Hacker News Reader

Comment by natch | Hacker News Reader

Another red flag Doc doesn't mention here is the fact that Mozilla now requires extraordinary knowledge to disable JavaScript in Firefox.

There are broadly useful reasons to have this available as a toggle in the common UI (such as when you want to save an image from a site that uses JavaScript to prevent right clicks), yet it's hidden inside of the cryptic (to most users) about:config.

And why might this be? There could be several reasons all in play at once, including an attempt to protect users from themselves (think: The Nanny Browser), but I would just point out that the advertising infrastructure Mozilla increasingly relies on, with its cross-site user tracking, leans heavily on JavaScript.

It would appear that with that as a counter incentive, Mozilla has chosen to side with the ad networks, instead of with the users, in choosing which options to expose for easy control.

View on HN

Ordinary users do not want to disable JavaScript. Hell, they don't even know what it is. Advanced users like you can still use NoScript or about:config.

This was exactly the explanation from Mozilla side and it makes sense. The reason for the decision was people telling "my internet stopped working" (white pages) once they've disabled JS by accident.

It's an interesting thought: should we be dumbing down everything or just engaging in a bit of education instead and helping people understand what JavaScript does and its use on web pages?

The manual for my car mentions things that must be done for maintenance. They don't dumb it down. Meanwhile in computer land we hide all options and dumb everything down to "protect" the user.

There is a difference between being easy to use and molly-coddling. It is a difficult balance to get it seems!

Exactly. In order to do complex tasks you get out the manual, open the hood, and get to work.

And in order to do something equally complex in Mozilla you grab the help, open about:config and get to work.

Your car doesn't put complex details on the dashboard, and neither should Mozilla.

> It's an interesting thought: should we be dumbing down everything

This is not a case of "dumbing down everything", the ability to remove javascript is still there, what is not there is one (of formerly 3) often inadvertently used method for it.

> The manual for my car mentions things that must be done for maintenance.

Disabling javascript is not maintenance, it's a significant structural change in the browser's abilities, like removing the car's suspension. And it makes no sense to put that as a switch on the car's dash.

>The manual for my car mentions things that must be done for maintenance.

Your car has a manual that describes maintenance. It doesn't have a button next to the radio that ejects the engine.

Who reads a car manual?

If you want to continue that, you could consider the manual to be about:config. No one is stopping you from reading the manual or going to about:config, but it's not required.

If you want something used by millions of people, you have to make it as simple as possible. Insisting that people learn about the invisible internals is more likely to put them off using it than to result in them learning.

Too many people mistakenly disable JavaScript every time a Java vulnerability hits the news, and there was a period not too long ago when a new Java vuln seemed to appear every other week. It was around this time that the "disable JavaScript" option disappeared from Firefox.

>> Ordinary users do not want to disable JavaScript

But sometimes "ordinary" users do need to disable Javascript. Wouldn't it make more sense to put in a pop-up "Disabling Javascript will potentially break lots of websites. Are you sure? Y/N"

It's perhaps a tempest in a teapot, since these ordinary blokes will simply follow a different set of connect-the-dots instructions they found while searching for "how do I save an image from XYZ website?"

http://limi.net/checkboxes-that-kill/ does a great job explaining why Mozilla killed the checkbox for disabling JavaScript.

No, it does a terrible job at explaining this. The browser's job is to display the webpage under the constraints set by the user, "javascript off" being one of the common constraints. If the page works incorrectly under this constraint, this is the problem of the webmaster who created it. The whole idea that Javascript is absolutely necessary for browsing is what's killing Internet with extremely slow websites and makes it insecure.

JavaScript is not slow. If I set a constraint "Don't use the letter 'e' on this page" and the text is garbled, is that the fault if the webmaster? Disabling the letter 'e' intentionally is very uncommon. If Firefox ships the option, they will have to support all the people who complain that pages are broken because they forgot or didn't know about the "feature."

But when you say "one of the common constraints", do you have any figures for how common? How many people as a %age of Firefox users, for example, switch Javascript off? If it's less than 5%, removing the checkbox is a perfectly fine decision.

I think if you want to disable JavaScript, you probably know what about:config is and how to use Google...

I think it does make sense to hide an option that pretty much breaks most of the Internet. As long as it's still in about:config I think that's reasonable.

By the way, you can download any image on the page from the Media tab in Page Properties, if I remember correctly.

It's actually a pretty bad development that most websites will no longer function without javascript. Graceful degradation was once one of the hallmarks of good tradecraft, and imo it should remain that way. The server should adapt to the client, not the other way around.

> It's actually a pretty bad development that most websites will no longer function without javascript.

Yes, because websites waited for this change to stop working without javascript...

