• Make Javascript Optional

last modified May 17 by strypey


Is Javascript optional?

 

Completely:

Enough:

  • DaveLane.nz - Dave does have scripts served from his own domain, and from gstatic.com, but the whole site can be browsed without them.
  • fediverse.party - yes, all pages can be browsed. But there is a warning saying "You disabled Javascript. Some things won't work" and there are novelty features and some links that require JS.

Partially:

  • Loomio.org - yes, on landing page. Logging in and using Loomio requires JS.
  • PixelFed - yes, both on project homepage and instance landing pages. Logging in and using PixelFed instances requires JS.
  • Trisquel.info - yes, all pages can be browsed as guest. Logging in to Trisquel.info requires JS.

Not yet:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 


Check out the Free Your Javascript page. Those activities will be incorporated into this campaign, which began with a Disintermedia blog post in April, 2019.

"If you're seeing this message, that means JavaScript has been disabled on your browser. Please enable JavaScript to make this website work."

- TechAsia.com

Many people now use browser add-ons like NoScript, to choose if, and when, a website can run Javascript on their computer. But many websites now refuse to even display text and images to users who don't agree to run their (often proprietary) Javascript. Let's start telling both website developers and web browser engineers, loud and clear, that it's time to #MakeJavascriptOptional!

Javascript is unique among programming languages, because the programs written in it are routinely downloaded and run on a person's computer (in their web browser) without their knowledge or consent. It has been the subject of criticism by everyone from experienced software engineers and computer security researchers, to privacy campaigners and software freedom activists. Bad Actors can use Javascript to abuse people while they use the web, by tracking them (and there have been designs for tracking users with Javascript since 2006, if not longer), by spying on them (and this sort of spying has been going on since 2010 if not longer), by hijacking their computers, and so on.

Almost every time you open a browser tab and go to a website, another batch of invisible programs starts running on your computer, every one of them using up a bit more of your computer's processing power and system memory. As each one starts running, it makes your computer a bit more sluggish and less responsive to you, like a kind of digital alcohol. Obviously, this degrades the user experience of the web, but most people don't even realize it's happening. They blame their internet connection, or assume their computer is just getting too old and they need a newer one, not realizing their computer could run much faster if it wasn't carrying so much unnecessary Javascript. As well as using up system resources on the computers of web users when they run, the same Javascript programs are sent to millions of computers, over and over again, every time the websites that use them are visited, which is a wasteful use of both server resources and internet bandwidth.

So what can be done? Some people just disable Javascript in their web browsers, but that has the major downside of breaking the vast majority of the web, even a lot of ethical services running free code software (like CoActivate). Others use NoScript to tell them when a page wants to run scripts in our browser, and which web domain they are being served from, and allows them to choose if and when to let them run. Other add-ons focus on blocking specific kinds of threats that exploit Javascript, including anti-tracking tools like the EFF's Privacy Badger (or the Privacy Possum fork) and other blocking tools like uBlockOrigin.

These kinds of tools are like wearing a suit of armour to protect against shark attacks while surfing, they can work, but they come with a fair bit of inconvenience. The long-term solution is to evolve the web so that we can eventually do without Javascript, just as the upgrade to HTML5 means we can add multimedia like audio, video, animations, and games, to the web, without proprietary plug-ins like Java, Flash, or Silverlight.

One recent trend in website design is to use a static website generator to create sites that display text, media, and links, with a sane page layout, using only basic web languages like HTML and CSS. This works fine for simple personal homepages, or  "brochureware" sites for community groups, public services, and businesses. But some web developers argue that the features Javascript can add to make web pages into "web apps" are arguably worth the costs. The federated photo-sharing app PixelFed recently modified its landing page to remove all the Javascript, which is a welcome move. But once you log in, you still need to allow the site to run some Javascript if you want to share photos and use the rest of the app's features.

Other web developers have been coming up with proposals for replacing Javascript with other technologies that could provide the same benefits, the extra-for-experts features you can't code in pure HTML/CSS, without its the downsides. New standards like WebAssembly have already been created to allow other, more robust languages to be used instead of, or alongside Javascript. Other developers argue that Javascript is fine for prototyping new kinds of web services, but before they're rolled out for mainstream use, these features ought to be standardized, and build into the browser itself, or native apps. Like static sites, this would mean these chunks of code wouldn't need to be sent over the net millions of times a day, every time users visit the same website.

One thing the developers of web browsers could do very easily to improve the situation, at least in the short term, is the same things they've done with cameras and microphones; ask the user's permission. When a website wants to run Javascript, ask the user if they consent to that, and ask them if they want the browser to remember that decision next time it's asked to run scripts from that source. In other words, build the functions of NoScript into every web browser.

It could also help to build a wiki to crowdsource information about what kinds of scripts websites are trying to fetch from this or that domain name, and what they do. Some scripts, like those from FontAwesome, just provide freely licensed fonts and icons, while others, like any associated with major web advertising companies, are almost always trackers of some kind, spying on website users. Making this kind of information available from a trusted source would help users that currently use NoScript to decide whether to allow them or not, and if opt-in Javascript does become a standard feature of web browsers, it would benefit everyone who uses the web.