I’m coming from outside the Tor community with a question about a web platform feature currently in development: the Invoker Commands API.
I understand that JavaScript is frequently disabled in Tor Browser. I’m a contributor to the WordPress project, and we’re currently working on ensuring that navigation menus work when JavaScript is disabled. One solution to this is problem is to use Invoker Commands, which are a new declarative way for buttons in HTML to trigger actions in other elements, for example for a nav menu button to open a nav menu dialog element. This is without any JavaScript at all. This is currently implemented in Chrome, and Firefox and Safari have both implemented it behind flags. In Firefox Nightly, this is enabled by the dom.element.invokers.enabled flag.
So my question is this: would Tor Browser allow Invoker Commands to be enabled even when JavaScript is disabled?
It depends on when the feature stabilises in Firefox and whether or not enabling it would work counter to our threat+privacy model. We are about to begin the transition to ESR-140 after the Tor Browser 14.5 release in the coming weeks.
If the feature has stabilised by Firefox 140, then we will likely evaluate the feature as part of our Firefox 128 → 140 Bugzilla audit. Knowing nothing of the feature, it sounds like it will probably be fine for Standard and maybe Safer security levels. A deeper investigation will need to be conducted to see if it is ok for Safest (which disables JavaScript).
That said, thanks so much for reaching out trying to figure out how to make your software work w/o JavaScript! It’s a shame so much of the web just doesn’t work properly without JavaScript enabled due to completely avoidable development decisions (or malicious business decisions lol).
As the creator of NoScript I’m for obvious reasons even more grateful than @morgan for your effort to support users who keep JavaScript disabled
If the default command values remain relatively innocuous as they are now (just to open and close optional overlay elements), I can see no issue and only advantages for the Tor Browser in keeping this feature enabled, especially in the Safest security level.
