13 ms·

NoScript is harmful and promotes malware

397 points by angry-hacker 10y ago

user5994461 10y ago
Summary of the article: The noscript website is showing ads which are installing malware. (typical clean your computer [with a trojan] bullshit) Bonus: The extension goes the extra mile to disable specific adblock filters during its installation + the website is displayed automatically on every extension update.
- Karlozkiller 10y ago
  I might be misinterpreting what you're saying. But it almost sounds like you're saying this is not such a bad thing. I would regardless ask the question in the punchline of the article: "why would you trust a security suite when they pull tricks like that"? (not verbatim)
  - user5994461 10y ago
    You're misinterpreting. I am simply giving the main points of the article so people can follow the news without reading everything.
    - cdubzzz 10y ago
      In American English this is generally called a summary. Your use of "resume" confused me here as well.
      - user5994461 10y ago
        Fixed.
- nine_k 10y ago
  What to use instead? Having scripts disabled by default saves battery life significantly.
  - Zekio 10y ago
    uBlock Origin and uMatrix works great :)
  - Davidbrcz 10y ago
    YesScript
  - PeCaN 10y ago
    uMatrix! It's a brilliant addon that lets you control what gets run at a pretty fine-grained level (per domain, per subdomain, whitelists can be local to a site, etc) without being at all clunky (easier to use than NoScript in spite of being more flexible).
- Klathmon 10y ago
  Important thing to note, the ad the article is talking about is hardcoded and always shows up to windows users. This isn't a case of someone using a shady ad network, this is a case of the noscript author knowingly trying to get their users to download and install malware. Edit: As another user pointed out lower in this submission. The software isn't exactly malware, and does do what it says on the box. If that's the case, this isn't really an issue to me. It's just an ad for software that I have no need for.
  - hackuser 10y ago
    > the ad the article is talking about is hardcoded and always shows up to windows users NoScript has a checkbox to disable displaying the page on updates.
    - Klathmon 10y ago
      That doesn't change the fact that the ad is always displayed to any windows users that visit the website. Even if this page was never shown during install/updates, it would still be an issue. Is it really too much to ask that the author of a security/privacy related application not try to push malware?
      - k1m 10y ago
        Exactly. I find it bizarre that so many here seem to see this as no big issue. An application touting itself as something to keep you safe on the web uses its website to advertise malware, and the author of this application goes to great lengths to make its ad for this malware as difficult to block as possible - even for users who've gone to trouble of protecting themselves (ie. by installing an adblocker). Why anyone would want to downplay this or continue to use an application from someone who does this is beyond me.
        Klathmon 10y ago
        As another user pointed out lower in this submission. The software isn't exactly malware, and does do what it says on the box. If that's the case, this isn't really an issue to me. It's just an ad for software that I have no need for.
zerognowl 10y ago
I prefer to turn JavaScript off in the browser itself. NoScript just increases the attack surface and also increases browser fingerprintability. There has to be a small subset of users who disable embeddings in the NoScript config, or turning off IFRAMEs, and even a smaller subset of people creating custom whitelists, which can all be checked for.
- necessity 10y ago
  But disabling it on the browser doesn't allow you to whitelist certain websites, which is the general use case for NoScript. I wish the web didn't break without JS, but that's just not the reality we live in.
  - ryanmccullagh 10y ago
    In Chrome, you can in fact white-list certain websites. It's actually quite nice. In Chrome, the advanced settings has an exceptions button that allows you to include websites that can bypass the rule.
    - icebraining 10y ago
      How does that work for a site that imports JS from multiple domains, as is usual? Does adding the top domain mean that it can load JS from everywhere, or do you have to manually find out which domains it needs whitelisted to work? Neither solutions seem particularly attractive; NoScript allows you to enable JS for that domain and stuff like CDNs without having to allow other sutff.
    - timlyo 10y ago
      There's also an extension to make it easier to do https://github.com/maximelebreton/quick-javascript-switcher https://github.com/maximelebreton/quick-javascript-switcher
  - zerognowl 10y ago
    > I wish the web didn't break without JS, but that's just not the reality we live in. Every time you temporarily enable JavaScript / whitelist a website you are performing a micro violation of your own privacy. In some cases even performing a large violation of your own privacy. Sure, there are some cases where I absolutely must have JavaScript turned on, but those cases are so rare that having JS permanently turned off is preferable in most cases.