It's a ratchet like process:

  - browsers don't support feature 'x'
  - some browsers support feature 'x'
  - all browsers support feature 'x'
  - websites start relying on feature 'x'
  - browsers change feature 'x' from being easy to switch off/on to defaulting to 'on'
  - browsers remove easy facility to remove feature 'x'

That's a pity. Ideally websites would work with clients both new, old and configured to explicitly leave out eye candy and things like javascript. Of course there is a price to pay in terms of user experience and it is more work to keep your website alive across many different browser versions so I can see the reasoning behind this. But it violates the spirit of be strict in what you send but liberal in what you receive. If what you receive is the message that 'javascript isn't wanted' then you should respect that and make your stuff work without. Of course there are websites where javascript really is a must but if I want to use my bank website without javascript (to get rid of all the unnecessary pop-ups, overlays and other bs) and I find out that it simply doesn't work anymore then that's disappointing.

So, mozilla obviously did the right thing here in hiding a feature that 'nobody' uses anymore but it is merely the last nail in the coffin of the non-programmable browser.

And for some weird reason I find a browser that does not have the ability to execute downloaded code a good thing.

So I personally regret this development.

Well as a developer it's easier to just assume JavaScript will be there. For example, imagine playing a game in a browser without JavaScript (yeah CSS can come close, but not close enough for my liking).

Games are one thing, basic navigation and rendering content are different. There's nothing about those operations which really depend on JS.

It was an example. Any 'app-like' content, like games, video/music players/calendars, etc. will and should fall apart when it's main language is disabled. Of course some pages incorporate JS to achieve better looking UI, but I can't imagine going back.

It's kinda like wanting to have National Geographic without the pictures.

> So I personally regret this development.

Yes, so do I, but time and again the world speaks and tells me "You disable javascript and cookies by default? What kind of a weirdo are you? No site for you, fuck off"

That's not true. Most websites function fine without javascript.

If you turn off javascript, most sites become at best read-only. A good chunk don't work at all or partially break in ways that make the site unusable even for viewing (e.g. flickr).

I'm trying to think of sites of that degrade nicely. I can only really think of HN and gmail.

"If you turn off javascript, most sites become at best read-only"

No. That is not the case. People keep saying this, but it is false.

Do you have some other counterexamples?

I don't need to show any counter examples. I'm not the one that is saying that most websites don't work without javascript. Show me some evidence that greater than 50% of websites are broken when JavaScript is disabled, and I'll listen. No such evidence will be provided though, because it's a ludicrous claim.

FWIW: I've been using NoScript for years, and it's clear to me that the vast vast majority of sites work fine with JS disabled. Most of them work better with JS disabled than with it enabled.

OK, easy fella. I was just asking. I don't use NoScript, so I wouldn't say one way or the other.

Turning off JS ruins the internet. I say this as an avid NoScript fan (been running it for nearly a year) - the vast majority of websites will fail (often mysteriously) with JS disabled, even if you use some curated whitelist. You need a lot of technical knowledge and debugging sense to figure out what you can/can't disable.

That's why I stopped using NoScript long ago. Things should just work, and NoScript doesn't let things just work. It'd be good if it had a list or something, but I have no clue what it would actually block/allow, since that's specific to the user's purpose.

I enjoy the challenge of figuring out how to disable some parts of site. It's a trial and error affair, but very interesting sometimes. It helps you realize how sites are built.

It's not for faint of heart though.

I can understand that. I'm a webdev by trade, mainly maintenance so that's more or less what I do day in day out.

No, it doesn't break the Internet.

It breaks a large majority of sites that transform our PCs into computing black holes sucking all free CPU cycles into nothingness.

I guess you are right...

Removing the settings option for javascript was almost certainly not a move for advertising/tracking. The simple fact is, too many web pages are turning into web applications, so turning off javascript has no use on the modern web. Therefore they took away the option.

Since we're on the topic. I wish they would at least create an option that makes the javascript part operate in a way that I don't have to disable PaX on Firefox. It is both the most critical desktop application to be protected and one of the very few that can't be. Even X.Org works fine with PaX these days.

What is PaX?

"PaX is a patch for the Linux kernel that implements least privilege protections for memory pages. The least-privilege approach allows computer programs to do only what they have to do in order to be able to execute properly, and nothing more. PaX was first released in 2000." [1]

[1] http://en.wikipedia.org/wiki/PaX

PaX prevents pages from being marked executable if they were ever writable, even if they are first (or simultaneously) marked non-executable. This means that no JITs are compatible with PaX.

Not allowing pages to be simultaneously executable and writable has a lot of merit, but the stricter restrictions of PaX are a hard sell. It would be nice if PaX had an option to just disallow pages that are simultaneously writable and executable.

It would be interesting to see a model where processes that were very restricted via the Linux Capabilities framework were allowed to execute pages that were once (but no longer) writable. This would allow programs such as browsers to run JITs in OS-level sandboxes.

Edit: actually, I wonder if PaX allows shared pages that are executable in one process and writable in another. That would be another interesting model.

Or you could just install noscript.

Do you think your average user would know to click a "disable javascript" button when they find right-clicking an image blocked anyway?

Yes you could, if you knew about it and trusted it.

I think there's a spectrum of skills, not a binary split amongst user skills. Hard to say where the average user is with disabling JavaScript, because skill levels are multidimensional.

Resistance is futile - we'll be assimilated. In the mean time, the GNU fork is looking promising if they actually start working on it.

Reply on news.ycombinator.com