[ext] NoScript 1.8 - Your Browser is YOURS

[bornplaydie]

Noscript is great and I love software with lots of bug fixes and new features. And I love it even more when it is free! Noscript lets me surf with total control. But it updates so often, just about every time I restart firefox that I am considering uninstalling Noscript.

[Alan Baxter]

I noticed some odd behavior with this page: http://www.kwikset.com/Support/Contact/default.aspx

Clicking "Kwikset Support (English)" does nothing. I checked the list of blocked sites and see quickset.com, which I grant temporary permissions. The link still does not work, so I check the list of blocked sites and notice that google-analytics.com shows up. Once I allow it, the link works. What I can't figure out, however, is why google-analytics.com doesn't show up until I allow scripts for quickset.com. Is this a bug or are they doing something unusual?

That kind of thing happens quite often. It's not a bug.

[Alan Baxter]

@bornplaydie:
There have been five releases in the past 33 days. You must not restart Firefox as often as I do.
http://noscript.net/faq#qa2_6

[cgraefe]

@bornplaydie and alan:
When I restarted my browser today and NoScipt updated again, I must admit I felt just a little annoyed, too. So, I thought "what the *** ist this all about again" and actually read the change log for version 1.8.9.7. That way I learned about the new Script Surrogate feature and my mood instantly changed from slightly annoyed to supremely thrilled! To me, that's one of those awsome ideas that seem so obvious when you learn about them that you can only wonder why you haven't thought about it yourself.

So, I registered at mozillazine.org just because I felt the need to say thank you for this greate piece of software!

[Soul Stealer]

It always amazes me that people get annoyed that an extension gets constantly updated, making it better. Seems to be a no-brainer for me, if you don't want the latest security protection, uninstall the extension.

[Paul Crete]

I've recently experienced a problem with NoScript as follows: on first opening up of Firefox after a Windows boot up, the NoScript toolbar fails to appear and right click doesn't produce any NoScript options. It's obvious that NoScript is running and working OK because script blocks are in place, but there is no quick way to allow any pages except by going through Tools/Add-ons/NoScript/Options, which is a bit tedious. Closing Firefox and opening it again seems to fix the problem - tool bar and right click options reappear and remain. I'm on NS 1.8.9.7, Firefox 3.0.5 and Windows XP with all latest updates/patches. Uninstalling NoScript and reinstalling doesn't seem to fix. Any suggestions, please?

[cgraefe]

@Friar Tuck: Peace, man. Of course it is not about the constant updates. I'm sure that absolute everyone appreciates an extension constantly getting better; I surely do, and I thought I made that point in my last post. I guess what tends to annoy some people is the "pop-up" window (two, actually) that accompanies each update.

Again, to me NoScript is one of the 2-3 essential extensions to Firefox and I surely do appreciate it.

[pirlouy]

In fact, Firefox should be like Updater (a plugin from the great Miranda IM) and should have a setting to allow beta version for extensions.

Because we can't say Noscript updates are all for security reasons; in 90% it's bug corrections, and in 90% displaying noscript homepage is useless and I suppose it's what bother people; I think an alternative could be to use about:config settings (there must be a key) and prevent Firefox to search for extensions updates too often..

[luntrus]

Hi Giorgio Maone,

Extension - KarmaBlocker, better then ABP and nice alongside NoScript, Perspectives and Request Policy, a right combination for the users that want their Firefox or Flock browser to be a truly personalized browser. And luntrus belongs to that tribe of users as many more readers of this thread in the forums....
So I installed and tested it myself. By the way the karma of this site is OK.

Installation: https://addons.mozilla.org/en-US/firefox/addon/5230 (never download fx add-ons/skins from other than the official sites, else you might even help yourself to political spam messages, if for instance you use this:
hxxp://[broken]kasteo[broken]deviantart.com/art/Noia-2-0-eXtreme-For-Firefox-4266778 you will see this http://www.xs4all.nl/~pgv123/mozilla/mozilla.jpg (dump of this) (I did not mean Giorgio Maone's website of course here, but for some other cases one never knows for sure what one gets aboard the browser, as again was proven in the above mentioned case, not malicious but certainly unwanted content - and what a web-karma those loaded upon themselves )

So first there was the adblocker, then we had ABP and now we have arrived at karma Blocker!
Block nuisances on the basis of the bad karma they have build up. The solution? karma Blocker, at approximately one fifteenth of the size, which sports the following features:

* Request-time blocking of any resource. (Blocked objects never load, never use bandwidth, never set cookies.)
* karma (or score) based weighting of objects, similar to popular spam filtering solutions like SpamAssasin.
* A flexible expression language for powerful filtering, on a richer set of data than simply "the URL".
* Global function injection; if a script is blocked, yet functions in it are still called, injecting a blank function of the same name will eliminate any errors.

Operation

Every time Firefox begins to load any resource (page, image, style sheet, javascript file, etc.) karma Blocker will first check it against the rules it is configured to use. If the rules match that request, it will be denied and never load. There are certain exceptions:

* When karma Blocker is disabled (and the status bar icon is greyed out), all requests will be allowed.
* When the resource is not from one of the schemes http, https, ftp, chrome, all requests will be allowed.
* Three different checks are made to ensure that resources that form part of the browser itself (i.e. the back/forward buttons, icons, etc.) are never blocked.

Click the icon in the status bar to globally enable/disable karma Blocker.
homesite of the developer: http://trac.arantius.com/wiki/Extensions/KarmaBlocker

I like to have this add-on inside Fx next to firekeeper, Perspectives, NoScript and RequestPolicy,
I think my malware and privacy issues are taken care of that way,

polonus

[DaleStan]

I believe I have found a conflict between NoScript's ClearClick and Mouse Gestures. (NoScript 1.8.9.7 and Mouse Gestures Redox 2.0.3, on Firefox 3.0.5)

Mouse gestures performed on top of a partially concealed object will get trapped by ClearClick, even though the interaction is (or should be, anyway) with the browser, not with the page. In most cases[0], the gesture will get eaten rather than just trapped -- the action that the gesture is supposed to trigger won't happen.

For a specific test case, follow this link: http://www.facebook.com/ext/share.php?s ... si&u=x02Ie , or any similar Facebook posted item link, click the comment button on the Facebook bar, and then perform a mouse gesture on the page behind the comment popup. This will often[1] cause the gesture to be trapped by ClearClick.

I'd prefer not to solve this by setting noscript.clearclick.exceptions on http://www.facebook.com/ext/share.php*, and am not entirely convinced it would/should work even if I did.

[0] I haven't entirely figured out what's going on here. The new-tab gesture reliably works if and only if I change the ClearClick dialog to show the red-bordered image, but I haven't found any other gestures that work either way. Because the only gestures I use on a regular basis are the rocker gestures, I have the status notifications disabled. Enabling them (Visual tab in Mouse Gesture's options) seems to change the behaviour, at least for normal gestures.

[1] The closer to the comment popup you are when you perform the gesture, the more likely it is to get trapped. For the link above, perform the gesture on whatever image the popup is covering. It appears that rocker, wheel, and normal (click-and-drag) gestures are all trapped equally.

[luntrus]

Hi Giorgio Maone,

When I go to this site: http://www.ad.nl and monitor it with KarmaBlocker (have to temporarily allow the main site in NoScript, and allow all requests with RequestPolicy, I get immediately 100 karma points for this:
chrome://global/content/bindings/general.xml? abphit:96754750514#basecontrol
Why is this and is NoScript or ABP for that matter blocking this as well. I found two of these on that particular Dutch newspaper site. Why is a browser not more transparent for the user, and do I have to go to lengths to see what is going on under the hood? I go on analyzing somewhat more, one learns every day,

luntrus

[johndoe32102002]

To the developers of NoScript:

Please fix a security vulnerability regarding HTTPS/SSL pages displaying HTTP content. It would be great if there were an option to block this or have this blocked by default in the extension. There is the vulnerability of data to leak from pages that are HTTPS/SSL, but not fully.

Regards,
John

[sycthos]

Bug Report

Whenever I click on the yellow star at the right-hand side of the address bar (while Firefox is on a page I have bookmarked), the NoScript icon disappears. The icon does not reappear until I either restart the browser or I disable then re-enable the icon through NoScript's settings.

Thanks and keep up the excellent work on this extension!

[EDIT]
The same thing happens when I create a bookmark from the Bookmarks menu or through Ctrl-D. It must be a conflict with the "Page Bookmarked"/"Edit This Bookmark" box that pops up that causes this.

[LoudNoise]

johndoe32102002

Merged your post with the NoScript support thread.

[Alan Baxter]

@Friar Tuck: Peace, man. Of course it is not about the constant updates. I'm sure that absolute everyone appreciates an extension constantly getting better; I surely do, and I thought I made that point in my last post.

Yes, your expression of appreciation was quite clear and is shared by me as well. I haven't used about:config to disable the NoScript update page either. I like to be told what features and fixes an update contains.

I guess what tends to annoy some people is the "pop-up" window (two, actually) that accompanies each update.

Does the NoScript update page pop up a new window for you? Mine just opens a new tab, which is easily closed with one click after I read the changes. I assume the second window you're referring to is the Add-ons dialog notification that an extension has been added or updated -- a security measure I appreciate.

@pirlouy:
I thought you already knew about the noscript.firstRunRedirection about:config preference. http://noscript.net/faq#qa2_5