NoScript 10 + New Version Releases

Hi Wat. Personally, when I go to a webpage, I am usually looking for specific content, this content is all I want to get and usually what I approve and dont care about the rest. Thats why I block what I am not looking for. In my view, I am not missing anything. Perhaps you want some of the content that I block but I certainly dont. For me, the main purpose for using NoScript is to clean the internet. You read my posts were I give credit to NoScript for keeping me safe but I get plenty security from Sandboxie. I dont need it for security. I use NoScript to clean the internet of annoyances, distractions. I realize that some of what I call distractions and annoyances is perhaps content that you desire to get. Try to understand that not everyone wants the same things when they land in a webpage. What I block, I want it blocked. Perhaps you think I am missing something but I am not.

On the reply above to Mr K, you call his approach (and perhaps mine, I guess), boring. You are being short sighted. If what I want from the internet is exactly what I get, why would that be boring? On the other hand, If I browsed using your views, my internet experience would be annoying and disgusting. So, what should I do, browse your way, or my way?

Bo

 

Wow, once more a very interesting and useful discussion here at Wilders. I admit that until now I have read only a part of the most recent page (16). Nevertheless, please allow me to interfere a little bit.

Like Bo, I am a permanent and in principle satisfied user of NoScript (always in combination with Sandboxie - also like Bo ). But during the recent troubles with the Firefox add-ons I have read so often and by so many users about uBlock that I started to be interested in it too (in uBlock).

So I would like to make a short remark and ask two basic questions.

From my experience I would say that NoScript is not (or let's better say: not always) so easy and so comfortable to use as Bo describes it:

For me sometimes it is quite hard to find out which script I have to allow to get access to the contents of a website (and also to decide if I should allow a certain script permanently or only temporarily). Of course experience helps (as Bo correctly mentioned) but nevertheless I find the procedure sometimes quite cumbersome. That's the main reason why I started to reflect if something like uBlock could be an alternative (??).

So my two basic questions are (to all of you who know something about the two add-ons):

1. Concerning the security aspect, do you think that uBlock could be a fully adequate replacement for NoScript? In other words: Could uBlock offer the same security level as NoScript provides? (I refer primarily to the basic function of NoScript - which is the blocking of scripts, I assume. I am aware that NoScript has various additional features but I am not such an advanced user that I make use of them, at least I am not aware of it. )

2. With regard to speed, simplicity of surfing, visiting websites etc.: Would it be a problem to use both NoScript and uBlock?

 

Hi Pete, I haven't used or tested UBO for script blocking. A few years ago, I used ABP along NoScript to block ads, at one point in time, when I experienced an issue with ABP, I replaced it with UBO. A short time later, I decided to stop using adblockers in general (as most ads can be blocked by NoScript). Unlike some UBO users here at Wilders, who dont miss any opportunity they can get to attack NoScript, I dont do that, and have no reason not to believe that UBO is a decent program and can be used (specifically) to block scripts efficiently.

Regarding #2. There are many users, including advanced NoScript users who I know use UBO as an adblocker along NoScript. Personally, I cant understand that as I block most ads with NoScript alone. Not all ads get blocked by NoScript but the vast majotity get blocked. To me, the trade off of using an extra extension (ABP/UBO) to block just a few more ads is not worth it.

I am open minded. If someone likes UBO better than NoScript, it doesnt bother me. Why should it bother me? But it annoys me when I see UBO users (same guys always) bashing NoScript and worst, when they personally attack and insult NoScript users just because we like NoScript......and dont switch.

I wrote before. Ten years ago, I read that NoScript was a great program, recommended by real (not amateur, like us) professional security experts. And decided to learn it. It wasn't easy but I never let it frustration take over, after a while when things started making sense, the program clicked in my head and all of the sudden, the program became very easy. I written how to make the program easy, and it can be easy, but you have to put the time to learn it, and not let frustration take over. I never never felt frustrated with NoScript, even when I knew nothing. I knew NoScript was a great program and wanted learn it. And I did.

Specifically, regarding speed, simplicity of surfing, visiting websites etc. Everything regarding browsing, gets tailored according to my choices, I owe that to NoScript. With NoScript, I make browsing my way.

Bo

 

The first thing I recommend you do, if you haven't, is to set up the bulk of sites that you visit regularly, your bookmarks. By doing this, you gain two things. One, you make those sites set and forget. So, when you visit, this type of sites, you wont have to interact with NoScript. And two, you gain experience and knowledge with every website you set up. Setting up and white listing your bookmarks, puts in front of your eyes many scripts, it gives you familiarity. Setting up your bookmarks is part of the process of learning NoScript, this gives you the experience that later, will help you know what scripts do when you look at their names.

