Javascript Off
05-NOV-2004
I wasn't sure if I should put this in the News section or Editorial section. I finally settled on Editorial since this and similar information has been making the rounds since javascript first hit the 'net. So, I'll use the facts to support my opinion for turning off javascript and for designing web pages that don't require javascript.
People ask me why I make javascript a "design issue" with web pages. The "issue" is about making web content accessible. Many people browse the web with javascript turned off. I'm one of them, and I recommend that others do the same. More on that in a moment. Whether you have javascript active or not, if you're putting a web site together it should be authored in a manner that does not require javascript to access content. Doing otherwise closes the door on those who have disabled javascript. Would you run a business that's "Closed" for a significant percentage of your potential customers? (Okay, there's the IRS Help Desk, but their business is about keeping people out. And money in.) Since HTML navigation gets the job done perfectly, javascript navigation is non-essential and foolish.
Some very important visitors to your site will be web crawlers and search engines. Guess what? They don't understand javascript. Therefore, nothing that relies on javascript will be indexed, including links to content within your own site.
So how many people do have javascript turned off? Well, a year ago (October, 2003) the percentage was 13%. By July 2004, that number had dropped to 5%. September and October of 2004 show the number up again, now at 9%. In my opinion, the percentage will continue to rise as the proliferation of annoying pop-ups and continued reports of security exploits make an impression on alert users of the internet. Few of these people are going to turn javascript on just to view a single web site. Instead, they'll go elsewhere for the information they seek. Google is just a click or back-button away. Does closing the door on 9% of your potential market make sense?
The reasons for turning off javascript are real. They are not simply a misunderstanding of what javascript can do. I occasionally hear from doubters that javascript can't do anything that it wasn't designed to do. That much is true. The problem is that the implementation of the design differs from the design intent, and it's the implementation that we're all stuck with. Not convinced? Check out the following links regarding javascript exploits. This list doesn't even begin to be comprehensive. (Some linked pages may be offline.)
- Here's why you can't trust your trusted sites:
Super Bowl stadium site hacked with exploits
You can trust many site owners, but you can't trust the hackers. - It just got worse:
Tool turns unsuspecting surfers into hacking help
Still not convinced about disabling javascript? Can you say "Duh?" - New Exploit 17-FEB-07:
JavaScript changes your web destination to someone else's fake site
Good news: protection from this exploit comes cheap. Turn off Javascript. -
DragDrop JavaScript exploit
So, yeah: consider this one next time you "opt out." -
This one circumvents firewall restrictions.
Mozilla added a patch. Microsoft didn't. -
Keystroke logger: Got passwords? E-accounts? Online banking?
Large, popular web sites compromised by malicious code. -
Even Google gets into the act.
Google has, at least partly, fixed this one. -
CSU Pomona virus report
Only 915 of 'em in the javascript category... -
IE flaw threat hits the roof
An Active-X exploit that requires no user interaction -
One for the Bloggers
Targets site developers and site visitors
These are fairly recent exploits. There are patches for some of them, but not all. Wary web-surfers acknowledge that there will always be something new coming down the information highway, and it won't necessarily be a hybrid, fuel-efficient kilobyte. My recommendations: Surf with javascript (and Microsoft's Active-X) "off." You can turn it on again if needed for a site you trust. For your online web page, ensure that all links and content are accessible to visitors without javascript enabled. Your visitors, especially those "in the know," will appreciate that courtesy in your design, and you'll see their traffic to content linked within your site. And who are those people? Well, they're the ones who haven't been bothered by those gosh-awful annoying pop-up windows since the moment they turned javascript off.
Copyright © Ed E. Powell
All Rights Reserved