@Gargron A <noscript> would be superduper! !qvitter informs non-javascripters. For inspiration on the "enable message", try this site without arbitrary remote code execution in the browser enabled: http://openingh.openstreetmap.de/

Spoiler, the message is: »You don‘t have JavaScript enabled and that is a good thing but this tool makes heavy use of JavaScript so you need to enable it in order to use this tool. If you don’t trust the code that is going to be executed that is good as well. I encourage you to read all the source code on Github. Also note that every commit and all releases are GPG signed. You might want to check this out as well :) Stay safe.»

cc: @wxcafe @mcscx @lmorchard