Thinking of JavaScript as privacy-friendly tech

For a long time I though of JavaScript as a privacy-violating technology. It's used for invasive analytics, cross-site tracking, and plenty of other abuses. I used to aggressively use NoScript, uMatrix and other tools to stop JavaScript from running. Not to mention Tor Browser's safest mode, which blocks it entirely.

Part of it was also my experience in doing server-side web development; I'd much rather write Python and Rust apps instead of JavaScript.

But lately I've changed my viewpoint, I'm pretty impressed with the subtle privacy benefits you can get with client-side code.

For example, if you accept input via a URL parameter, ?input=foo, the server receives a copy of it. Many webservers will log it by default. On the other hand if you include it as part of the anchor, #input=foo, then it is not transmitted to the server and stays entirely client-side.

Client-side code is not universally better. If you're making HTTP requests to a third-party website, doing it client-side will reveal the end user's IP address whereas if it's proxied through a server, it would only reveal the server's address.

End-to-end encrypted applications in the browser like CryptPad are only possible because the encryption can run client-side before sending data to the server.

So going forwards I will be thinking about how I can use JavaScript to improve users' privacy by computing things on the user's device instead of doing it on a remote server.