JavaScript - Revision history

Rudxain: swap OJSF & ECMA, again, because this is JS not ES

2026-03-22T17:06:49Z

swap OJSF & ECMA, again, because this is JS not ES

← Older revision		Revision as of 17:06, 22 March 2026
Line 5:		Line 5:
	\|InProduction=Yes		\|InProduction=Yes
	\|Category=Software		\|Category=Software
	\|Website=https://~~tc39~~.~~es/ecma262/multipage~~/,https://~~openjsf~~.~~org~~/		\|Website=https://openjsf.org/,https://tc39.es/ecma262/multipage/
	\|Description=A high-level programming language that's also the "lingua franca of the web"		\|Description=A high-level programming language that's also the "lingua franca of the web"
	\|Logo=JavaScript-logo.png}}		\|Logo=JavaScript-logo.png}}

Rudxain: bsky JS is just questionable. "at best" implies they're deliberately lying

2026-03-22T15:52:39Z

bsky JS is just questionable. "at best" implies they're deliberately lying

← Older revision		Revision as of 15:52, 22 March 2026
Line 59:		Line 59:
	*[[X Corp\|Twitter]]. It also used to work without it, but some time after being bought by [[Elon Musk]], it became mandatory.{{Citation needed}}		*[[X Corp\|Twitter]]. It also used to work without it, but some time after being bought by [[Elon Musk]], it became mandatory.{{Citation needed}}
	*[[wikipedia:Bluesky\|Bluesky]]:		*[[wikipedia:Bluesky\|Bluesky]]:
	**The web app (<code>bsky.app</code>) shows this message if JS is disabled<blockquote>This is a heavily interactive web application, and JavaScript is required. Simple HTML interfaces are possible, but that is not what this is.</blockquote>which is questionable ~~at best~~		**The web app (<code>bsky.app</code>) shows this message if JS is disabled<blockquote>This is a heavily interactive web application, and JavaScript is required. Simple HTML interfaces are possible, but that is not what this is.</blockquote>which is questionable
	**Its legal docs ([https://bsky.social/about/support/tos ToS], [https://bsky.social/about/support/privacy-policy PP], [https://bsky.social/about/support/community-guidelines CG]) need JS to be viewed by humans, however this seems more of an oversight than deliberate		**Its legal docs ([https://bsky.social/about/support/tos ToS], [https://bsky.social/about/support/privacy-policy PP], [https://bsky.social/about/support/community-guidelines CG]) need JS to be viewed by humans, however this seems more of an oversight than deliberate
	*[[Discord]]. While its instant-messaging functionality legitimately requires JS, they refuse to let the user change their account settings (including security and privacy ones) unless JS is enabled.		*[[Discord]]. While its instant-messaging functionality legitimately requires JS, they refuse to let the user change their account settings (including security and privacy ones) unless JS is enabled.

Rudxain: JS is still JS even if it weren't a Standard

2026-03-22T15:48:31Z

JS is still JS even if it weren't a Standard

← Older revision		Revision as of 15:48, 22 March 2026
Line 18:		Line 18:
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].
	*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>
	*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> John Gruber says that JS shouldn't ~~exist~~;<ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-22 \|title=Gizmodo Investigation Exposes Websites Collecting Form Data Before You Hit 'Submit' \|url=https://daringfireball.net/linked/2017/06/22/navistone-form-data \|url-status=live \|archive-url=https://web.archive.org/web/20260319180650/https://daringfireball.net/linked/2017/06/22/navistone-form-data \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref><ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-27 \|title=Using Today's Web Without JavaScript \|url=https://daringfireball.net/linked/2017/06/27/web-without-javascript \|url-status=live \|archive-url=https://web.archive.org/web/20260319180612/https://daringfireball.net/linked/2017/06/27/web-without-javascript \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref> ~~One~~ way that would work is by turning JS into an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] that the user willingly installs.<!-- This proposal is just to sugarcoat John's bold/"based" opinion, without putting words in his mouth. I'm not sure how else to reword this -->		*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> John Gruber says that JS shouldn't be part of browsers;<ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-22 \|title=Gizmodo Investigation Exposes Websites Collecting Form Data Before You Hit 'Submit' \|url=https://daringfireball.net/linked/2017/06/22/navistone-form-data \|url-status=live \|archive-url=https://web.archive.org/web/20260319180650/https://daringfireball.net/linked/2017/06/22/navistone-form-data \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref><ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-27 \|title=Using Today's Web Without JavaScript \|url=https://daringfireball.net/linked/2017/06/27/web-without-javascript \|url-status=live \|archive-url=https://web.archive.org/web/20260319180612/https://daringfireball.net/linked/2017/06/27/web-without-javascript \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref> one way that would work is by turning JS into an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] that the user willingly installs.<!-- This proposal is just to sugarcoat John's bold/"based" opinion, without putting words in his mouth. I'm not sure how else to reword this -->
	*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].		*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].