Svip 10y ago
So what's the alternative to NoScript? And I don't mean an adblocker, I mean an extension that allows one to disable/enable JavaScript execution by domain.
- XzetaU8 10y ago
  "uMatrix" https://addons.mozilla.org/nn-NO/firefox/addon/umatrix/ https://addons.mozilla.org/nn-NO/firefox/addon/umatrix/
  - digi_owl 10y ago
    I get the impression that while noscript operates around a default-deny/whitelist scheme, umatrix is more default-allow/blacklist.
    - bigcheesegs 10y ago
      It all depends on how you configure it. I use it in 1st party allowed and all others white-listed approach.
      - digi_owl 10y ago
        Yeah, but out of the proverbial box noscript is at first appearance more secure.
        gorhill 10y ago
        uMatrix is default-deny by default, except 1st-party scripts. It also comes with an extensive lists of hosts files enabled (representing 10s of thousands hostnames and their subdomains) by default for which scripts won't be allowed at all, even as 1st-party. NoScript is default-deny by default, except for its preset list of whitelisted hostnames for which scripts are allowed to execute. In both cases, with a few clicks one can reconfigure to their liking, to further restrict or relax existing rules. Here is my thinking on this: between blocking everything and allowing everything, there is a point I consider optimal, which is what I picked for uMatrix. Not blocking enough out of the box will defeat the primary purpose of the tool. Blocking too much out of the box will discourage many users from using the tool at all -- they will uninstall. My goal is for as many people to protect themselves, and this won't be accomplished if I set uMatrix's default to cause too much work out of the box that they uninstall it out of tediousness. Blocking everything 3rd-party by default except images/css is what I personally identified as the optimal -- this would correspond to "medium mode" on the graph at that page: https://github.com/gorhill/uBlock/wiki/Blocking-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode Again regarding the tediousness factor, another important aspect of a tool such as uMatrix is how easy it is to set rules to block/allow things, including on a per-site basis: one can easily change default settings after install, but how easy/difficult it is to set/remove rules is something which can't be changed. To dismiss the ease to create rules and other core features in uMatrix because one personally disagree with its (easily changed) default settings out of the box does not make much sense to me. If the end result is that the aggregate number of stuff blocked by all users of uMatrix with default settings is higher than the aggregate number of stuff blocked by all users of uMatrix with hardcore settings, then i reached my goal. In any case, as said, the defaults can be changed easily with a few clicks, there is no "hidden" settings, what is blocked or not is up front and visible right after install by just looking at the popup panel matrix. One thing I would like people to keep in mind: uMatrix is not NoScript or RequestPolicy, it is its own thing.
Kenji 10y ago
Phew, for a moment there I thought it was a drive-by installer. I am mortified of these as it already happened to me while casually browsing the web. Nah, it's just a plain old exe you download and execute if you're dumb.
- daenney 10y ago
  That people are dumb, for whatever definition of dumb we feel like adhering to today, does little against the fact that someone promoting their extension as a security mechanism goes above and beyond to try and get you to install some malware.
  - Kenji 10y ago
    The difference between drive-by viruses and downloadable exe viruses that have to be manually executed is like the difference between someone who pretends to be your relative to convince you to give him money and someone who robs you at gunpoint. You're immune to one thing if you're not gullible and dumb, but completely powerless against the other, all it takes is unfortunate circumstances. Now, both are bad, of course, but one is vastly more concerning and hard to protect oneself against.
