Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

from https://www.mediawiki.org/wiki/No-JavaScript_notes

2021: NoScript has between 100,000 and 1,000,000 installs on Chrome[1], and approximately 330,000 installs on Firefox[2]. NoScript is a "recommended extension" by Mozilla, and is one of the very few addons available for Mobile Firefox. (newer stats, and other reliable sources, would be appreciated. Statcounter doesn't yet reveal no-JS usage)

Internal

2015: ~3% using browsers that do not support JavaScript per Analytics/Reports/Clients without JavaScript#Preliminary results

2016: ~7% of visitors to Wikipedia Portal do not request JavaScript resources per File:Browsers, Geography, and JavaScript Support on Wikipedia Portal.pdf and File:Analysis of Wikipedia Portal Traffic and JavaScript Support.pdf

2020: Per T253033 (methodology in T234865), 13.84% of sub-A tier Desktop, and 36.48% sub-A tier mobile web page views are from browsers without JS support.

2021: Measuring the % of edits coming from users without JS enabled across all Wikimedia wikis: ~6% of logged-in users and ~1% of logged-out users (~5% total). Per T240697.

Perhaps the pervasive use of JS forces people to enable it. I disable it and when things work, they are fast and wonderfully ad-free (or greatly cut down; I do further ad blocking). JS is a security risk IMO.



> JS is a security risk IMO.

A network connection is a security risk.

The question is whether the benefits outweighs the risk added by enabling it.

For me the benefit of disabling JS is more in privacy and disabling annoying user experience. JavaScriot runtimes are quite well audited meanwhile.


And a turing complete language delivered from a third party over said network connection to be executed locally will exponentially increases that risk, no?

> JavaScriot runtimes are quite well audited meanwhile.

Given (for example) the leftpad trainwreck, is that really true?


> > JavaScriot runtimes are quite well audited meanwhile.

> Given (for example) the leftpad trainwreck, is that really true?

That was that some (quite pointless) code was not available anymore as easily. Not a security issue.


That's entirely irrelevant. It was available, got used, and things massively fell over when it was pulled. You've given no case to show things have changed - can you actually give any evidence that 'JavaScriot runtimes are quite well audited'.


Correct, leftpad ia completely irrelevant for the discussion.


And helloooo eternal september. You haven't a clue.


It really was a non-event.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: