Re-examining JavaScript

After getting some feedback on my original rant, which included a comment about JavaScript, I have researched the issue further. My conclusion is all the more firm: JavaScript in it's current implementation is a bad thing. The standards place too much power in the hands of the web developer.

First, I must acknowledge that JavaScript (JS) is implemented differently in every browser, and may change for the various OSes supported by the browser. If you read complaints by web designers, you'll see a focus on how they can't control the user's browser. That indicates to me the primary problem: control. In my explanation of libertarian ethics, I note this violates the principle of live and let live, especially in light of the concept the Net is about sharing information promiscuously. It was never intended to be an entertainment media, and I won't budge on that idea. If you want to depart from the HTML -- the bare essence of the Internet -- then create a new protocol so the rest of us can ignore you. Having a page on the Net means you present yourself as a participating member of the Web of Trust. Violate that trust and you shouldn't be there. You are entitled to a differing view, but I am also entitled to call for firewalling you off the Net. The libertarian ethic assumes the individual user is the least powerful element on the Internet, and therefore ought to have the upper hand in every transaction.

Just to help clarify things, I personally believe most marketing people are soulless manipulators. They don't care in the least about my needs or wants; they would love to have the power to determine my wants for me. This they actively pursue via a host of foreground and background efforts to change cultural trends. They will twist and pervert anything to their purpose, and have no concept of civility, morality, nor ability to discern the difference between sin and righteousness. For example, they'll use the offer of free TV/VCR combos with free cable access to public and private schools in exchange for the right to beam their ads into the classroom. The ads are carefully designed to suspend rational thought and mold the entire thought process of students. Not just the ads, but the whole programming on these "educational channels" has the same goal. I am not the type of libertarian who sees all economic activity as benign, all profitable enterprises as good, for I never forget the world is fallen. I, too, am subject to serious mistakes, so take me with a grain of salt.

I remain convinced JS is broken. Here is a demonstration of the evil JS can do. This page shows code snippets and tests, indicating how JS allows hijacking. The primary example is the uncloseable webpage. There is also a link demonstrating the homepage hijack. That it is (or was) possible to do that shows JS is a bad idea. The sandbox preventing such evil is just not tight enough. I came across this somewhat dated JS rant by Karsten Self. He says JS "is a nonstandard extension, not supported by all browsers, and in particular not supported by text-based browsers, handheld and PDA devices. It may raise ADA (American Disability Act) compliance issues by being incompatible with common text-to-speech software." When someone blogged a review of the page, Karsten responded in person.

The rant is dated, though I make occasional corrections (which update the "last modified date"). It's one of a bunch of pieces I keep online, not all of them current. Though I will periodically revisit stuff over time. I have added a note to my homepage which warns that this is pretty dated material.

Both Mark and several follow-ups appear to be missing the point that this is a rant against MANDATORY Javascript. Sites designed using chrome in such a way that they break if the functionality isn't present. You want to toss a script into your site? Fine. Just make sure that Mozilla with JS disabled, or lynx (or w3m, or googlebot...) can handle it too.

The real issues now are several:

Annoyance. Javascript can be used to annoy, and in the hands of marketers and advertisers, often does. Few (if any) browsers offer the ability to disable JS selectively, so it's an all or nothing proposition. I disable it, globally, since I don't like being annoyed.

Accessibility. Whether you're talking screen-scrapers reading GUI browsers, or alternative browsers, including text-mode and PDA/mobile phone browsers, Javascript isn't supported. Not good if you want to support the blind or (US) ADA requirements.

Accessibility. Don't care about blind users? Remember: Google is a blind user. Using Google-opaque formats (including graphics, javascript, java, flash, etc.) is the kiss of death for any site which depends on being found. Of course, if that's not your goal....

Usability. Javascript, Java, Flash, et al, tend to promote nonstandard controls and navigation elements. This can be "cool", but it also makes a site harder to follow. Norms are good, and for mass-use sites, following norms is good.

Stability. While most browsers which actually do support Javascript are considerably better than ~1998, more stuff still means more stuff to break. I saw browser sessions grow from a few hours or minutes (before crashing) to days or weeks. Yes, really. As a power-surfer who keeps tons of state in a session, this is a major consideration.

Maintainability. Chrome is great for design shops. It really doesn't do much for the owner of the website though. All the above problems, and you have to hire a geek to make trivial changes. Lose-lose proposition.

I'll grant that the original drift of the article isn't particularly applicable. There are still relatively few reasons to use Javascript, and plenty of reasons not to.

The ultimate reason, arguing with your customer, still stands. If someone goes to a website, it doesn't work, and they're told "switch to browser foo or download product bar to view this site", my response remains: "Sod off!". For my own needs, there's little or no reason for me to put up with that sort of attitude.

The blog's author went on to agree with this amended statement. I note accessibility is the key issue. If a blind or text-browser user can't see anything useful on your page, you have violated the ethical principle upon which the Internet exists. Removing choice from the user's hands is immoral. Indeed, a basic element in the newer standards centered on XML and CSS assume the browser has maximum flexibility to interpret your offerings. For example, you are discouraged from going beyond merely suggesting fonts. The "font" tag is no longer allowed, and the CSS standard for font selection permits the browser to override your choices by use of an internal CSS reference. Sadly, there is currently no means for the average user to make detailed choices easily. Mozilla is trumpeted as the most standards-compliant, but Mozilla's options for font display are pretty simplistic, and only someone who knows CSS can make detailed adjustments.

This fellow curmudgeon comes out in favor of ending active content. I won't go quite that far, but would prefer such content be optional, as Karsten asserts. If I visit your home page with lots of "cool" content, I should have to click on something to see it. However, I'm not willing to involve governments and legislation, except perhaps via lawsuits. It should be possible to file a class-action lawsuit against providers who refuse to take down malignant sites, for example. I still believe in the power of voluntary standards, but I also believe any major node has the right -- nay, the moral responsibility -- to refuse traffic from any IP that rejects community standards. I'm willing to take my complaint to the community, and accept the burden of proof.

A Quick Outline of Suggested Standards

Here is a sample of applications I propose in keeping with civility and the libertarian ethic:

Your default site page should be readable in any browser. If none of your other pages are so readable, that information needs including in your default page. For the sake of blind users, this page should outline what you believe you are doing with your site. This page should also be rather small in terms of code, so everyone can download it regardless of the type connective they have. At the very least, set up browser type detection and steer low- or non-graphical clients to an appropriate page.
Whenever technically possible, do the work on the server side. Display functions in your webpages that pass work to the client is unethical. It's not much different from spam, wherein the bulk of the cost for processing your message is passed on to the recipient. The nature of the web includes openness and linking, so inherent in the system is the high liklihood all pages will draw random, accidental traffic. If you do not serve them, too, you've no business on the Net. Restrict your pages to logon membership to protect the random visitor.
Given the frequency of official advice such as "disable ActiveX" or to disable other browser responses, these forms of display manipulation should be discontinued. If it's always advisable to disable JS for email clients, browser makers need to stop making it an option. Apparently they cannot be made safe enough. At the minimum, they need to be turned off by default. Since user security is the last concern when these technologies are developed, there is no longer any excuse. Learn to use something else to spice up your pages.
Natural monopolies/oligopolies should be vulnerable to expensive lawsuits for restricting their sites to one browser. An obvious example is banks. Far too many disbursements require you accept direct deposit in a bank, and not just any bank-type institution you choose. In many locations, there is only one bank, period. A part of the effort to overturn this natural vector of oppression is making them liable to small-claims or class-action lawsuits when their service websites are constructed to respond only to IE. Nor should they charge any online banking fees they wouldn't for face-to-face transactions. With the increasing democratization of Net access, it becomes in effect a basic right. If a bank bothers to have a webpage, they are morally obliged to do business that way. There are other sole-supplier businesses to which this applies.
Just as there are blocklists by domain and by IP for known spam havens, there should be similar lists for those who violate these standards. Anyone providing DNS and pass-through traffic service should be free to block traffic based on these lists. If institutions such as ICANN have the legal authority to issue standards, they should be required to enforce them. ICANN virtually never takes action on violations. Thus, it falls to the community to do it for them. Commerce should not make the rules as they now do via lobbyists and bribes with various governments and quasi-governmental institutions. The individual user comes first.

Those failing diligence in protecting liberty deserve none. Sadly, the biggest problem in that formula is simple ignorance. Folks don't know what's at stake, and big-money interests want to keep it that way. When you add in the natural disinclination of fallen man to take proper action, even for his own good, we end up with a very dismal expectation. I seriously doubt my suggestions will gain much traction. That does not relieve me of the responsibility for declaring them as loudly as possible.

Ed Hurst
25 February 2005

COPYRIGHT NOTICE: People of honor need no copyright laws; they are only too happy to give credit where credit is due. Others will ignore copyright laws whenever they please. If you are of the latter, please note what Moses said about dishonorable behavior -- "be sure your sin will find you out" (Numbers 32:23)