During the process, you ll realize that there are some scripts, like google.com, that you might need for some functions in some webpages, so, you dont white list this domains and only allow them temporarily when they are required to get the content you desire or want. In my case, I have about 5 domains I treat like this, I know what they are and what I usually need them for. So, if I go to a site and see this domains, I know I might need them but only allow them if I actually need them. Seeing them in the menu, not necessarily means that I will have to allow them to get what I want.

The black list. Not everyone creates one but I find it very useful. So, I have one and work on it. Most of my interaction with NoScript has to do with cultivating my black list.Why? When you become familiar with scripts, you realize that you see many of the same scripts appear in many of the websites you visit, you also realize that you dont need to allow this scripts for any content you want, this is the type of domains that I black list. The black list is very useful when I visit websites that I haven't setup. Black listed domains don't run when you temporarily allow all scripts in a webpage, and also makes things easier when you set up a new website since you know that any blacklisted domain that appears in the NoScript menu is not gonna be required for anything useful. So, the trial and error to get new sites or sites you want to set up becomes easier.

There is more, but this should give you some ideas on how I do things.

Edit: One last thing in this post (and very important). Whenever I land in a new webpage, one that's not setup, I dont allow anything if I get the content I am looking for without allowing anything. The vast majority of new and unknown sites I visit can be treated this way. Unless you are a user that want to get everything the site has to offer, there is no reason not to treat this type of site this way. Some NoScript bashers seem to feel that they are missing something when they dont get all the stuff that runs in websites, NoScript is not for this users.

Bo

 

Hi Bo,

once more many thanks for all your help and for your interesting comments.

I think I understand your concept concerning bookmarked sites and making them "set and forget". On the whole I handle such sites in the same way and I will continue to do so in the future.

Concerning visiting new websites (= not bookmarked and visited seldom or never before):
After a short test with "uBlock Origin" I tend to change my method in the future: For such websites (whenever seeing that working with NoScript becomes cumbersome - see below what I mean) I will deactivate NoScript and activate uBlock Origin. This means two or three mouseclicks but in many cases this will mean by far less effort than the "trial and error" method with NoScript.

Would you like to make a little test?

You may take a look at this website: https://tvthek.orf.at/profile/Niederoesterreich-heute/70017/Niederoesterreich-heute/14012510
It is a transmission of the state-run Austrian TV (ORF) in its archive (= a video). [I hope there is no geoblocking. If yes, I will search for another website.]

Try to make the video playing
a) when using uBlock Origin (and with deactived No Script)
b) when using NoScript (and with deactivated uBlock Origin)

In case a) the video will play immediately (after a short loading time), in case b) you will have to do quite a lot of trial and error with the scripts: NoScript shows me 6 of them and it takes a while until you find out which scripts you have to allow. (And of course there are often websites where the number of scripts is even higher.)

I follow exactly the same concept as the one you describe above:

+

I do it the same way.

But from my experience I would not agree with your conclusion:

Seldom I can get the contents (or for example a search function on a site) without allowing anything. (That I have to allow at least one or two scripts is the standard, I would say.) And sometimes (or even quite often) you have to allow more scripts and then the way to the success of getting the "basic" content you are interested in is a quite cumbersome procedure.

In this respect, wat0114 has described very well the situation as I experience it as a user practising with NoScript consequently an "aggressive script blocking":

In such cases uBlock Origin seems to me a very attractive and comfortable alternative - especially if anyway you do not intend to visit the specific site on a regular basis. If you do so, o.k. - then it may be worth the effort to make a setup with NoScript by trial and error and afterwards to bookmark the site.

---------

And something about the security aspect:

Bo writes:

I must admit that originally I started to use NoScript exclusively for security reasons and only by the time I realized that it is also a good protection against annoyances, distractions (especially undesired advertisement etc.). Nevertheless until now remains in my head the idea that I (have to) use it primarily because of security (and that not blocking every unnecessary script would mean a terrible danger for my computer ).

Bo, your above statement encourages me to abandon this idea because I use - as you - Sandboxie (and I hope I have configurated it in a tight way). But if the specific add-on (NoScript respectively uBlock Origin) in our cases (!) is not so important for reasons of security, this could be an additional argument (for me) to reduce the use of NoScript and to prefer in certain cases uBlock: The cleaning function you mention (less annoyances etc.) works fine with NoScript but from what I have seen in my short use of uBlock, this add-on seems to "clean" even better. E.g. at YouTube: I have got used to some advertisement video or picture (or whatever it is) whenever opening the site - and with uBlock activated it is gone.

 

That's because Mr K mentions only wanting text Well, I can guarantee the majority of users surfing the web, shopping for cars, appliances, camping gear, electronics, watching youtube, plus some other I won't mention want a heck of a lot more than just text. I'm sure I don't need to explain this.

