Hacker News Reader

Totally unrelated to this cable, but since you mention it...

I've been trying to build web/single page applications using new ES modules and no build tool, so all dependencies are pulled from their creator/CDN rather than bundled locally. Would this set off flags for a no-script user?

View on HN

If they use pure noscript with scripts disabled globally, then yes, it’ll just be unable to load the one first-party script.

The more domains you load JS from, the more entities have control over what happens on that page, and the higher the risk that one of those entities is trying to do something nefarious. So yes, loading all the scripts from one place will set off fewer alarm bells, at least for me.

Reply on news.ycombinator.com