@sajith I’m so tired of people complaining about a handful of sites they use as if that defines the entirety of the web.

And it’s such a whiny entitled hill to die on.

It’s like grow up already.

@Are0h Yes indeed.

I find it odd that folk are complaining about web applications on Mastodon, a perfectly fine web application.

@cwebber I’m not sure where your point of disagreement is.

@Are0h Well you said "If you just want text, go read a book. Enough already." I'm just saying even without javascript the web gives us something that normal books don't

@cwebber Thats not the entirety of what I said.

There is space for both on the web. My point is that I’m tired of people saying the web should be this one thing.

That’s just silly and reductive.

@Are0h Ah sure I agree with that.

@cwebber Ha I know.

@Are0h I guess even with 500 chars nuance is hard to fit in too :)

Some points we probably agree on?
- Meltdown/Spectre means that atm probably all critical websites should have a "noscript compatible" version
- "app store"'ification of the web is bad, especially if JS and etc are permitted DRM (a world where nobody is imprisoned for right-click-view-source)
- Executable web security isn't great because browsers putting security after features, but we do want sandboxed execution to get better

@Are0h point 2 there is a legal one... if everyone could right click view source and study/learn what they can without threat of imprisonment this wouldn't be an issue

@Are0h In other words, "the executable web is potentially good, but there are some serious things we need to do to keep users safe and free!"

@cwebber @Are0h can we please spare a thought for the plight of users who have 2 GB of RAM who are left behind as sites like FB get increasingly Javascript-heavy and resource-intensive

@nev @Are0h I recently had to upgrade all our computers' RAM for this reason.

@Are0h @nev That said lighter resource websites aren't incompatible with the executable web being a thing. But we do need to push for that.

@cwebber @nev @Are0h does 'more js' necessarily imply 'more resources' and will it necessarily always imply that?

@swizzard @cwebber @Are0h 1. no, but in practice yes; 2. probably because tech is a fuck

@nev @cwebber @Are0h i guess i'm just a little confused why this is framed as such a Crisis

maybe it's because i was like 10 but people weren't freaking out when we had to buy a new computer so we could play win95-only games

@swizzard @cwebber @Are0h because increasingly we're talking about "practical applications people rely on" instead of "high end entertainment experiences"

@nev @cwebber @Are0h again, i was 10, but i'm pretty sure there were things that were win95-only besides games

@Are0h @cwebber i am all about the creative potential of the web!! but like I literally need to buy a whole new machine to use Google Drive

@cwebber Agreed.

@Are0h Yay! I'm glad to see that in general we already agreed. Defining the boundaries of consensus is useful :)

@cwebber

I don’t agree with no script. I think devs need to stop writing shitty code.

I’m still on the fence about that. We’re pushing the web in a direction it was never meant to go, so there are gonna be some growing pains. I like the idea of the web a platform but we need better tools. That’s gonna take time.

I do agree with that. I think we’re starting to see a trend where security is given priority so I
I’m optimistic.

@Are0h Well at the moment "devs, don't write shitty code" can't save you against rowhammer/meltdown/spectre because it's a problem at a layer *below* browsers... so you can visit any website and it can steal your sekrets and you wouldn't know it. A lot of that isn't developers.. it's hardware manufacturers! So the only thing that can semi-save you is to turn on noscript. It sucks.

Hopefully that's not a terrifying reality we have to live with long term though!

@cwebber Ah I didn’t say it was limited to web developers. Those particular bugs exploit how hardware interfaces interact with the system.

I’m a bit lenient with that because who could have predicted it, but yeah they need to improve as well.

Nah I don’t think it’s that terrifying. We just need to adapt has the web expands.

No script seems like a panicked response to an issue that needs some real thought.

Adapt, don’t just react, you know?

@Are0h @cwebber As a user, noscript is the only real defense currently available to me. The more sites play well with that, the happier I am.

This may change over time. But it could change for the worse first - attacks often get better before defense catches up.

@HerraBRE @cwebber And that’s fine in the meantime while we figure out how to deal with these new threats.

However the idea that the entire web should get rid of scripting altogether is what I have a problem with.

@Are0h @cwebber Oh, I agree, I write JS code myself! The web is an amazing platform.

One of the things that makes it amazing is how it has the capacity to gracefully enhance/degrade.

If I proclaim "sites should work well without JS!" (give me a pint or two and I might), my intent is:

"It is both possible and potentially in your interest to work well without JS, so cautious, casual users have a good experience and can become regulars who enable scripting and have an even better experience!!"

@HerraBRE @cwebber @Are0h alot of sites these days are actually almost exclusively script generated :-) using google's angular.js facebook's react.js etc...

@phiofx @cwebber @Are0h Yep!

These sites have made a trade: they have abandoned compatibility with the scriptless web in exchange for better developer tools.

This gives a bipolar experience. The site either works really well (better use of dev time), or doesn't work at all.

That's the right choice for some sites, but I will contend it's not the right choice for all.

I do wonder, are devs making that choice with their eyes open, or just hopping on bandwagons?

@HerraBRE @cwebber @Are0h

ha, indeed there are bandwagons galore (there are people that will adopt anythin google or facebook are pushing)

but there is also a core problem that we still dont have an optimal design how to split and organize the work between what the server is doing and what the browser is doing...

this is a problem if you want to create webapps that have professional "desktop" feel and functionality...

@phiofx @cwebber @Are0h I doubt there is any one "optimal design" - it will always depend on what you are doing.

As an example, having a good offline app experience requires modern JS magic, so you may as well use modern tools.

OTOH, if your site is basically long-tail blog with mostly casual visitors, or a search engine where users never ask the same question twice - anything which depends on the server to be useful, then graceful degradation and "web 2.0" techniques may be a fine fit.

@HerraBRE @cwebber Yeah I can definitely get down with that. It’s always a good thing to give users options.

I just don’t care for the we need to get rid off css/js altogether arguments. That is such foolish thought.

@Are0h @cwebber I agree it's mostly foolish. Especially wrt CSS!

JS is more nuanced. I will point out that the more annoying it is to browse the web with noscript, the less likely people are to do so.

Today, that means more people are put at risk of all sorts of nasty JS-based attacks. People aren't wrong to feel this is a problem.

Sticking with positive arguments, devs who make sites that gracefully degrade are helping users stay safe by making a secure browsing experience less awful. 😇

@HerraBRE @cwebber As a dev of some years, it’s always been like that and we’ve adapted through a combination of improving technologies and personal responsibility.

I don’t have a problem with people expressing concern as knowledge of the web works proliferates. I think people understanding it is a good thing for everyone.

What I do have a problem with having knee jerk reactions to issues that require more thought than tear it all down.

@Are0h @HerraBRE
> What I do have a problem with having knee jerk reactions to issues that require more thought than tear it all down.

I agree that this line of argument is rarely good. Another example I find unsatisfying is "tear it all down" when it comes to existing institutions when that call to action *isn't* coupled with an immediate plan to replace something with.

Lots of people do have suggestions on how to reform or replace systems, but calling for tear-down alone is the easy part.

@HerraBRE @Are0h So even "tear it all down" can be okay... but I want more than that :) What comes next? (And why is it better than reform?)

Perhaps the difficulty of conveying nuanced conversations in character-limited social networks results in a lot of this frustration and weak dialogue. This is one reason why I find that especially 140char twitter was the worst when it came to discussion... not enough space to elaborate.

@cwebber @Are0h I suspect a lot of the tear-it-all-down in this context comes from users who have decided NoScript (or even NoCSS) is something they need, and they rant from a place of frustration about how the web doesn't work well for them [anymore].

Maybe they're silly, maybe they have needs we're overlooking. I've seen both... but in either case, expecting frustrated people to make nuanced arguments is a tad optimistic IMO. 😜

@HerraBRE @cwebber @Are0h some of us have been building stuff for the web for rather a long time and have drifted into the conclusion that the web was in a bunch of essentials an extremely damaging mistake.

there aren't really a lot of us who feel that way who expect "tear it all down" to offer a literal solution. personally i think we're basically fucked. still, that people steeped in the tech & culture of it for so long feel that way can be instructive.

@HerraBRE @cwebber Ha, I’ll agree to disagree because there a plenty of us who a frustrated with many aspects of the web but we can still talk like adults.

If anything, I’d argue people who make such outlandish comments aren’t realistic interested in improving anything.

And that’s fine, but I think we need to be very careful about who we listen to. Some folks don’t want solutions.

@cwebber @HerraBRE Ha well it depends on the institution in question, but I understand the sentiment.

That said, I do believe collaboration to improve is generally preferable. I’m the context of the web, that’s how we’ve gotten here.

Suggesting to remove js from the process is counter to how we got all of the cool stuff we use today. It’s just nonsensical.

@herrabre @Are0h @cwebber I generally ignore sites that require JS or cookies to work. Keep your trackers, cryptominers, brute force attacks, etc. to yourself. Not to mention the digital tons of really, really crappy JS :)

@cwebber i dont understand your position here

@cwebber @Are0h and rowhammer.js

@kara you have no idea of what you’re talking about.

Just block me and save us both the annoyance

@Are0h your loss buddy

@kara I doubt that.

@gamehawk There are browsers that prioritize privacy. Brave is an example. And I feel it is one’s personal responsibility to know what kind of places they are giving their info too. Being responsible is just something one should do.

And I’m with you on sites that do that. My solution is to just not support those places.

@Are0h @gamehawk Privacy Badger and Brave don't protect you from fingerprinting. :)
It's difficult to protect yourself against that... We MUST make this kind of protections the standard.

@ekaitz_zarraga @gamehawk That’s a fair point but I will save Brave is raising awareness cancer how seriously we need to take our privacy.

Nothing is perfect but we’re getting there. It just takes a bit more care than most web users are used to

@Are0h @gamehawk Yeah yeah, I agree with all that but at the moment the best way to stay safe is BLOCK EVERYTHING.
It's **really** disgusting, I don't do it and I agree with you in your first post.

BUT

We have to punish more this kind of activities and raise awareness. (and make the tools to avoid the exploitation)

@Are0h Oh, true, but I don't so much demand absolute privacy (I do have Tor for that) as I do a reasonable compromise between "I want cool stuff on the web to work" and "I don't want Amazon to know every single place I go."

And yeah, there are a lot of places I just don't follow links to any more. (Or if I really really want to know what a conversation is about, I'll use the nuclear option: Lynx. 😜 )

@gamehawk Well I think as more people discover just how invasive the bigger sites are, they willing adjust. In the meantime, there are precautions that should be taken as opposed to just burning down the village.

Yeah same here. There are places I just don’t go because I know how intrusive they are.

@Are0h Yeah, I have introduced a *lot* of people to PB after they complained "I bought X on Amazon and now every site shows me ads for X." I'm afraid the arms race is staying ahead of the education race, though.