I'm 100% on board with this line of thinking, but the edge case that the business keeps complaining about is being able to push async events to the client.
How would we accomplish this sort of UX without javascript?
I think the argument is that while a good amount of my daily web browser usage might like that feature (as I do in fact use it as an application sandbox), a vanishingly small number of the separate web sites I visit on any given day (which are all one-off pieces of content I am accessing) need that to functionality, and I can whitelist them by turning JS on for them, as they are also pretty much the same few websites every day.
I believe you can utilize partial http response streaming that never stops and there is even a way to replace html fragments. I‘m sure i‘ve seen this, but I am having no luck finding anything about it.
That ... is an interesting question that is not really a problem for someone who wants to browse the web without JavaScript. Which is almost the only person whos choice really matters when it comes to user security.
Some sites I've accidentally browsed without NoScript makes me question how people access sites with JS enabled at all. There are some shockers out there.
For this edge case I suggest handling JavaScript like Webcam-Access, if a website wants to use it they can and need to convince the users. So we have an agreement between both sides :)
I foster myself some weird JavaSript to allow hardware-access. But I think business itself should not be the driving force for the technical development and society.
How would we accomplish this sort of UX without javascript?