Rudxain at 22:33, 20 March 2026

2026-03-20T22:33:58Z

← Older revision		Revision as of 22:33, 20 March 2026
Line 39:		Line 39:
	Expanding on the security risks, these are the most common vulnerabilities found in JS code:		Expanding on the security risks, these are the most common vulnerabilities found in JS code:
	*[[wikipedia:Cross-site_scripting\|XSS]], which [[wikipedia:NoScript\|NoScript]] tries to mitigate		*[[wikipedia:Cross-site_scripting\|XSS]], which [[wikipedia:NoScript\|NoScript]] tries to mitigate
	*[[wikipedia:Arbitrary_code_execution\|Arbitrary code execution]] and [[wikipedia:Code_injection\|code injection]]. Typically caused by <code>[https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval eval]</code> (part of ~~the~~ ES ~~spec~~), but there are Web APIs (such as <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout setTimeout]</code> and <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setInterval setInterval]</code>) that can be misused as well.		*[[wikipedia:Arbitrary_code_execution\|Arbitrary code execution]] and [[wikipedia:Code_injection\|code injection]]. Typically caused by <code>[https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval eval]</code> (part of ES), but there are Web APIs (such as <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout setTimeout]</code> and <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setInterval setInterval]</code>) that can be misused as well.
	*Remote code execution. This is used by hackers and crackers to build [[wikipedia:Botnet\|bot-nets]] for [[wikipedia:Ddos#Distributed_DoS\|DDoS]] or [[wikipedia:Cryptocurrency\|crypto]]-mining, but it's mostly used for spyware since it can hide more easily.		*Remote code execution. This is used by hackers and crackers to build [[wikipedia:Botnet\|bot-nets]] for [[wikipedia:Ddos#Distributed_DoS\|DDoS]] or [[wikipedia:Cryptocurrency\|crypto]]-mining, but it's mostly used for spyware since it can hide more easily.
	Browser-engine developers (such as [[Google]] and [[Mozilla]]) not only feel compelled, but are financially incentivized to optimize JS to its limits. This leads to complex code-bases that are harder to verify for correctness. Browser vendors mitigate this via [[wikipedia:Sandbox_(computer_security)\|sandboxing]]. Unfortunately, since modern browsers compile JS to native CPU code (see [[wikipedia:Just-in-time_compilation\|JIT]]) to improve performance, this introduces a higher risk of sandbox-escape.<ref>{{Cite web \|last=Norman \|first=Johnathan \|date=2021-08-04 \|title=Super Duper Secure Mode \|url=https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ \|url-status=live \|archive-url=https://web.archive.org/web/20260218110912/https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode \|archive-date=2026-02-18 \|access-date=2026-03-19 \|website=Microsoft Browser Vulnerability Research}}</ref>		Browser-engine developers (such as [[Google]] and [[Mozilla]]) not only feel compelled, but are financially incentivized to optimize JS to its limits. This leads to complex code-bases that are harder to verify for correctness. Browser vendors mitigate this via [[wikipedia:Sandbox_(computer_security)\|sandboxing]]. Unfortunately, since modern browsers compile JS to native CPU code (see [[wikipedia:Just-in-time_compilation\|JIT]]) to improve performance, this introduces a higher risk of sandbox-escape.<ref>{{Cite web \|last=Norman \|first=Johnathan \|date=2021-08-04 \|title=Super Duper Secure Mode \|url=https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ \|url-status=live \|archive-url=https://web.archive.org/web/20260218110912/https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode \|archive-date=2026-02-18 \|access-date=2026-03-19 \|website=Microsoft Browser Vulnerability Research}}</ref>

