My rationale is that I've chosen to go to a site, and most JS dangers are served from ad networks and trackers. Not typically from the site itself.
Of course, as long as we don't try to force our preferences on each other, we can both browse the web however we like.
uMatrix comes with many hosts files enabled[1], so even if working in allow-all/block-exceptionally, most trackers/ads and whatnot will still be blocked.
There is no pre-whitelisted (aka "trusted") 3rd-party hostnames in uMatrix, that will be for you to decide.
The default in uMatrix, in full view in the popup panel, can be changed with a few clicks from the main popup panel, and you can also remove all the default whitelisted hostnames in NoScript.
[1] entries are translated into `* hostname * block`.
Buying things with security add-ons installed sometimes can be tricky: When you click 'buy', the host site sometimes contacts destinations that were previously unknown to your browser (payment processors, etc.), meaning you wouldn't know to enable them. You may hesitate to reconfigure NoScript/uMatrix and reload because you don't know if you are making multiple payments or placing multiple orders.
On the positive side, uMatrix and NoScript can remember what you enabled to get that page working, so you configure them the first time you visit the site and then forget it. NoScript's configurations are less granular, however, which may discourage permanently allowing some things:
https://news.ycombinator.com/item?id=12624628
(But NoScript has many more security features:
This is becoming less and less true unfortunately, thanks to stupidly designed (eg: not progressively designed ) JS frameworks.
Usually sites work well enough by enabling 1st party JS and sometimes not even all of them. I lose all the code from tracking and monitoring services, which I really don't care about. I gain a much faster browsing experience.
Then there are sites with CDNs, and I have to enable them to see some content. Or Disqus comments, must enable to read them. Then there are some sites that are like a puzzle and I can't understand what to enable. I either give up (lose-lose) or read them in a browser I use for that kind of sites (I lose, they win). Then there are sites with content embedded in the JavaScript (I really mean in the script, not loaded by the script) or in some invisible element that only JS can make visible. Forbes is one of them and the one I hate most. I did a short script to deobfuscate the content at a Forbes URL and display it in a brower.
By using NoScript I appreciate how useless is JavaScript on some sites: there is no reason not to serve basic content (text and most of the images) directly and use JS only to enhance it. Examples: to add comments, to zoom into images, to load the next article - which has it's own URL anyway.
Some news organizations implement their paywalls with JS. It gets rid of a lot of annoying ads and scroll-behavior modifications. It actually makes some sites subjectively better.
HN isn't the 2016 web at all. Not that you fundamentally need JavaScript, but HN's HTML hearkens back to the pre-CSS table-driven web.
Yes but when visiting a website with JS turned off, the site can still be progressively enhanced similar to how an electric stairs still works when the power is switched off. Users of the stairs still get to climb it, but now they have to put in extra effort.
It can, but sites often don't test that path (if they develop it at all), because it only applies to people who intentionally disable JavaScript.
Once upon a time, screen readers and similar accessibility software didn't work well with JavaScript, so better sites would pay attention to that case for accessibility. However, screen readers work fine with standard browsers and JavaScript now, which makes the "JavaScript disabled" case an incredibly tiny fraction of web users. (In fact, Mozilla found a few years ago that there were far more users with JavaScript accidentally disabled than people who actually wanted it disabled.) So, handling disabled JavaScript by just saying "you seem to have disabled JavaScript; you should fix that" really does seem appropriate for the proportional amount of time worth spending on that tiny subset of users.
That said, know your target audience. If you're building a mainstream consumer product, the proportional amount of time worth spending on running with JavaScript disabled rounds to zero. If you're building a product catering to a smaller subset of users, and you expect people with JavaScript disabled to represent a much larger fraction of your potential users, by all means take the extra development time to make that case work well.
Or combine this with uMatrix, giving yourself a global blocklist with 3rd party granularity on the sites you do clearlist.
All 0 of them?
Code is sandboxed, processes are isolated, OS-level security is used on top of that. The few CVEs that show up are reported quickly via browser bounties or in-house testing. People claim bounties are ineffective, but how many exploits have we really seen emerge from "black markets" or other sources?
I ran without JS for a few years and then realized it was making my online experience more miserable than it needed to be. I can't remember the last time I actually saw a computer "infected" just from visiting a website, and not through social engineering. Can you?
The bottom line is that the margin for being compromised via JS is so small that it might as well not exist. If you disable it because privacy or surveillance or whatever else, that's your prerogative. But the security issue is completely overstated and largely misinformed.
But that's exactly the default I do not want. One of the main reasons I use NoScript in the first place is to protect against Javascript vulnerabilities. If the default is to enable Javascript, that defeats that protection.