Two problems I see here:

1. No way can you convince me that only five domains are required to surf the web hassle-free, unless you are visiting a very limited number of sites in your day-to-day surfing. I'm not suggesting you are lying, only that this is not the reality for most.

2. You mention allowing them temporarily when needed. Well, this means you are managing NS every time you visit these sites, spending more time on NS than you probably should be as opposed to spending it surfing.

It starts with the letter "u" . I just don't want to imply a product x vs NoScript debate.

BTW, just to be clear, I never suggested dropping NS for anything else.

 

It's not worth to answer this. What @wat0114 and @Peter 123 said in other posts makes your statement void.

I never said that Noscript can't do that. I said that uBO can do it to illustrate that it can do what Noscript does.

ROFL. This silly telediagnosis shows that you're running out of arguments. My main point was that uBO can block scripts as well as NS can. And if you must allow scripts for a site (which is necessary very often and not only for your famous 5 sites) the filter lists still block most ads/blockers/malicious stuff. If that is not superior compared to NS then I don't know the definition of "superior".

 

Either you didnt understand what I meant, or I explained wrong. I said there are in my case about 5 domains that I treat as I treat google.com (google.com. cloudflare, facebook.com, facebook.net, twitter, ajax.googleapis, gstatic). This are domain that I need for some websites that I visit but I dont set as trusted, and I dont black list them either. I let them be default and only allow them when I need content that to get, I have to allow them.

Let me quote myself, I said in an earlier reply to Peter, "One last thing in this post (and very important). Whenever I land in a new webpage, one that's not setup, I dont allow anything if I get the content I am looking for without allowing anything. The vast majority of new and unknown sites I visit can be treated this way."

In other words, adding to the quote. For most sites I land at random, I don't have to allow any content to run to get the content I want. No interaction with NoScript is required on my part.

To end. You are still missing the most important detail.

I surf the internet my way, not your way.

Your way of surfing is not the way I want to do it.

Your way of surfing (allowing all content to run), to me, is annoying. I told you that already but you miss it.

I accept not everyone feels as I do, why cant you boys who love UBO accept that some of us like to do things differently.

Bo

 

@summerheat....Ignore. Thank you.

Bo

 

Great words...I sign with both hands

 

Well I'm nonplussed by this statement. One example of a popular sports website, at least in Canada, is: tsn dot ca If I just so much as block 3rd-party scripts - never mind 1st-party scripts, I am not able to see any scores or videos. This completely breaks much of the prime content in the site. This is just one example off the top of my head no less. There would be many others where blocking everything like you do or even 3rd-party content will render most web sites to the dark ages.

EDIT

on another attempt with 3rd-party scripts blocked, scores rendered but videos still did not. 1st-party blocking breaks both

No I get it that you and others want to surf your way and I have no problem with that whatsoever. It just puzzles me that you can surf the web blocking as much as you do and you're fine with that. Also as I mentioned earlier, I don't believe I've ever tried to plug uBlock over NS. My apologies if I did.

One more thing; I don't allow all content to run as you claim I do. I block iframes and ads. That's fairly considerable, although certainly not to the aggressive degree that you and some others filter web sites.

 

Websites that stream sports live play games with users. They want you to allow all the content they have in their pages. So, its up to you to know the tricks they play and not let frustration take over. Let me show you some examples of tricks sites do to discourage users from using script blockers, ad blockers.

First look at this site, as of today, this is the site that I am using most of the time for MLB and NFL. look at what I allow and what I get (clean website). Its a pretty decent site (May 2019). But it has been rough in the past. This type of sites continuously change what they do to serve their content, they do it to discourage users from using script blockers. So you have to be aware of that, know it, and act accordingly when they make changes.





Now, look at this site here below, to make things difficult, this site changes one script from the list of required scripts every time you close and reopen the website. In other words, every time you visit the site, there's one script that you ll have to temporarily allow for the site to display the games. So, if you are a rookie, a beginner, it complicates things a little bit because you don't understand whats going on. But as you become an experienced user, you ll realize or at least ought to realize that sites do this sometimes to discourage you from using NoScript, script blockers. Guessing what the new scripts that has to be allowed is usually easy, because the names usually follow a pattern. Theres some similarity in the name of the script that's rotated. eurohosting was the domain thats rotated at the moment I took the picture.



The site I visit to follow sports is cbssports.com. This site is what I consider, regarding scripts, horrendous, is a very difficult site . But CBS is what I use to see scores, etc, every day. Despite the site being difficult, I like the writers, so, what do I do? Leave the site? No, I tame it and have fun doing it.

