sent from a disposable whonix qube

  • OwOarchist@pawb.socialEnglish
    853·
    7 days ago

    Honestly, it’s bonkers that the standard, default approach for all mainstream browsers is to let every random website in the world run any arbitrary code it wants on your computer.

    Yeah, they usually attempt to sandbox it, but still. Sometimes sandboxes can be escaped. And sometimes the code can do significant harm while still inside its sandbox.

    • Err(()).unwrap()@lemmy.worldM
      415·
      7 days ago

      Most websites would break, or not even display, without javascript. Sure, it’s bonkers for you, but an alternative browser that can’t immediately show a website that works perfectly well in Chrome wouldn’t get much of a user base.

        • OrganicMustard@lemmy.world
          4·
          6 days ago

          There are protocols like gemini that only have text and files, no executing code. I wish there was more of the web moving towards that.

          *Edited for wrong language autocorrect.

          • libewa@feddit.org
            2·
            4 days ago

            There are valid use cases for JS and AJAX, but they are few. HTML/CSS is great, and has gotten many new features that can replace JavaScript in the long run: Popovers, commandfor etc. One thing I am missing is opening arbitrary popovers on a long hover. For that, you still need mousemove event listeners.

      • chonglibloodsport@lemmy.world
        162·
        7 days ago

        Most websites from when I was a kid did not need JavaScript. Heck, they didn’t even have any JavaScript on many of them! No CSS either, just HTML and images (which were very slow to load on dialup).

      • OwOarchist@pawb.socialEnglish
        93·
        6 days ago

        Most websites would break, or not even display, without javascript.

        I use NoScript – I’m well aware.

        But a lot of those websites could function without javascript. A lot of websites use it unnecessarily, for reasons such as:

        • They want their ads and trackers and other malicious code to work as intended.

        • They want to add fancy cosmetic elements to the content and are too lazy to think about failing gracefully and still displaying the content if javascript isn’t working.

        • They built the website in a framework that depends on javascript, and are again too lazy to bother worrying about graceful failure if javascript isn’t working, even if their content could, in theory, be displayed just fine without it. (Or maybe the framework developers deserve a bit of the blame for that laziness, since they could have made graceful failure a feature of the framework, but chose not to.)

        In a hypothetical world where most browsers didn’t allow every website to run arbitrary code, then every website would be forced to take that into account and only depend on javascript when it’s absolutely necessary for the website’s core functions.

      • hirihit640@sh.itjust.worksEnglish
        3·
        6 days ago

        Just another piece of evidence that people care more about convenience than privacy, sadly. People aren’t willing to put up with a single broken website

      • wonderingwanderer@sopuli.xyz
        52·
        7 days ago

        That’s the problem though, why is it standard for websites to be built in such a way that their basic functionality depends on allowing such arbitrary scripts? Shouldn’t there be some regulatory body that tells them that’s against the rules or something?

        • Err(()).unwrap()@lemmy.worldM
          42·
          7 days ago

          Do you want regulatory overreach? Imagine forcing every small project or self-hoster to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.

          To redirect your other question: you should ask the web developers. If they’re honest, you’ll get a dozen legitimate answers that can’t be solved without locally running code. A chat web app, for example, needs to either poll the server at a given rate, or use a WebSocket to fetch incoming messages, both of which require Javascript. Then it needs to modify the DOM to display the new messages, which again requires Javascript. If it needs access to the microphone or webcam, it has to use some kind of local interface. I could go on. The point is, a lot of this arbitrary local code exists because there’s no other way to implement many features without it. Imagine having to reload an instant messaging app if you want to see if you’ve received anything. It would be like writing a GUI application using Qt or GTK, but without using any events.

          • wonderingwanderer@sopuli.xyz
            43·
            7 days ago

            I don’t view basic consumer rights as “regulatory overreach.”

            to adhere to the rules set by the equivalent of the HDMI Forum, but controlled by the likes of Microsoft and Facebook.