Rudxain: IG ext-link already is ref on "Forced account", and it makes more sense there, so remove from here

2026-03-20T22:10:37Z

IG ext-link already is ref on "Forced account", and it makes more sense there, so remove from here

← Older revision		Revision as of 22:10, 20 March 2026
Line 70:		Line 70:
	*[https://libredirect.github.io/faq.html LibRedirect explaining why it exists], and how [[Google Chrome]]'s MV3 limits it		*[https://libredirect.github.io/faq.html LibRedirect explaining why it exists], and how [[Google Chrome]]'s MV3 limits it
	*Google being anti-competitive towards [[Firefox]]: https://github.com/uBlockOrigin/uBlock-issues/discussions/3240		*Google being anti-competitive towards [[Firefox]]: https://github.com/uBlockOrigin/uBlock-issues/discussions/3240
	*Instagram refusing to serve content to <code>noscript</code> users, and deliberately nagging them to [[Forced app download\|install the app]] or [[Forced account\|login]]: https://github.com/Rudxain/uBO-rules/pull/9
	*[https://github.com/iam-py-test/my_filters_001/blob/fc5f61eff0b0d821cb426bea76b18937072bc390/no-js-warnings.txt Websites that nag users to enable JS, even when it provides negligible value]		*[https://github.com/iam-py-test/my_filters_001/blob/fc5f61eff0b0d821cb426bea76b18937072bc390/no-js-warnings.txt Websites that nag users to enable JS, even when it provides negligible value]
	*Discord being extremely bloated to the point of crashing when opening Developer-tools: https://github.com/Rudxain/uBO-rules/blob/42220bd4f80052ee15136dff7269df19529c43ec/rx.ubo#L3-L19. This is not the fault of bloated JS, it's likely a bloated DOM-tree, but discord only bloats the DOM when JS is enabled.		*Discord being extremely bloated to the point of crashing when opening Developer-tools: https://github.com/Rudxain/uBO-rules/blob/42220bd4f80052ee15136dff7269df19529c43ec/rx.ubo#L3-L19. This is not the fault of bloated JS, it's likely a bloated DOM-tree, but discord only bloats the DOM when JS is enabled.

Rudxain: /* List of sites refusing to work without JS */

2026-03-20T22:06:41Z

List of sites refusing to work without JS

Rudxain: improve John Gruber citation

2026-03-20T21:58:01Z

improve John Gruber citation

← Older revision		Revision as of 21:58, 20 March 2026
Line 18:		Line 18:
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].
	*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>
	*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> ~~Some people say~~ that JS shouldn't ~~even~~ exist,<ref>https://daringfireball.net/linked/2017/06/22/navistone-form-data</ref><ref>https://daringfireball.net/linked/2017/06/27/web-without-javascript</ref> ~~implying~~ that ~~it should be~~ an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] the user willingly installs.		*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> John Gruber says that JS shouldn't exist;<ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-22 \|title=Gizmodo Investigation Exposes Websites Collecting Form Data Before You Hit 'Submit' \|url=https://daringfireball.net/linked/2017/06/22/navistone-form-data \|url-status=live \|archive-url=https://web.archive.org/web/20260319180650/https://daringfireball.net/linked/2017/06/22/navistone-form-data \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref><ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-27 \|title=Using Today's Web Without JavaScript \|url=https://daringfireball.net/linked/2017/06/27/web-without-javascript \|url-status=live \|archive-url=https://web.archive.org/web/20260319180612/https://daringfireball.net/linked/2017/06/27/web-without-javascript \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref> One way that would work is by turning JS into an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] that the user willingly installs.<!-- This proposal is just to sugarcoat John's bold/"based" opinion, without putting words in his mouth. I'm not sure how else to reword this -->
	*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].		*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].

Rudxain: comment on tc39 improving ES

2026-03-20T21:24:26Z

comment on tc39 improving ES

← Older revision		Revision as of 21:24, 20 March 2026
Line 19:		Line 19:
	*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>
	*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> Some people say that JS shouldn't even exist,<ref>https://daringfireball.net/linked/2017/06/22/navistone-form-data</ref><ref>https://daringfireball.net/linked/2017/06/27/web-without-javascript</ref> implying that it should be an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] the user willingly installs.		*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> Some people say that JS shouldn't even exist,<ref>https://daringfireball.net/linked/2017/06/22/navistone-form-data</ref><ref>https://daringfireball.net/linked/2017/06/27/web-without-javascript</ref> implying that it should be an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] the user willingly installs.
	*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].		*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].

	==How it works==		==How it works==

Rudxain: remove other duped links

2026-03-20T21:11:03Z

remove other duped links

← Older revision		Revision as of 21:11, 20 March 2026
Line 69:		Line 69:

	*[https://libredirect.github.io/faq.html LibRedirect explaining why it exists], and how [[Google Chrome]]'s MV3 limits it		*[https://libredirect.github.io/faq.html LibRedirect explaining why it exists], and how [[Google Chrome]]'s MV3 limits it
	*[[Google]] being anti-competitive towards [[Firefox]]: https://github.com/uBlockOrigin/uBlock-issues/discussions/3240		*Google being anti-competitive towards [[Firefox]]: https://github.com/uBlockOrigin/uBlock-issues/discussions/3240
	*[[Instagram]] refusing to serve content to <code>noscript</code> users, and deliberately nagging them to [[Forced app download\|install the app]] or [[Forced account\|login]]: https://github.com/Rudxain/uBO-rules/pull/9		*Instagram refusing to serve content to <code>noscript</code> users, and deliberately nagging them to [[Forced app download\|install the app]] or [[Forced account\|login]]: https://github.com/Rudxain/uBO-rules/pull/9
	*[https://github.com/iam-py-test/my_filters_001/blob/fc5f61eff0b0d821cb426bea76b18937072bc390/no-js-warnings.txt Websites that nag users to enable JS, even when it provides negligible value]		*[https://github.com/iam-py-test/my_filters_001/blob/fc5f61eff0b0d821cb426bea76b18937072bc390/no-js-warnings.txt Websites that nag users to enable JS, even when it provides negligible value]
	*[[Discord]] being extremely bloated to the point of crashing when opening Developer-tools: https://github.com/Rudxain/uBO-rules/blob/42220bd4f80052ee15136dff7269df19529c43ec/rx.ubo#L3-L19. This is not the fault of bloated JS, it's likely a bloated DOM-tree, but discord only bloats the DOM when JS is enabled.		*Discord being extremely bloated to the point of crashing when opening Developer-tools: https://github.com/Rudxain/uBO-rules/blob/42220bd4f80052ee15136dff7269df19529c43ec/rx.ubo#L3-L19. This is not the fault of bloated JS, it's likely a bloated DOM-tree, but discord only bloats the DOM when JS is enabled.
	*[https://www.slideshare.net/slideshow/enough-withthejavascriptalready/23262138 "Enough with the JavaScript already!"]		*[https://www.slideshare.net/slideshow/enough-withthejavascriptalready/23262138 "Enough with the JavaScript already!"]
	*[https://eev.ee/blog/2016/03/06/maybe-we-could-tone-down-the-javascript "Maybe we could tone down the JavaScript"]		*[https://eev.ee/blog/2016/03/06/maybe-we-could-tone-down-the-javascript "Maybe we could tone down the JavaScript"]

Rudxain: mention instant-messaging as another justification; criticize disbloat account-settings forced-JS

2026-03-20T21:09:21Z

mention instant-messaging as another justification; criticize disbloat account-settings forced-JS

← Older revision		Revision as of 21:09, 20 March 2026
Line 29:		Line 29:

	==Why it is a problem==		==Why it is a problem==
	Many webpages (and even entire websites), force the user to keep JS enabled, otherwise they break or deliberately refuse to work. In 2026, considering the advancements in HTML<!-- TO-DO: cite `<portal>`. I remember an entire website that demos/showcases the Portal API, but can't find it. `<portal>` fixed the fundamental problem that SPAs try to solve, with minimal (or zero!) JS --> and CSS technology, there is minimal reason why an average website (excluding real-time simulations and low-latency gaming) would ''ever'' need JS.<ref>{{Cite web \|last=Valkhof \|first=Kilian \|date=2023-12-02 \|title=You don't need JavaScript for that \|url=https://www.htmhell.dev/adventcalendar/2023/2/ \|url-status=live \|archive-url=https://web.archive.org/web/20260308161856/https://www.htmhell.dev/adventcalendar/2023/2/ \|archive-date=2026-03-08 \|access-date=2026-03-19 \|website=HTMHell}}</ref><ref>{{Cite web \|last=Archibald \|first=Jake \|date=2025-07-01 \|title=Give footnotes the boot § Footnotes on the web \|url=https://jakearchibald.com/2025/give-footnotes-the-boot/#footnotes-on-the-web \|url-status=live \|archive-url=https://web.archive.org/web/20251220110553/https://jakearchibald.com/2025/give-footnotes-the-boot/#footnotes-on-the-web \|archive-date=2025-12-20 \|access-date=2026-03-20 \|website=Blog - JakeArchibald.com}}</ref> The ~~only~~ valid justifications are:		Many webpages (and even entire websites), force the user to keep JS enabled, otherwise they break or deliberately refuse to work. In 2026, considering the advancements in HTML<!-- TO-DO: cite `<portal>`. I remember an entire website that demos/showcases the Portal API, but can't find it. `<portal>` fixed the fundamental problem that SPAs try to solve, with minimal (or zero!) JS --> and CSS technology, there is minimal reason why an average website (excluding real-time simulations and low-latency gaming) would ''ever'' need JS.<ref>{{Cite web \|last=Valkhof \|first=Kilian \|date=2023-12-02 \|title=You don't need JavaScript for that \|url=https://www.htmhell.dev/adventcalendar/2023/2/ \|url-status=live \|archive-url=https://web.archive.org/web/20260308161856/https://www.htmhell.dev/adventcalendar/2023/2/ \|archive-date=2026-03-08 \|access-date=2026-03-19 \|website=HTMHell}}</ref><ref>{{Cite web \|last=Archibald \|first=Jake \|date=2025-07-01 \|title=Give footnotes the boot § Footnotes on the web \|url=https://jakearchibald.com/2025/give-footnotes-the-boot/#footnotes-on-the-web \|url-status=live \|archive-url=https://web.archive.org/web/20251220110553/https://jakearchibald.com/2025/give-footnotes-the-boot/#footnotes-on-the-web \|archive-date=2025-12-20 \|access-date=2026-03-20 \|website=Blog - JakeArchibald.com}}</ref> The main valid justifications are:

	*[[wikipedia:Legacy_code\|Legacy code-bases]]. As those are impractical to migrate to no-JS solutions		*[[wikipedia:Legacy_code\|Legacy code-bases]]. As those are impractical to migrate to no-JS solutions
	*[[wikipedia:Web_hosting_service#Static_page_hosting\|Static web-hosting]]. As the developer has no control over the server, any interactivity must be provided by JS		*[[wikipedia:Web_hosting_service#Static_page_hosting\|Static web-hosting]]. As the developer has no control over the server, any interactivity must be provided by JS
			*[[wikipedia:Instant_messaging\|Instant messaging]]. For self-evident reasons.

