Hacker News Reader

Comment by gcr | Hacker News Reader

Case study: I help run a site that has resources for trans and LGBT people.

With a question as sensitive and personal as “am I transgender or not and how would I know,” it’s deeply important to me that visiting my website won’t accidentally get my users into trouble, even indirectly through tracking or federated cohort ad targeting.

- The only JavaScript is that which is necessary to run the site;

- The site only listens on HTTPS;

- There are no cookies;

- I explicitly opt users out of FLoC to prevent other sites targeting ads to my users based on my site’s content;

- I use a third-party hosting provider that only supplies aggregate passive server logs for a 30-day rolling window, which only shows me the domain name of the Referer, so I can’t know exactly where my users came from.

View on HN

Do you have a link to this website?

> The only JavaScript is that which is necessary to run the site

No JS is required to 'run' a site. I can and do use Hackernews without ever requiring JS to be enabled. Everything works via POST, it's quick and simple.

Yes. A Non-JS world is painful, and there are many difficulties, but ensuring your site works with noscript would do the world a huge favor.

You have no idea what site is it. Perhaps it's an interactive game or a questionnaire. POSTing that data to a server is much worse than running some clientside code. Your post is not productive at all.

> You’re right, JavaScript wouldn’t be necessary for my website. I agree that getting rid of it would increase accessibility.

Yeah, but you didn't know that when you wrote that comment.

If it's something like a resource locator or questionnaire, then doing the processing locally in JS is in fact better for privacy than sending personal data over the network. It's nice when websites work without JS but you are a deeply unserious engineer if you think that there are no tradeoffs involved.

Asceticism isn’t supposed to necessarily make sense to those outside the bubble.

I could see the idea of building a quiz or something with CSS and named anchors (links within the document). No JavaScript, everything all on one .html, and it would work on elinks!

But yeah, that’s certainly a bit of a novelty.

Isn't it possible to set cookies with CSS anyways? https://dev.to/astrit/how-to-set-a-cookie-with-css-3o16 Seems like there would potentially be a way to get cross-site tracking using only CSS, though I don't imagine many people looked into it (I haven't), largely because its a good assumption that your clients have JS enabled so if you want to track, just use JS -- especially because then you get full browser fingerprinting.

But I think "this site doesn't use JS so it must be safe" is...a really bad assumption.

They don't say that they run JS to run the site - they say that JS runs only to run the site. As in, they promise to use JS to only run the site.

You’re right, JavaScript wouldn’t be necessary for my website. I agree that getting rid of it would increase accessibility. Would love to be able for my site to be usable in elinks…

My post above was concerned most of all with privacy, and the only scripts are for page rendering, they’re hosted from my domain, and they make no network calls. Bytecode in, DOM nodes out, all on the user’s device.

Reply on news.ycombinator.com