            No and no. I never said it should be corporations setting the standard. That’s the FCC’s job, and comparable agencies in other countries. The FCC already regulates many things about the internet. Some things they don’t regulate enough. Were you one of those people who viewed Net Neutrality as “regulatory overreach” too?

            Sure, the current admin is corrupt and the current FCC can’t be trusted, but that won’t be forever.

            Also, there’s such thing as the IEEE. Standards for web development are not unheard of, and they’re not categorically wrong. There need to be rules governing the rules that govern web development to ensure those rules aren’t abused. But setting no rules or standards would be insane.

            If they’re honest, you’ll get a dozen legitimate answers that can’t be solved without locally running code.

            That’s not honesty. That’s deflection and dissembling. Sure, you can think of a dozen different reasons why scripts need to be run locally. But that doesn’t excuse using those scripts as a trojan horse for malicious data mining practices. Permissions can be atomized.

            If a web developer can’t compartmentalize the part of the script that loads an image on their website from the part of the script that harvests sensitive fingerprinting data that the website has no legitimate need for, then they’re either a really bad developer who’s never heard of modularity, or they’re doing it deliberately and maliciously because they know they can get away with it and are choosing to make their website break for anyone who doesn’t let them basically peep under their device’s skirt.

            • Kangae_Hishiryo@scribe.disroot.org
              2·
              7 days ago

              I get your point, yeah. I actually do think that scripts should’ve hugely modularized, compartmentalized, and browsers should’ve using OCaps instead of ACLs, or at least make more granular ACLs so you can finetune what can or what cannot do a given site and/or a given script.

              • wonderingwanderer@sopuli.xyz
                2·
                6 days ago

                Thank you! It seems pretty clear to me, modularity is supposed to be the modern standard for quality code, so why are we normalizing websites that use scripts with more arms than Cthulhu harvesting uniquely identifiable data from our personal devices by running arbitrary code locally? It seems insane to me…

                “One tool for one job.” It’s pretty basic Unix philosophy. So why do we now have “One script for several hundred different fingerprint variables, oh and also the website’s basic functionality”?

    • cley_faye@lemmy.world
      4·
      7 days ago

      Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can’t access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.

      The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.

      It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don’t know what site you’re viewing.

      • OwOarchist@pawb.socialEnglish
        21·
        6 days ago

        Still can have issues with javascript crypto miners. And there’s always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.

        • Tanoh@lemmy.world
          2·
          6 days ago

          Most (all?) browsers throttle tabs that take too much cpu for too long (especially background). The actual numbers vary, but hidden cryptominers are not that effective anymore.

        • cley_faye@lemmy.world
          1·
          5 days ago

          JavaScript in the browser have no “sandbox” to evade. It does not have the ability to run outside of it’s virtual machine, at all. It’s completely different from a native executable, that actually have the ability to make system calls, that would evade a container/chroot/whatever.

          Also, running a crypto miner in a browser tab (or even as a service worker) is probably more costly to put in place than it will ever bring back. It’s just not efficient enough.

  • axh@lemmy.world
    26·
    7 days ago

    I can’t convince my wife to even use an add blocker, because it makes some (terrible) websites unusable (and you need an entire one additional click to disable it, it’s too much effort), blocking JS would make the entire internet unusable for normies.

    • W98BSoD@lemmy.dbzer0.comEnglish
      14·
      7 days ago

      I can’t convince my wife to even use an add blocker…

      Can you convince her to use a subtraction blocker?

      • mirshafie@europe.pub
        6·
        7 days ago

        A subraction facilitator. It enables the surgical excision of unwanted, harmful and stupefying noise.

      • keiko@fedia.ioOP
        4·
        7 days ago

        Pi-hole is a great project for network-wide dns-based blocking, yes. I was going to link to the official site, but it seems to be broken now, so I linked to the official github repo.

          • ReluctantMuskrat@lemmy.world
            5·
            7 days ago

            My wife loves our pihole setup so much I was forced to setup VPN access to the home network so she could block ads while traveling. Now our oldest daughter wants me to setup pihole for her house.

