Script Defender for Chrome

The interface is by far the best one of any extension so far. I actually think it's the best interface for any script blocker I've seen. My one issue is the size of the blocks.

He seems to have a really good handle on things.

The user face is actually so easy to use that I may just leave it installed. Though I do have it set separately in my settings to only allow images over https://[*.]com and a few other TLD's. Just to see how that works out.

Either way, very nice program.

 

agreed.
it is very nice indeed and i will play with this some more over the next few days.

 

I am also trying HTTP Switchboard, my first impression is that is very good...let's see over the next few days.

 

My impressions are not so good. HTTP switchboard looked just fine etc., but my Smooth Gestures stopped working. Who knows what imcompatibilities with other extensions?

Remember if you try, you can always reset Chrome settings, it will also disable all the extensions. Or try them in a sandboxed Chrome.

 

Test XSS:

http://labs.lachisterablanca.com/po...rt('XSS WITH WHITESPACES');</script>=anyValue

Check Scriptsafe,Script Defender ...........with Chrome.

Firefox + Noscript.

 

Good point.
So far it seems it conflicts with AdBlock and with Do not Track me.

 

interesting.

tnx m8.

 

I have an issue with HTTP switchboard. If I close the browser it losts all settings, I have to re-allow every page. Annoying.

 

Check moontan's post:

 

Yeah, once you allow Javascript the XSS works, naturally. Not sure if it's possible to solve this with Chromium APIs. Maybe someone should open a bug.

 

Thanks wat!! Appreciated.

 

Actually you temporarily greylisted the hosts, you have to click the lock icon for those settings to stick.
I contacted the extension author saying that clicking the lock is a bit of added work to keep your settings.

My only complaint is not with the extension but how chrome behaves when javascript is disabled. I couldn't even save an image
unless I allowed the page to use javascript even when I'm looking at the image and not the webpage itself.

 

Yep, FF + Noscript or just IE11

 

I think gesture-based extensions are borked right now on Chrome (Dev/Canary).

I don't use Smooth Gestures, but "Yet Another Drag 'N' Go" hasn't been functioning for the past few versions.

Anyhow, I may be missing something, but Switchboard needs a global allow with blacklist a la NoScript. Or ability to turn off the pre-compiled blocks lists listed in "stats."

& this would be a great time to implement some configurable JS rules. If you look at malware domains over time, a huge amount of rogue pages have numerals and hyphens in the domain. Looking at Alexa and my bookmarks/history, most legit pages do not. I already global block JS and allow .com etc, but more granular rules would be great.

 

Smooth Gestures seems to be working fine with ScriptBlock and Adblock Plus for me. Perhaps because their controlling interface is more simple than that of Switchboard's to not mess up things.

 

I tried with HTTPSB and it does work fine for me. Of course, since SG inject inline script tags in the web page, the web page needs to have javascript enabled. I am curious as to why it doesn't work for some. Also: https://groups.google.com/forum/?hl=en#!topic/httpsb/FAvK2mNnS0w

 

Also I.E.8:

 

gorhill, you are maybe trying to say that Smooth Gestures is maybe a too smooth operator? With that superfish linking.

I anyways removed that one, same time takes some time to trust Http switchboard too.

Smooth Gestures worked anyways for ScriptBlock without allowing Superfish or the site I was surfing to needed JS to be allowed. But it is gone now. Reason being I could never understand what SG in the settings was allowing.

 

Agreed, this would be a really nice feature. Feature requests and bug reports can be placed here:

Maybe I'm missing something, but does it matter about the changing malware domains? As long as only a whitelisting approach is used, if it's not on the list the malicious script has no effect.

 

As mentioned, only if "Submit Usage" is "on", so this can be turned off, which is the polite thing to do.

I looked into this and Smooth Gesture ("SG") works with ScriptBlock ("SB") because SB doesn't block inline scripts. If it were blocking inline script tags (which SG injects), it would also interfere with SG.

 

Thank you for investigating that behaviour.

About HTTPSB, it really needs an option to allow all.
I can of course disable it to get some videos etc hidden so deeply behind some scripts etc working, but that is too unconvinient.
As an example this video and it working in that same page:
http://www.iltasanomat.fi/tyoelama/art-1288598894875.html

I could not get it working how I wanted also in SB, but at least there is an option "Temporarily allow scripts globally". Sometimes just ABP is enough.

 

As much as I dislike this kind of option, I suppose I will have to..

The above video I could make it work by whitelisting the "all", "plugin" and, unfortunately,"adserver.adtech.de". The need to whitelist "adserver.adtech.de" seems to be caused by a programming error on the page, as an exception was thrown by the page: "Uncaught ReferenceError: ADTECH_showAd is not defined". Allowing "adserver.adtech.de" caused 22 more scripts to be loaded/executed from that one hostname...

I can't imagine what would happen if I were to allow all the blacklisted sites from that page bloated with ad and tracker scripts... In my opinion that kind of page deserved to be boycotted, but then ultimately I can't force my choices on others. So I will enter an issue to have an "Allow all" switch (I actually put in this feature a while ago, but I scrapped it back then.)

 

Hi gorhill,
On some sites my wife goes to, mainly Facebook flash games, the httpsb popup can extend down below the taskbar. Even the scrollbar doesn't go down far enough to access all of the entries listed. Would including a Small text selection (presently Normal and Large) under options help with shortening the length of the list?

BTW, I really like this chrome extension. Very effective and comprehensive.

Later...

Bob

 

Hi Gorhill, since it seems that HTTP SW has some conflict with AbBlock I disabled ADB but now I get ads in Gmail.
I tried to set SW up in order to not to see them, but I failed....
Any advise?

 

@gorhill,

thank you for update 0.5.7