I’ve always thought having javascript totally disabled / on a whitelist basis makes you identifiable more.

It's complicated. That can be true. But it is often not true.

For a total JS disable, that almost certainly makes you less identifiable. I.e, improves your privacy. It is true that JS-disable is a fingerprint. But it gives the -log2(%-who-do-that) bits of identifying info. If you prevent more bits than that from being obtained via JS, it is a net win. And JS has very powerful ways to fingerprint, and collect more bits than that log2(%) value. Thus, it is normally a privacy win to fully disable JS. Despite it putting you into a small cohort. That cohort is still bigger than the cohort the JS can bucket you into.

But your other case, disabling some JS, that might make you more ID-able. If you disable the same subset as most other ppl, it won't. But if the set you disable is specific to you, then that can provide enough signal to overwhelm the improvement. In that case it can hurt your privacy.

There is not a simple yes/no answer. Which everyone wants to have. "It's true!" "No it's not!" "Yes it it!" Really, it depends. We must consider the factors, to know the answer. Which will vary for each person and circumstance.

I’ve always thought having javascript totally disabled / on a whitelist basis makes you identifiable more.

is advertising a threat model?

btw does it use a lot of ram?

thanks 👍