          • keiko@fedia.ioOP
            4·
            7 days ago

            One thing that’s really nice about pi-hole is that it gives a window into your network, allowing you to easily see dns requests as they happen, while also organizing them into useful charts and graphs.

      • rumschlumpel@feddit.org
        3·
        7 days ago

        AFAIK some sites are so terrible that they won’t work even if you use DNS-based adblocking instead of browser extension-based adblocking …

        Definitely worth trying, though.

    • keiko@fedia.ioOP
      27·
      7 days ago

      I have never heard the bottom left take anywhere before, though.

      ✨️ until now ✨️

      • Multiplexer@discuss.tchncs.de
        7·
        7 days ago

        Had a look into the ublock settings.
        The one I found seems to be more of a nuke-grade total disabling, as opposed to the fine-grained approach of the noscript extension.

        • rumschlumpel@feddit.org
          5·
          7 days ago

          UBlock’s approach is that you disable it for every site in the settings and then whitelist per site. Seems sensible enough to me. How does noscript do it?

          • keiko@fedia.ioOP
            3·
            7 days ago

            That is certainly a valid approach to using ublock origin, but the wiki outlines a few other blocking modes available.

          • Multiplexer@discuss.tchncs.de
            2·
            6 days ago

            I guess I prefer the Unix philosophy of doing things:
            Have a bunch of combinable small programs each being dedicated to a single function and doing that well instead of large complex monoliths.

            • keiko@fedia.ioOP
              3·
              6 days ago

              When it comes to browser addons, it is generally recommended to have as few as possible in order to reduce attack surface, since a higher number increases the chance of having one that becomes compromised. It’s especially relevant with browser addons because they tend to have lots of capabilities/permissions and can therefore do lots of damage.

    • keiko@fedia.ioOP
      1·
      5 days ago

      Those are websites I don’t want to use. As I’ve said in other comments, sites which break without javascript are what I consider broken sites. And I don’t like to use broken sites.

      Almost all websites stop working

      Another way of saying this: Most websites are broken and not worth accessing.

      Like, have you seen the web? Most sites suck. lol. The good ones don’t bully/coerce me to change my behaviour.

      • REDACTED@infosec.pub
        1·
        4 days ago

        I don’t know man. This seems extreme. JavaScript is part of web standard, nearly all sites use it, including every single of my own site/project. I don’t even consider people who have it disabled as I treat them same as bots.

        Imagine saying “Windows is less secure than Linux, so I’m not going to make any of my apps work on windows”. You’d get so many weird stares. It’s like instead of dealing with it, learning how to be safer, etc, you’re shutting out.

        EDIT grammar

        • keiko@fedia.ioOP
          1·
          3 days ago

          I don’t know man.

          Please don’t say that to me.

          nearly all sites use it

          Yep, and the ones that don’t work without it are what I call broken, and those are not sites that I care to use.

          I don’t even consider people who have it disabled as I treat them same as bots.

          To quote you: “This seems extreme.”

          But it’s your decision, just like it’s my decision to not bother with sites like that. I’m not sure if you’re trying to convince me to comply, but that is exactly what makes me avoid a site. I don’t put up with that sort of thing anymore. It’s not worth my time.

          Imagine saying “Windows is less secure than Linux, so I’m not going to make any of my apps work on windows”.

          Are you unaware of Free and Open Source Software (FOSS) and that there are plenty of developers who don’t bother making things for closed systems like Windows? It’s not weird at all.

          It’s like instead of dealing with it, learning how to be safer, etc, you’re shutting out.

          How am I not “dealing with it” ? I don’t value sites which mistreat me, and so I avoid them. I am happier as a result. I have more comfort and self-respect, and I lose nothing.

          From another of my comments:

          Without javascripts, I get neat and tidy static pages that load super fast. I can have dozens of them loaded in separate tabs on my Librem 5 or Pinephone, which only have 3GB of RAM. It’s nice and comfy.

          With javascripts, I get a bad experience involving

          • ads
          • trackers
          • cookie notices
          • popups & overlays
          • obnoxious “chat” features
          • long wait times for everything to load
          • new elements pushing other elements around as they load
          • pages which automatically reload/refresh without my consent
          • useless effects like blur which slow down the pages significantly
          • “infinite scroll” pages which fuck up my calm navigation of the page
          • poorly-designed pages which aren’t easy to fix with things like web dev tools or ublock origin
          • captchas
          • etc. etc. etc.

          I’m not seeking to convince web devs like you to design your sites to my liking, but you shouldn’t expect people like me to want to use your sites if they’re broken.

          It’s rarely ever worth it to comply with the demand to allow scripts, and I resent that it is so often a demand rather than a suggestion.

          • REDACTED@infosec.pub
            1·
            3 days ago

            Just to be clear, the JavaScript in my sites is used to improve load times and functionality, not for tracking or other stuff. It has been a standard for quite some time to not load entire pages again if a user clicks on something or scrolls below visible area, but rather only what’s changing. I can guarantee you the alternative is slower as it has been tested and proven for years and years. I wanted to ask you how are you even using YouTube, but I guess they made non-JS version because they also heavily rely on dynamic content. That means your YouTube page doesn’t just load what you see, it also loads comments and other bloat that you might never need, resulting in larger html itself.

            • keiko@fedia.ioOP
              1·
              3 days ago

              It has been a standard for quite some time to not load entire pages again if a user clicks on something or scrolls below visible area

              Yes, and I hate that. The alternative gives me a complete page which is accessible with or without an active internet connection. The standard you like is a worse experience for me. Loading complete pages without javascripts is aways a faster and better experience than sites which hide content behind a javascript ‘paywall’. I think I’ll start calling it that from now on, because that’s what it is to me, a javascript paywall.

              I wanted to ask you how are you even using YouTube

              I don’t use GAFAM serivices. If I want to access content which is controlled by youtube (rare), then I use an invidious instance. If I want comments to load, I load the page with the tag specifying non-javascript mode.

  • keiko@fedia.ioOP
    10·
    6 days ago

    Hey, so there are a few threads I can’t see from this instance due to defederations and I wanna respond anyway.

    @Digit@lemmy.today open dyslexia font? nice touch.

    Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.

    @Onomatopoeia@lemmy.cafe That makes it easier for dyslexics?

    Possibly for some, as @Ludicrous0251@piefed.zip said. I think it would probably be more beneficial for those who are introduced to it at a young age. Otherwise it takes some time to get used to it, and I did end up falling back to the fonts I had been using. But I do like OpenDyslexicAlta font and think it makes a good meme font, so yeah.

    Okay so that’s my response to the chain of comments quoted above. Sorry I can’t give y’all upvotes due to the defederation, and sorry it took me so long to realize there were comments which were hidden from me. I do try my best to respond to everything that seems directed at me or which I can offer a worthwhile response.

    The next chain of comments is much longer (it’s a really good one too), and I’m thinking I’ll make one or more responses when I get back online a while from now.

    🩷

    • keiko@fedia.ioOP
      2·
      5 days ago

      Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.

      @Digit@lemmy.today This, I applaud. I aim similarly.

      tyvm for the appreciation. and since I can’t send upvotes directly, you get extra hearts: 🩷🩷🩷🩷🩷

      • keiko@fedia.ioOP
        2·
        5 days ago

        I have a brand??! 🫨 (seriously tyvm 🩷) I’m currently going through my notifications and responding to stuff before using another qube to find that other chain of comments (and any new ones too). I am pretty obsessive ^^’ (and maybe trying to show more of myself here in the hopes that people can truly see me when I say things that matter)

    • Digit@lemmy.todayEnglish
      1·
      5 days ago

      Thanks. Yeah, it’s OpenDyslexicAlta Bold. It felt like a good option for a meme font that was kinda different and maybe easy enough to read to make it useful too.