	Expanding on the tracking capability, JS makes it harder for [[Ad block\|ad-blockers]] to block ads, since it can be used to make overly-dynamic ads. The data collected by malicious JS makes it trivial to serve [[Personalized Ads\|personalized ads]], even across unrelated sites. Some sites collect so much data that they are indistinguishable from [[spyware]] (see also [[wikipedia:Keystroke_logging\|key-logging]]).<ref>{{Cite web \|last=Hill \|first=Kashmir \|date=2017-06-20 \|title=Before You Hit ‘Submit,’ This Company Has Already Logged Your Personal Data \|url=https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|url-status=live \|archive-url=https://web.archive.org/web/20260220091637/https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|archive-date=2026-02-20 \|access-date=2026-03-19 \|website=Gizmodo}}</ref>		Expanding on the tracking capability, JS makes it harder for [[Ad block\|ad-blockers]] to block ads, since it can be used to make overly-dynamic ads. The data collected by malicious JS makes it trivial to serve [[Personalized Ads\|personalized ads]], even across unrelated sites. Some sites collect so much data that they are indistinguishable from [[spyware]] (see also [[wikipedia:Keystroke_logging\|key-logging]]).<ref>{{Cite web \|last=Hill \|first=Kashmir \|date=2017-06-20 \|title=Before You Hit ‘Submit,’ This Company Has Already Logged Your Personal Data \|url=https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|url-status=live \|archive-url=https://web.archive.org/web/20260220091637/https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|archive-date=2026-02-20 \|access-date=2026-03-19 \|website=Gizmodo}}</ref>
Line 60:		Line 61:
	**The web app (<code>bsky.app</code>) shows this message if JS is disabled<blockquote>This is a heavily interactive web application, and JavaScript is required. Simple HTML interfaces are possible, but that is not what this is.</blockquote>which is questionable at best		**The web app (<code>bsky.app</code>) shows this message if JS is disabled<blockquote>This is a heavily interactive web application, and JavaScript is required. Simple HTML interfaces are possible, but that is not what this is.</blockquote>which is questionable at best
	**Its legal docs ([https://bsky.social/about/support/tos ToS], [https://bsky.social/about/support/privacy-policy PP], [https://bsky.social/about/support/community-guidelines CG]) need JS to be viewed by humans, however this seems more of an oversight than deliberate		**Its legal docs ([https://bsky.social/about/support/tos ToS], [https://bsky.social/about/support/privacy-policy PP], [https://bsky.social/about/support/community-guidelines CG]) need JS to be viewed by humans, however this seems more of an oversight than deliberate
			*[[Discord]]. While its instant-messaging functionality does require JS, they refuse to let the user change their account settings (including security and privacy ones).

	==Benefits==		==Benefits==

← Older revision		Revision as of 15:48, 22 March 2026
Line 18:		Line 18:
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].
	*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>
	*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> John Gruber says that JS shouldn't ~~exist~~;<ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-22 \|title=Gizmodo Investigation Exposes Websites Collecting Form Data Before You Hit 'Submit' \|url=https://daringfireball.net/linked/2017/06/22/navistone-form-data \|url-status=live \|archive-url=https://web.archive.org/web/20260319180650/https://daringfireball.net/linked/2017/06/22/navistone-form-data \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref><ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-27 \|title=Using Today's Web Without JavaScript \|url=https://daringfireball.net/linked/2017/06/27/web-without-javascript \|url-status=live \|archive-url=https://web.archive.org/web/20260319180612/https://daringfireball.net/linked/2017/06/27/web-without-javascript \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref> ~~One~~ way that would work is by turning JS into an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] that the user willingly installs.<!-- This proposal is just to sugarcoat John's bold/"based" opinion, without putting words in his mouth. I'm not sure how else to reword this -->		*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> John Gruber says that JS shouldn't be part of browsers;<ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-22 \|title=Gizmodo Investigation Exposes Websites Collecting Form Data Before You Hit 'Submit' \|url=https://daringfireball.net/linked/2017/06/22/navistone-form-data \|url-status=live \|archive-url=https://web.archive.org/web/20260319180650/https://daringfireball.net/linked/2017/06/22/navistone-form-data \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref><ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-27 \|title=Using Today's Web Without JavaScript \|url=https://daringfireball.net/linked/2017/06/27/web-without-javascript \|url-status=live \|archive-url=https://web.archive.org/web/20260319180612/https://daringfireball.net/linked/2017/06/27/web-without-javascript \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref> one way that would work is by turning JS into an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] that the user willingly installs.<!-- This proposal is just to sugarcoat John's bold/"based" opinion, without putting words in his mouth. I'm not sure how else to reword this -->
	*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].		*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].

