This.

And also ads at the top of the page that are rigged somehow to load synchronously, so until the ad loads the rest of the page below it stays blank — they were doing that dirty trick back in 1997.

The next frontier needs to be dealing with those jerkass site designs that use CSS to make all of the text white-on-white or cover most of the screen with a nag overlay, which some script then undoes, all to punish/nag NoScript users. Dealing with that will probably take creating a “sandboxed JS” mode in NoScript, in which scripts can modify the DOM (except by loading elements into it from third-party domains) and document.load in response to mouse clicks but everything else doesn’t work (especially, anything that touches or tries to send the browser to a third party domain, or that attempts to invoke Flash or other plugins). Annoying things like NoScript nag overlays and making every link be to “href=# onClick=document.load…” to punish script-blockers would work like you weren’t using NoScript but the malicious stuff that tries to send you to a Neutrino EK landing page wouldn’t run.

Worse is all the sites that punish JS blockers by hosting images on Instagram. I’ve found that those images generally won’t display if you don’t enable scripts for a) the site you’re on, b) Instagram, and c) one or more sites with names like d89329f3ab.cloudfront.net(!). Yes, that last looks exactly like the kinds of names sometimes used for malware domains. One assumes it’s a cloud storage provider, and whitelisting scripts from it will whitelist the Instagram scripts that you want working and any other scripts that happen to have gotten sorted into the same cloud storage hash bucket. Some of which could well be malicious, and linked from some URL you might one day blunder into. And all of this because someone either a) does not understand how to use the src=”foo.jpg” attribute of the img tag or b) is being deliberately obstructive to script-blocking users. a) is incompetence and b) is bordering on criminal negligence since the main reason to use NoScript is security, not ad-dodging. Making things that could work without JS gratuitously fail without JS, particularly in a way that takes more effort than having it work would (“href=# onClick=” comes to mind again here) amounts to demanding that end users disable some of their security or be denied useful features, such as site navigation, where there is no technical reason the feature can’t be provided without the reduction in security. That type of behavior is evil, not to put too fine a point on it.

Now I’m just waiting for them to come up with a “smart TV” that includes a popup blocker. I am sick of having the action in my favorite shows (and often opening credits or even subtitles for foreign speech) covered up by giant cartoon full moon, a distracting dancing Burger King logo, a cartoon bottle of shampoo, or some other fucking ad. I’d hoped the opening credits thing would lead to the Screen Actors’ Guild suing and turning these popups into a very brief fad, but no such luck. Apparently the SAG has been bought off. If I get ahold of cheap enough uncapped broadband before a popup-blocking TV comes on the market I’ll be torrenting everything from then on, and likely never looking back afterward…