      This, I applaud. I aim similarly.

  • obnomus@lemmy.mlEnglish
    6·
    6 days ago

    Its not related to this but Tempermonkey amd scripts is insanely good experience.

  • PinkiePieYay2707@pawb.socialEnglish
    9·
    7 days ago

    I’m currently testing just outright blocking all scripts through uBO, and to be honest it is not usable. I will use it for a little longer, then for sure disable it. A lot of websites just refuse to load (thanks, SPAs), and those that do often have little interactions that break, thus making the pages hard to use or even outright unusable.

    To give some examples for those that haven’t tried this: images may refuse to load (js based lazy load implementation), dropdown menus almost never work, search option usually doesn’t work (and if it does it’s only because it goes to a different page, which is fair), comments probably won’t show up, pretty much anything “live” won’t work. Oh and let’s not forget the captchas and all the proof-of-work blockers.

    For me the only really interesting part about this experience is that imgur refuses to load, even if you have a direct link to an image.

    • tempest@lemmy.ca
      5·
      7 days ago

      The company I worked for used to use SSR which was fine but the web scraping was relentless and the “free” thing we offered was relatively computationally expensive. Eventually we moved to SPA and bought into the CloudFlare protection racket. This didn’t stop it of course but it made the low effort scrapers have to use a browser and hopefully bumped their costs us The advent of the LLM crawlers has made everything worse as well.

      We got a bunch of complaints when we moved to the JS only site saying we were ruining the Internet and while I didn’t disagree the practicalities make it a requirement.

      • keiko@fedia.ioOP
        4·
        7 days ago

        We got a bunch of complaints when we moved to the JS only site saying we were ruining the Internet

        From my perspective, sites which move to javascript-only cease to be publicly accessible and essentially remove themselves from the internet. I do understand the necessity to do something about the scrapers, but going javascript-only is basically death of the site.

        • tempest@lemmy.ca
          1·
          7 days ago

          It’s also just practicalities of the industry. You can write interactive elements on a site with minimal JS and some guys blog which could just be an MD file shouldn’t need 10mb bundles of JS. However when you do need to shift more in to the application on the web side of things and you need front-end developers it’s far cheaper and easier to source spa devs, there is just more of them.

    • keiko@fedia.ioOP
      3·
      7 days ago

      To give some examples for those that haven’t tried this: images may refuse to load (js based lazy load implementation), dropdown menus almost never work, search option usually doesn’t work (and if it does it’s only because it goes to a different page, which is fair), comments probably won’t show up, pretty much anything “live” won’t work.

      All of those things work perfectly on non-broken sites like mbin instances. As far as captchas, I refuse to do them, as I don’t consent to being used like that.

      For me the only really interesting part about this experience is that imgur refuses to load, even if you have a direct link to an image.

      imgur.com/something -> farside.link/rimgo/something

      Not all of the rimgo instances work, but some do.

      Edit: Well apparently farside has been shut down.

  • Bluescluestoothpaste@sh.itjust.works
    41·
    5 days ago

    Im not super tech saavy, especially compared to the lemmy userbase, but every complaint about software just reads to me like whining about something you chose to install on your computer. You can just not use someone else’s software, yes the mainstream software companies are fucking assholes and they will take all of your data and privacy in exchange for a subscription to their software. It’s on you if you accept that deal.

    • keiko@fedia.ioOP
      2·
      5 days ago

      I’m confused (happens a lot). Is your comment responding to the meme or to some other comment? If the former, I am even more confused, since the meme isn’t complaining about anything at all. It’s poking fun some of the ways people view the web.

      You can just not use someone else’s software

      That is what I am doing when I deny a site to run scripts on my computer, yes. And I love that I have the ability to make that choice.

      yes the mainstream software companies are fucking assholes and they will take all of your data and privacy in exchange for a subscription to their software

      lol yes. That’s why I tend to avoid them and their products/services.

