ScriptSafe former ScriptNo: Discussion

Discussion in 'other software & services' started by andryou, Nov 15, 2011.

  1. Hungry Man
    Offline

    Hungry Man Registered Member

    Re: ScriptNo: Discussion

    I've got youtube in another tab right now, not whitelisted. No images are loading. If I whitelist, reload, they show. If I then remove it from the whitelist, reload, they're blocked again.

    IDK what to tell you.
  2. lipsin
    Offline

    lipsin Registered Member

    Re: ScriptNo: Discussion

    haha just to make sure, you using the latest scriptno version?

    1.0.6.2?

    that would be 1.0.5.X behavior.
  3. lipsin
    Offline

    lipsin Registered Member

    Re: ScriptNo: Discussion

    If you click the block/whitelist option you effectively refresh the pages.

    And i already said, refreshed the pages, it blocked all.

    It only apply when user enter from address bar in chrome or click from bookmark bar.

    once reload or by scriptno it will blocked the things.

    simple step:

    1) start fresh chrome
    2) enter google.com / youtube.com to address bar, press enter
    3) thats it.

    no config all default, fresh chrome, fresh scriptno, very simple.

    If you cannot reproduce, maybe miss somethings, i don't know.

    It reproduce on multi platform, different chrome version, even latest chromium.
  4. pandorax
    Offline

    pandorax Registered Member

    Re: ScriptNo: Discussion

    @lipsin, take a look at my previous post. But i am not sure if i explained the situation well! http://www.wilderssecurity.com/showpost.php?p=2019222&postcount=107

    Note:
    I told told this because scriptno uses webrequest api or whatever! Or i have no idea what i am talking about! o_O
    Last edited: Mar 22, 2012
  5. Hungry Man
    Offline

    Hungry Man Registered Member

    Re: ScriptNo: Discussion

    Yes, I followed those steps. I'm on Chrome 17 on Ubuntu 12.04. It's working here so perhaps I have some setting changed.
  6. gugarci
    Offline

    gugarci Registered Member

    Re: ScriptNo: Discussion

    Just added this extension. Been using it for over a week now and everything is working well.
  7. moontan
    Offline

    moontan Registered Member

    Re: ScriptNo: Discussion

    try it when it is On and when it is disabled.

    see if there is a speed difference to load pages...
  8. gugarci
    Offline

    gugarci Registered Member

    Re: ScriptNo: Discussion

    I have, if there's an issue loading pages it's so small that I cannot notice it. I cleared my cache and history twice for my tests, on/off, and I see no differences.
    Like I said I'm visiting all my regular sites, including YouTube, and everything so far is working well.

    Now that I know this thread exist I will check it regularly. Also this extension is much better than NotScripts.
  9. moontan
    Offline

    moontan Registered Member

    Re: ScriptNo: Discussion

    allright, i'll install ScriptNo again and run some tests, again.

    you are right, i found it much better than NotScript.
    ---------------------------------
    edit:
    ScriptNo makes loading pages slower on my machine.
    how much slower?
    without ScriptNo, about 2 seconds to load a page, with ScriptNo, about 4-5 seconds.

    but once i am in a site, all the pages from that site load fast.
    the slowdown only happens going from one site to a different site.


    not that big of a deal really, after all.
    Last edited: Apr 9, 2012
  10. gugarci
    Offline

    gugarci Registered Member

    Last edited: Apr 9, 2012
  11. moontan
    Offline

    moontan Registered Member

    Re: ScriptNo: Discussion

    i have re-installed ScriptNo.

    the added security offsets the timing issues for me.
    i like NoScript better but until Firefox gets its own sandbox i'll stick with Chrome and ScriptNo.
  12. tlu
    Offline

    tlu Registered Member

    Re: ScriptNo: Discussion

    On https://chrome.google.com/webstore/detail/oiigbmnaadbkfbmpbfijlflahbdbdgdf/reviews I found a review by Peter Greenburg which says:

    Well, I tried that site - and, indeed, it said that JS was enabled! Only after clicking the reload button, JS was disabled. (However, this result has not always been reproducible after restarting Chrome although I have disk caching disabled in Chrome.) I found the same result on http://www.enable-javascript.com/

    Disabling ScriptNo and controlling JS with in the Chrome settings isn't an alternative, either: I've noticed on a couple of sites (which only work in Firefox if I allow some 3rd party domains in Noscript) that they work in Chrome without the need to allow scripting for those 3rd party sites. In other words: If you allow JS for a specific site, you're obviously also allowing all 3rd party scripts.

    Conclusion:
    1. Script blocking in ScriptNo is unreliable. Either that relatively new API it's using is still crap or ScriptNo itself is flawed.
    2. Controlling JS in the Chrome settings is ridiculous as you always automatically allow 3rd party scripting.

    That's really not the degree of control which I expect from my browser. I will stick with Firefox for the time being.
  13. Hungry Man
    Offline

    Hungry Man Registered Member

    Re: ScriptNo: Discussion

    Yeah the isjavascriptenabled site did confuse me and I reported it I think. The thing is, sometimes it seems to work and other times ti doesn't. I wouldn't rely on it for security, mostly only for privacy (blocking social widgets etc.)
  14. moontan
    Offline

    moontan Registered Member

    Re: ScriptNo: Discussion

    it hasn't been updated from mid-February either.

    i went back to Firefox with NS.
  15. lipsin
    Offline

    lipsin Registered Member

    Re: ScriptNo: Discussion

    Similar scriptno behavior reported here earlier.

    1.0.6.X got 2 major bugs。

    1)Does not block script under some startup situation only after reload.
    2) If temp alow some script,it may also pull some 3rd party element which never allow by user.

