I feel like it's a bit ironic that the blog post chastises Codeberg for taking a stance and then does the same with JS.

The whole blog post is also taking a stance. What is criticized is the specific stance taken by Codeberg. TFA seems to state that Codeberg should allow projects of all kinds to be hosted on their service (though apparently artificially limiting their resources would be alright).

One of them is a website that hosts source code from other users, their "stance" is arguably more important because of that. The other one is just a personal blog, completely different subjects. I created an account just to reply to this.

I find it endearing that someone is keeping up the resistance against JavaScript. Used things like noscript myself since 2008 or so. Eventually gave up since nearly no website would work that way and served you captcha loops instead.

I still use NoScript. I actually started in 2018. I will turn on 1 or 2 js sites for a respectable looking page, but blank screens and captchas are a good signal to bounce, or occasionally to use an incognito window which enables all JS.

As the web gets more hostile (2018 was so much worse than 2008) NoScript will be more competitive in spite of all the inconvenience.

How do you browse cloudflare + anubis sites like that?

(Asking because they've both become routine problems for me with most browsers, probably since I disable cookies + run an ad blocker).

Yeah, every day brings choices. I tend to allow a first party js from every small site, and that covers Anubis and the even more egregious use case of Mastodon instances. Needing 100KB of Js to display 140 chars :eyeroll:

I still haven't allowed Cloudflare, though. That is bounce or incognito.

I'm increasingly tempted to just archive.is 100% of anubis page loads or something like that, then instruct my LLM to try archive.is if it sees anubis. If there was a plugin for this, it'd probably get close to 100% cache hit rate for agents pretty quickly. The plugin could even have an MCP endpoint that popped up windows for me to solve captchas or whatever in my primary browsing session, then uploaded the result to the shared cache.

Archive.is blocks agents, I think, but you get the idea.

Also, I really wonder what the economics are for your example. The JS boilerplate for the anubis landing page is usually longer than the piece of information I need.

(That's ignoring the actual anubis JS, which is probably on a privacy-destroying shared CDN link).

Well, my lens tends to be geopolitical rather than economic. Privacy isn't some axiomatic metric for me. I just decide if someone is an ally and I am willing to put up with the cost of their action. With Anubis I don't see it being suborned yet by non-allies like big companies. But I'm definitely watching for that.

You gave up because the anti JavaScript position is completely insane and unreasonable?

The amount of work you have to put in to support a complete absence of JavaScript is more than 2x the original time spent on getting the site to work and it will lead to a heavily degraded user experience that nobody wants in the first place.

The amount of features locked behind JavaScript keep increasing. There are so many essential features that require JavaScript it is completely unreasonable to argue against them.

I am fine with the "degraded" experience. I eventually gave up because I got served captcha loops instead of the actual site. All I need from an untrusted site is to read text which shouldn't require JavaScript.

They warn against JavaScript being on by default and recommend using it only on trusted websites. It's a solid advice.

I thought it was funny at first and kept clicking away to see what other random changes I'd get, but then I got a "Zuckerberg nudes" Google search webpage and I'm on my work computer...

Fortunately this functionality doesn't change your browser history, but it did really annoy me for a bit

Interestingly, nothing happens in my case, even after unblocking JS on their site. I suppose it's because I do block JS by default.

The JS file has been quietly removed.

Oh, I didn't know that. Thanks!

For me it still happens, the file has just been renamed to /js/kill.<giant hash>.js

We're back to square one, then. :)

I was wondering if the hash might be unique, then a commenter would say "it's now `kill.<hash xyz>.js`, and the webmaster would be able to connect <hash XYZ> to a user agent and IP. It wouldn't accomplish anything, but it might be fun.