Hacker News new | past | comments | ask | show | jobs | submit login

Stuff like that is the reason I have disabled JS by default.

Access to client side scripts on my machine has to be earned in trust.

Most websites never get that far, because they are broken without js.

Doesn't matter, saves me a lot of time ;)




This is an interesting take, I would assume at some point it would end up costing you time, because for all its faults, the modern web has some great tools (apps) that can improve your life in a number of ways. I’m also unsure how they’d earn your trust without giving them that essential unblocking js trust in the first place.


I've been browsing without js for a decade. The alternative is to install blockers or live with ads.

I have zero interest in "apps that can improve my life". People have different interests.

Disclaimer: I write us for a living.


> Access to client side scripts on my machine has to be earned in trust

I agree that it's all about trust. Why would you ever enter information on a website you don't trust? What extra information can be gathered using JS that can't be otherwise? Or what is the exact harm done if they send extra requests to a tracking API?

My point is that once you access a specific website you consent with that website sending HTML/CSS/JS to your computer and executing it. The biggest problem those days is when that website is sending your information to other entities, 3rd parties, for other purposes than improving your experience. I think having "tracking" to detect errors, loading time issues and improving the user experience is perfectly reasonable if implemented in a proper way.


> My point is that once you access a specific website you consent with that website sending HTML/CSS/JS to your computer and executing it

Just HTML and CSS in my case.


Apart from the JS engine vulnerabilities, what are the privacy benefits of disabling JavaScript? You can still include 3rd party tracking pixels (via CSS or HTML) and share request data server-side with third parties.


I don't usually surf on pages that are known for such stuff. And when I do, I fake a lot of my data :)

Apart from that, it is not only about privacy for me.


It seems that ping attribute of <a> does not require JS. So you still can be tracked.

Actually I think that's the whole reason of introducing this attribute.


With all browser vendors nowadays (minus chrome) trying to perceive themselves as privacy protectors, who even approved and implemented this?

The only good thing coming out of this ping attribute is that it’s a lot easier for plugins to block it rather than intercepting javascript and domains.





The deadline for YC's W25 batch is 8pm PT tonight. Go for it!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: