Also, for my own record, do you consider this discussion inappropriate to the subject of natty 404 pages? Asking as I kicked it off.
Also, I can't believe every time this refrain pops up we need to be reminded that js not loading is not only a problem for those deactivating it explicitly but also in those cases when it didn't load for any number of reasons (like a bad connection). You're doing your visitors a disservice if you need js to load static text and pictures.
Making something elegant, and full of features, and pretty is often complex.
No you don't. Nor should you ever if the page doesn't need it.
Having your code running on my machine always was and always will be a security risk. If you don't understand that you shouldn't be in that job.
> You also need an ID to get into the boarding area of an airport and you can't smoke in restaurants
Respectively, that's because a boarding area is not a public area, and relevance of smoking to this?
> It's time to stop complaining about this
No, it's time web devs understood the implications of their job, and the risk they put their users at if done improperly.
An axiom of technology design: Simplicity. If you don't need X, don't use it.
Edit: so you're the "Founder of Improvely: https://www.improvely.com" which "Track, Test and Optimize Your Online Marketing". That explains something. No, no, no, you're not going to track me. I am not your data point.
If a website doesn't run then it's upto you to either accept that you won't see their content or enable JS.
People who complain about sites not working without JS in comment sections are silly. Nobody is going to be convinced to change.
But others with less tech knowledge (which is 97% of the population I guess) are not in a position to make the choice and have to trust. Some people abuse that trust for profit. Other web devs are well-intentioned but clueless about the risks they put on the users.
Also I disable JS long ago because I knew that there would be unknown unknows, and bingo: (https://react-etc.net/entry/exploiting-speculative-execution...) "Exploiting Speculative Execution (Meltdown/Spectre) via JavaScript"
It's a matter of trust; trust is earned; the industry as a whole hasn't earned it.
Further reading:
Remember that there is no code faster than no code. -- Taligent's Guide to Designing Programs
Simple things should be simple and complex things should be possible. -- Alan Kay
Perfection (in design) is achieved not when there is nothing more to add, but rather when there is nothing more to take away. -- Antoine de Saint-Exupéry
[...]But there is one quality that cannot be purchased in this way---and that is reliability. The price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay. -- C.A.R. Hoare, "The Emperor's Old Clothes", Turing Award Lecture (1980)
Increasingly, people seem to misinterpret complexity as sophistication, which is baffling --- the incomprehensible should cause suspicion rather than admiration. Possibly this trend results from a mistaken belief that using a somewhat mysterious device confers an aura of power on the user. -- Niklaus Wirth
The difference between a good and a poor architect is that the poor architect succumbs to every temptation and the good one resists it. -- Ludwig Wittgenstein
Beauty is more important in computing than anywhere else in technology because software is so complicated. Beauty is the ultimate defense against complexity. -- David Gelernter, "Machine Beauty", Basic Books (1998)
Fools ignore complexity; pragmatists suffer it; experts avoid it; geniuses remove it. -- Alan Perlis
The cheapest, fastest, and most reliable components of a computer system are those that aren't there. -- Graham Bell
[...]Simplicity and elegance are unpopular because they require hard work and discipline to achieve and education to be appreciated. -- Edsger W. Dijkstra
Controlling complexity is the essence of computer programming. -- Brian Kernighan
Complexity is a sign of technical immaturity. Simplicity of use is the real sign of a well design product whether it is an ATM or a Patriot missile. -- Daniel T. Ling
There's an old story about the person who wished his computer were as easy to use as his telephone. That wish has come true, since I no longer know how to use my telephone. -- Bjarne Stroustrup
The most likely way for the world to be destroyed, most experts agree, is by accident. That's where we come in; we're computer professionals. We cause accidents. -- Nathaniel S. Borenstein
> Concern over Meltdown exploit through JS? Again, when just browsing the "normal" web?
I am not an expert in these things but what I do know, and it is backed up by the quotes from various well-known engineers (in the looser sense, encompassing programmers) I gave, is that complexity costs. Security is one such.
From https://coar.risc.anl.gov/meltdown-spectre-and-speculative-e... "Using these instructions, a malicious program can be created that leveraged speculative execution to read and send every address in memory to the attackers [...] Additionally, the authors crafted a JavaScript program that leverages the browser process that houses it to access additional memory locations. Both of these proof-of-concept attacks violate memory isolation boundaries that have delineated program execution spaces"
There were some quick patching and releasing done to browsers for this (coarsening the granularity of the timer IIRC) so I guess they must have cared.
If you can read outside process boundaries then theoretically... well, do you bank online? Do you ever put your credit card number into a website? If you don't do you think other people do?
I don't know if these cpu flaws can be realistically used, and the data exfiltrated from your machine, but I know with certainty that no JS = no exploitation will ever be possible with JS.
Example: this happened in about 2012 with a company I was working for. I'll necessarily be vague, sorry. We were phished with a precision that was shocking and had nearly £20,000 taken from the company account. The malware came with browser-embedded java (not javascript!). Our off-site support guy, R, came in after and me and him uninstalled java from all the machines (~20, small business). Without the java the attack could not have taken place (the attack was 2-pronged and needed more than the java, but it was a necessary).
The broader lesson is, if there's a hole it can be exploited, but if no hole then no exploit is possible there. This should be self-evident.
OK, my GP has desktops in their office which are connected to the web, and allow JS to run. Are my medical records safe? Are yours?
A company I worked for a year ago (turnover several million) had the browser screen hijacked with a warning I had malware and to call this number. I had to call support to verify it was a scam - remember I don't see these at home so I literally never saw this before and had to check. If I'd been a naive user at home I'd have been on the phone to wherever so the nice man could help me.
The machines in that office would crawl for an hour once a week when a malware scan was being run (run late, but staff often worked late so it bothered them occasionally). Malware checker and human time interfered with - another cost.
What about the cost of your browsing time of slow page loads and annoying audio/video? The cost of being tracked? Is this acceptable to you? Not for me it isn't. We may differ in what we're prepared to tolerate though.
If more sites are allowe to abuse js because people won't push back then that js-disease will spread and sites will choose to use it. If there's pushback then it will be reduced and we start to gain a kind of herd immunity.
You asked about malware, does this help?https://www.trendmicro.com/vinfo/us/security/news/cybercrime...
Just google "javascript malware". You won't run out of hits. Stupid net security holes and we are talking about cyber warfare - closing dumb js holes aren't the end but they might be a start. More importantly it'll be the start of a security mindset. I want us to think long-term, systemic, not "it probably won't happen".
I should not have to point this out. It should be self-evident that abusable things will be abused. It's just a minor variation on Power Corrupts. Oh well.
This is a bit of an unstructured brain dump so sorry for it not being precise but I hope it clarifies my position.
Edit: much to me and R's annoyance the bank refunded the stolen cash, so the boss never felt need to do a proper security review.
Move fast and break things is increasingly less defensible for what is a mature technology that the world relies on. And Moores Law is a thing of the past, it isn't really tenable to just take the view that hardware will 'fix' your performance problems. Then there are the security and accessibility considerations.
I suppose Javascript is the single use plastic of the digital world. In its place there aren't really any good alternatives, that doesn't mean you should use it everywhere.
Plus many things are repeated ad infinituum. I can guarantee any discussion on wind power will have someone saying we should be going nuclear. Every discussion on electric cars will devolve to a discussion on Elon Musks personality, every discussion on facebook will lead to a mention on privacy. People have opinions, they've come here to express them, most of it will retread old ground, if there was nothing new to add, 90% of submissions could just be linked to the original discussion, that isnt what happens, (although old threads are generally linked to) so it seems reasonable if we're going to re-have all the other discussions, to re-have this discussion.
And finally, it seems to be the rule that to be downvoted, an opinion has to be wrong and/or offensive. So if there is a downvoted comment that seems to be neither I'll then take the time to find out if I was wrong, so for me, downvoting comments that you just don't want to read, just adds noise. I'll admit that that's personal to me, and its entirely likely that others see downvotes differently, that is an annoying consequence of votes being such blunt instruments.
We don't live long enough to examine every true argument. It is important to us to filter to useful ones. In that respect, starting the JS debate is the equivalent of starting a neovim vs xemacs debate, both of which are like chewing gum that's got all the flavour gone in the first hour.
Claiming js is essential to all modern browsing is not true and I am contesting it because in practice its use opens up bloody great security holes.
And you are still not addressing my obvious and relevant point, that not using js closes those holes. Stop downvoting and explain why you think compromising browsing safety is your right.
How difficult is it to make a page saying 'not found' using static HTML, perhaps with a GIF if you want minor animation.
I mean, how difficult is it to not use tech that you don't need?
Edit: loved the FT 404 though