JavaScript - Revision history

Rudxain: ext-links: UK Gov guide for PA

2026-05-28T18:58:15Z

ext-links: UK Gov guide for PA

← Older revision		Revision as of 18:58, 28 May 2026
Line 80:		Line 80:
	*https://gomakethings.com/why-progressive-enhancement-still-matters/		*https://gomakethings.com/why-progressive-enhancement-still-matters/
	*https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation		*https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation
			*[https://www.gov.uk/service-manual/technology/using-progressive-enhancement Building a robust frontend using progressive enhancement]. A guide for UK government websites to ensure information is accessible in a wide range of situations, devices, and browsers.
	*[https://youtu.be/xE9W9Ghe4Jk "Shipping a button in 2026…"], by Kai Lentit. This illustrates the burnout and fatigue software developers can experience on a daily basis		*[https://youtu.be/xE9W9Ghe4Jk "Shipping a button in 2026…"], by Kai Lentit. This illustrates the burnout and fatigue software developers can experience on a daily basis
	*[https://grugbrain.dev/#grug-on-front-end-development HTMX developer advocating for less JS]		*[https://grugbrain.dev/#grug-on-front-end-development HTMX developer advocating for less JS]

Rudxain: Scraping: remove links that are already in main article

2026-05-25T20:25:44Z

Scraping: remove links that are already in main article

← Older revision		Revision as of 20:25, 25 May 2026
Line 55:		Line 55:
	===Scraping===		===Scraping===
	{{Main\|Artificial intelligence/training}}		{{Main\|Artificial intelligence/training}}
	Since the rise of big LLM's many brokers<!-- link to data brokers? --> have started offering scraping services for companies that want more training data for their AI. And to that end, a lot of [[wikipedia:Headless_browser\|headless browser]] agents have begun to scrape (collect a sites information provided) even with the site's <code>robots.txt</code> provided as a common standard to tell agents not to do so. This has lead to many forums and websites that had not used JS before to start implementing ~~[[CAPTCHA\|~~CAPTCHAS~~]] (or [[wikipedia:Anubis_(software)\|Anubis]])~~, to prevent increased overhead and bandwidth costs.		Since the rise of big LLM's many brokers<!-- link to data brokers? --> have started offering scraping services for companies that want more training data for their AI. And to that end, a lot of [[wikipedia:Headless_browser\|headless browser]] agents have begun to scrape (collect a sites information provided) even with the site's <code>robots.txt</code> provided as a common standard to tell agents not to do so. This has lead to many forums and websites that had not used JS before to start implementing CAPTCHAS, to prevent increased overhead and bandwidth costs.

	==Incidents==		==Incidents==

Rudxain: CSS exfil mentioned in new article

2026-04-26T01:13:55Z

CSS exfil mentioned in new article

← Older revision		Revision as of 01:13, 26 April 2026
Line 21:		Line 21:
	*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the [[Google]]-[[Mozilla]] duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>		*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the [[Google]]-[[Mozilla]] duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>
	*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]~~<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ -->~~ '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]] '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>
	*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref name=":0">{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=16 Mar 2026 \|access-date=19 Mar 2026 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere -->		*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref name=":0">{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=16 Mar 2026 \|access-date=19 Mar 2026 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere -->
	*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].		*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].

Rudxain: move G and Moz links to new 1st occurrence; also because the 1st-ocur aren't in parentheses

2026-04-26T00:13:19Z

move G and Moz links to new 1st occurrence; also because the 1st-ocur aren't in parentheses

← Older revision		Revision as of 00:13, 26 April 2026
Line 19:		Line 19:

	*'''Degraded accessibility''': Dynamic and/or active content is well-known to have poor accessibility for users with visual and/or cognitive impairments. While standards such as [[wikipedia:WAI-ARIA\|WAI-ARIA]] were created to mitigate this, it's no silver bullet, especially when developers aren't aware of ARIA.		*'''Degraded accessibility''': Dynamic and/or active content is well-known to have poor accessibility for users with visual and/or cognitive impairments. While standards such as [[wikipedia:WAI-ARIA\|WAI-ARIA]] were created to mitigate this, it's no silver bullet, especially when developers aren't aware of ARIA.
	*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the Google-Mozilla duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>		*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the [[Google]]-[[Mozilla]] duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>
	*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>
Line 41:		Line 41:

	===Security===		===Security===
	Browser-engine developers (such as [[Google]] and [[Mozilla]]) not only feel compelled, but are financially incentivized to optimize JS to its limits. This leads to complex code-bases that are harder to verify for correctness. Browser vendors mitigate this via [[wikipedia:Sandbox_(computer_security)\|sandboxing]]. Unfortunately, since modern browsers compile JS to native CPU code (see [[wikipedia:Just-in-time_compilation\|JIT]]) to improve performance, this introduces a higher risk of sandbox-escape.<ref>{{Cite web \|last=Norman \|first=Johnathan \|date=4 Aug 2021 \|title=Super Duper Secure Mode \|url=https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ \|url-status=live \|archive-url=https://web.archive.org/web/20260218110912/https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode \|archive-date=18 Feb 2026 \|access-date=19 Mar 2026 \|website=Microsoft Browser Vulnerability Research}}</ref> Some examples of this are as follows:		Browser-engine developers (such as Google and Mozilla) not only feel compelled, but are financially incentivized to optimize JS to its limits. This leads to complex code-bases that are harder to verify for correctness. Browser vendors mitigate this via [[wikipedia:Sandbox_(computer_security)\|sandboxing]]. Unfortunately, since modern browsers compile JS to native CPU code (see [[wikipedia:Just-in-time_compilation\|JIT]]) to improve performance, this introduces a higher risk of sandbox-escape.<ref>{{Cite web \|last=Norman \|first=Johnathan \|date=4 Aug 2021 \|title=Super Duper Secure Mode \|url=https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ \|url-status=live \|archive-url=https://web.archive.org/web/20260218110912/https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode \|archive-date=18 Feb 2026 \|access-date=19 Mar 2026 \|website=Microsoft Browser Vulnerability Research}}</ref> Some examples of this are as follows:

	*[[wikipedia:Cross-site_scripting\|XSS]], which [[wikipedia:NoScript\|NoScript]] tries to mitigate		*[[wikipedia:Cross-site_scripting\|XSS]], which [[wikipedia:NoScript\|NoScript]] tries to mitigate

Rudxain: JS isn't just for "complex" stuff; sockets can improve latency

2026-04-25T03:19:25Z

JS isn't just for "complex" stuff; sockets can improve latency

← Older revision		Revision as of 03:19, 25 April 2026
Line 36:		Line 36:

	===Tracking===		===Tracking===
	Many webpages (and even entire websites), force the user to keep JS enabled, otherwise they break or deliberately refuse to work. CSS stylesheets combined with HTML<!-- TO-DO: cite `<portal>`. I remember an entire website that demos/showcases the Portal API, but can't find it. `<portal>` fixed the fundamental problem that SPAs try to solve, with minimal (or zero!) JS --> should be fine with most basic websites or webpages that do not need complex client side interaction.		Many webpages (and even entire websites), force the user to keep JS enabled, otherwise they break or deliberately refuse to work. CSS stylesheets combined with HTML<!-- TO-DO: cite `<portal>`. I remember an entire website that demos/showcases the Portal API, but can't find it. `<portal>` fixed the fundamental problem that SPAs try to solve, with minimal (or zero!) JS --> should be fine with most basic websites/webpages that do not need complex client-side interaction or low-latency server communication.<!-- see Web-Sockets -->