← Older revision		Revision as of 22:33, 20 March 2026
Line 39:		Line 39:
	Expanding on the security risks, these are the most common vulnerabilities found in JS code:		Expanding on the security risks, these are the most common vulnerabilities found in JS code:
	*[[wikipedia:Cross-site_scripting\|XSS]], which [[wikipedia:NoScript\|NoScript]] tries to mitigate		*[[wikipedia:Cross-site_scripting\|XSS]], which [[wikipedia:NoScript\|NoScript]] tries to mitigate
	*[[wikipedia:Arbitrary_code_execution\|Arbitrary code execution]] and [[wikipedia:Code_injection\|code injection]]. Typically caused by <code>[https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval eval]</code> (part of ~~the~~ ES ~~spec~~), but there are Web APIs (such as <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout setTimeout]</code> and <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setInterval setInterval]</code>) that can be misused as well.		*[[wikipedia:Arbitrary_code_execution\|Arbitrary code execution]] and [[wikipedia:Code_injection\|code injection]]. Typically caused by <code>[https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval eval]</code> (part of ES), but there are Web APIs (such as <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout setTimeout]</code> and <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setInterval setInterval]</code>) that can be misused as well.
	*Remote code execution. This is used by hackers and crackers to build [[wikipedia:Botnet\|bot-nets]] for [[wikipedia:Ddos#Distributed_DoS\|DDoS]] or [[wikipedia:Cryptocurrency\|crypto]]-mining, but it's mostly used for spyware since it can hide more easily.		*Remote code execution. This is used by hackers and crackers to build [[wikipedia:Botnet\|bot-nets]] for [[wikipedia:Ddos#Distributed_DoS\|DDoS]] or [[wikipedia:Cryptocurrency\|crypto]]-mining, but it's mostly used for spyware since it can hide more easily.
	Browser-engine developers (such as [[Google]] and [[Mozilla]]) not only feel compelled, but are financially incentivized to optimize JS to its limits. This leads to complex code-bases that are harder to verify for correctness. Browser vendors mitigate this via [[wikipedia:Sandbox_(computer_security)\|sandboxing]]. Unfortunately, since modern browsers compile JS to native CPU code (see [[wikipedia:Just-in-time_compilation\|JIT]]) to improve performance, this introduces a higher risk of sandbox-escape.<ref>{{Cite web \|last=Norman \|first=Johnathan \|date=2021-08-04 \|title=Super Duper Secure Mode \|url=https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ \|url-status=live \|archive-url=https://web.archive.org/web/20260218110912/https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode \|archive-date=2026-02-18 \|access-date=2026-03-19 \|website=Microsoft Browser Vulnerability Research}}</ref>		Browser-engine developers (such as [[Google]] and [[Mozilla]]) not only feel compelled, but are financially incentivized to optimize JS to its limits. This leads to complex code-bases that are harder to verify for correctness. Browser vendors mitigate this via [[wikipedia:Sandbox_(computer_security)\|sandboxing]]. Unfortunately, since modern browsers compile JS to native CPU code (see [[wikipedia:Just-in-time_compilation\|JIT]]) to improve performance, this introduces a higher risk of sandbox-escape.<ref>{{Cite web \|last=Norman \|first=Johnathan \|date=2021-08-04 \|title=Super Duper Secure Mode \|url=https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ \|url-status=live \|archive-url=https://web.archive.org/web/20260218110912/https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode \|archive-date=2026-02-18 \|access-date=2026-03-19 \|website=Microsoft Browser Vulnerability Research}}</ref>

← Older revision		Revision as of 21:58, 20 March 2026
Line 18:		Line 18:
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].
	*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and CSS<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|access-date=2026-03-19 \|website=Am I Unique ?}}</ref>
	*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> ~~Some people say~~ that JS shouldn't ~~even~~ exist,<ref>https://daringfireball.net/linked/2017/06/22/navistone-form-data</ref><ref>https://daringfireball.net/linked/2017/06/27/web-without-javascript</ref> ~~implying~~ that ~~it should be~~ an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] the user willingly installs.		*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref>{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=2026-03-16 \|access-date=2026-03-19 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere --> John Gruber says that JS shouldn't exist;<ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-22 \|title=Gizmodo Investigation Exposes Websites Collecting Form Data Before You Hit 'Submit' \|url=https://daringfireball.net/linked/2017/06/22/navistone-form-data \|url-status=live \|archive-url=https://web.archive.org/web/20260319180650/https://daringfireball.net/linked/2017/06/22/navistone-form-data \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref><ref>{{Cite web \|last=Gruber \|first=John \|date=2017-06-27 \|title=Using Today's Web Without JavaScript \|url=https://daringfireball.net/linked/2017/06/27/web-without-javascript \|url-status=live \|archive-url=https://web.archive.org/web/20260319180612/https://daringfireball.net/linked/2017/06/27/web-without-javascript \|archive-date=2026-03-19 \|access-date=2026-03-20 \|website=Daring Fireball}}</ref> One way that would work is by turning JS into an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]] that the user willingly installs.<!-- This proposal is just to sugarcoat John's bold/"based" opinion, without putting words in his mouth. I'm not sure how else to reword this -->
	*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].		*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://wiki.theory.org/YourLanguageSucks#JavaScript_sucks_because</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].

