ScriptSafe former ScriptNo: Discussion

Discussion in 'other software & services' started by andryou, Nov 15, 2011.

  1. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Nice one. ;)

    Actually, that's embedded in the noscript tags. If you take a look at the source code, you'll also see the only script tags are for Google Analytics. There's nothing much there.
     
  2. luxi

    luxi Registered Member

    Joined:
    Aug 31, 2013
    Posts:
    74
    I was wondering how ScriptSafe should handle meta refresh redirects in a <noscript> tag.

    Example:

    Code:
    <noscript><meta http-equiv="refresh" content="0;url=http://example.com/" /></noscript>
    I encounted a certain site that does this and didn't think it should be allowed, but I don't know if it can or should be blocked.
     
  3. dogbite

    dogbite Registered Member

    Joined:
    Dec 13, 2012
    Posts:
    1,290
    Location:
    EU
    NoScript / ScriptSafe addons

    I am currently using both FF and Dragon.
    While I find FF NoScript an add-on very effective and efficient, ScriptSafe for Dragon does not so well.
    But actually I could not find any equivalent NoScript extension for Chrome/Dragon.

    Any advise?

    Thanks much
     
  4. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,738
    Re: NoScript / ScriptSafe addons

    ScriptSafe is the best so far, Google doesn't open up the browser as much as Mozilla for extension developers. Which means less tampering, but less extensibility as well.
     
  5. Brandonn2010

    Brandonn2010 Registered Member

    Joined:
    Jan 10, 2011
    Posts:
    1,854
    Re: NoScript / ScriptSafe addons

    Does ScriptSafe load before the rest of the page, or is it still asynchronous?
     
  6. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,738
    Re: NoScript / ScriptSafe addons

    Can't really tell, but nothing seems to have been bypassed so far. You'll have to ask a real expert that. :ouch:
     
  7. moontan

    moontan Registered Member

    Joined:
    Sep 11, 2010
    Posts:
    3,931
    Location:
    Québec
    Re: NoScript / ScriptSafe addons

    the interface of ScriptSafe seems wonky.

    i just tried a few pages with it.

    i get "No external resources loaded" sometimes, other times i get to see them.

    you can't have your cake and eat it too. ;)
    it's either NoScript or the Chrome sandbox.
     
  8. guest

    guest Guest

    Re: NoScript / ScriptSafe addons

    About ScriptSafe, somehow it caused slowdowns in Chrome. I don't know why, but it was definitely not something I would tolerate.
     
  9. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    4,064
    Location:
    Canada
    Re: NoScript / ScriptSafe addons

    So far as I've seen, NoScript is unparalleled.
     
  10. moontan

    moontan Registered Member

    Joined:
    Sep 11, 2010
    Posts:
    3,931
    Location:
    Québec
    Re: NoScript / ScriptSafe addons

    if i recall correctly, that's always been a problem with this extension.
    i have been trying it here and there over the past few years.
     
  11. guest

    guest Guest

    Re: NoScript / ScriptSafe addons

    No idea. :doubt: It used to be not. But there was an update and the problem started to occur.
     
  12. tlu

    tlu Guest

    Re: NoScript / ScriptSafe addons

    Well, I haven't tried it for a while but last time when I did it was bypassed by some javascript testing sites. One of them - if I remember correctly - was http://www.isjavascriptenabled.com/

    BTW, a less overloaded alternative which I'm testing right now is Scriptblock which is, according to its About tab, based on the old Chrome Extension "NotScripts".
     
  13. guest

    guest Guest

    Re: NoScript / ScriptSafe addons

    Seems like a resurrected NotScript to me instead. I will wait for a few months before trying it out, but thanks for the recommendation anyway. :)
     
  14. rinem

    rinem Registered Member

    Joined:
    Mar 11, 2012
    Posts:
    156
    Re: NoScript / ScriptSafe addons

    I use NotScript. Its easy to use although it hasn't been updated since years.
    Scriptsafe needs much more attention for unblocking sites.
     
  15. tlu

    tlu Guest

    Re: NoScript / ScriptSafe addons

    That's the problem. It's very well possible that it will no longer run in Chrome by January 2014 because of Manifest 2. And that's why Scriptblock is probably already the safer alternative as it is Manifest 2 compliant (otherwise it would have unpublished in the Web Store).
     
  16. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,738
    Re: NoScript / ScriptSafe addons

    It's properly blocked now: <h1 id="no">NO</h1>

    Thanks, never heard of it.
     
  17. safeguy

    safeguy Registered Member

    Joined:
    Jun 14, 2010
    Posts:
    1,797
    Re: NoScript / ScriptSafe addons

    Agreed ;)

    1. NoScript goes beyond Javascript blocking. It also includes anti-XSS and anti-Clickjacking protection among others; even if you choose to "Allow Scripts Globally".

    2. You can build your own Untrusted Blacklist; useful even if you choose to "Allow Scripts Globally".

    3. With Google Analytics Surrogate Scripts, more sites work correctly even if you decide to block google-analytics.com.

    4. It's reliable for javascript blocking. There's little need to second guess.
     
  18. tlu

    tlu Guest

    Re: NoScript / ScriptSafe addons

    I totally agree that Noscript is excellent. However:

    Chrome has its own XSS filter called XSS Auditor. And as a matter of fact Mozilla is planning to implement an XSS filter in Firefox that is based on the Chrome one:

    Chrome has also protection against clickjacking according to several mentions in the security notes of the Chrome releases blog.

    Which one is better/more reliable? I have no idea ...

    Absolutely. The most reliable way to block scripting in Chrome is by forbidding it by default in the settings and allowing it per-site. However, this means that also any 3rd party scripts are allowed. And that's where extensions like ScriptSafe or ScriptBlock come in which can block those 3rd party scripts even if you allow JS for a specific site.

    The question is how relevant that is if you also use Adblock (with the relevant filter lists which should block most 3rd party scripts anyhow) and/or a big hosts file. Both solutions block, at least, the known bad guys while those extensions give you more control - provided that they work reliably. So the best approach is to use them in combination.
     
  19. luxi

    luxi Registered Member

    Joined:
    Aug 31, 2013
    Posts:
    74
    Just realized NoScript has an option to block meta redirection inside a <noscript> element and it works well for what I described above. Doesn't seem to be an alternative for Chrome at the moment.
     
  20. tlu

    tlu Guest

    Re: NoScript / ScriptSafe addons

    FYI: I tested ScriptSafe and ScriptBlock against a couple of websites:

    1. http://www.javatester.org/javascript.html

    2. http://sveinbjorn.org/check_if_javascript_is_enabled

    3. http://www.isjavascriptenabled.com/

    4. http://www.whatismybrowser.com/is-javascript-enabled

    5. http://www.activatejavascript.org/

    6. http://browserspy.dk/javascript.php

    Result: ScriptSafe failed on all 6 websites (javascript was reported as enabled). :thumbd:

    ScriptBlock only failed on website no. 2. On the other 5 websites, javascript was reported as disabled or no test result was displayed (nos. 1 and 3).

    Conclusion: ScriptSafe is highly unreliable. ScriptBlock is significantly better but not perfect (although it is possible that test no. 2 is flawed).
     
    Last edited by a moderator: Oct 4, 2013
  21. tlu

    tlu Guest

  22. hogndog

    hogndog Registered Member

    Joined:
    Jun 9, 2007
    Posts:
    632
    Location:
    In His Service
    Seems to work in Chromium, passed all 6, maybe its the way you have it configured or maybe the application in your browser is corrupted or..?

    *edit: Just a thought, maybe its my Linux installation, I'm using a USB stick?
     
  23. moontan

    moontan Registered Member

    Joined:
    Sep 11, 2010
    Posts:
    3,931
    Location:
    Québec
    Re: NoScript / ScriptSafe addons

    NoScript blocks #2
     
  24. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,738
    Re: NoScript / ScriptSafe addons

    It passed all of them for me. I confirmed the results on a clean Chrome portable with nothing other than ScriptSafe installed. Something is wrong with your profile or settings.
     
  25. Baserk

    Baserk Registered Member

    Joined:
    Apr 14, 2008
    Posts:
    1,321
    Location:
    AmstelodamUM
    Re: NoScript / ScriptSafe addons

    Weird thing is, with 'Noscript' and 'Img' under options checked (on latest Chrome and Scriptsafe 1.0.6.16) opening the links in new tabs gives a 'no javascript/disabled' on all 6 links.
    Opening the links in new windows reports 'javascript enabled' on the first 2 links only.
    Repeating opening all links in new tabs again on the first instance of Chrome, gives 'javascript enabled' on links 1 and 3.
    I don't get the inconsistency.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.