Blocking JavaScript by default is not an easy path

May 25, 2019

I'll start with my toot, slightly shorn of context:

Every so often I wind up viewing a version of the web that isn't filtered by uBlock Origin and my 'allow basically no JS' settings (in my default browser) and oh ow ow ow.

(But 'allow no JS' is basically the crazy person setting and it's only tolerable because I keep a second browser just for JS-required sites. Which throws away all my cookies & stuff every time it shuts down, because my trust is very low once JS is in the picture)

I'm a long time proponent of not allowing JavaScript in your browser, along with other measures to increase your online privacy as much as possible (for example, not being logged in to places unless you trust them a great deal). Periodically I run across other people advocating this too, and talking about their experiences, and I'm all for this.

But, at the same time, I want to explicitly admit that blocking JavaScript by default in your normal browser makes your life hard, hard enough that you have to be a bit crazy and stubborn to do it. I'm doing things the extra hard way by using uMatrix with a lot of blocks, but even using uBlock Origin to block JavaScript by default will leave you with a lot of work and annoyance on the occasions when a particular site needs JavaScript in order to work acceptably. The annoyance and work is not just turning things on; it's figuring out what to turn on. Any time I want to make a site work, it's a whole exercise in enabling some things in uMatrix, refreshing the site, seeing if it works now, then enabling some more things and so on. Using uBlock Origin would result in fewer cycles of this, but I don't think it would be only one (unless you want to basically stop protecting yourself from the site entirely).

What makes this whole process tolerable for me is that I mostly don't do it. Instead, I go to the effort of maintaining an entirely separate browser that has JavaScript fully enabled but that throws out all cookies and history when I close it, so that most of the bad stuff that people use JavaScript for is neutered. I also have a bunch of magic things in my personal desktop environment that make it relatively easy to start with a link or URL from one browser and open it in the other.

(The other thing that makes the whole situation more tolerable is that most websites that I go to work fine without JavaScript, or at least well enough to make me happy. Some of them work better; very few newspaper websites nag me about 'only X articles a month', for example.)

Having two browsers is reasonably easy (provided that you're willing to use both Chrome and Firefox; these days I instead have two instances of Firefox). Arranging to be able to move URLs and links easily back and forth is probably not for most people in most desktop environments. I'm the kind of person who writes scripts and runs a custom window manager environment, so I can blithely describe this as 'not too much work (for me)'.

(You can always select a link in one browser and do 'Copy link location', then start the other browser and paste it into the URL bar. But this is not a fast and fluid approach.)

I still encourage you to try a non-JavaScript web (I'd suggest starting with uBlock Origin for this), but only if you're willing to do some work and undergo some pain. Blocking JavaScript by default is nowhere near effortless and sometimes it will cause even perfectly straightforward websites (ones that are basically just text) to completely not work. Perhaps it will be someday in the future, but probably I'm dreaming there.

(People keep writing about 'progressive enhancement' and pointing out that people on bad wifi or cellular connections don't necessarily get your JavaScript and anyways it's very slow to start on their lower end smartphones. But the people who actually put together websites keep not caring, judging from the end results, which are the only thing that matters.)

Comments on this page:

It's hard but it isn't without reward. It's nice getting an intuitive understanding of what is or is not a required CDN or JS domain. I have a sixth sense after all these years of NoScript temp-whitelist only. I'm not willing to give up my perception of websites as something that I can understand and alter to my liking. The idea that they are some black box foreign code that I'm just supposed to run will never be acceptable.

The majority of the web may move beyond me in time (as it did RMS). But that's not so bad. While the JS-only web grows faster it doesn't mean that the decent, actual web will disappear or that it won't continue growing at a lesser rate.

By Obdurate at 2019-07-21 05:36:56:

FWIW, after the Spectre vulnerabilities came out, I switched from a very restrictive whitelist to a hard javascript.enabled = false.

There are a few websites that this renders flatly unusable; there's some blog platform which loads all content via javascript and I haven't been able to find an equivalent text link.

Some sites I have to turn off styling to find the text. Often (e.g. twitter) I can find a "loading screen" element that is obscuring the tendered text which I can render invisible with a uBlock cosmetic filter.

One annoying thing that happens a lot is some sites (BBC news comes to mind) don't load styles properly and render a bunch of SVG icons at full-screen size, which makes the rendered form pretty hard to read.

I add ?disable_polymer=true to all youtube URLs, which produces a perfectly reasonable rendered form. I don't see comments, which I'm told is a blessing.

(I also never see disqus comments. which is very much desirable; it's a tracking beacon website with a pretext of being useful.)

Instagram is almost unusable; I can pick target image URLs out of the crap and see them but I can't see any associated text or links.

Imgur albums don't work (they used to have a /noscript render option, but that stopped working a while ago. For one or two images, I pick the image URLs out of the HTML; for more I append /zip to the URL and download the collection.

I definitely lose a perceptible fraction of the web, but overall, it hasn't been that limiting.

I suppose one annoying thing I lose is Microsoft KB articles. Fortunately, it's rare that I care and I can read the Google cached versions in such cases.

"I also have a bunch of magic things in my personal desktop environment that make it relatively easy to start with a link or URL from one browser and open it in the other."

This is something I've been wondering about how to achieve for a while.

Can you tell us what DE that is? And/or what tools you use for this particular scripting job?

By cks at 2023-07-11 23:30:34:

This is a good question so I wrote an entry about how I move URLs between browsers in my fvwm-based environment. One of the pieces requires being able to define new window manager menus and ideally mouse button bindings for them, although there are other options.

Written on 25 May 2019.
« The problem of paying too much attention to our dashboards
Why I no longer have strong feelings about changes to Python »

Page tools: View Source, View Normal, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Sat May 25 23:56:59 2019
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.