Hacker News Reader

Comment by jfaucett | Hacker News Reader

"gngr by default disables cookies, Javascripts, referrers, third-party frames and has a minimalistic UA string: "gngr.info/major-version"."

So they want to disable by default every website online? I'm all for innovation but why not just invent a completely new browser that is a better runtime for apps if you're going to disable every website anyway?. Heck, pick a more easily optimizable language than javascript as the default scripting language, have built in GPG so we can throw away passwords, force HTTPS everywhere, use a non-centralized dns like namecoin - why not just go all the way here?

View on HN

HN itself is perfectly readable without cookies or Javascript.

Even if you want to login, vote, comment, and post, all of that can be done without Javascript (though you do need to at least temporarily enable cookies).

I am really grateful to HN for making this design choice. Javascript is superflous for 99.9% of websites. It's an unfortunate design choice to use it anyway.

I wish I could say that I hope website creators would move away from Javascript and other "dynamic" (ie. turing-complete, overpowered) technologies. But it's clear that's not going to happen.

In light of that, privacy and security tools will have to adapt and somehow find a way to protect their user's privacy and security despite having Javascript enabled.

Right now, the best hope I see for something like that is having light-weight disposable VMs/jails/containers and sandboxes. At least that could limit the damage that Javascript does to a single tab or session.

> Javascript is superflous for 99.9% of websites.

For web sites, yes. For web applications though (of which there are more every day), it's definitely not.

"Superfluous" is not the same as "not necessary in practice" in this case. There are many websites that use JavaScript for polyfills, browser detection, screen detection, and scroll detection. In some cases there are alternatives, but that doesn't mean those alternatives are ubiquitous.

> Heck, pick a more easily optimizable language than javascript as the default scripting language, have built in GPG so we can throw away passwords, force HTTPS everywhere, use a non-centralized dns like namecoin - why not just go all the way here?

We actually do want to implement some of those ideas (and other similar ones)! But we don't believe it is necessary to ditch the existing standards for that. There can be a transitionary period and this (or any other browser) could be a test-bed for new ideas.

> "gngr.info/major-version"

That ... is not minimalistic. Speaking as a person whose browser sends `User-Agent: browser` and `Referer: https://news.ycombinator.com/` (that is, dynamically the root of the requested site). I have never seen anything break because of user-agent, and only a few things because of referer (and more than a few things break when I do send correct referers). I do agree with the going all the way part though; web browsers seem to view security as a afterthought to be bolted on after the fact.

Why not just use lynx/links/w3m?

Reply on news.ycombinator.com