	The data collected by malicious JS makes it trivial to serve [[personalized ads]], even across unrelated sites. Some sites collect so much data that they are indistinguishable from [[spyware]] (see also [[wikipedia:Keystroke_logging\|key-logging]]).<ref>{{Cite web \|last=Hill \|first=Kashmir \|date=20 Jun 2017 \|title=Before You Hit ‘Submit,’ This Company Has Already Logged Your Personal Data \|url=https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|url-status=live \|archive-url=https://web.archive.org/web/20260220091637/https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|archive-date=20 Feb 2026 \|access-date=19 Mar 2026 \|website=Gizmodo}}</ref>		The data collected by malicious JS makes it trivial to serve [[personalized ads]], even across unrelated sites. Some sites collect so much data that they are indistinguishable from [[spyware]] (see also [[wikipedia:Keystroke_logging\|key-logging]]).<ref>{{Cite web \|last=Hill \|first=Kashmir \|date=20 Jun 2017 \|title=Before You Hit ‘Submit,’ This Company Has Already Logged Your Personal Data \|url=https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|url-status=live \|archive-url=https://web.archive.org/web/20260220091637/https://gizmodo.com/before-you-hit-submit-this-company-has-already-logge-1795906081 \|archive-date=20 Feb 2026 \|access-date=19 Mar 2026 \|website=Gizmodo}}</ref>

JodyBruchonFan: /* Consumer impact summary */ It's not just about old browsers but also minimalist lightweight ones that are alternatives to the Google-Mozilla duopoly.

2026-04-22T07:55:24Z

Consumer impact summary: It's not just about old browsers but also minimalist lightweight ones that are alternatives to the Google-Mozilla duopoly.

← Older revision		Revision as of 07:55, 22 April 2026
Line 19:		Line 19:

	*'''Degraded accessibility''': Dynamic and/or active content is well-known to have poor accessibility for users with visual and/or cognitive impairments. While standards such as [[wikipedia:WAI-ARIA\|WAI-ARIA]] were created to mitigate this, it's no silver bullet, especially when developers aren't aware of ARIA.		*'''Degraded accessibility''': Dynamic and/or active content is well-known to have poor accessibility for users with visual and/or cognitive impairments. While standards such as [[wikipedia:WAI-ARIA\|WAI-ARIA]] were created to mitigate this, it's no silver bullet, especially when developers aren't aware of ARIA.
	*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes it impossible ~~for~~ legacy systems ~~to access a website at all~~, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref>		*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the Google-Mozilla duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>
	*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>
Line 25:		Line 25:
	*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].		*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].
	*'''Degraded performance (web apps)''': "Web apps" load slower than traditional web sites because lots of code has to be processed by the web browser before any content can appear on screen, putting the content at the end of the rendering path.<ref>{{cite web \|title=Critical rendering path – Mozilla Developer Network \|url=https://developer.mozilla.org/en-US/docs/Web/Performance/Guides/Critical_rendering_path \|access-date=2026-04-18 }}</ref>		*'''Degraded performance (web apps)''': "Web apps" load slower than traditional web sites because lots of code has to be processed by the web browser before any content can appear on screen, putting the content at the end of the rendering path.<ref>{{cite web \|title=Critical rendering path – Mozilla Developer Network \|url=https://developer.mozilla.org/en-US/docs/Web/Performance/Guides/Critical_rendering_path \|access-date=2026-04-18 }}</ref>

	==How it works==		==How it works==
	Whenever a user visits a webpage, an average web-browser will execute the JS code it finds in <code><script></code> [[wikipedia:HTML_element\|tags]]. This code could do anything from updating part of the [[wikipedia:Document_Object_Model\|DOM]]-tree only when the user requests it, to showing a [[wikipedia:Pop-up_ad\|popup/popunder]].		Whenever a user visits a webpage, an average web-browser will execute the JS code it finds in <code><script></code> [[wikipedia:HTML_element\|tags]]. This code could do anything from updating part of the [[wikipedia:Document_Object_Model\|DOM]]-tree only when the user requests it, to showing a [[wikipedia:Pop-up_ad\|popup/popunder]].

Rudxain: specific URL for Gemini FAQ

2026-04-21T22:59:59Z

specific URL for Gemini FAQ

← Older revision		Revision as of 22:59, 21 April 2026
Line 65:		Line 65:

	*'''Extension''': turning JS into an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]], so that users can choose to install it, is a way to discourage abuse and incentivize static/passive pages. To do this, JS must be deprecated as a Web Standard, but not deprecated as language or API.		*'''Extension''': turning JS into an [[wikipedia:Browser_extension\|extension]] or [[wikipedia:Plug-in_(computing)\|plug-in]], so that users can choose to install it, is a way to discourage abuse and incentivize static/passive pages. To do this, JS must be deprecated as a Web Standard, but not deprecated as language or API.
	*'''Deprecation''': John Gruber says that JS should never have been added to browsers.<ref>{{Cite web \|last=Gruber \|first=John \|date=22 Jun 2017 \|title=Gizmodo Investigation Exposes Websites Collecting Form Data Before You Hit 'Submit' \|url=https://daringfireball.net/linked/2017/06/22/navistone-form-data \|url-status=live \|archive-url=https://web.archive.org/web/20260319180650/https://daringfireball.net/linked/2017/06/22/navistone-form-data \|archive-date=19 Mar 2026 \|access-date=20 Mar 2026 \|website=Daring Fireball}}</ref><ref>{{Cite web \|last=Gruber \|first=John \|date=27 Jun 2017 \|title=Using Today's Web Without JavaScript \|url=https://daringfireball.net/linked/2017/06/27/web-without-javascript \|url-status=live \|archive-url=https://web.archive.org/web/20260319180612/https://daringfireball.net/linked/2017/06/27/web-without-javascript \|archive-date=19 Mar 2026 \|access-date=20 Mar 2026 \|website=Daring Fireball}}</ref> The [[wikipedia:Gopher_(protocol)\|Gopher]] and [[wikipedia:Gemini_(protocol)\|Gemini]] projects advocate for a simpler web.<ref>{{Cite web \|title=Project Gemini \|url=https://geminiprotocol.net/ \|access-date=13 Apr 2026}}</ref> If JS were to be completely removed from the web, this would allow users to navigate without worrying about invisible tracking.<ref>{{Cite web \|date=2 Sep 2023 \|title=Project Gemini FAQ § Why not just use a subset of HTTP and HTML? \|url=https://geminiprotocol.net/docs/faq.gmi#79-why-not-just-use-a-subset-of-http-and-html \|access-date=13 Apr 2026}}</ref> Even if not all JS was removed, this would allow tools like [[wikipedia:UBlock_Origin\|uBO]] to adapt their filters for non-JS users.<ref>https://github.com/Rudxain/blog/blob/a326c9db28c9f7eb6e30e6a737ca4aeae0d2ee39/post/js-abuse.md#to-do</ref>		*'''Deprecation''': John Gruber says that JS should never have been added to browsers.<ref>{{Cite web \|last=Gruber \|first=John \|date=22 Jun 2017 \|title=Gizmodo Investigation Exposes Websites Collecting Form Data Before You Hit 'Submit' \|url=https://daringfireball.net/linked/2017/06/22/navistone-form-data \|url-status=live \|archive-url=https://web.archive.org/web/20260319180650/https://daringfireball.net/linked/2017/06/22/navistone-form-data \|archive-date=19 Mar 2026 \|access-date=20 Mar 2026 \|website=Daring Fireball}}</ref><ref>{{Cite web \|last=Gruber \|first=John \|date=27 Jun 2017 \|title=Using Today's Web Without JavaScript \|url=https://daringfireball.net/linked/2017/06/27/web-without-javascript \|url-status=live \|archive-url=https://web.archive.org/web/20260319180612/https://daringfireball.net/linked/2017/06/27/web-without-javascript \|archive-date=19 Mar 2026 \|access-date=20 Mar 2026 \|website=Daring Fireball}}</ref> The [[wikipedia:Gopher_(protocol)\|Gopher]] and [[wikipedia:Gemini_(protocol)\|Gemini]] projects advocate for a simpler web.<ref>{{Cite web \|title=Project Gemini \|url=https://geminiprotocol.net/ \|access-date=13 Apr 2026}}</ref> If JS were to be completely removed from the web, this would allow users to navigate without worrying about invisible tracking.<ref>{{Cite web \|date=2 Sep 2023 \|title=Project Gemini FAQ § Why not just use a subset of HTTP and HTML? \|url=https://geminiprotocol.net/docs/faq-section-7.gmi#79-why-not-just-use-a-subset-of-http-and-html \|access-date=13 Apr 2026}}</ref> Even if not all JS was removed, this would allow tools like [[wikipedia:UBlock_Origin\|uBO]] to adapt their filters for non-JS users.<ref>https://github.com/Rudxain/blog/blob/a326c9db28c9f7eb6e30e6a737ca4aeae0d2ee39/post/js-abuse.md#to-do</ref>
	*'''Feature-freeze''': There has been discussion about feature-freezing JS so that it becomes "JS0" (for lack of better name).<ref>https://docs.google.com/presentation/d/1ylROTu3N6MyHzNzWJXQAc7Bo1O0FHO3lNKfQMfPOA4o/</ref> The main purpose is to make it easier for browser implementers to keep browsers secure and stable.		*'''Feature-freeze''': There has been discussion about feature-freezing JS so that it becomes "JS0" (for lack of better name).<ref>https://docs.google.com/presentation/d/1ylROTu3N6MyHzNzWJXQAc7Bo1O0FHO3lNKfQMfPOA4o/</ref> The main purpose is to make it easier for browser implementers to keep browsers secure and stable.

Rudxain: rm "See also", cause the only link is broken

2026-04-18T23:01:39Z

rm "See also", cause the only link is broken

← Older revision		Revision as of 23:01, 18 April 2026
Line 89:		Line 89:
	*[https://tobyho.com/2010/03/11/how-much-of-the-web-actually/ "How Much of the Web Actually Work Without Javascript"]		*[https://tobyho.com/2010/03/11/how-much-of-the-web-actually/ "How Much of the Web Actually Work Without Javascript"]
	*[https://github.com/Rudxain/blog/blob/main/post/js-abuse.md Blog-post with more sources]<!-- TO-DO -->		*[https://github.com/Rudxain/blog/blob/main/post/js-abuse.md Blog-post with more sources]<!-- TO-DO -->

	~~==See also==~~

	*[[Electron]]

	==References==		==References==

Rudxain: more specific "grug" link

2026-04-18T22:50:13Z

more specific "grug" link

← Older revision		Revision as of 22:50, 18 April 2026
Line 80:		Line 80:
	*https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation		*https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation
	*[https://youtu.be/xE9W9Ghe4Jk "Shipping a button in 2026…"], by Kai Lentit. This illustrates the burnout and fatigue software developers can experience on a daily basis		*[https://youtu.be/xE9W9Ghe4Jk "Shipping a button in 2026…"], by Kai Lentit. This illustrates the burnout and fatigue software developers can experience on a daily basis
	*[https://grugbrain.dev/ HTMX developer advocating for less JS]		*[https://grugbrain.dev/#grug-on-front-end-development HTMX developer advocating for less JS]
	*[https://idlewords.com/talks/website_obesity.htm "Web Obesity Crisis"]		*[https://idlewords.com/talks/website_obesity.htm "Web Obesity Crisis"]
	*[https://tonsky.me/blog/js-bloat JS bloat (2024)]		*[https://tonsky.me/blog/js-bloat JS bloat (2024)]

Rudxain: rm "PE important" ext-link, as it's now a citation

2026-04-18T22:19:04Z

rm "PE important" ext-link, as it's now a citation

← Older revision		Revision as of 22:19, 18 April 2026
Line 77:		Line 77:
	*[https://eev.ee/blog/2016/03/06/maybe-we-could-tone-down-the-javascript "Maybe we could tone down the JavaScript"]		*[https://eev.ee/blog/2016/03/06/maybe-we-could-tone-down-the-javascript "Maybe we could tone down the JavaScript"]
	*[https://www.kryogenix.org/code/dont-need-that-js "You really don't need all that JavaScript, I promise"]		*[https://www.kryogenix.org/code/dont-need-that-js "You really don't need all that JavaScript, I promise"]
	*[https://jakearchibald.com/2013/progressive-enhancement-still-important "Progressive Enhancement Still Important"]
	*https://gomakethings.com/why-progressive-enhancement-still-matters/		*https://gomakethings.com/why-progressive-enhancement-still-matters/
	*https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation		*https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation

← Older revision		Revision as of 01:13, 26 April 2026
Line 21:		Line 21:
	*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the [[Google]]-[[Mozilla]] duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>		*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the [[Google]]-[[Mozilla]] duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>
	*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]~~<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ -->~~ '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]] '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>
	*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref name=":0">{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=16 Mar 2026 \|access-date=19 Mar 2026 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere -->		*'''Market control''': JS is built into almost every web-browser and [[wikipedia:User_agent\|user-agent]] (UA), including "light-weight" ones (such as [[wikipedia:W3m\|w3m]]), incentivizing companies to use it for everything, since "there's no need to worry about compatibility or portability".<ref name=":0">{{Cite web \|title=Everyone has JavaScript, right? \|url=https://www.kryogenix.org/code/browser/everyonehasjs \|url-status=live \|archive-url=https://web.archive.org/web/20260316024516/https://www.kryogenix.org/code/browser/everyonehasjs.html \|archive-date=16 Mar 2026 \|access-date=19 Mar 2026 \|website=Kryogenix Consulting}}</ref><!-- We need another citation here. The current one is relevant, but doesn't cite anyone who assumes JS is portable. Ideally, it should cite an entity using that quote as an excuse to add JS everywhere -->
	*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].		*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].

← Older revision		Revision as of 00:13, 26 April 2026
Line 19:		Line 19:

	*'''Degraded accessibility''': Dynamic and/or active content is well-known to have poor accessibility for users with visual and/or cognitive impairments. While standards such as [[wikipedia:WAI-ARIA\|WAI-ARIA]] were created to mitigate this, it's no silver bullet, especially when developers aren't aware of ARIA.		*'''Degraded accessibility''': Dynamic and/or active content is well-known to have poor accessibility for users with visual and/or cognitive impairments. While standards such as [[wikipedia:WAI-ARIA\|WAI-ARIA]] were created to mitigate this, it's no silver bullet, especially when developers aren't aware of ARIA.
	*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the Google-Mozilla duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>		*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the [[Google]]-[[Mozilla]] duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>
	*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>
Line 41:		Line 41:

	===Security===		===Security===
	Browser-engine developers (such as [[Google]] and [[Mozilla]]) not only feel compelled, but are financially incentivized to optimize JS to its limits. This leads to complex code-bases that are harder to verify for correctness. Browser vendors mitigate this via [[wikipedia:Sandbox_(computer_security)\|sandboxing]]. Unfortunately, since modern browsers compile JS to native CPU code (see [[wikipedia:Just-in-time_compilation\|JIT]]) to improve performance, this introduces a higher risk of sandbox-escape.<ref>{{Cite web \|last=Norman \|first=Johnathan \|date=4 Aug 2021 \|title=Super Duper Secure Mode \|url=https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ \|url-status=live \|archive-url=https://web.archive.org/web/20260218110912/https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode \|archive-date=18 Feb 2026 \|access-date=19 Mar 2026 \|website=Microsoft Browser Vulnerability Research}}</ref> Some examples of this are as follows:		Browser-engine developers (such as Google and Mozilla) not only feel compelled, but are financially incentivized to optimize JS to its limits. This leads to complex code-bases that are harder to verify for correctness. Browser vendors mitigate this via [[wikipedia:Sandbox_(computer_security)\|sandboxing]]. Unfortunately, since modern browsers compile JS to native CPU code (see [[wikipedia:Just-in-time_compilation\|JIT]]) to improve performance, this introduces a higher risk of sandbox-escape.<ref>{{Cite web \|last=Norman \|first=Johnathan \|date=4 Aug 2021 \|title=Super Duper Secure Mode \|url=https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ \|url-status=live \|archive-url=https://web.archive.org/web/20260218110912/https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode \|archive-date=18 Feb 2026 \|access-date=19 Mar 2026 \|website=Microsoft Browser Vulnerability Research}}</ref> Some examples of this are as follows:

	*[[wikipedia:Cross-site_scripting\|XSS]], which [[wikipedia:NoScript\|NoScript]] tries to mitigate		*[[wikipedia:Cross-site_scripting\|XSS]], which [[wikipedia:NoScript\|NoScript]] tries to mitigate

← Older revision		Revision as of 07:55, 22 April 2026
Line 19:		Line 19:

	*'''Degraded accessibility''': Dynamic and/or active content is well-known to have poor accessibility for users with visual and/or cognitive impairments. While standards such as [[wikipedia:WAI-ARIA\|WAI-ARIA]] were created to mitigate this, it's no silver bullet, especially when developers aren't aware of ARIA.		*'''Degraded accessibility''': Dynamic and/or active content is well-known to have poor accessibility for users with visual and/or cognitive impairments. While standards such as [[wikipedia:WAI-ARIA\|WAI-ARIA]] were created to mitigate this, it's no silver bullet, especially when developers aren't aware of ARIA.
	*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes it impossible ~~for~~ legacy systems ~~to access a website at all~~, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref>		*'''Degraded compatibility''': While HTML and CSS degrade gracefully, meaning web browsers not supporting a certain feature will simply ignore it and load the rest of the page, JavaScript does not. If any JavaScript feature is not supported by a web browser and not caught using a <code>try</code>...<code>catch</code> block, the rest of the script is not executed, which usually breaks the entire site if it requires JavaScript for basic functions, as "web apps" usually do. This makes accessing a website impossible from legacy systems that do not support recent web browser versions or minimalist web browsers that challenge the Google-Mozilla duopoly, rather than being able to use some parts of a website.<ref>{{cite web \|url=https://jakearchibald.com/2013/progressive-enhancement-still-important/ \|title=Progressive enhancement is still important - JakeArchibald.com \|date=2013-07-03 \|access-date=2026-04-18 }}</ref><ref>{{cite web \|url=https://digdeeper.club/articles/browsers.xhtml#minimal \|title=How to choose a browser for everyday use? § Why "minimalist" browsers suck. \|author=Dig Deeper \|access-date=2026-04-22 }}</ref>
	*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>		*'''Lack of transparency''': To optimize network bandwidth, JS code is typically served in [[wikipedia:Minification_(programming)\|minified]] form, which makes it harder to understand for humans. This is particularly problematic if the original source is not publicly [[wikipedia:Source-available_software\|available]], which is typically the case of [[wikipedia:Proprietary_software\|proprietary software]].<ref>{{Cite web \|last=Gross \|first=Carson \|date=21 Sep 2023 \|title=The #ViewSource Affordance \|url=https://htmx.org/essays/right-click-view-source/ \|url-status=live \|archive-url=https://web.archive.org/web/20260228105626/https://htmx.org/essays/right-click-view-source/ \|archive-date=28 Feb 2026 \|access-date=24 Mar 2026 \|website=</> htmx ~ Essays}}</ref>
	*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>		*'''Excessive tracking''': JS is much more capable than HTML and [[CSS]]<!-- See "CSS Exfil": https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense/ --> '''combined''' to track user behavior.<ref>https://clickclickclick.click/</ref> JS can communicate with almost any server (only limited by [[wikipedia:Cross-origin_resource_sharing\|CORS]]) at any time (limited by connection availability), using a plethora of protocols. JS can get hardware information and compute a [[Device fingerprint\|fingerprint of the device]], user, or both.<ref>https://privacycheck.sec.lrz.de/</ref><ref>https://abrahamjuliot.github.io/creepjs</ref><ref>https://www.deviceinfo.me/</ref><ref>{{Cite web \|title=Learn how identifiable you are on the Internet \|url=https://www.amiunique.org/ \|url-status=live \|access-date=19 Mar 2026 \|website=Am I Unique ?}}</ref>
Line 25:		Line 25:
	*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].		*'''Security risks''': It is well-known that JS is poorly-designed,<ref>https://github.com/denysdovhan/wtfjs</ref><ref>https://github.com/brianleroux/wtfjs</ref><ref>https://github.com/Rudxain/ideas/blob/aa9a80252a4b7c9c51f32eda5c716e96220ed96e/software/evar/with_bf.js</ref> even [[wikipedia:Ecma_International\|tc39]] acknowledges that{{Citation needed}}<!-- They do improve (and complicate) it every year, but the fact that `eval` isn't deprecated implies they don't care that much about improving the language -->. This leads to programmers and even experienced software-devs to accidentally add vulnerabilities to their code. That, and the fact that ES is [[wikipedia:Turing_completeness\|Turing-complete]]<!-- Not typo. ECMAScript alone is TC. No need for extensions --> (both [https://gavinhoward.com/2024/03/what-computers-cannot-do-the-consequences-of-turing-completeness/#mathematical-vs-practical in practice and in theory]), makes [[wikipedia:Debugging\|debugging]] and [[wikipedia:Reverse_engineering\|reverse-engineering]] impractical in big code-bases. It's worth noting that tooling, such as [[wikipedia:TypeScript\|TypeScript]] and [[wikipedia:ESLint\|ESLint]], exist to substantially minimize the likelihood of [[wikipedia:Software_bug\|bugs]].
	*'''Degraded performance (web apps)''': "Web apps" load slower than traditional web sites because lots of code has to be processed by the web browser before any content can appear on screen, putting the content at the end of the rendering path.<ref>{{cite web \|title=Critical rendering path – Mozilla Developer Network \|url=https://developer.mozilla.org/en-US/docs/Web/Performance/Guides/Critical_rendering_path \|access-date=2026-04-18 }}</ref>		*'''Degraded performance (web apps)''': "Web apps" load slower than traditional web sites because lots of code has to be processed by the web browser before any content can appear on screen, putting the content at the end of the rendering path.<ref>{{cite web \|title=Critical rendering path – Mozilla Developer Network \|url=https://developer.mozilla.org/en-US/docs/Web/Performance/Guides/Critical_rendering_path \|access-date=2026-04-18 }}</ref>

	==How it works==		==How it works==
	Whenever a user visits a webpage, an average web-browser will execute the JS code it finds in <code><script></code> [[wikipedia:HTML_element\|tags]]. This code could do anything from updating part of the [[wikipedia:Document_Object_Model\|DOM]]-tree only when the user requests it, to showing a [[wikipedia:Pop-up_ad\|popup/popunder]].		Whenever a user visits a webpage, an average web-browser will execute the JS code it finds in <code><script></code> [[wikipedia:HTML_element\|tags]]. This code could do anything from updating part of the [[wikipedia:Document_Object_Model\|DOM]]-tree only when the user requests it, to showing a [[wikipedia:Pop-up_ad\|popup/popunder]].