Hacker News Reader

Comment by jwilk | Hacker News Reader

https://support.torproject.org/tbb/tbb-34/

> We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them.

View on HN

That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff.

[1] https://openresty.org/, https://github.com/openresty/lua-nginx-module

What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it.

(Fuck you imgur)

LibRedirect (https://libredirect.github.io/) can proxy Imgur, Fandom, Medium, and other links to no-JS alternative proxies, though some of the proxies are down or have broken Fandom images, and you have to disable the specific websites so you won't be redirected again.

if I build a site using react, is there a way to fallback to plain HTML?

It's called SSR, but unless you invest a ton of effort into architecture, it won't fallback to the point where buttons and links still work without js, it will just render.

if it's statically generated, yes. you can write an entire site in React using eg GatsbyJS, and it will be built ahead of time, and pages will be available as static HTML.

Yikes. I thought the point of Tor was uncompromising security? This is going to bite some less-experienced people in the ass.

It has.

The NoScript approach is dumb because it easily supports temporary and permanent white-listing of sites, which is agreeable to many (but still problematic depending on what your risk profile).

With NoScript’s current approach, you get ruined when your JavaScript-free-optimized starts sending you nasty JavaScript.

JavaScript used to be disabled by default but too many users were complaining about pages not working. It's not very useful if you're a CFO trying to leak financial documents to a journalist but the website won't work.

Tech-literate people use JavaScript.enabled=false in about:config.

You don't even need to use about:config, it is as simple as setting Security level to "Highest" using the button on the toolbar

Reply on news.ycombinator.com