JavaScript & spellcheckers & malice

I couldn't spell-check my last post, because there was no spellchecker button on my post edit page. I was assured that blogspot has a spellchecker, yet it did not appear. I spent a few minutes going through all the options, to no avail.

It didn't take long for me to realize what the problem was: I have a JavaScript blocker installed in my web browser. I told it to enable JavaScript from "bloger.com" and "blogspot.com", and then the "check spelling" button appeared. Once I also enabled popups I had a working spellchecker.

So what's the big deal? Am I an idot for installing software that blocks JavaScript and popups, and then complaining that spellchecking doesn't work? Of course not. Not really.

There are some real problems with defaulting to allowing JavaScript. The JavaScript interpreter is a large quantity of complex code. Requiring more compex code to execute in order to render a web page adds more risk of exploitable bugs (e.g. buffer overflows and stack smashing attacks). In addition to the possibility of bugs in the JavaScript interperter which allow the author of a malicious web page to take over your computer, there is also the simple fact that JavaScript is a fairly full-featured programming language, and it's never a good idea to run any random code that you happen to find on the web. Even if the code does not exploit a bug in the JavaScript interpreter to take over your computer, there's a good chance the JavaScript code can do something annoying.

All this risk is (not) balanced by the fact that JavaScript rarely adds much to the page. Often, the main "benefit" of the JavaScript code is to make an advertisement much noticable. Good for the advertiser, but not so good for those who'd rather not be bothered by ads. Occasionally, like on blogspot, the JavaScript is actually useful and makes my life easier.

So, I generally disable JavaScript (and other active scripting technologies), and only enable it for pages where there is a real advantage to me, and I feel the advantage outweighs the risk.

Final thought: there are many browsers out there with JavaScript intentionally turned off. If your web site does have some useful functionality that requires it, and JavaScript is disabled, your should put a notice on the page telling the user that a much richer experience is available if JavaScript is enabled.

Why blog?

That's a good question, which each person needs to answer for themselves. In my case, I know deep in my heart why I need to create and use this blog, but I'm not ready to share it yet. It can be my little mystery.

Meanwhile, I need to find the spellchecker, because I can't spell "mystery".