked ONCE.

At the moment of this writing, the NoScript extension is the 6th most popular extension.

https://addons.mozilla.org/en-US/firefox/extensions/?sort=us...

There's very few applications I'd consider useful to me if stripped of the options that "most users" would never want to touch.

> they become dumping grounds for "something someone asked for once".

Right. That's what they should be.

Software exists to provide utility for users, not to instantiate designers' aesthetic visions.

"If there really is a problem, it may be worthwhile to move it to an "advanced settings" panel, but removing it entirely is a terrible idea."

I'd like to see the evidence as well. Perhaps there are dozens of bug reports coming in every week that can be traced back to disabled javascript.

They did leave it as an option in about:config though so at least it can still be disabled via javascript.enabled=false

Implementation isn't the only cost of features. You need to test them so they don't break. Features can be a burden for the codebase and removal can lead to many edge cases becoming unnecessary. A magnitude of features can overwhelm users, especially occasional users. They steal attention from other features that you may find more important.

And the most important point here: This feature really is broken as of today. Nobody can persuade me that they use it on their main browsers. I don't believe them.

There are some web sites that use a Javascript to prevent one from right clicking on images to save them; disabling Javascript is a workaround for that. I wouldn't be surprised if that is in common use.

Certain shopping sites disable right-click to prevent you from comparing prices.

Certain lyrics sites disable right-click to prevent "theft".

Certain sites disable right-click for aesthetics or to prevent me from seeing the page source.

This news just makes me glad I'm on chrome.

But then deactivating javascript for the whole browser isn't the right solution, because it breaks everything. You simply use NoScript.

But you don't need to disable JS altogether to prevent that, only disable replacing context menus. Unfortunately for that argument, updating to FF23 removes all of the 'advanced' JS options, not just the checkbox to disable it altogether.

The option has not been removed entirely, it is in the advanced settings, which are called about:config.

> Is there any empirical evidence that suggests that people accidentally disabling JavaScript and then being confused as to why websites don't look right is a significant problem?

Of course not. Mozilla's agenda is determined by its main sponsor, Google, which has a vital interest for JS to be enabled. Any spin on this being somehow "for the user" is bullshit.

Apparently, the agenda of Google's own browser team isn't determined by Google, since they haven't removed this option.