- RaleyField 10y ago
  > if you're dumb Everyone should get CS degree to operate a computer. /s
an0nyrn0us 10y ago
Yeah, but gee, how much does JavaScript itself cost us by promoting and enabling so much "dogshit" in the first place. Oh, wait. JavaScript is so good, that no one should ever question whether to permit untested random code from anyone ever, because JavaScript is just implicitly safe at all times. Just use JavaScript, and never ask why. Trust us. Sincerely, Anonymous
- Kiro 10y ago
  So you mean we should be fine with this or what?
ladzoppelin 10y ago
I recently had to go back to NoScript after browsing with UBlock for a month. I was on a random webpage and all of sudden the browser would not close, and some lady was telling me "to call this number my computer is infected". I seriously doubt the author of NoScript was trying to infect people with malware. He might of made sure you see adds by disabling filters but the malware is problem with adds in general. In other words, browsing without Noscript is risky. Edit: It was UBlock orgin. NoScript is the only thing that works but I have no idea if the guy is shady or not. Keep in mind I install the DEV addition so this has never happened to me.
- kodr 10y ago
  UBlock or UBlock Origin? They aren't the same.
  - deleted 10y ago
    [deleted]
- Klathmon 10y ago
  The article states that this ad is hardcoded, so the author fully knows the application that he/she is pushing on their users.
- gorhill 10y ago
  By default, uBlock Origin ("uBO") works with a set of block lists, it does not block javascript -- out of the box you can't compare NoScript to uBO, they are two different things, it's not a case of "which one to use?". Given the symptoms you describe, it seems you went to a site which launched popups. This is usually addressed by filters in the default block lists (EasyList, etc.), but when there is no filter, unwanted popups may occur. One solution is to report to block lists maintainers, so that they can add a filter. There is also a per-site switch in uBO to unconditionally block all popups for a given site -- so no need to wait for a filter. That said, you can block scripts by default with uBO if you want. It also allows to block specifically all inline script tags on a page without disabling all javascript. uBO works well with NoScript, and many people use it in concert with NoScript, they consider they complement well each others.
necessity 10y ago
As I mentioned on /r/netsec it's valid to point out the author does shady shit, but the title is clickbaity at best - the NoScript website advertises malware, there is no evidence that NoScript itself is harmful to the user. And btw you shouldn't let your extensions auto-update on Firefox anyway, specially if you use Tor, as it's vulnerable to MITM as someone posted here a few days ago. I might switch to uMatrix, but I don't really have the time right now to learn it.
- corndoge 10y ago
  Takes about five minutes to learn. For NoScript equivalence, click the matrix and deselect the JavaScript column.
  - vesinisa 10y ago
    I can second this. Recently migrated from NoScript to uMatrix. I was finally confident enough to put NoScript to "globally allow all" mode this week and use uMatrix alone for controlling scripting permissions. (After reading this disabled NoScript altogether.) uMatrix allows more fine-grained control than NoScript. It's basically based on three contexts (scopes): host, domain and global, but my experience is I only ever use the global and domain scopes. I would recommend starting by globally white-listing the popular CDNs (so scripts on all sites delivered e.g. through Google's CDN are always executed and <script> snippets to integrate Google widgets work). Then, for a majority of trusted sites it's enough to just white-list the local domain (allow executing scripts from example.com when you are visiting example.com sites). Scripts included on foobar.org from example.com still remain blocked – this is the crucial difference between global and local scopes that NoScript doesn't lend to. I would recommend always allowing XHR and iframes in the site-local scope. IIRC this is not in the default config but since XHR anyway requires scripting you can then easily control both XHR / scripting by just white-listing the site for scripting. So this is my uMatrix base configuration currently and a good starting point for migrating from NoScript: * * * block * * css allow * * image allow * 1st-party cookie allow * 1st-party frame allow * 1st-party xhr allow I.e. CSS / images allowed from all sources (except those blocked explicitly). Cookies, frames and XHR allowed from the same site you are currently visiting. Only scripting must be allowed per-site, just like with NoScript.
Fiahil 10y ago
TLDR: NoScript's website display shady ads. Something that is only happening because we let ads networks and advertisers push all the shit they want on our webpages. How long before we actually start vetting (for nuisance and performance) what is put bellow users' eyes?
- tarancato 10y ago
  Before providing a "tldr" please read the article.
  - bbcbasic 10y ago
    What makes you think he or she didn't?
- Klathmon 10y ago
  This ad in particular is hard coded by the author. This isn't a case of someone using a shitty ad network, the author is knowingly pushing malware to the users of their application.
  - pbhjpbhj 10y ago
    Hmm, not sure really where to go with this - I certainly don't want to support malware, but what's the "speedupmypc.exe" actually do that's malicious. I ran it through online tools: * https://www.virustotal.com/en/file/3d9e6b1e9f1296e0ce85061e0a6a0b571a1361565fc2924a22940d27bd2a2ebb/analysis/1475446511/ https://www.virustotal.com/en/file/3d9e6b1e9f1296e0ce85061e0... (17/57) * https://www.metadefender.com/#!/results/file/5fd5ceb2e10942d4873220572503b173/regular/analysis https://www.metadefender.com/#!/results/file/5fd5ceb2e10942d... (5/42) * http://scanthis.net/scan/f74a94435ae047770b0fb26c4752d43b http://scanthis.net/scan/f74a94435ae047770b0fb26c4752d43b (result pending) a lot of the big name antivirus companies don't report this as a malicious file (according to these tools). e.g. looking at the first scan results Ad-Aware, Avast, BitDefender, Symantec, etc., etc., all find no problem with the file. The obfuscation would be needed to load ads for the market that NoScript is targetting. To get ad revenue they would need some system to load the ads [as if] from the local server or they'll get blocked. Indeed isn't this what people often ask for from adverts that they won't use external providers in order to improve page-load times. If you look at the source for the page at noscript.net you see that the section is tagged as if it's included code from an automated script. So yes, he's clearly gone to trouble to hide the ad, but that's because it's an ad and not necessarily because it's malicious. So, it hinges on whether the speedupmypc.exe is truly malicious IMO. Cnet & Tucows endorse it, not sure that tells us much ... installing the app (on a vbox) it looks like reasonably useful app after the type of PC-decrapifier or CC or whatever. I got a freemium app which gave a scan (results looked kosher) and offered a £20 unlock to fix the issues found. Not the greatest software but not quite what I'd call malware. Perhaps oversold-stuff-people-dont-really-need-ware?? Unless, like I said, there's a hidden payload?
jasonkostempski 10y ago
Maybe Mozilla could take a few days off from Flash and PDF and build in some good white-listing features. It's the last feature browsers actually need. After that it's nothing but speed and security.
- DeepYogurt 10y ago
  I for one would love if mozilla built in some javascript controls in by default.
- TD-Linux 10y ago
  Like this, released last week? https://testpilot.firefox.com/experiments/tracking-protection https://testpilot.firefox.com/experiments/tracking-protectio...
  - Sylos 10y ago
    That wasn't really released last week. It's been in Firefox and default-enabled in Private Browsing for probably a year already. This just enables it in normal browsing as well, and they've only published it via Test Pilot for testing, as you could already enable it in normal browsing before by setting "privacy.trackingprotection.enabled" in about:config to true.
  - nercht12 10y ago
    It tells me I need Javascript. Ironic, no?
  - digi_owl 10y ago
    That do not seem to offer the detailed control that noscript does.
    - TD-Linux 10y ago
      Nor would I expect it to - that's what extensions are for. This is a one-click tool.
- acqq 10y ago
ryanmccullagh 10y ago
For what my comment is worth, I ended up removing NoScript and doing and clean install of Debian after noticing that the the NoScript extension would seem to auto-update often, and then would launch an instance of the noscript.net website each time I opened firefox. It did sketch me out, and I can't recommend installing this.
- pbhjpbhj 10y ago
  Go to about:addons, click the "more" text at the end of the NoScript description on the right and set auto-update to "off". Next go to about:addons again and "preferences" of NoScript, on the "Notifications" tab uncheck "Display the release notes". Done. My 2¢ is that it certainly does appear to offer updates more often than one might expect (a bit like browsers themselves) but I have these two settings so I don't really notice. I choose to update manually because I don't like stuff breaking automatically (and am happy to keep on top of security warnings and such).
- driverdan 10y ago
  Why would you reinstall your OS for an extension that updates frequently?
  - wtallis 10y ago
    More importantly, why would you be distressed by security software updating frequently?
    - ryanmccullagh 10y ago
      I was exaggerating quite a bit, but I did end up installing another OS, but not really because of NoScript.
- Dylan16807 10y ago
  Lots of extensions open a changelog after they update. I'm not sure why that would be the thing that bothers you.
leeoniya 10y ago
switched to uMatrix + uBlock Origin and never looked back.
SamuelAdams 10y ago
Especially to Windows users. Every time NoScript updates itself, the users are shown the homepage of the extension. Options > Notifications > Uncheck "Display the release notes on updates". I get that this sucks but there is an easy way to mitigate this problem without changing to another extension.
svenfaw 10y ago
Relevant Tor ticket: https://trac.torproject.org/projects/tor/ticket/19280 https://trac.torproject.org/projects/tor/ticket/19280
tunap 10y ago
Damn! I took the click-bait. For more on the so-called harm, here's a good summary of giorgio & wlad's pissing contest: http://www.dedoimedo.com/computers/adblock-noscript.html http://www.dedoimedo.com/computers/adblock-noscript.html
oridecon 10y ago
I'll wait for the NoScript origin fork. uMatrix is too weird for me (I love uBlock though).
- gorhill 10y ago
  What is "weird" about uMatrix, specifically? The logic of the matrix is completely straightforward, once you get the basic rule that narrower rules override broader ones, all interactions with the matrix will become obvious, easy to understand in advance what will happens when adding/removing a specific rule -- and in any case, the visual feedback when adding/removing a rule through the popup panel matrix should be obvious enough to understand what will end up blocked/allowed.
VertexRed 10y ago
1. You'd have to actually click and willingly install the software to be infected. 2. Even though he's able to randomize the banner code the redirect to the advertiser's site will most likely be caught by ad blockers. --- Still it's a pretty hypocritical thing to do when you're the creator of a plugin which aims to increase the user's security.
- wbkang 10y ago
  "1. You'd have to actually click and willingly install the software to be infected." This is how most Windows malware/unwanted software are installed today, not via some rare zero-day Chrome exploits.
AdmiralAsshat 10y ago
Alternative: uMatrix https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix Made by the same developer of uBlock Origin, allows blocking of Javascript and other aspects of the site. I switched awhile back and found it somewhat more usable than NoScript, insofar as it usually allows Javascript on the local site by default, while automatically blocking JS on third-party domains. There are some growing pains associated with it, as there are with NS. Some of the drawbacks I've noticed: - It will take about three or four refreshes before you can whitelist everything necessary to get Youtube working. First youtube, then s.ytimg.com, then googlevideo.com, THEN you might finally get a video. - Any page with a Google Captcha on it will take several refreshes to completely let them through. This is particularly irritating if there's a captcha on a form. - Anything which needs to reach out to jquery, ajax, etc. will fail. But you should be able to whitelist those once then add them to your permanent whitelist. - I have yet to find a good tutorial for uMatrix yet on how to make some pre-defined rules for common sites. That would greatly reduce the learning curve.
- ars 10y ago
  > insofar as it usually allows Javascript on the local site by default NoScript can do this too BTW. The web is almost unusable without that setting enabled. The drawbacks you identified are exactly the same on NoScript so they should not be used as a reason to pick one over the other. It takes a LONG time to get a good list of whitelisted sites, now that mine is more or less usable I don't intend to switch - especially since I disabled the "show webpage with ads" thing on NoScript, so I don't have the problem in the article.
  - hackuser 10y ago
    One advantage of uMatrix: You can filter based on host-destination pairs. That is, in NoScript you can only filter based on the destination. For example, if you allow one site to run scripts from cloudfront.net, every site can. Effective the rules are, DENY * * ALLOW * cloudfront.net In uMatrix, you can write rules based on host-destination pairs, permitting scripts from, e.g., cloudfront.net to run on your bank's website but not on any others: DENY * * ALLOW mybank.com cloudfront.net Finally, you can filter by host & destination & function: DENY * * ALLOW mybank.com cloudfront.net JavaScript ... which would not allow plugins, images, CSS or anything else from cloudfront.net, only JavaScript. EDIT: Add, improve examples
tarancato 10y ago
A honest thought: the typical user of NoScript won't fall for those ads, I think.
- JabavuAdams 10y ago
  There's no reason to believe that. How many people install NoScript on friends' and family's machines?
  - serf 10y ago
    very few i'm betting, it takes hours to build a usable white-list for NoScript, and it breaks everything by default.