      It’s on you if you accept that deal.

      Well I do still find it fucked-up that they prey on unsuspecting people who are ignorant of what’s being done to them, including especially kids. It’s not on them. They don’t deserve the bad things done to them by the surveillance corporations. They can’t be expected to know and understand.

    • TorstenTyp@feddit.nu
      3·
      5 days ago

      While technically correct, it’s a slightly shallow analysis. It’s like people complaining that companies put chemicals in the food, you could grow all of your your own food but it’s probably not feasible.

        • TorstenTyp@feddit.nu
          1·
          3 days ago

          We’re both here on Lemmy so it’s safe to assume we’re both doing our best, but I’m willing to bet all my money that you are not sourcing all of your tech needs from ethical companies or the open source community. You probably use an Apple or Google made phone, your work might lock you into Microsoft operating systems, the list goes on. It’s not wrong for people to demand better solutions from companies that have managed to establish a monopoly and who use their vast resources to maintain that monopoly.

          • Bluescluestoothpaste@sh.itjust.works
            1·
            3 days ago

            Idk what we mean by wrong but it’s just dumb and causes self inflicted stress. Yes i use microsoft at work because they tell me i have to, i dont complain about it on the internet because that would just be wasting my energy for naught. And no monopoly has ever self policed itself and never will. The problem is the laws passed so go complain to your local politicians instead. And if microsoft was the first company to ever self police itself out of a monopoly, google and apple would instantly suck up all that market share.

    • Richard@lemmy.world
      12·
      7 days ago

      This disabling scripts thing is really for hardcore privacy enthusiasts. Just install librewolf on your linux box, change the DNS on your router to block ads and you’re good.

      The reason i say it’s for enthusiasts is that it will break everything as soon as you do it. And i mean it. The modern web is not useful without java script. Only websites designed specifically for working without javascript will still work.

        • Jadey@feddit.nl
          7·
          7 days ago

          exactly this, I’ve been using noscript for at least 15 years by now, probably longer. It’s annoying, sometimes. But it’s worth it always.

      • keiko@fedia.ioOP
        52·
        7 days ago

        This disabling scripts thing is really for hardcore privacy enthusiasts.

        It also just makes things better. Javascripts tend to make for a worse browsing experience to me.

        it will break everything as soon as you do it

        Sites that don’t work without javascripts are broken sites. It’s not the lack of javascript functionality that causes them to break. They are in a broken state and should be updated to not rely on javascripts. Leaving scripts disables makes it clear which sites are broken and which sites are worth accessing.

        The modern web is not useful without java script.

        I disagree. The modern web is unusable with all the ads, trackers, captchas, and javascripts. The true modern web consists of the sites which don’t have all of those drawbacks. Mbin is a good example of what the modern web can and should be. It’s superior to all other fediverse instances I’ve known.

        Only websites designed specifically for not working with javascript will still work.

        Those are the sites worth accessing. ^^

        Just install librewolf on your linux box, change the DNS on your router to block ads and you’re good.

        I do agree that this is good advice <3

        • 𝄞 Inkstain (they/them)𓆩 𓆪@pawb.social
          2·
          6 days ago

          Hi, question, my own website pretty much only uses JavaScript in order to correctly display a list of my blogposts without me having to manually update the html. I did really want a way to have this without JavaScript (or backend services like PHP, I’m still hosted by neocities). Is there?

    • rumschlumpel@feddit.org
      4·
      7 days ago

      I’m reading a lot of personal blogs that don’t use JS at all, or at least are still functional with JS blocked. A somewhat surprising amount of websites work without it.

      The issue with JS is that while I assume that your use of JS is relatively minimal and you’re not malicious, I don’t know that, and even if you’re not actively malicious, your site might still be compromized by exploited JS vulnerabilities, site hacks or uninformed/negligent choices of third party libraries/plugins/CDNs (NPM is notorious for supply chain attacks and lots of otherwise alright sites include font CDNs or even analytics). I’m not super anal about not using any site that doesn’t work without JS, but having it off by default is definitely good practice and sometimes I do decide that I don’t want to see a site that badly.

