Noscript

Discussion in 'other software & services' started by max2, Nov 2, 2015.

  1. The Red Moon

    The Red Moon Registered Member

    Joined:
    May 17, 2012
    Posts:
    4,101
    If it is a struggle to get videos working on that site,then whitelisting the site would be an easier option.But of course this would be like not running noscript at all.
     
  2. imdb

    imdb Registered Member

    Joined:
    Nov 2, 2011
    Posts:
    4,208
    @The Red Moon
    yeah, that's the biggest downside of noscript.
    umatrix does a much better job at that department.
     
  3. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,144
    Location:
    Nicaragua
    Kees, figuring that site cant be any easier than it is. It took me about 15 seconds to get the first video I clicked on to get it working. Any site that only requires scripts from 2 domains can not be considered difficult.

    Bo

    Sin título.jpg
     
  4. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,144
    Location:
    Nicaragua
    Red Moon, on that particular site, you dont have to white list the whole site to get videos working. All that was required to get the video working was to allow scripts from zie.nl and snmmd.nl. All other scripts can remain blocked. Allowing scripts from zie.nl is obvious as that is the name of the site. Guessing the other one was like drinking water.

    Bo
     
  5. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,144
    Location:
    Nicaragua
    Kees, that site below I think can be considered a challenge to figure as it requires different scripts for videos, pictures and additional scripts when you move from the US version to the French or UK version of it. And it does take more than a minute to completely figure it out. But most sites are very very easy.
    http://www.huffingtonpost.com/

    I dont use huffington post but I helped a friend here and another friend in another forum to figure it out. In fact, the friend here had tried NoScript a few times and always gave up on it as he thought NoScript was difficult. After I showed him via PM that even a site like huffigton post can be easily figured, NoScript finally made click and now he is a NoScript user.

    Bo
     
  6. @bo elam

    With Scriptblocker for Chrome (which I am using right now) allowing snmmd.nl (is sanoma media, the publisher of nu.nl) does not result in playing those video's, probably the differences in browser and script blocker, so .... see avitar :blink:

    Kees :)
     
    Last edited by a moderator: Nov 26, 2015
  7. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,144
    Location:
    Nicaragua
    Kees, my original test was done with flash installed in the PC (in my case, the sandbox). Without Flash, allowing snmmd.nl is not required anymore. Allowing zie.nl is it that's needed to play videos.:)

    Bo
     
  8. @bo elam

    Let's be fair you won the challenge :blink:, so I will keep the silenced Avitar. But you might have won the challenge because Noscript is just no-script (so it does what it says, just blocking scripts, not blocking other nasty stuff).

    The author of Scriptblocker for Chrome informs us that it is "not even close to Noscript". When enabling the domains you posted, the video still would not play (with Scriptblocker for Chrome allowing same domain scripts/iframes/plug-ins).

    Therefore I installed uMatrix on Chrome, because Thomas (TLU) is a strong endorser of Noscript and he has replaced Noscript by uMatrix (so I assume uMatrix is as good or better than Noscript and the logging of uMatrix has detailed reporting, so I can figure out what to allow).

    Assuming I have not messed up my setting, I additionally need to allow the domains in green (see picture), so something is slipping through Noscript :eek: see picture (green have to be allowed with flash).

    upload_2015-11-26_11-5-7.png
     
    Last edited by a moderator: Nov 26, 2015
  9. Gullible Jones

    Gullible Jones Registered Member

    Joined:
    May 16, 2013
    Posts:
    1,466
    @Windows_Security

    You might want to report that on the Informaction forums?

    I'm having trouble reproducing it, but I've got a rather top-heavy filtering proxy setup.
     
  10. @Gullible Jones

    Not a Noscript user, because I have not used FF since upgrading XP to Vista (stopped using a browser without a build-in sandbox). Could a member with both Noscript and uMatrix installed please check it on FF (to rule out differences caused by Chrome)?

    As posted above assuming not having messed up my settings: I run uMatrix with NO third party host files and ONLY blocking blocking third party in uMatrix, allowing some well known video players/services (see picture to check for configuration errors on my side).

    upload_2015-11-26_11-27-32.png
     
    Last edited by a moderator: Nov 26, 2015
  11. The Red Moon

    The Red Moon Registered Member

    Joined:
    May 17, 2012
    Posts:
    4,101
    In chrome you can turn off javascript in the settings.In which way would this affect scriptblockers.?
    The more divergent these script killers become the more crippled the web will become in time.

    Sandboxing a browser.....?
    I dont feel this is needed.For a click happy download junkie this may be considered a defence.But for more cautious users its simply a waste of resources.

    Chrome has tab isolation.!
    Really,If users like me who rarely open up more than 2 tabs,this is a un-needed functionality which again is eating up resources.

    Thanks.
     
  12. imdb

    imdb Registered Member

    Joined:
    Nov 2, 2011
    Posts:
    4,208
  13. The Red Moon

    The Red Moon Registered Member

    Joined:
    May 17, 2012
    Posts:
    4,101
    Well thanks.
    I am not trying to put chrome down.For what it offers its excellent but its not what every user wants or needs.
     
  14. @The Red Moon

    Re: turning off javascript:
    uBlock takes control over javascript blocking in Chrome browser setting itself (allows all)

    Re: Sandboxing not needed
    Active content runs INSIDE the browser (no need to click or download).
    See you are running Linux mint, never considered firejail?

    Re: Tab isolation unneeded and eating resources
    Only when running old hardware, memory is an issue. Isolation does not have a negative impact on performance when comparing Firefox against Chrome and Edge (source)
    upload_2015-11-26_15-56-43.png
     
    Last edited by a moderator: Nov 26, 2015
  15. MisterB

    MisterB Registered Member

    Joined:
    May 31, 2013
    Posts:
    1,267
    Location:
    Southern Rocky Mountains USA
    Blocking scripts in the browser with whitelisting is faster and more secure. The only reason I can see to do that is to set up a browser as a client for a specific site or service. I'm using Chrome that way and have set it up as a client for Google Voice which I've replaced Skype with. I am using Script Blocker for Chrome to restrict scripting to the necessary Google domains but I could block JS globally in the browser and just cut and paste the white list from Script Blocker and disable it.

    I find Script Blocker for Chrome to be quite solid but it lacks temporary whitelisting functionality. I've been running it together with uMatrix in Chromium browsers. So there is a two extension gauntlet that any allowed domains have to get through.

    All the different script blockers have their strengths and weaknesses. uMatrix is really good and combines a lot of different mechanisms. Noscript does what it does really well even if its scope is more limited. The Script Keeper extension for Opera 12 is really fast, easy and simple. I'm using all of them right now in different browsers in different computers. I added ScriptBlock instead of Script Blocker for Chrome to one of my recent installs but haven't played around with it enough to form an opinion yet.
     
  16. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,144
    Location:
    Nicaragua
    No, nothing is slipping through NoScript. I think you assume something slipped though NoScript because you dont see google-analytics.com or videoplaza.tv in my picture. In the first screen I posted, you dont see googleanalytics because I black list google analytics. In the picture below, opening the same video as yesterday, now when I hover over my Untrusted list, you can see google analytics as a black listed site. Perhaps you have to allow google analytics to watch videos in Chrome because you are using Chrome and Google makes it so. With Firefox, I dont have to allow google-analyics to watch videos in the Dutch site.

    In the picture I posted yesterday I don't see videoplaza.tv so to make sure it is not slipping though NoScript, I looked for a video where NoScript blocks both, google analytics and videoplaza.tv and see what is required to play videos when videoplaza.tv is in the menu. As you can see in the picture at the bottom, I dont have to allow google analytics or videoplaza.tv and the video still displays just fine. Both domains are blocked by NoScript

    Sin título.jpg

    nu.jpg

    By the way, the domains with the Forbid next to them on the right side of the NoScript menu are the only sites that load scripts. The ones in the Untrusted list to the left with the Allow next to them are sites that I have included in my black list. If I was a regular user of this Dutch site, it is likely I would untrust to add to the black list just about anything that is displayed in the menu that is not required for what I do. The exceptions would be facebook.com and google.com which I don't black list or white list but prefer to leave them blocked by default and temporarily allow them when I want to.

    Bo
     
  17. Well we know the answer to that (something slips passed NoScript or Chrome forces Google Analytics) when somebody checks this on firefox with uMatrix installed. With the core business of Google in mind, I am afraid the last is the correct answer :(
     
  18. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,144
    Location:
    Nicaragua
    We dont need anyone to check this with Umatrix in Firefox to confirm that nothing is slipping through NoScript. Kees, dont foget, NoScript is the grand daddy of all scrip blockers and the one other similar programs that came later are gauged against, not the other way around.

    Anyway, NoScript blocks google analytics by default and I have the domain included in my black list because I don't require scripts from it in any site that I visit regularly or that I have bookmarked. In other words, I never have to allow scripts even temporarily from google analytics for anything in any site. If you have to allow google analytics while using Chrome, its probably as I said, "Perhaps you have to allow google analytics to watch videos in Chrome because you are using Chrome and Google makes it so".:) Greetings.

    Bo
     
  19. RoTom

    RoTom Registered Member

    Joined:
    Apr 21, 2015
    Posts:
    8
    Check the source:
    view-source:http://www.zie.nl/video/algemeen/Am...i-advertentie-uit-metro-New-York/yulzs25fi9en
    Search for videoplaza: I may be wrong, but seems flash-related to me.
    No flash plugin, no videoplaza needed.

    Google analytics?
    https://hackademix.net/2009/01/25/surrogate-scripts-vs-google-analytics/
    NoScript is not merely a "script blocker"...

    For example:
    https://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/
    https://hackademix.net/2010/01/08/nat-pinning-and-abe/

    Just my two cents
     
  20. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,144
    Location:
    Nicaragua
    With or without Flash being installed in the PC, I do not need to allow videoplaza.tv to load scripts in Firefox with NoScript. But the domain is somewhat related to Flash, if Flash is not installed in the PC, videoplaza shows up (blocked by default) in the NoScript menu. If I install Flash, videoplaza does not appear in NoScript menu. But either way, that site as well as google analytic do not have to be allowed with or without flash to view videos in the Dutch site when using NoScript in Firefox. But they have to be allowed in Chrome when using the script blocker that Kees is using.

    This sort of thing kind of reminds me of Why Chrome has no NoScript. I know the article is old but even after all this years, there is still no NoScript available for Chrome.
    https://hackademix.net/2009/12/10/why-chrome-has-no-noscript/

    Bo
     
    Last edited: Nov 26, 2015
  21. That is belief not facts, so dream on :cool:

    See hackademix post and the good news with these feature called surrogate scripts
    So you can blacklist google analytics as much as you want, but it won't get blocked

    :argh: Bo's Surrogate blocking of Google Analytics ROFL :argh:
     
    Last edited by a moderator: Nov 26, 2015
  22. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,144
    Location:
    Nicaragua
    Wrong. If you blacklist or dont allow google analytic temporarily, google analytic don't load scripts. Kees, thats not a maybe.

    From the same link, I quote:

    "Sooner or later you, dear NoScript user, may face this puzzle: you already allowed every single script source looking "legitimate" on a certain page, but the damn thing stubbornly refuses to work as it should. Then, in a moment of enlightenment, you dig inside your Untrusted menu, and there you find google-analytics.com. You put it there long ago because you don't like to be tracked, but now you cross your fingers and temporarily allow it... et voilà , the page starts behaving!"

    Is obvious that the last sentence in the quote is implying that google analytic is blocked from loading scripts if black listed but you might need to allow it for some sites otherwise they wont work as required. Thankfully, I don't use any site like that. And for the the Dutch site, it is not required for watching videos in Firefox as you have to ....in Chrome.:cool:

    Bo
     
  23. RoTom

    RoTom Registered Member

    Joined:
    Apr 21, 2015
    Posts:
    8
    I can't try to have the video served by flash because I don't have the plugin at all.
    But yes, videoplaza shows up in the menu but I don't need to allow it to play the video in html5.
    The same for google analytics: in my system is blocked in the hosts file.
    :)
     
  24. @bo elam

    Wrong, the post EXPLICITLY states in the next paragraph
     
  25. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    6,144
    Location:
    Nicaragua
    Exactly, in Firefox without the plugin, I only have to allow zie.nl. And with the plugin installed, I have to allow zie and snmmd. Nothing else has to run.....as in Chrome. I dont have the plugin in my W7 either but I can play around quickly with and without it because I install it sandboxed whenever I want to use it. :)

    Bo
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.