NoScript silently inserts ad whitelists into Adblock Plus

Discussion in 'other security issues & news' started by Eice, May 2, 2009.

Thread Status:
Not open for further replies.
  1. Eice

    Eice Registered Member

    Joined:
    Jan 22, 2009
    Posts:
    1,413
    http://adblockplus.org/blog/attention-noscript-users
     
    Last edited: May 2, 2009
  2. lordpake

    lordpake Registered Member

    Joined:
    Aug 7, 2004
    Posts:
    563
    Location:
    Helsinki ~ European Union
    Re: NoScript disables Adblock Plus

    Thank you for this posting. I wasn't even aware of any controversies involving NoScript, which I rely on myself.
     
  3. kriebly

    kriebly Registered Member

    Joined:
    Dec 22, 2008
    Posts:
    41
    Location:
    Northern California
    Re: NoScript disables Adblock Plus

    The Noscript Developer has taken out the problematic code and apologized.
     
  4. tlu

    tlu Guest

    Re: NoScript disables Adblock Plus

    1. The topic of this thread is strongly misleading. Noscript doesn't disable ABP. That's simply not true.
    2. One should also read this long thread to understand why Giorgio had implemented these measures.
    3. Nevertheless, Giorgio's move was absolutely questionable. As a consequence he has removed the anti-ABP filters in v. 1.9.2.6 and apologized.
     
  5. IceDogg

    IceDogg Registered Member

    Joined:
    Mar 21, 2006
    Posts:
    26
    Location:
    Arkansas
    Re: NoScript disables Adblock Plus

    1. It DID disable ABP on his sites.. FACT.
    2. He 'implemented these measures' to force his ads on people that were blocking them. A cat and mouse game had been going on with him and the filterset easylist when a FP took place and messed up something on his site..that was after the fact though.. it was not WHY he did this in the beginning.
    3. Danged if I can find an 'apology' anywhere on his site. All I see is he removed filters whitelisting all his sites (that wasn't just the site with the false positive that caused an issue on his extensions site) with 'no questions ask' is that the apology part?

    So he fixed his (some are calling) mistake and we should all go back to trusting him again, right. His extension changed settings in another extension without warning so he could display his ads (make money) and that's just a little mistake.
     
  6. tlu

    tlu Guest

    Re: NoScript disables Adblock Plus

    Yes, on HIS sites. That's not the same as "Noscript disables ABP" - this wrongfully suggests that ABP is completely disabled. I still regard that as misleading.

    Regarding his apology, it's in the 2nd link I presented.

    I agree with your other statements, though.
     
  7. IceDogg

    IceDogg Registered Member

    Joined:
    Mar 21, 2006
    Posts:
    26
    Location:
    Arkansas
    Re: NoScript disables Adblock Plus

    Yea, I looked in your second link.. I couldn't find it. Sorry bout that.. can you quote it at least?

    Edit: And it does "disable ABP" you said so yourself (on his sites).. it doesn't say it completely disables it. Sounds find to me..but just my opinion.
     
  8. Eice

    Eice Registered Member

    Joined:
    Jan 22, 2009
    Posts:
    1,413
    Re: NoScript disables Adblock Plus

    Changed, thanks.
     
  9. tlu

    tlu Guest

    Re: NoScript disables Adblock Plus

    Here we go:

    Well, actually it doesn't disable ABP even on his sites but rather whitelists them ... but that's semantics ;)
     
  10. Threedog

    Threedog Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    1,125
    Location:
    Nova Scotia, Canada
    I am glad I use IE as Bill Gates intended! :D

    Seriously, though. I had noticecd that No Scripts site seemed to have a lot of ads on it even though I had adblock installed. I just never put two and two togeather.
     
  11. IceDogg

    IceDogg Registered Member

    Joined:
    Mar 21, 2006
    Posts:
    26
    Location:
    Arkansas
    Re: NoScript disables Adblock Plus

    Like everything it's open to interpretation. And thanks for posting the info I still can't find it on the site..but I don't care to anyway.
     
  12. Steven Avery

    Steven Avery Registered Member

    Joined:
    Nov 13, 2007
    Posts:
    110
    Re: NoScript disables Adblock Plus

    Hi Folks,

    Yep, thanks for the update and info. Appreciated here as well.

    As a side-concerrn I will mention that I pointed out to Giorgio (and similarly Mozillazine) that his sites had lots of really horrid Google ads. This was after he posted properly about the similar problem at Mozillazine that I had pointed out. Giorgio took my input to use the google-block method to .. block the more horrid ads ! Mozillazine does similarly, however they had been a bit lackadaisical in monitoriing, they had the method in place and used the new info nicely as well.

    For the most part these might be ads that lead to scareware and scamware and crapware and rogueware and deception-ware and others that would flunk "web of trust" and/or common sense. Those software floozies and doozies use google as their lifeblood, yet when they are bounced there are other ads that are far more reasonable and sensible that act as full or partial replacements.

    With my new XP install I took a break from that activity. However I appreciated Giorgio's responses and concerns, and hope to work with some others as well, there is a UK fellow who seems to share these concerns nicely and has some net infrastructure and is active in web of trust.

    On Giorgios's sites now there probably are still some bad ones today. Giorgio does not see the USA ads in Italy and may have contractual restraints against actively searching out with proxy servers from Italy on his own. Also the block lists may have some workarounds by the bad guys. The sharks work quickly, however we definitely did a good job improving the ad quality. The only place so far we mildly disagreed was Uniblue, with which he has an arrangement beyond Google, and Uniblue is quite crafty in their gray-line and dark gray activities.

    This situation with Adblock is unfortunate, I am not really commenting on it at all .. simply wanted to give a little backdrop. I actually don't use Adblock partly because I want to see the ads that it would be good to block, using the internal google-block-list methods, so I can help on that end of the problem.

    Oh, in that thread on Adblock I see a report that NoScript is now doing a crapware Ask toolbar opt-out thing. That is a mess. (Followup-correction: this is contradicted as being an incorrect report - post 211.)

    This whole ad-scourge leading to deception and scam and more is really not addressed properly, which is why I prefer forums that simply do not have the problem (including Wilders, Donationcoder, WebofTrust) as the main discussion forums.

    (e.g. Softpedia has junk all over the place, ads and downloads, so while I agreed with them on the specifics of the Comodo brouhaha, it was with a bit of a sardonic twist, since their own software virtue paragon level is quite deficient.)

    Shalom,
    Steven Avery
     
    Last edited: May 3, 2009
  13. AKAJohnDoe

    AKAJohnDoe Registered Member

    Joined:
    Sep 26, 2007
    Posts:
    989
    Location:
    127.0.0.1
    I was appropriately outraged when I discovered NoScript had inserted WhiteLists into my installation of AdBlockPlus. So I removed them.

    Subsequently, after pondering the situation for several hours, I uninstalled NoScript.

    After further pondering for the better part of a day, I have also uninstalled AdBlockPlus. I determined there was nothing it did that I could not do myself with native Firefox facilities.

    ~Phrase removed.~
     
    Last edited by a moderator: May 3, 2009
  14. tlu

    tlu Guest

    Why? With the new version and that whitelist removed I don't think that's necessary. And I'm sure that Giorgio has learned that his move was completely unacceptable (at least in the way how he did that). He knows now that he would completely lose any confidence if he did anything similar again. You can feel his contrition in his latest postings.

    I wonder what that could be. There are no native FF facilities that can replace what the ABP subscriptions do.
     
  15. Eice

    Eice Registered Member

    Joined:
    Jan 22, 2009
    Posts:
    1,413
    Same here, rather curious as to what those native FF facilities are. o_O
     
  16. DOSawaits

    DOSawaits Registered Member

    Joined:
    Dec 11, 2008
    Posts:
    415
    Location:
    Belgium
    He's probably using the "Make Cookies Session-only". :D

    Anyway, I really wonder *why* people install a dumb block-all-javascript add-on in the first place, while there's something that got subscriptions are rarely breaks anything yet getting rid of all tracking- and spamming stuff.

    Also, ABP has a great community, helpful and has updates that could be called updates, not releasing a new version when the author corrected 1 dutch word, only to lure you to his banner infested site on a daily basis.

    Now that a new trend has been started, it's only waiting for next bunch of Firefox add-ons that won't keep their hands in their own pockets.:blink:
     
  17. lordpake

    lordpake Registered Member

    Joined:
    Aug 7, 2004
    Posts:
    563
    Location:
    Helsinki ~ European Union
    You are forgetting one very important thing, malicious scripts. When one allows all necessary scripts to run in trusted sites, possible malicious scripts loaded from elsewhere via exploits/mal. ads won't get a chance to run. This is my main motivation for using NoScript, besides ABP subscriptions.

    Defencive action is not necessarily because of ads :)
     
  18. Eice

    Eice Registered Member

    Joined:
    Jan 22, 2009
    Posts:
    1,413
    Unfortunately, NoScript's solution to this problem is to break the web.

    I wonder when will Giorgio come up with the next logical extension: NoHTML, even safer than NoScript!
     
  19. AKAJohnDoe

    AKAJohnDoe Registered Member

    Joined:
    Sep 26, 2007
    Posts:
    989
    Location:
    127.0.0.1

    Simply go to Menu/Tools/Options/Content and check Load Images Automatically.

    Then, for any image you do not want to see, Right-click on it and select Block Images from ...(url). This will build the exeception list of those websites from which you do not want to see images.

    Alternately, you can go the other way and uncheck Load Images Automatically and then build the exception list for those websites from which you do want to see images.

    Don't believe these methods work for Flash, though.
     
  20. accessalternative

    accessalternative Registered Member

    Joined:
    Sep 17, 2008
    Posts:
    40
    Hi all

    I'm using NoScript 1.8.9.7, is it vulnerable? Should I updtae or is it ok? Which versions were doubtful?

    Thanks
     
  21. Eice

    Eice Registered Member

    Joined:
    Jan 22, 2009
    Posts:
    1,413
    That still doesn't come close to the power that Adblock offers, nor the convenience. With Adblock, you basically get a working list ready to go instead of having to whitelist or blacklist images one by one.
     
  22. Dogbiscuit

    Dogbiscuit Guest

    LOL !
     
  23. TonyW

    TonyW Registered Member

    Joined:
    Oct 12, 2005
    Posts:
    2,634
    Location:
    UK
    The latest version is 1.9.2.6; the offending filters have been removed in this version.
     
  24. Dogbiscuit

    Dogbiscuit Guest

    Not to get too far off topic, but I think that just keeping your software up-to-date should prevent infections from known bugs exploited by malicious scripts.
     
  25. arran

    arran Registered Member

    Joined:
    Feb 5, 2008
    Posts:
    1,139
    Why don't you guys block ad's the Professional way by instead using Admuncher or Proxomitron?
     
Loading...
Thread Status:
Not open for further replies.