      • keiko@fedia.ioOP
        3·
        7 days ago

        The security issues are the reason that, if I do decide to enable javascript, it’s in a disposable whonix qube. Which is basically what the bottom left panel of the meme is describing. Whereas the bottom right describes my general lack of desire to enable it at all.

    • keiko@fedia.ioOP
      7·
      7 days ago

      It depends on the site. Some sites which leverage javascripts are still usable without the scripts. And there is a spectrum of usability. Lemmy is a good example. Most lemmy instances which are open to the public (without captchas or login) are generally usable without javascripts. Some features don’t work, but knowing the path to the page allows manually getting there without javascript buttons. So like, adding /?sort=TopHour to the end of a lemmy instance’s url sets the sorting for the page to top posts in the past hour. However, some other features don’t seem to work at all. But then there are lemmy instances which utilize mlmym, which basically replicates old reddit and works 100% without javascripts. And then there are instances like mbin, which is designed to be a modern fediverse experience which does not require any javascripts, and it works very well.

      When I load a site, any site, if I get a blank page or a bunch of placeholders for javascript elements, I just close the tab and move on. Sometimes if I’m curious, I’ll switch from “Basic Page Style” to “No Style” (Alt+V Y N) to see if there’s anything hidden beneath the surface.

    • Onomatopoeia@lemmy.cafeEnglish
      5·
      7 days ago

      That makes it easier for dyslexics?

      I find it awful to read - takes a lot more effort for me I’m surprised it helps with dyslexia.

      • Ludicrous0251@piefed.zipEnglish
        2·
        7 days ago

        Short answer: studies are limited and results are mixed but there’s little to no peer reviewed evidence to suggest it provides much benefit, that said, people seem to like it, so do whatever makes you happy.

      • Digit@lemmy.todayEnglish
        1·
        6 days ago

        Not for this dyslexic.

        I tried it for a little while, a while back, but went back to the fonts I made a long while back.

  • hirihit640@sh.itjust.worksEnglish
    3·
    6 days ago

    I am also a bottom-right user. But browsers like Tor Browser and Mullvad Browser supposedly take care of javascript fingerprinting, at least if you check websites like amiunique.org. So I’m running out of reasons to disable javascript. What privacy reasons do you disable javascript for?

    • keiko@fedia.ioOP
      2·
      6 days ago

      Bottom left text gives reasons that relate to security, which is also related to privacy. I don’t trust arbitrary scripts, and I find it more convenient to simply disallow them. While css can theoretically be used to track mouse movements, that is typically done with javascripts, and I find that creepy af. I don’t like the feeling that I’m being observed. I get enough of that whenever I go outside into this dystopic world.

      So on that note, as I’ve said in some other comments within this thread, I prefer static pages from a UX perspective. Static pages feel comfy and safe, at least in comparison to the alternative. In contrast, javascripts tend to make the UX of sites worse in my view. So there aren’t any compelling reasons for me to allow them most of the time.

      It comes down to this: What do I gain by allowing javascripts? What I see is largely nothing. What do I lose by allowing javascripts? Comfort, calm, and a relaxed experience.

        • keiko@fedia.ioOP
          2·
          5 days ago

          Those issues concern me too, and as I’ve said in another comment somewhere, while it’s technically possible to do the same using css, it is actively used via javascripts. I remember reading an article a long time ago about how google’s cursor-fingerprinting was able to accurately diagnose parkinson’s symptons that were too subtle to detect any other way. And I don’t think that google has ever made any attempt to inform such users. That is the character of google. That with their massive powers, they never bother to do good without profit or further control.

      • keiko@fedia.ioOP
        1·
        4 days ago

        idk how I forgot to point that out, but thank you for doing so. Yes, without the scripts, load times are ⚡fast⚡