I can see your local web servers

I use NoScript, you can't see shit.

You can't see shit neither

yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"

This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

Here's a port scanning technique that doesn't use javascript:

https://blog.jeremiahgrossman.com/2006/11/browser-port-scann...

That was actually funny

> This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.

Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with <noscript>, you just get a broken and/or blank page.

I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users.

(Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encounter several new sites daily.)

That's like saying that people shouldn't have to run ad blockers, that instead ad networks should behave. Sit and wait.

Most users have a modem or router that comes with a web interface, like just about everything in the internet of things.

I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.

Their routers do, along with an ever growing number of IoT devices people happily hook up to their WiFi without a second thought.

Given the long and gory history of companies releasing insecure by default devices methods like this are a legitimate entry point into a network.

Actually, they can: even if you enable JS, NoScript's ABE will prevent this attack: https://en.wikipedia.org/wiki/NoScript#Application_Boundarie...

Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.

Not anymore. It's not included in modern versions (after the changes in Add-Ons for Firefox's Quantum update).

> Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.

Yes.

Joking aside, I will add that I've been a NoScript/FlashBlock user for quite some time (more than a decade? I honestly can't remember), and while I run into some things that are frustrating (just had to disable NoScript for a tab to order plane tickets), it is refreshingly uncommon.

Yes, you can browse with default deny to JS and Flash.