Hacker News new | past | comments | ask | show | jobs | submit login

That's just paranoia.

NoScript might be worthwhile 15 years ago, as you browsed 90s porn sites. Today, you're just making your own web browsing life difficult, hoping the "security benefits" of your paranoia outweighs all the broken functionality you'll be constantly making exceptions for, or flat out missing out on because you don't know it's there.




I don't consider that much of a loss.

Other than that, it means people can't mine bitcoin with my CPUs and power bill, I'm immune to ~90% of browser-only exploits (as opposed to ones in things like flash, PDFs, etc., which I am still far less likely to get hit by than a javascript(flash, etc.)-enabled-by-default user), and a few random and generally non-critical things won't work. Even dropdown menus still work as they are generally done in CSS these days.

If a site really needs javascript, I can whitelist it while leaving google tracking scripts, adverts, disqus, etc. disabled.


It's 2014, most sites assume javascript, and the "graceful degradation" is never "graceful".

Me and all people doing front-end work I know of, who even care for any kind of "graceful degradation" (that's a minority of front-end-devs!), always go over "the layout breaks and some fonts are wrong for users with javascript disabled" with "but they cans still click the links and read the text, so we'll just leave it this way" (because the alternative will be putting at least 3x as much work into it, and nobody would pay us for it ...just as nobody would pay for a website without "live filtering" and "ajax loading" and all nowadays).

So you're basically choosing a stone-age-degraded-experience to be able to spare some CPU cycles.

(the security and privacy arguments are valid though, and you're 100% right on these... but as more and more sites become SPAs, you'll basically have no choice than whitelist more and more untill you'll have to whitelist everything)


NoScript gives you a chance to evaluate a site for trustworthiness. Yes, you have to click 1-2 times when you load a new domain that you trust, but it's worth it for that one site that looks sketchy or that you get mislead into clicking onto. For people who automatically execute JavaScript, it's already too late, but NoScript users have an opportunity to avoid this cantankerous situation.

NoScript will expose phishing schemes immediately, for instance, because it will recognize that the scripts being executed are not coming from the previously-whitelisted domain for Google.


>you'll basically have no choice than whitelist more and more untill you'll have to whitelist everything

Even if that is the case (which I do doubt), if it means I still have google analytics, advertisers, disqus, and random dodgy sites I've never before visited blocked (e.g. when a site gets compromised by injecting malicious javascript), I don't mind.


Actually, after trying NoScript not long ago my web experience dramatically improved. Where I need to enable JS I can do it in two clicks, while where I don't have to, everything is faster and not cluttered with useless stuff. I like it!


>Where I need to enable JS I can do it in two clicks

But there's no reliable way of knowing where you need JS.

It's not like every useful component on a site reveals its whole story with JS disabled. There could be a data viz animation that strengthens the topic of an article you're reading. The author refers to "the above visual" but doesn't mention it's an animation (because he assumed everyone would see the animation). All you see is a still image - the fallback to the animation. You aren't aware there's a useful animation showing the schematic of an engine part in motion, for example.

The animation was cool, you totally missed out!

However, if the way you use the web is more about fetching specific content or services from specific places - your favs basically, and you don't like to explore, then if it works for you then I won't judge :)


I'm often using different browsers on different devices and only some of them have NoScript installed, and from my experience I can tell that usually if something doesn't work without JS, it's perfectly visible that it's broken until you whitelist it. I can also tell via tiny toolbar that something is blocked on the site, so if it doesn't include lots of analytics or social media cruft then I usually just unblock it on any pages that focus on useful content.

Before I actually installed it, I had the same concerns like you described, but the reality showed that it's moot, and the advantages were even higher than expected, so I sticked with NoScript :)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: