Hackademix

NoScript implemented this over a decade ago, as part of its surrogate scripts feature: https://hackademix.net/2009/01/25/surrogate-scripts-vs-google-analytic… This was one of my favorite examples of how there was much more to NoScript than most people assumed, and it had a depth of features that could not be matched by "alternatives" like uMatrix. But that feature was killed by the mass extension breakage in Firefox 57: https://github.com/hackademix/noscript/issues/133#issuecomment-5931504… So in a way, this feature can be seen as more than three years overdue.

> Extensions are second class citizens in any other browser. I'd say Firefox's support for extensions is better than Chrome's, even after the change to WebExtensions. The author of NoScript, for example, thinks Firefox has the best environment for add-ons: https://hackademix.net/2017/11/21/noscript-1011-quantum-powerball-fini…

It's probably better to go straight to the blog post about the migration: https://hackademix.net/2017/11/14/double-noscript/ Basically, the work to adapt NoScript and correspondingly expand the WebExtensions API has been going on for years, the original plan was to have a smooth transition when Firefox 57 came out, but there were some delays in the final days leading up to the release. Not recommended to stay on Firefox 56 because it won't get security patches; move to 52 ESR instead.

EDIT: To the author, the download and email icons are the same. This is fantastic. A feature you might not have realized is that it works well with NoScript users. With font-faces considered harmful[0], these icons can be delivered to the user, vulnerability free. [0] https://hackademix.net/2010/03/24/why-noscript-blocks-web-fonts/

Wow I wasn't aware, but after reading this post: http://adblockplus.org/blog/attention-noscript-users I'm honestly concerned about using NoScript any longer. //Edit: http://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users-… The reply by NoScript was excellent. I feel reassured.

That site turned me off. I am using DDG as my primary search engine for many months now. I really dislike the style and "atmosphere" of that site. The images are seemingly unordered and could use some borders. The images of the dog biting the women or the predator disgust me. Then some "motivationals" and memes that do not help the case. This site gave me mental stress (the left-alignment of varied sized text and images maybe, maybe the white, maybe the images) and overall broke a chunk off the good impression the DDG creator gave me so far. I'd suggest either not making such weird site or at least make it properly designed. (When I clicked the link I expected it to be related to the http://hackademix.net/2010/12/28/x-do-not-track-support-in-noscript/ disaster which dramatically "uniquifies" your browser fingerprint so I started with a bad feeling. Thanks for adding ad-blocking recommendations though! And even more so: Tor!)

NoScript includes protection against this! He calls it ClearClick: " whenever you click or otherwise interact, through your mouse or your keyboard, with an embedded element which is partially obstructed, transparent or otherwise disguised, NoScript prevents the interaction from completing and reveals you the real thing in "clear". At that point you can evaluate if the click target was actually the intended one, and decide if keeping it locked or unlock it for free interaction." https://hackademix.net/2008/10/08/hello-clearclick-goodbye-clickjackin…

I think, ClearClick and ABE are still missing. (According to this post [1] from a few weeks ago, they're supposed to be coming in the next few weeks...) Or well, active content blocking and XSS protection are definitely in there. [1]: https://hackademix.net/2017/11/21/noscript-1011-quantum-powerball-fini…

Here [1] is a post by the NoScript developer explaining how the new UI works and which buttons map to which legacy functions. After reading it and letting myself adjust for a few days, I'm perfectly comfortable with the new version. [1] https://hackademix.net/2017/12/04/noscript-quantum-vs-legacy-in-a-nuts…

WebExtension version of NoScript is going to be released today: https://hackademix.net/2017/11/14/double-noscript/

Touch away: https://hackademix.net/2017/11/14/double-noscript/

response: https://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users… it wasn't circumventing the filters just to show ads. It was circumventing the filters because the filter were blocking everything, including the install extension button.

noscript author's response: "It's a story of FUD and sensationalism, which got reported in such a careless way that now makes explaining and correcting readers' perception an uphill battle." https://hackademix.net/2016/04/08/crossfud-an-analysis-of-inflated-res…

If I wasn't clear: http://hackademix.net/2010/03/24/why-noscript-blocks-web-fonts/

Also, NoScript developer Giorgio Maone's take on WebExtensions: https://hackademix.net/2015/08/22/webextensions-api-noscript/

Giorgio's post on the matter: https://hackademix.net/2015/08/22/webextensions-api-noscript/

Wow, thank you for posting that. Very informative. The post and the NoScript reply [1] both raise some interesting points about how to compensate plugin authors for their hard and continued work that seem like they're still not addressed six years later. I have never really stopped to consider either compensating plugin for their work and I rely on them daily. 1. https://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users…

Flashblock still loads the plugin and content, doesn't it? I don't run Flashblock, but does this still work: http://hackademix.net/2008/06/08/block-rick/ I disable plugins in Chrome and either whitelist sites or run them as-needed.

Agreed (at least to the first part). The same argument has been made about the new web font technologies. http://hackademix.net/2010/03/24/why-noscript-blocks-web-fonts/ "It really worries me that the FreeType font library is now being made to accept untrusted content from the web. The library probably wasn’t written under the assumption that it would be fed much more than local fonts from trusted vendors who are already installing arbitrary executable on a computer, and it’s already had a handful of vulnerabilities found in it shortly after it first saw use in Firefox."

Interesting, in the Messages and Proxies[1] page, Apple has ad-blocking as an example which actually blocks the ads from being loaded using the `beforeload` event (as oppose to hide them after they're loaded): > Safari 5.0 and later (and other Webkit-based browsers) generates a “beforeload” event before loading each sub-resource belonging to a webpage. The “beforeload” event is generated before loading every script, iframe, image, or stylesheet specified in the webpage, for example. Isn't this exactly what the NoScript's author says Chrome extension was lacking[2]? [1]: http://developer.apple.com/safari/library/documentation/Tools/Conceptu… [2]: http://hackademix.net/2009/12/10/why-chrome-has-no-noscript/

NoScript doesn't just block JavaScript. See http://hackademix.net/2010/03/24/why-noscript-blocks-web-fonts/

Take a look at the note from the NoScript developer that was posted here yesterday: Maybe Google plans to implement the missing stuff later, maybe they’re still trying to figure out whether it can be done without enabling effective ad blocking, but in the meanwhile the pale AdBlock and FlashBlock imitations which have been hacked together by overwhelming popular demand, are forced to use a very fragile CSS-based hiding approach, ridiculously easy to circumvent. http://hackademix.net/2009/12/10/why-chrome-has-no-noscript/

Blog spot here: http://hackademix.net/2009/12/10/why-chrome-has-no-noscript/ I think Chrome should consider exposure of more APIs, like context menu items, network stack, direct Skia calls, etc. Chrome has builtin libjingle for p2p, but currently mainly used tinyxml for parsing XMPP and bookmark syncing. If we can script it with Javascript how awesome is that!

Google developer Peter Kasting's comment on this is here: http://hackademix.net/2009/12/10/why-chrome-has-no-noscript/#comment-1… That comment points to a Chromium tracking bug, here: http://code.google.com/p/chromium/issues/detail?id=16932 It looks like while a developer at Google was working on this project, that developer left Google in October and there's been no replacement. While this doesn't suggest the feature is the highest priority for Google, it also doesn't suggest Google is deliberately intending to prevent JavaScript or advertising blocking. Sometimes things that didn't get done just didn't get done.

i can replicate that. he's using obfuscated URLs from his site to dynamically add the google banners. ABP apparently doesn't catch that. this is just wrong. there is no other way of putting ig. there are the URLs that ABP…

I use NoScript and Policeman on Firefox, with conservative settings (disallow all active content (scripts, fonts, WebGL), whitelist-only cross-site requests). I've also configured Firefox to block cookies by default; only permitted sites can store cookies for the session, and just a handful I allow permanent cookies. Web pages load much quicker, Firefox uses less resources, my browsing is significantly more secure (see [1] for risk of loading arbitrary fonts), and I can browse the web without Google/Facebook/AdvertizingCorp (and thus the Five Eyes) building a profile of everything I do. It's a nice feeling. This set up also blocks ads served from third parties, which I feel is an agreeable compromise on web advertising. If I send a request to your website, and you send me a document with embedded images stored on your website, I'll download them and view them alongside the page. However, if you try to tell me "go send 5 unsecure requests to each of these three companies you've never heard of, and execute their 20KB of code, to get flashing ads alongside this page" - I'll ignore you. Sites loading resources from external domains (usually Google) is nothing new. I've been browsing this way for two years now, and I've developed a healthy level of contempt for 95% of web developers. The vast majority of them just don't care for their users; campaigning to get the developers to change their habits is a broken model. Ultimately, you have to take control, and decide for yourself…