News for hackers. Stuff that matters.
Re:How I recorded user behaviour on my competitor’s websites by mrob on Wednesday August 22, 2018 @10:40PM (#17824107)
Yet another reason to browse with JS disabled by default.
Re:How I recorded user behaviour on my competitor’s websites by King-Aaron on Thursday August 23, 2018 @04:50AM (#17825642)
That's a reasonable course of action until you need to use the internet for pretty much anything.
Re:How I recorded user behaviour on my competitor’s websites by JdeBP on Thursday August 23, 2018 @05:58AM (#17825941)
Experience teaches that that is a vastly exaggerated statement. There remains quite a lot of the World Wide Web that does not require Javascript.

And of course it is pretty much not required at all for using the Internet outwith the World Wide Web.

Re:How I recorded user behaviour on my competitor’s websites by kmbriedis on Thursday August 23, 2018 @09:36AM (#17827114)
And then classic React enters the building
Re:How I recorded user behaviour on my competitor’s websites by eadmund on Thursday August 23, 2018 @06:59AM (#17826175)
The Internet works just fine without JavaScript: DNS, FTP, SSH, SMTP, NNTP — none of them have ever required JavaScript. Indeed, HTTP works just fine without JavaScript. HTTP pages perform better without it.

Granted, many broken and ill-programmed HTTP pages aren't useful without JavaScript. That's no an indication of how useful it is, but rather an indication of how poorly-skilled those webmasters are.

Then there are web apps; they indeed don't work properly without JavaScript. Fortunately, there just aren't that many important web apps. To be honest, I can't think of one web app that I regularly use, other than Google Meet.

Re:How I recorded user behaviour on my competitor’s websites by EdwardDiego on Thursday August 23, 2018 @08:00AM (#17826465)
Your distinction between web pages and web apps is entirely arbitrary. Many web pages use JS in such a way that interacting with them without JS is a lesser, if not broken, experience.
Re:How I recorded user behaviour on my competitor’s websites by SquareWheel on Thursday August 23, 2018 @08:21AM (#17826605)
Example: Is reddit a webpage or a web app? Correct - it's both.
Re:How I recorded user behaviour on my competitor’s websites by adrianN on Thursday August 23, 2018 @06:58AM (#17826170)
Works pretty well for me.
Re:How I recorded user behaviour on my competitor’s websites by dwild on Thursday August 23, 2018 @10:49AM (#17827704)
Yeah I know, personally I prefer to use paper, way safer. I plan to just do the full TCP request by hand using the ethernet wire, morse-code-like, next./s

Sure increasing the functionalities increase the risk, it doesn't means the risk isn't worth it or isn't mitigable. Worst case, he fake your back button.. it's not that bad seriously. Google will probably try back buttons and different similar situation now on their engine and deal with theses cases one by one.

Re:How I recorded user behaviour on my competitor’s websites by confiscate on Thursday August 23, 2018 @01:26AM (#17824807)
really? That seems extreme.

Might as well say:

"Yet another reason to not browse anything on the web"

Re:How I recorded user behaviour on my competitor’s websites by LeoPanthera on Thursday August 23, 2018 @02:00AM (#17824944)
It's a shame you're being downvoted, you're entirely correct.

Most of the modern web is unusable with javascript disabled.

Re:How I recorded user behaviour on my competitor’s websites by Nadya on Thursday August 23, 2018 @02:11AM (#17824986)
>Most of the modern web is unusable with javascript disabled

This isn't wrong - but it assumes most of the modern web is worth using. Most of the modern web isn't worth browsing, and every site I've ever come across that is worth reading works just fine without Javascript. I'll continue to browse the internet with Javascript disabled-by-default. It's a surprisingly good filter.

With that being said - while this is "another reason" it is as minor of a reason as it gets...

Re:How I recorded user behaviour on my competitor’s websites by A2017U1 on Thursday August 23, 2018 @02:56AM (#17825143)
> assumes most of the modern web is worth using

But it is, are you really going to ignore reading some huge breakthrough in physics because the site uses react? Also in many situations there's absolutely no other choice. Government sites, e-stores, banking.

And then there's the buildup of recorded urls. Private browsing is somewhat less useful when your scipt blocker whitelist is full of porn sites.

I use it for security in specific browsers but happily admit it's not an actual solution for normal people. Adding another 3 clicks, then another 2 for the inline JavaScript contained within after reload makes the internet incredibly annoying to use.

Re:How I recorded user behaviour on my competitor’s websites by dorgo on Thursday August 23, 2018 @04:58AM (#17825677)
>dding another 3 clicks, then another 2 for the inline JavaScript contained within after reload makes the internet incredibly annoying to use.

Yes, it is annoying. It reminds me each time how annoying websites are which use Javascript for things which could be done without. And it lets me search for alternatives or just abandon such websites.

Re:How I recorded user behaviour on my competitor’s websites by rauhl on Thursday August 23, 2018 @07:13AM (#17826236)
> how annoying websites are which use Javascript for things which could be done without

A good example of sites which use JavaScript for things they don’t really need are those GP mentions: ‘government sites, e-stores, banking.’

Government sites: the vast majority of government sites are simply informative text. There’s absolutely no need for me to grant the government permission execute code on my computer (which is what JavaScript does) in order to read the minutes of the latest council meeting. Even when interactivity is needed (e.g. an online tax-payment system), HTML forms (the sort we’ve had for over two decades) are a perfectly good solution for ‘enter information in a box and submit it.’ JavaScript can definitely lead to more attractive, more usable solutions — but it’s completely optional. Government sites are a great example of something which should work for anyone, even someone using an old BeOS box on the other end of a modem connexion running over a bit of wet string.

E-stores: there’s simply no need for JavaScript to display pictures & descriptive text of goods in an attractive fashion. There’s simply no need for JavaScript to give me a form to enter my credit card information & mailing address. Again, JavaScript can make the experience better, but it is also a privacy and security risk. I seem to recall that Amazon made quite a lot of money before JavaScript was a thing; I imagine it could continue to do so.

Banking: there’s no need for my bank to execute code on my computer to send me a statement of my accounts, nor to give me a form to pay bills or send money. Indeed, in my experience JavaScript just makes things worse, because instead of downloading a single HTML document from my bank’s servers I get to download dozens of trackers and bugs, as well as the code necessary to hit multiple APIs and stitch the page together out of its parts on my own desktop.

I think I read something yesterday, here or elsewhere, about how client-side JavaScript really took off at the same time as server-side Ruby was a big thing, with the implication that the reason was that Ruby was so slow that websites had to offload as much computation as possible. I don’t know, now, if that was actually the case, but I do know that it’s 2018 and my desktop experience is slower than it was in 1998, thanks to JavaScript.

Re:How I recorded user behaviour on my competitor’s websites by ams6110 on Thursday August 23, 2018 @08:46AM (#17826753)
JavaScript is popular for the same reasons Flash was popular.

a) It objectively can make web pages more usable and convenient.

b) The fancy animations and other effects make marketers and managers happy.

c) You an use it to build interactive games, which many users like.

Re:How I recorded user behaviour on my competitor’s websites by kmbriedis on Thursday August 23, 2018 @09:44AM (#17827168)
2FA authorization needs JS if you want to use it conveniently, otherwise you would have to refresh all the time
Re:How I recorded user behaviour on my competitor’s websites by rauhl on Thursday August 23, 2018 @09:53AM (#17827223)
> 2FA authorization needs JS if you want to use it conveniently, otherwise you would have to refresh all the time

How do you mean? IME 2FA works via an CLI utility or mobile app, and JavaScript doesn’t enter into it at all.

Re:How I recorded user behaviour on my competitor’s websites by mrob on Thursday August 23, 2018 @07:15AM (#17826248)
Many modern web pages work better with Javascript disabled now, because it avoids the GDPR/cookie popup spam.
Re:How I recorded user behaviour on my competitor’s websites by confiscate on Thursday August 23, 2018 @02:29PM (#17829561)
fun fact

Not browsing the web at all, also avoids the GDPR/cookie popup spam.

That solution works 100% of the time. It blocks out 100% of the GDPR popup spam.

Re:How I recorded user behaviour on my competitor’s websites by blitmap on Thursday August 23, 2018 @02:55AM (#17825140)
The thing that concerns me is it's easy to wrap a JS API or unreference it if I know it's abused for ads/tracking. I don't know of good ways to go about tracking based on pointer events or scrolling.

I'd put more research into generating fake events or limiting them for an untrusted site, so mouse behavior can't be used for "where are they looking" analysis.

Re:How I recorded user behaviour on my competitor’s websites by caspervonb on Thursday August 23, 2018 @02:53AM (#17825131)
I wish... even GitHub won't work properly without JavaScript enabled these days.
Re:How I recorded user behaviour on my competitor’s websites by jwilk on Thursday August 23, 2018 @03:38AM (#17825326)
IME, most parts of GitHub work fine without JS enabled. (Though sometimes I have to disable CSS to get my hands on some forms…)

This is unlike major competitors (GitLab, Bitbucket), which are completely broken.

Re:How I recorded user behaviour on my competitor’s websites by btasovac on Thursday August 23, 2018 @10:15AM (#17827415)
Hello everyone, GitLabber here! We had a similar issue about this [1], and we raised another one when deciding to further clarify our documentation regarding this question [2]. You can find out more about our motives behind this decision there.

[1] - here https://gitlab.com/gitlab-org/gitlab-ce/issues/36754 [2] - https://gitlab.com/gitlab-org/gitlab-ce/issues/43436

Re:How I recorded user behaviour on my competitor’s websites by jwilk on Thursday August 23, 2018 @11:01AM (#17827793)
Ironically, you have to enable JS to see comments for these issues…
Re:How I recorded user behaviour on my competitor’s websites by detaro on Thursday August 23, 2018 @11:03AM (#17827815)
Not really ironic, it tells you what the answer in those comments was
Re:How I recorded user behaviour on my competitor’s websites by Deimorz on Thursday August 23, 2018 @03:04AM (#17825178)
Completely disabling Javascript isn't feasible, but you can use uMatrix or NoScript with all scripts blocked by default, and only whitelist ones on sites/domains that you trust.
Re:How I recorded user behaviour on my competitor’s websites by interfixus on Thursday August 23, 2018 @04:11AM (#17825472)
Exactly. I've been browsing script-free for twenty years. It used to be a real pain switching on and off, until Opera introduced easy by-site settings. But then, back in the day most sites were perfectly servicable without any scripting whatsoever. And these days, uMatrix makes it all a snap.
Re:How I recorded user behaviour on my competitor’s websites by wiether on Thursday August 23, 2018 @03:20AM (#17825241)
In that case, just not using useless thing like "back" button will be perfectly fine.

A good website don't need using this button.

And to navigate between websites, using a tab for each website is fine. Especially when comparing results from Google.

Re:How I recorded user behaviour on my competitor’s websites by azeirah on Thursday August 23, 2018 @04:04AM (#17825443)
... Don't use the back button? What? I actually kind of like the ability to move between pages and domains with the back button.
Re:How I recorded user behaviour on my competitor’s websites by wiether on Thursday August 23, 2018 @08:37AM (#17826698)
A good website give you the ability to move without this button.

It's like Android VS iOS.

The first one has a back button, the other don't.

Re:How I recorded user behaviour on my competitor’s websites by LyndsySimon on Thursday August 23, 2018 @10:48AM (#17827689)
> A good website give you the ability to move without this button.

I disagree, fairly strongly. Re-implementing behavior that the user already has in their client is at best superfluous, and at worst very confusing.

> It's like Android VS iOS. The first one has a back button, the other don't.

iOS apps implement history as part of their UI because iOS doesn't have provision for one in the default UI. This is changing, as gestures become more and more common. I don't think I've actually used a "back button" on my iPhone in months. I pretty much take its presence as communicating that it's possible to go back, not as a means to do so.

Re:How I recorded user behaviour on my competitor’s websites by rawTruthHurts on Thursday August 23, 2018 @03:34AM (#17825307)
I agree. User experience is so overrated these day, right?