ScriptSafe former ScriptNo: Discussion

Re: ScriptNo: Discussion

I've got youtube in another tab right now, not whitelisted. No images are loading. If I whitelist, reload, they show. If I then remove it from the whitelist, reload, they're blocked again.

IDK what to tell you.

 

Re: ScriptNo: Discussion

haha just to make sure, you using the latest scriptno version?

1.0.6.2?

that would be 1.0.5.X behavior.

 

Re: ScriptNo: Discussion

If you click the block/whitelist option you effectively refresh the pages.

And i already said, refreshed the pages, it blocked all.

It only apply when user enter from address bar in chrome or click from bookmark bar.

once reload or by scriptno it will blocked the things.

simple step:

1) start fresh chrome
2) enter google.com / youtube.com to address bar, press enter
3) thats it.

no config all default, fresh chrome, fresh scriptno, very simple.

If you cannot reproduce, maybe miss somethings, i don't know.

It reproduce on multi platform, different chrome version, even latest chromium.

 

Re: ScriptNo: Discussion

@lipsin, take a look at my previous post. But i am not sure if i explained the situation well! https://www.wilderssecurity.com/showpost.php?p=2019222&postcount=107

Note:

I told told this because scriptno uses webrequest api or whatever! Or i have no idea what i am talking about!

 

Re: ScriptNo: Discussion

Yes, I followed those steps. I'm on Chrome 17 on Ubuntu 12.04. It's working here so perhaps I have some setting changed.

 

Re: ScriptNo: Discussion

Just added this extension. Been using it for over a week now and everything is working well.

 

Re: ScriptNo: Discussion

try it when it is On and when it is disabled.

see if there is a speed difference to load pages...

 

Re: ScriptNo: Discussion

I have, if there's an issue loading pages it's so small that I cannot notice it. I cleared my cache and history twice for my tests, on/off, and I see no differences.
Like I said I'm visiting all my regular sites, including YouTube, and everything so far is working well.

Now that I know this thread exist I will check it regularly. Also this extension is much better than NotScripts.

 

Re: ScriptNo: Discussion

allright, i'll install ScriptNo again and run some tests, again.

you are right, i found it much better than NotScript.
---------------------------------
edit:
ScriptNo makes loading pages slower on my machine.
how much slower?
without ScriptNo, about 2 seconds to load a page, with ScriptNo, about 4-5 seconds.

but once i am in a site, all the pages from that site load fast.
the slowdown only happens going from one site to a different site.

not that big of a deal really, after all.

 

Re: ScriptNo: Discussion

Sorry to hear that, but I'm fine on my end. I even ran some test with it on and off on speed testing sites.
If it was slowing down my browsing i would of removed it immediately.
http://www.dslreports.com/speedtest
http://www.speakeasy.net/speedtest/
http://www.speedtest.net/index.php

 

Re: ScriptNo: Discussion

i have re-installed ScriptNo.

the added security offsets the timing issues for me.
i like NoScript better but until Firefox gets its own sandbox i'll stick with Chrome and ScriptNo.

 

Re: ScriptNo: Discussion

On https://chrome.google.com/webstore/detail/oiigbmnaadbkfbmpbfijlflahbdbdgdf/reviews I found a review by Peter Greenburg which says:

Well, I tried that site - and, indeed, it said that JS was enabled! Only after clicking the reload button, JS was disabled. (However, this result has not always been reproducible after restarting Chrome although I have disk caching disabled in Chrome.) I found the same result on http://www.enable-javascript.com/

Disabling ScriptNo and controlling JS with in the Chrome settings isn't an alternative, either: I've noticed on a couple of sites (which only work in Firefox if I allow some 3rd party domains in Noscript) that they work in Chrome without the need to allow scripting for those 3rd party sites. In other words: If you allow JS for a specific site, you're obviously also allowing all 3rd party scripts.

Conclusion:
1. Script blocking in ScriptNo is unreliable. Either that relatively new API it's using is still crap or ScriptNo itself is flawed.
2. Controlling JS in the Chrome settings is ridiculous as you always automatically allow 3rd party scripting.

That's really not the degree of control which I expect from my browser. I will stick with Firefox for the time being.

 

Re: ScriptNo: Discussion

Yeah the isjavascriptenabled site did confuse me and I reported it I think. The thing is, sometimes it seems to work and other times ti doesn't. I wouldn't rely on it for security, mostly only for privacy (blocking social widgets etc.)

 

Re: ScriptNo: Discussion

it hasn't been updated from mid-February either.

i went back to Firefox with NS.

 

Re: ScriptNo: Discussion

Similar scriptno behavior reported here earlier.

1.0.6.X got 2 major bugs。

1）Does not block script under some startup situation only after reload.
2) If temp alow some script，it may also pull some 3rd party element which never allow by user.

Bug 2 can't verified, maybe it cause by the loading behavior of Bug 1。

Chrome developer tools - script panel made it so much easier to spot which script is load for any site.

Basically 1.0.6.X version is unusable。

This maybe a Chrome limitation, or scriptno bugs.