    Bug 2 can't verified, maybe it cause by the loading behavior of Bug 1。

    Chrome developer tools - script panel made it so much easier to spot which script is load for any site.

    Basically 1.0.6.X version is unusable。

    This maybe a Chrome limitation, or scriptno bugs.

    ***

    Alternative usage.

    1) Don't enter url through address bar.
    2) Don't click any bookmark directly.
    3) For any link including bookmark (Right click - Open in new tab) to open.

    90% of the time, it worked. zero script will execute on 1st load.

    1 caveat.

    eg. Google Reader - V keyboard shortcut to open target website will not block script when open. Unless explicit right click to open the link.

    After a while, decide just too much hassle.
    Migrate back to Firefox.
  16. shuverisan
    Offline

    shuverisan Registered Member

    Re: ScriptNo: Discussion

    Thanks for pointing this out, tlu. Same thing happens for me. I can clear the cache and reload the page to sometimes get a different result.

    The extension otherwise works perfectly for me. If I go to any site other than the two Greenburg names, nothing leaks through which needs a page refresh to be blocked. Unless for site I allow, I always have the blocked JS image in the address bar and the ScriptNo icon is red.

    I'd like to know what about those two websites makes them bypass the extension. The first site even looks like it disables script blocking because there's no blocked JS icon in the address bar, AND the NoScript icon is green. With enable-javascript.com, the browser at least is verifying script blocking. The links are to pics showing this.

    http://i45.tinypic.com/1g3o85.png isjavacriptenabled.com
    http://i49.tinypic.com/15zpndk.png enable-javascript.com


    Here are some other JS checking sites. I've got ScriptNo 1.0.6.2 on default block with Chromium 22. All consistently tell me that Javascript is disabled, and show the address bar icon for disabled JS. Then there's sites like the Acid3 test, Browserspy, Panopticlick, SunSpider and the JonDonym which will also tell you if JS is enabled.

    http://sveinbjorn.org/check_if_javascript_is_enabled
    http://www.cyscape.com/showbrow.asp?bhjs=0
    http://www.ismyjavascriptenabled.com/
    http://liblearn.osu.edu/tutor/jscript.html


    Andryou, are you still supporting this extension?


    Oh, also... Peter Greenburg linked to a thread on the NoScript forum, Giorgio should have a Chrome port available "by this summer."
    http://forums.informaction.com/viewtopic.php?f=8&t=8306
    Last edited: Jun 25, 2012
  17. thisismatt
    Offline

    thisismatt Registered Member

    Re: ScriptNo: Discussion

    If I disable "Respect same domain" in the ScriptNo preferences, both these websites and others do not mention that JS is enabled. So this extension works just fine.

    I've been using this extension for several months now, enduring several Chrome releases and a ScriptNo update. And in fact, I've never noticed such a bug like the one you mention here...?

    Please avoid the unhealthy undertone of your statement. The latest ScriptNo update was in february 2012. NotScripts and NotScript for Chrome OS have not been updated for over one and a half year. The regularity of ScriptNo updates is good (latest update was four months ago) for a one-person-project.
  18. lipsin
    Offline

    lipsin Registered Member

  19. tlu
    Offline

    tlu Registered Member

    Re: ScriptNo: Discussion

    This is the default also used by myself (and probably by most users). And I have observed these problems as mentioned earlier. Besides, why should this option be relevant for the question if ScriptNo reliably blocks JS or not?

    Well, the fact that YOU never noticed it doesn't mean that it doesn't exist. lipsin's Youtube video shows it very clearly.


    awkwardpenguin only asked a simple question. It's a legitimate one as this wouldn't be the first extension whose development stopped (for whatever reason), and since Andrew hasn't participated in this thread for quite some time.
  20. shuverisan
    Offline

    shuverisan Registered Member

    Re: ScriptNo: Discussion

    I keep Respect same domain unchecked as well, the same as the default setting.

    I never noticed such a bug either until I saw tlu's post, it works exactly as lipsin's video shows. Much luv to the community and again, these are the only two sites I've noticed this bug on.

    If you identify something "unhealthy" in such a simple and non-threatening question, that's your decision.

    Anyway, I emailed Andrew and linked him to these recent posts. This is far from something that would turn me away from ScriptNo, but I'm still looking forward to seeing how Giorgio's new extension turns out.
  21. doesntmatter
    Offline

    doesntmatter Registered Member

  22. luciddream
    Offline

    luciddream Registered Member

    Re: ScriptNo: Discussion

    No questions, but a comment: If you can get this puppy functioning like NoScript does for FF, I'll probably use Chrome when I upgrade to Win7. It would be the deal-maker for me.

    Thanks for showing up here.
  23. emmjay
    Offline

    emmjay Registered Member

    ScriptNo to ScriptSafe

    Is this extension safe ? It renamed itself on my Chrome Browser today.

    I new tab opened and it showed an update to V1.6.2, dated Feb 2012. I closed it, then closed the browser. On re-opening the browser a new tab opened showing an update to 1.6.3 and asking me if I wanted to enable sync. I am not sure what is going on here.
  24. moontan
    Offline

    moontan Registered Member

    Re: ScriptNo to ScriptSafe

    i went to the Google Store and the thing seems legit.
    it has a new name, like you mentioned.

    we all thought this thing was almost abandonware because it had not been updated since February.

    i don't use Chrome but maybe folks can report here if some of the reported issues have been fixed since the February update.
    Last edited: Dec 28, 2012
  25. moontan
    Offline

    moontan Registered Member

    Re: ScriptNo to ScriptSafe

    here's the changelog: