So you are suggesting that half of web sites are not being built properly. Those sites that do not work when JavaScript is disabled are losing a huge section of their audience.
And it must certainly be a surprise to those who use the Internet just fine with Javascript turned off.
And tell all your friends and get them to tell their friends so that you can all go to a competitor who knows what they are doing.
Noscript is the first extension I always install. The only one making me use firefox.
XSS protection, click-jacking prevention, disabling of google tracker and easy to use whitelisting. Bonus : no more stupid unwanted flash and obnoxious ads.
If a website does not work at all (like full flash ones) when I first get there, they just lose one visitor.
Most other browsers have that functionality built in. Firefox and IE are the only ones where you need a plugin/extension to be able to turn scripts on and off as required.
I don’t know of any browsers that have built-in protection against XSS (other than basic same-domain-origin restrictions) or click-jacking.
I use noscript with firefox to disable JavaScript on all pages until I make them trusted. The added security is really reassuring in my web browsing.
Try to turn off google’s javascript on sitepoint with Opera.
Enjoy turning all sitepoints included js off or going in some submenus to put some string.
I prefer just using my mouse to open a menu where I can just disable js by domain in one click for each.
Well they technically do if you kill all JavaScript but you are correct, NoScript is a much better solution. It allows you to explicitly target the types of scripting being issued and which sites can run such scripts. Felgall might be correct in theory that having a plug-in could add to exposure but it should be pointed out that NoScript has a well established history of fast patching, regular updates and some highly respected security experts backing as a better way of controlling scripts on the web, one of whom is Steve Gibson. So personally I would say install and use it rather than turning scripting on and off regularly. 
And it must certainly be a surprise to those who use the Internet just fine with Javascript turned off.
Yeah, enough that I really notice when a site doesn’t work well without JS on. Besides parts of a certain “design” magazine (and commenting systems in general), I notice it on many forms (where the true function of the submit button is lost and javascript does all the submitting!) and I still see it a lot on drop-down menus, where the href’s on the top-level items are “#” and there’s no other way to get to the dropdowns’ options. Bleh. It seems many bloggities and contact forms rely much too much on client-side filters to save their sorry butts. My three biggest issues with JS are, keyboard is often forgotten, JS is always assumed to be on, and servers/server-side-scripting is often not used where it should be (or, reliance on the client when there shouldn’t be).
Forums like Sitepoint etc work just fine without JS and I haven’t found a reason to allow it on here at all. Most bloggities and articles are readable, and most of the time, search functions work (they notably don’t on the perldocs site, arg!). Most of the web for me works without JS, but then, I don’t go to sites that live off JS and require drag-n-dropness.
I keep JS turned off on my Linux browsers (and generally leave them on in my Windows browsers for testing) but one thing I like about NoScript is I can allow one script at a time. So, I can allow a site who uses googleapis for going to the next page (terrible practice I know) without turning on the tracker and the 15 other worthless scripts they’ve piled onto the page.
I do hope that is Opera’s next Feature, a per-script yes/no ability, like many browsers can do with cookies. I’ll take that over extravagance like Unite, Turbo or Links any day : )
(edit and if it’s already got that somewhere, pls pls tell me where it is!)
I’ve seen sites where the main navigation is done via javascript
Obviously such sites don’t want too many people visiting the other pages of the site.
Originally Posted by FastLionDesign
Security is a big reason javascript is turned off.
@Felgall: do you still stand by your comments?
Here is an article detailing a javascript vulnerability that could enable a hacker to take over a computer if a surfer visited a compromised website (admittedly only in IE).
http://www.webuser.co.uk/news/top-stories/431941/ie-users-warned-to-disable-javascript
Psh. And here’s why IE users won’t. : )
That and nobody reads that page… if this showed up on the front page of BBC, CNN, or whatever, with more explanation about what the exploit is and how it works blah blah, then possibly some people would do it… and then they’d turn it back on because they want all the functionality of their favourite web sites.