＊＊＊

Alternative usage.

1) Don't enter url through address bar.
2) Don't click any bookmark directly.
3) For any link including bookmark (Right click - Open in new tab) to open.

90% of the time, it worked. zero script will execute on 1st load.

1 caveat.

eg. Google Reader - V keyboard shortcut to open target website will not block script when open. Unless explicit right click to open the link.

After a while, decide just too much hassle.
Migrate back to Firefox.

 

Re: ScriptNo: Discussion

Thanks for pointing this out, tlu. Same thing happens for me. I can clear the cache and reload the page to sometimes get a different result.

The extension otherwise works perfectly for me. If I go to any site other than the two Greenburg names, nothing leaks through which needs a page refresh to be blocked. Unless for site I allow, I always have the blocked JS image in the address bar and the ScriptNo icon is red.

I'd like to know what about those two websites makes them bypass the extension. The first site even looks like it disables script blocking because there's no blocked JS icon in the address bar, AND the NoScript icon is green. With enable-javascript.com, the browser at least is verifying script blocking. The links are to pics showing this.

http://i45.tinypic.com/1g3o85.png isjavacriptenabled.com
http://i49.tinypic.com/15zpndk.png enable-javascript.com


Here are some other JS checking sites. I've got ScriptNo 1.0.6.2 on default block with Chromium 22. All consistently tell me that Javascript is disabled, and show the address bar icon for disabled JS. Then there's sites like the Acid3 test, Browserspy, Panopticlick, SunSpider and the JonDonym which will also tell you if JS is enabled.

http://sveinbjorn.org/check_if_javascript_is_enabled
http://www.cyscape.com/showbrow.asp?bhjs=0
http://www.ismyjavascriptenabled.com/
http://liblearn.osu.edu/tutor/jscript.html


Andryou, are you still supporting this extension?


Oh, also... Peter Greenburg linked to a thread on the NoScript forum, Giorgio should have a Chrome port available "by this summer."
http://forums.informaction.com/viewtopic.php?f=8&t=8306

 

Re: ScriptNo: Discussion

If I disable "Respect same domain" in the ScriptNo preferences, both these websites and others do not mention that JS is enabled. So this extension works just fine.

I've been using this extension for several months now, enduring several Chrome releases and a ScriptNo update. And in fact, I've never noticed such a bug like the one you mention here...?

Please avoid the unhealthy undertone of your statement. The latest ScriptNo update was in february 2012. NotScripts and NotScript for Chrome OS have not been updated for over one and a half year. The regularity of ScriptNo updates is good (latest update was four months ago) for a one-person-project.

 

Re: ScriptNo: Discussion

Create a simple video on youtube to show the problem.

http://www.youtube.com/watch?v=tSjNHCReikg


http://www.youtube.com/watch?v=tSjNHCReikg

 

Re: ScriptNo: Discussion

This is the default also used by myself (and probably by most users). And I have observed these problems as mentioned earlier. Besides, why should this option be relevant for the question if ScriptNo reliably blocks JS or not?

Well, the fact that YOU never noticed it doesn't mean that it doesn't exist. lipsin's Youtube video shows it very clearly.

awkwardpenguin only asked a simple question. It's a legitimate one as this wouldn't be the first extension whose development stopped (for whatever reason), and since Andrew hasn't participated in this thread for quite some time.

 

Re: ScriptNo: Discussion

I keep Respect same domain unchecked as well, the same as the default setting.

I never noticed such a bug either until I saw tlu's post, it works exactly as lipsin's video shows. Much luv to the community and again, these are the only two sites I've noticed this bug on.

If you identify something "unhealthy" in such a simple and non-threatening question, that's your decision.

Anyway, I emailed Andrew and linked him to these recent posts. This is far from something that would turn me away from ScriptNo, but I'm still looking forward to seeing how Giorgio's new extension turns out.

 

Re: ScriptNo: Discussion

Hi,

The link below was already mentioned in several topics here:

http://forums.informaction.com/viewtopic.php?f=8&t=7475

but not this one:

http://forums.informaction.com/viewtopic.php?t=7020&f=8

 

Re: ScriptNo: Discussion

No questions, but a comment: If you can get this puppy functioning like NoScript does for FF, I'll probably use Chrome when I upgrade to Win7. It would be the deal-maker for me.

Thanks for showing up here.

 

ScriptNo to ScriptSafe

Is this extension safe ? It renamed itself on my Chrome Browser today.

I new tab opened and it showed an update to V1.6.2, dated Feb 2012. I closed it, then closed the browser. On re-opening the browser a new tab opened showing an update to 1.6.3 and asking me if I wanted to enable sync. I am not sure what is going on here.

 

Re: ScriptNo to ScriptSafe

i went to the Google Store and the thing seems legit.
it has a new name, like you mentioned.

we all thought this thing was almost abandonware because it had not been updated since February.

i don't use Chrome but maybe folks can report here if some of the reported issues have been fixed since the February update.

 

Re: ScriptNo to ScriptSafe

here's the changelog: