5 ms·

More requests to more code by more parties inherently increases attack surface area. As a user why should I allow this for something that provides me no value

More requests to more code by more parties inherently increases attack surface area. As a user why should I allow this for something that provides me no value (ads, tracking, js comment systems that I dont care about etc). I can see why some people use noscript religiously and whitelist when needed

baby 11y ago
Yup. Too bad using noscript breaks the web though. An Adblocker will do for now...
- mirimir 11y ago
  NoScript doesn't break the Web. It's usually enough to allow first-party scripts, plus scripts as needed for content.
  - baby 11y ago
    Really? I had a feeling everything is javascript heavy these days. Especially with React, angular, backbone, meteor... Maybe I should give it another try.
    - aikah 11y ago
      > Really? I had a feeling everything is javascript heavy these days. Especially with React, angular, backbone, meteor... Maybe I should give it another try. The point is to white list scripting on websites . It allows faster browsing, lessens CPU load and memory consumption and save battery life on mobile and laptop. Most websites do not need javascript to be turned on to be browsed.
      - baby 11y ago
        I just did it. And woosh browsing is fast, I had forgotten that part. But then I remembered why I uninstalled it. On every site I visit I have to go through the list of scripts to allow until I can browse correctly.
        JeremyNT 11y ago
        You really, really need to try uBlock Origin for script blocking instead of Noscript. Enable advanced mode and default deny third party scripts. The UI (once you understand it) is better for almost every use case, except for blocking individual scripts rather than domains.
        baby 11y ago
        I'm already using it, I figured noscript would be better for security though (in general, XSS can appear from anywhere, not just ads)
        JeremyNT 11y ago
        uBlock Origin has many more capabilities that can be found in the advanced options[0], and you can configure blocking of third party content in general that "stacks" with the default ad blocking behavior. I have uBlock Origin configured to disable all javascript by default, for example, and when I do need to enable javascript I find the uBlock interface makes it (relatively) easy to get sites working. [0] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-default-deny https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-de...
  - roblabla 11y ago
    I personally really enjoy using umatrix[1]. I find it allows unbreaking websites with much more ease than NoScript in my experience. 1.https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix
    - rjbwork 11y ago
      Agreed. It gives you full control over the things you allow onto your browser.
  - avian 11y ago
    I used to be a heavy NoScript user. I dumped it some time ago when they started doing a ton of weird stuff in the name of "security". Take a look at their list of features: https://noscript.net/features https://noscript.net/features NoScript is way beyond just blocking scripts by domain at this point. They attempt to prevent things like clickjacking by subtle Javascript trickery. This broke too many web sites for me (often in infuriating and unpredictable ways) to be usable.
- SixSigma 11y ago
  I use it every day without trouble
ssharp 11y ago
> As a user why should I allow this for something that provides me no value (ads, tracking, js comment systems that I dont care about etc). You're presumably getting value from the page/site you're on. The person running that site is doing so because the ads, tracking, and things you don't care about allows that person to pay for the site and the time it takes to run and produce it.
annnnd 11y ago
What I am missing in NoScript is ability to allow 3rd party scripts (say "google.com") but just for this domain. If I allow facebook.com, I want it whitelisted only on its own domain, not elsewhere.
- dandelion_lover 11y ago
  You should try augmenting NoScript with RequestPolicy.
  - annnnd 11y ago
    Thanks, looks awesome! I'll try it out...
- drdaeman 11y ago
  uMatrix has this (well, it doesn't exactly prevent script execution, but prevents fetching the scripts, which is roughly the same).

baby 11y ago

Yup. Too bad using noscript breaks the web though. An Adblocker will do for now...

mirimir 11y ago
NoScript doesn't break the Web. It's usually enough to allow first-party scripts, plus scripts as needed for content.
- baby 11y ago
  Really? I had a feeling everything is javascript heavy these days. Especially with React, angular, backbone, meteor... Maybe I should give it another try.
  - aikah 11y ago
    > Really? I had a feeling everything is javascript heavy these days. Especially with React, angular, backbone, meteor... Maybe I should give it another try. The point is to white list scripting on websites . It allows faster browsing, lessens CPU load and memory consumption and save battery life on mobile and laptop. Most websites do not need javascript to be turned on to be browsed.
    - baby 11y ago
      I just did it. And woosh browsing is fast, I had forgotten that part. But then I remembered why I uninstalled it. On every site I visit I have to go through the list of scripts to allow until I can browse correctly.
      - JeremyNT 11y ago
        You really, really need to try uBlock Origin for script blocking instead of Noscript. Enable advanced mode and default deny third party scripts. The UI (once you understand it) is better for almost every use case, except for blocking individual scripts rather than domains.
        baby 11y ago
        I'm already using it, I figured noscript would be better for security though (in general, XSS can appear from anywhere, not just ads)
        JeremyNT 11y ago
        uBlock Origin has many more capabilities that can be found in the advanced options[0], and you can configure blocking of third party content in general that "stacks" with the default ad blocking behavior. I have uBlock Origin configured to disable all javascript by default, for example, and when I do need to enable javascript I find the uBlock interface makes it (relatively) easy to get sites working. [0] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-default-deny https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-de...
- roblabla 11y ago
  I personally really enjoy using umatrix[1]. I find it allows unbreaking websites with much more ease than NoScript in my experience. 1.https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix
  - rjbwork 11y ago
    Agreed. It gives you full control over the things you allow onto your browser.
- avian 11y ago
  I used to be a heavy NoScript user. I dumped it some time ago when they started doing a ton of weird stuff in the name of "security". Take a look at their list of features: https://noscript.net/features https://noscript.net/features NoScript is way beyond just blocking scripts by domain at this point. They attempt to prevent things like clickjacking by subtle Javascript trickery. This broke too many web sites for me (often in infuriating and unpredictable ways) to be usable.
SixSigma 11y ago
I use it every day without trouble

ssharp 11y ago

> As a user why should I allow this for something that provides me no value (ads, tracking, js comment systems that I dont care about etc). You're presumably getting value from the page/site you're on. The person running that site is doing so because the ads, tracking, and things you don't care about allows that person to pay for the site and the time it takes to run and produce it.

annnnd 11y ago

What I am missing in NoScript is ability to allow 3rd party scripts (say "google.com") but just for this domain. If I allow facebook.com, I want it whitelisted only on its own domain, not elsewhere.

dandelion_lover 11y ago
You should try augmenting NoScript with RequestPolicy.
- annnnd 11y ago
  Thanks, looks awesome! I'll try it out...
drdaeman 11y ago
uMatrix has this (well, it doesn't exactly prevent script execution, but prevents fetching the scripts, which is roughly the same).