Disabling JavaScript: Why and How

Most recent web browsers support JavaScript, and enable it by default. You can turn it off in perhaps fifteen seconds (see the ``How'' section), and it will generally improve your browsing experience enormously thereafter.

There are a very few web sites -- generally poorly-thought-out sites that are ugly and contain little interesting information -- that are impossible to navigate with JavaScript turned off. You can turn JavaScript back on just as easily as you turned it off. (Just don't forget to turn it back off when you're done with that web site!)

Why

First, there's almost no benefit to leaving it on. Virtually all Web sites that use JavaScript are just as easy to navigate and just as pretty to look at without JavaScript. Even the small minority of sites that can't be navigated without JavaScript aren't any easier to navigate than simple HTML sites.

(I have seen one exception: Thomas Boutell's Geek, the Game. And I have heard that some people find it useful to remove all the menus, buttons, and scrollbars from web-browser windows to keep users under their control. It's up to you whether you want to be subject to that kind of control.)

Maybe I'm paranoid, but for me, the most important reason is security. Over the years, nearly all of the security vulnerabilities found in Web browsers have been in implementations of Java or JavaScript, and all of the worst ones have been in implementations of JavaScript. These have run the gamut from allowing a web-page author to annoy the user to allowing a web-page author to steal all the files on your hard disk and take control of your computer, so that the next few times you typed your credit card number or your mainframe password, that information would be whisked off to the Web-page author.

Here are a few sample problems:

• March 18, 1996: In the prerelease of Netscape 2.0, JavaScript programs could read your URL history list, and read your disk cache; in both the prerelease and the final release of Netscape 2.0, JavaScript programs could steal your email address and forge messages from it, get a listing of the names of the files on your computer, and get a list of all URLs you accessed after you went to the Web page containing the script. In all cases, all the information gathered could be sent back to the web site operator. These problems were fixed in Netscape 2.01.
• October 16, 1997: Internet Explorer 4 lets a JavaScript script read any file your computer can access -- as long as it's a type your browser knows how to display -- and send it back to the web server, as long as the script knows the name of the file beforehand. This is called the "jabadoo hack", because it was discovered by Jabadoo Communications. They issued a press release in English and German. Microsoft issued a patch on October 18, 1997, (according to Jabadoo) or November 11, 1977, according to Microsoft. They call it the "Freiburg text-viewing issue". Internet Explorer 4.01 fixes this.
• Ausust 18, 1998: A buffer overflow in JavaScript. Microsoft says it can cause Internet Explorer to "close unexpectedly", but also admits "A skilled hacker could us such a script message to run harmful code on your computer." Which is sort of like saying that, well, yes, guns are dangerous, and a skilled explosives and ballistics specialist could use one to propel a bullet into you. It neglects to mention the possible effects of having harmful code run on your computer (basically, the cracker can steal and then delete all the files your computer has access to), and also neglects to mention that once one "skilled hacker" accomplishes this feat, then any loser can download their methods off the Net and use them on you.
• July 8, 1997: Netscape 2, 3, and 4, and Microsoft Internet Explorer 3 and betas of 4 -- essentially all browsers supporting JavaScript -- lets a JavaScript script monitor the URLs of all the documents you view in the Web browser, everything you type into HTML forms (including passwords), and the values of cookies set by remote web sites. This was fixed in Netscape 4.01 and Microsoft Internet Explorer 4.0 final.. It was supposedly fixed in Netscape 3.02, but there is a report that it still worked in 3.02. This ended up in PC World, as well as a few other places. (There's a more detailed explanation available too.)

How

Parts of this taken from WebMonkey's Intro to JavaScript. Please let me know if this information is inaccurate or if you can tell me how to turn off JavaScript in browsers I haven't mentioned here.

On Netscape 3 for Unix, Mac, or Microsoft Windows, click on the Options menu, select Network Preferences to get the Network Preferences dialog box, click on the Languages tab, and click on the Enable JavaScript checkbox to turn off the check mark in that box. (Then click OK.)

On Microsoft Internet Explorer 3 for Microsoft Windows, Webmonkey says you should ``choose Options [under the View menu], pick Advanced, and select Enable JavaScript''. My Internet Explorer doesn't have anything labeled Enable JavaScript there, but it does have another tab on the Options dialog box labeled Security, which has a ``Run ActiveX scripts'' checkbox in it, which, when you turn off the check mark in it, disables JavaScript. (Presumably it disables other scripting languages too.)

On Microsoft Internet Explorer 3 for Mac, Webmonkey says, ``Under the Edit menu choose Preferences, select Web Content, and under Active Content, select Enable Scripting.''. I don't have a Mac, so I can't confirm or deny this.

On Netscape 4 for Unix, Mac, or Microsoft Windows, click on the Edit menubutton, select ``Preferences'' from the bottom of the menu, click on ``Advanced'' in the Category box on the left side of the Preferences dialog (making sure it's Advanced itself you click on, not Cache or the other subcategories of Advanced), then turn off the Enable JavaScript checkbox.