It seems you are using this fact as a soldier-argument. The position under discussion is that all things considered, turning scripting off seems to be a wrong decision. Of course there are potential problems, but at the same time, there are working solutions to these problems, and benefits from actually using the technology.
Such as? The only working solutions I know of are server-side, or disallowing javascript and/or cookies.
The position under discussion is that all things considered, turning scripting off seems to be a wrong decision.
No, the position under discussion is that turning Javascript off is “just totally stupid”. If one can provide good pro tanto reasons for doing so, it is at least not “just totally stupid”.
Disallowing Javascript does NOT protect you against CSRF—“Press button to see kittens” form works without any Javascript. The right solution is server-side—auth tokens for all cookie-validated write forms.
It seems you are using this fact as a soldier-argument. The position under discussion is that all things considered, turning scripting off seems to be a wrong decision. Of course there are potential problems, but at the same time, there are working solutions to these problems, and benefits from actually using the technology.
Such as? The only working solutions I know of are server-side, or disallowing javascript and/or cookies.
No, the position under discussion is that turning Javascript off is “just totally stupid”. If one can provide good pro tanto reasons for doing so, it is at least not “just totally stupid”.
Disallowing Javascript does NOT protect you against CSRF—“Press button to see kittens” form works without any Javascript. The right solution is server-side—auth tokens for all cookie-validated write forms.