← Older revision		Revision as of 22:06, 20 March 2026
Line 33:		Line 33:
	*[[wikipedia:Legacy_code\|Legacy code-bases]]. As those are impractical to migrate to no-JS solutions		*[[wikipedia:Legacy_code\|Legacy code-bases]]. As those are impractical to migrate to no-JS solutions
	*[[wikipedia:Web_hosting_service#Static_page_hosting\|Static web-hosting]]. As the developer has no control over the server, any interactivity must be provided by JS		*[[wikipedia:Web_hosting_service#Static_page_hosting\|Static web-hosting]]. As the developer has no control over the server, any interactivity must be provided by JS
	*[[wikipedia:Instant_messaging\|Instant messaging]]~~. For~~ self-evident ~~reasons.~~		*[[wikipedia:Instant_messaging\|Instant messaging]] (self-evident)

	Expanding on the tracking capability, JS makes it harder for [[Ad block\|ad-blockers]] to block ads, since it can be used to make overly-dynamic ads. The data collected by malicious JS makes it trivial to serve [[Personalized Ads\|personalized ads]], even across unrelated sites. Some sites collect so much data that they are indistinguishable from [[spyware]] (see also [[wikipedia:Keystroke_logging\|key-logging]]).<ref>{{Cite web \|last=Hill \|first=Kashmir \|date=2017-06-20 \|title=Before You Hit ‘Submit,’ This Company Has Already Logged Your Personal Data \|url=https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|url-status=live \|archive-url=https://web.archive.org/web/20260220091637/https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|archive-date=2026-02-20 \|access-date=2026-03-19 \|website=Gizmodo}}</ref>		Expanding on the tracking capability, JS makes it harder for [[Ad block\|ad-blockers]] to block ads, since it can be used to make overly-dynamic ads. The data collected by malicious JS makes it trivial to serve [[Personalized Ads\|personalized ads]], even across unrelated sites. Some sites collect so much data that they are indistinguishable from [[spyware]] (see also [[wikipedia:Keystroke_logging\|key-logging]]).<ref>{{Cite web \|last=Hill \|first=Kashmir \|date=2017-06-20 \|title=Before You Hit ‘Submit,’ This Company Has Already Logged Your Personal Data \|url=https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|url-status=live \|archive-url=https://web.archive.org/web/20260220091637/https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|archive-date=2026-02-20 \|access-date=2026-03-19 \|website=Gizmodo}}</ref>
Line 52:		Line 52:

	==List of sites refusing to work without JS==		==List of sites refusing to work without JS==
	The following is a non-exhaustive list of websites where most or all pages deliberately only work with JS enabled:		The following is a non-exhaustive list of websites where most or all pages deliberately only work with JS enabled, even when its use is "illegitimate":

	*[[YouTube]]		*[[YouTube]]
Line 61:		Line 61:
	**The web app (<code>bsky.app</code>) shows this message if JS is disabled<blockquote>This is a heavily interactive web application, and JavaScript is required. Simple HTML interfaces are possible, but that is not what this is.</blockquote>which is questionable at best		**The web app (<code>bsky.app</code>) shows this message if JS is disabled<blockquote>This is a heavily interactive web application, and JavaScript is required. Simple HTML interfaces are possible, but that is not what this is.</blockquote>which is questionable at best
	**Its legal docs ([https://bsky.social/about/support/tos ToS], [https://bsky.social/about/support/privacy-policy PP], [https://bsky.social/about/support/community-guidelines CG]) need JS to be viewed by humans, however this seems more of an oversight than deliberate		**Its legal docs ([https://bsky.social/about/support/tos ToS], [https://bsky.social/about/support/privacy-policy PP], [https://bsky.social/about/support/community-guidelines CG]) need JS to be viewed by humans, however this seems more of an oversight than deliberate
	*[[Discord]]. While its instant-messaging functionality ~~does require~~ JS, they refuse to let the user change their account settings (including security and privacy ones).		*[[Discord]]. While its instant-messaging functionality legitimately requires JS, they refuse to let the user change their account settings (including security and privacy ones) unless JS is enabled.

	==Benefits==		==Benefits==