Why I've started using NoScript

telling people to just go on shouldering that annoyance to ensure that the annoyance is minimized

With respect, please re-read my comment, because not only did I not say anything like this, I specifically pointed out that I am not saying anything like it!

Furthermore, the argument from incentives was not specifically (or even mostly) about trackers; it was about bloat in website design / features. Frankly, it does not seem to me like you have given due consideration to what I wrote in that section of my comment…

However I think you miss one important disadvantage of your approach: These alternatives are mostly blacklists, and so they become less useful as you get further into the less-trafficked corners of the web, which is also where you’re most likely to hit, e.g., invisible compromised resources.

This is an interesting counterpoint, certainly. I am curious to what extent this is true in practice, and whether you make this claim on the basis of experience, or supposition; do you have examples?

Well, for one thing, the problem of “code delivered from a site you would normally trust but that is now malicious” is the same as the problem of “being mistaken about what sites to trust (and so accidentally trusting a site that was malicious all along)”.

As I understand your question, and as I understand the web and its technologies, the problem basically is that “if you run code (JavaScript) in your browser—code that is provided by arbitrary people on the internet—this is fundamentally a vulnerability”. And that’s true. There’s no solution to that basic fact other than “don’t run JavaScript”.

The matter really depends on how much you trust your browser vendor (Google, Apple, or Mozilla) to secure the browser against exploits that could harm/steal/pwn your computer or your data. If you trust them to a reasonable degree, then precautions short of “disable JavaScript entirely” suffice. If you really don’t trust them very much at all, then disable JavaScript (and possibly take even stricter measures to limit your exposure, such as running your browser in a VM, or some such thing; Richard Stallman’s browse-by-email workflow would be an extreme example of this).

Yes, it disables JavaScript and sometimes can break webpages. In those cases I’ll check my console and begin enabling JavaScript on the host page and any obvious CDNs it may be using. If after a couple of attempts the page still won’t display content, I’ll usually just leave the site as it’s not worth it.

Over half of my comment, by word count, is dedicated to addressing, and deconstructing, specifically this argument, and explaining both of the problems with it. Meaning no offense, but I am having a hard time believing that you read what I wrote; it rather seems like you instead skimmed my comment, pattern-matched to simplistic arguments you’ve read elsewhere, and responded to that straw version. I can’t really say anything in response without rehashing exactly what I wrote, because what I wrote is already a rebuttal of your points!

May I respectfully ask that you re-read my comment? If you still do not think that your arguments are addressed, then I suppose I have nothing further to say.

I’m curious as to why you think disabling JavaScript is something to avoid.

I explained this in my comment. See above.

It’s executing code, consuming power and occupying my CPU and RAM, often for no other purpose other than reporting my behavior back to some third party host. Why would I want to allow that?

Once again, the specific JavaScript that is running “for no other purpose other than reporting my behavior back to some third party host” is, indeed, that which you absolutely should be blocking. I explained that in my comment, as well, and I gave a detailed explanation of how to do precisely that.

Said's comment specifically addresses this.

I think it depends a lot on how you frame it, and analogies work much less well than people expect because of ways the Internet is very different from previous environments.

The intuitive social norms surrounding the store clerk involve the clerk having socially normal memory performance and a social conscience surrounding how they use that memory. What if the store clerk were writing down everything you did in the store, including every time you picked your nose, your exact walking path, every single item you looked at and put back, and what you were muttering to your shopping companion? What if that list were quickly sent off to an office across the country, where they would try to figure out any number of things like “which people look suspicious” and “where to display which items”? What if the clerk followed you around the entire store with their notepad when it's a giant box store with many departments? For the cross-site case, imagine that the office also receives detailed notes about you from the clerks at just about every other place you go, because those ones wound up with more profitable store layouts and lower theft rates and the other shops gradually went out of business.

There are other analogy framings still; consider one with security cameras instead, and whether it feels different, and what different assumptions might be in play. But in all of those cases, relying on misplaced assumptions about humanlike capability, motivation, and agency is to be wary of. (Fortunately, I think a lot of people here should be familiar with that one!)

[Rana hits on most of what I say here, but more clearly I think.]

I agree, there is a lot that happens in real interactions that is similar but seems much different.

First, the store clerk is limited largely to that store. The virtual world and big data is about taking all my other activities and then using that to guide how the clerk engages me in that one store. The parallel there would be having that clerk follow me around all day documenting everything I do, buy, look at....

I have more control over what information I provide the clerk. Clearly that person will know my sex/gender, approximate age and other physical traits. If they are really attentive, and able to see, they might know what type of car I drive and would be able to guess at socioeconomic status based on dress, speech and manner/demeanor. They will generally not know my name, address or approximate location, my travel habits, where I might work or my larger social circle.

Much of the information now collected is something I have no control over. For the clerk I can do any number of things to control what information I share. This is not the case in the virtual world. So, that gets me back to the "If someone did this in the real world...."

It's not that I'm saying everything should be taken as stalking but rather it should be considered more carefully. I've just never really seen the issue framed as how would this look if done in the "old fashioned" shopping/commercial interaction setting. Would that change anything?