Those of us who keep it off are generally ok with fluff sites not doing all the singing and dancing, because we’ve only seen the pages like that in the first pace.
But someone using IE who’s always had JS on, they have a harder time surfing with it off.
All the more reason to make sure websites WORK (function) without client-side scripts. Functionality might = behaviour, but I don’t believe all behaviour belongs under client-side scripting.
Internet Explorer is the one browser that doesn’t support JavaScript.
Instead Internet Explorer supports JScript and VBScript.
JavaScript is close enough to a subset of JScript to be able to write code using feature sensing to detect and handle the differences provided that you start with JavaScript and modify it to work as JScript. There are lots of JScript commands that don’t have a Javascript equivalent.
There are a few JavaScript commands that require activeX to work as JScript and those are the areasd most vulnerable.
You can’t disable JavaScript in IE because IE doesn’t support JavaScript at all.
The main reason for disabling JScript is with IE6 where there are a lot of vulnerabilities in activeX and so you really ought to disable activeX when using that browser so as to plug hundered of known security holes. If you do that then you get an alert that activeX is disabled every time you load a page unless you also turn off active scripting to disable JScript and VBScript. Most of those activeX vulnerabilities were fixed in IE7.
The only browser where client side scripting is a potential security issue is Internet Explorer and that is the one browser where people are least likely to turn off scripting as it is the browser that tends to be most used by people who are least aware of those issues since the easiest way to fix the security issues in old versions of IE is to switch to a different browser.
Since running JavaScript in a modern browser does not have security issues, security is not a reason for disabling JavaScript.
Agreed, when IE talks about “Active Scripting”, it’s talking about it’s ActiveX components (including it’s support for VBScript) rather than it’s own implementation of JavaScript (JScript). Where as JavaScript (as properly implemented) is sandboxed in such a manner where it cannot affect anything outside of the browser, and what it can affect within the browser is seriously limited, Internet Explorer (in Microsoft’s wisdom) has no such sandboxing in effect, apart from it’s default security measures, VBScript and ActiveX are granted complete access to your computer from the point of execution, to the point of having full user control. This is dangerous if your running as an administrator because it essentially gives the browser “superuser” control. I don’t use IE as my default browser and I always have Active Scripting disabled within it because it’s simply too poorly implemented and dangerously cavalier about what script’s can do
Ditto. The only thing I use IE for is to test my own web pages. I don’t even use it for my hotmail account any more.
I don’t use IE as my default browser and I always have Active Scripting disabled within it because it’s simply too poorly implemented and dangerously cavalier about what script’s can do
Is this different than “setting security settings to High” which seems to stop any scripts from running when I test pages? It doesn’t say anything about Active X, which I do not write on my pages and do not test for (though I assume it disables that too).
I leave it (scripts) on in my IE’s, but they’re either on someone else’s machine (work machine, I don’t care what nasties live in there) or on my Virtual Box, which is simply a separate operating system and has no access to my OS.
Hi,
So, I’m just wondering about this, as this is genuinely a subject that has interested me for quite a while.
A quick Google search for “javascript vulnerability firefox” turns out 366,000 results. The first site (at least in google.de) is mozilla.com, which informs us:
A bug discovered last week in Firefox 3.5’s Just-in-time (JIT) JavaScript compiler was disclosed publicly yesterday. It is a critical vulnerability that can be used to execute malicious code.
It goes on to say that the vulnerability can be mitigated by disabling the JIT in the JavaScript engine. Another site reporting the same vulnerability also recommends using the noscript add on to acheive the same thing.
Again, you can argue that it’s not JavaScript that is insecure, rather the JIT compiler. The point remains that one is better protected if one has the noscript extension enabled.
I would be glad to hear people’s thoughts on this.
Last I read (I admit this was a while ago now), No-Script was the only known browser feature or extension that could protect or warn against clickjacking. I wouldn’t doubt tho that by now there was something similar people could get for IE…