Let me show you a couple of pictures at cbs sports. When I first land in it, nothing is allowed to run but the scripts that I trusted when I set up the site. Now, see what I do when I want to watch videos (something rare, as I usually only care for the reading).

First of all, I have to disable blocking content in Firefox. This is not NoScript. So, some of you using Firefox might be experiencing some blocking that's done by Firefox, but since you dont know, you blame the script blocking program you are using. So, look at the first picture.



Disabling Content blocking for Cbs sports in Firefox, allows facebook.net to run and to appear in the NoScript menu. If I dont do this in Firefox, facebook.net doesnt appear in the NoScript menu. Unbelievable as it might seem, you have to allow facebook and facebook net at CBS sports for videos to play. After this domains appear in the NoScript menu, I allow this two domains to temporarily run, and the videos play.



Sites play tricks, Wat. Personally, I have fun with this games. They don't make me angry or frustrated, I figure them out and have fun doing it. Whenever I find one site doing tricks, I find the solution (it gets easier every time). Beating the trick makes you more knowledgeable. And next time, beating the trick becomes easier.

Bo

 

Bo, as a fellow NoScript user, that is a lot of fluffing about that some people just can't be bothered with. You say you have fun taming the site, where I can see how that would not be fun but rather a PITA having to mess with NoScript at every visit.

That's my thoughts and remember, I also use and love NoScript, now in Chrome as well.

 

CBS sports is the exception. Most sites are not like that (99%), you ought to know that.

Wat mentioned the Sport site he has issues with, and most sport sites are what can be considered difficult. Thats why I brought up the sport sites I visit regularly and what I do with them, and how to make them work.

The way I set them up, using those sites work like when you turn the TV on, you visit the site, and they work without any interaction, other than when there's a trick, you ought to know that too.

Later

Bo

 

Bo, I do know. My point is that for many people, that would be far too annoying. FWIW, I also have uBO installed but only use that in basic mode for its filter lists and to block some extra stuff manually.

 

Thats true. Thats the whole point why some sites play tricks. They want users to give up using script blocking. And they achieve it when people find script blocking difficult and cumbersome.

Also agree, its a lot easier to use filters ala ABP or UBO.

Bo

 

i assume you know who mr. steve gibson (of gibson research corp) is. here's what he's got to say about ns, ubo & umatrix. it's a good place to start learning about ubo & umatrix. i recommend you first watch "the security now" (mr gibson's video on ubo) video and then watch the other two videos on ubo & umatrix at the end of this post.

https://www.youtube.com/watch?v=dB9zKOJJYaI

and these two videos on ubo & umatrix will give you a basic idea of the concept & general use of ubo & umatrix. (mind you, the videos below are from about a year and a half ago. both ubo & umatrix improved and evolved a lot since then).

1) how to use ublock origin to protect your online privacy and security (ublock origin tutorial 2018 ).
https://www.youtube.com/watch?v=2lisQQmWQkY

2) how to use umatrix to protect your online privacy & improve security (umatrix tutorial)
https://www.youtube.com/watch?v=TVozpo3zUBk

 

@Peter 123

https://youtu.be/dB9zKOJJYaI?t=4670

 

Thank you for your information, imdb. I will watch the videos. But for now I have to finish to deal with my computer as I spent already the last hours to experiment a little bit with uBlock, especially with the medium mode (blocking 3rd-party scripts and 3rd-party frames): https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium-mode
All worked fine until now and I like this add-on more and more.

(Sorry for getting off topic as this is the thread about NoScript. I promise to continue with questions or comments concerning exclusively uBlock in the thread which exists for this add-on.)

 

I'd like to know that as well. I hope wat0114 will tell us. Don't know what to use these days.

The only iframe blocker I'm familiar with is in Opera 12 and NoScript 5 in SeaMonkey. Vivaldi doesn't have a setting about it. Or I haven't foud it under perhaps some other jargon.

 

I thought watt0114 was referring to uBlock Origin
https://www.wilderssecurity.com/threads/noscript-10.397945/page-17#post-2825390

 

I completely missed it in these long, interesting, discussions. Thank you much

 

Ah, I see. You're welcome then.

 

Yep

Actually, using NoScript or another script filtering extension, 3rd-party scripts could also be blocked by default, as long as one has the patience to fine tune "noisier" sites, depending on how often these types of sites are frequented in daily surfing. I would not go beyond this level (iframes and 3rd-party scripts) of filtering, though. I think most people won't have the patience for this.

I'm not sure about Firefox or other browser, but javascript can be blocked in Chrome, with selected top level domains or specific sires whitelisted...



Obviously .com allows a lot of javascript, but at least this level of filtering keeps out other country domains one may not want, as well as ip address-specific malware infested sites.

 

not possible with ff.