Welcome • User Guide
ToS • Privacy • Canary
Donate • Bugs • License

©2025 Poal.co

449

Sites that force javascript on you, like Poal are very dubious.

Two things everyone should know, but very few people do know about JS.

  1. It is completely unnecessary to make a website work. It can all be done on the server side, devs who use it are simply cheap fucks putting the work of content delivery off on you CPU instead of their own. Users are either ignorant about it, or brainwashed to just go along with the ass fucking and keep quiet about it.

  2. More importantly. JS is a security risk to users. Again, JS is a security risk to users. Enabling JS puts you at risk to all manner of evil fuckery by webdevs. Not saying that is what AOC is up to, but definitely could be. The problem for a user is the only way to find out if a website is up to fuckery with JS is to allow their JS to run. Once you do that, if they are up to fuckery, you just got fucked. The only intelligent thing to do is block all JS on all sites.

There is no reason whatsoever for a site to require you to allow JS to run in order for their site to work properly, anyone who says otherwise is a liar and almost certainly up to fuckery.

Poal does not work with JS blocked.

I'm not talking about their alleged 'spit and polish' 'features', I'm talking about basic site functionality. Block JS and away goes your settings, inbox etc.

Any site that forces you to allow JS for basic site functionality is dubious at the very best.

Sites that force javascript on you, like Poal are very dubious. Two things everyone should know, but very few people do know about JS. 1. It is completely unnecessary to make a website work. It can all be done on the server side, devs who use it are simply cheap fucks putting the work of content delivery off on you CPU instead of their own. Users are either ignorant about it, or brainwashed to just go along with the ass fucking and keep quiet about it. 2. More importantly. JS is a security risk to users. Again, JS is a security risk to users. Enabling JS puts you at risk to all manner of evil fuckery by webdevs. Not saying that is what AOC is up to, but definitely could be. The problem for a user is the only way to find out if a website is up to fuckery with JS is to allow their JS to run. Once you do that, if they are up to fuckery, you just got fucked. The only intelligent thing to do is block all JS on all sites. There is no reason whatsoever for a site to require you to allow JS to run in order for their site to work properly, anyone who says otherwise is a liar and almost certainly up to fuckery. Poal does not work with JS blocked. I'm not talking about their alleged 'spit and polish' 'features', I'm talking about basic site functionality. Block JS and away goes your settings, inbox etc. Any site that forces you to allow JS for basic site functionality is dubious at the very best.

(post is archived)

You are currently inside a comment thread.
Click here to see all the comments (18).
[–] [deleted] • 3 pts

Wow. Alright.

So, I think Javascript is way, way overused. It doesn't belong on many sites. has basically none of it. I think there's just the one page where you can buy my book for Bitcoin SV using Money Button, and I warn about offsite JS there.

It's true that Javascript is a pretty complicated thing. Lots of vulnerabilities that come with it and lots of easy fingerprinting. There are even battery APIs that show how much capacity your battery has, that can help fingerprint you.

All of that said...

  • Your browser still has tons of vulnerabilities even without Javascript.
  • You're still extremely fingerprintable, even without Javascript.
  • You should sandbox your browser and keep it far and away from your private files. I've been doing this for years. It's probably the most vulnerable bit of code you run (mainly due to its complexity).

If you don't want to be tracked, use Whonix, Vagabond Workstation, TAILs or even Tor Browser at an absolute minimum.

And yes, you can make a site "like Poal" without JS. I'll show you one. . It's on a Tor Hidden Service, so you'll need to use Tor to connect to it.

It works, but it's a PITA. Every vote has to reload the page because it's a form submission. Every comment has to reload the page. It works, but it makes for a suckier website experience. And I think they do a really good job making it as good as they possibly can, being JS free. Even as probably the best successful example of a Poal-like site, it's still a notably inferior user experience.

I think, with fairly few exceptions, almost every page should be readable without Javascript. But there's so much you can do with it that really makes the client side more usable and can lower server load. A lot nicer using JSON calls back and forth rather than the goofy HTTP POST forms.

There's also lots of cases where for privacy reasons you want the client doing the work and not the server.

Here's a few things I've made that all need Javascript for a good reason: , ,

I don't want to make a HTTP post form endpoint for SporeStack when I already have a working JSON endpoint. I like being able to give the user errors (like if they give me a bad SSH key) without sending them to a whole other page or having the whole page reload. I could make it work without JS, but it would be a real pain in the ass. Bitsqus is basically a demo for comments on blockchain that uses existing blockchain APIs to handle comments. No way it would work without JS.

And Double Mixer is a client side service where the browser will request a mix from two different mixers and pipeline them together. If I did it as you describe, I would see the user's mixes and defeat the whole purpose.

So yes, Javascript is overused. Especially offsite Javascript. It kills me how many trackers, etc, there are. Web development can be way cleaner than it is. But Poal's requirement of JS is not the biggest deal. Your browser is insecure anyways, just sandbox it if you are paranoid like me. Don't go whining about how the world doesn't conform to your rather inexperienced opinion. I'm sure you made some "My first web application" that looks like it's from 1995 and needs no Javascript. I do explicitly try to not use Javascript if at all reasonable, but for tons of things, it's essential.

[–] [deleted] • 0 pt (edited )

Security risk sites, like poat poal, are an inferior user experience.

[–] [deleted] • 2 pts

Then feel free to go somewhere else.

[–] [deleted] • 0 pt

The best place to discuss poal's failings in on poal.