  - tarancato 10y ago
    I am sure more sites would work with IE6 than with the default configuration of NoScript.
  - revanx_ 10y ago
    Imagine the conversation with a none-tech savy person on how to use Noscript, jeeeezzz.
gcb0 10y ago
response: https://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users-dear-mozilla-community/ https://hackademix.net/2009/05/04/dear-adblock-plus-and-nosc... it wasn't circumventing the filters just to show ads. It was circumventing the filters because the filter were blocking everything, including the install extension button.
Vindicis 10y ago
Here's the site that ad on noscript.net takes you to: uniblue.com/cm/deletedcmunits/speedupmypc/spdeletedcmunits/download/?aff=3257&x-at=noscriptt1 After 4-5 clicks, the exe finally downloaded. Seems like a lot of work to download malware doesn' it? So I downloaded the exe and uploaded it to Kaspersky's online scanner https://scan.kaspersky.com/Home/Result https://scan.kaspersky.com/Home/Result and it says the file is safe. It almost seems like he has an axe to grind or something. Maybe I'm just reading too much into such a terrible article, and it's just that though.
- consto 10y ago
  Upload to virus total, passing one scanner isn't enough.
  - Vindicis 10y ago
    I did that, and, it seems that although it fails some virus scanners, it would be what I like to call a false positive. Just to link a description of what one of them found: https://www.symantec.com/security_response/writeup.jsp?docid=2014-071815-0057-99&tabid=2 https://www.symantec.com/security_response/writeup.jsp?docid... Basically it could be an unwanted application that "The application reports an exaggerated number of problems." Shitty software? Sure. Malware? Not to me. YMMV. Here's a screen shot of the ones it failed from that total scanner: https://i.imgur.com/vwy9sXY.jpg https://i.imgur.com/vwy9sXY.jpg
    - deleted 10y ago
      [deleted]
    - 59nadir 10y ago
      It's funny that you mention axes to grind (hidden motives). It's exactly what I think when I read the apologist threads/posts like yours. To look at obviously shady behavior and start giving excuses for it just reeks of misguided fanboyism. If this were a bigger entity I'd assume you were all corporate astroturfers.
nickphx 10y ago
PUP != malware. PUP = potentially unwanted software. It's no more aggressive than the typical scareware tactics anti-virus companies use..
- carterehsmith 10y ago
  So they mention, among others, "Trojan.Win32.Generic!BT" So I Googled that, and no, not a pup, more like a trojan that hijacks your pc and joins a botnet.
Stratoscope 10y ago
Another sleazy thing... The NoScript site calls the code "open source" and "Free Software" (complete with a link to the FSF), but nowhere on the site can I find the source code. I searched GitHub and didn't find any source code from the NoScript author there either. As far as I can tell, the only way to get the source code is to actually install the extension and then extract the code from there. It appears that GitHub user 'avian2' did exactly that: https://github.com/avian2/noscript https://github.com/avian2/noscript Thanks avian2! And no thanks to the NoScript author.
- quesera 10y ago
  An XPI is just a zip file. You can download it without installing it. Not as convenient as a github repo, but equally open source.
  - Stratoscope 10y ago
    Ah, thank you. In that case, I stand corrected!
  - digi_owl 10y ago
    Yeah we should not forget that Firefox extensions became popular because most of the UI was made out of XML and JS.
lbstr_ftw 10y ago
The article never substantiates the claim that "NoScript is harmful". They talk about NoScript's website serving questionable software, not NoScript itself.
digi_owl 10y ago
From a blog with two entries, with an attached twitter that looks more like bot spam than someone actually using it, and a github account that is all about messing with adblockers(?). Why do this feel like a schoolyard pissing match between "1337 haxors"?
revanx_ 10y ago
For how long has that malware link been on the update page? The article mentions the author has a history of doing shady things, can someone provide more background into this?
- angry-hacker 10y ago
  Disabling adblock filters to whitelist himself. Easy to find on Google.
bbcbasic 10y ago
Clickbaity title

397 points by angry-hacker 10y ago

Summary of the article: The noscript website is showing ads which are installing malware. (typical clean your computer [with a trojan] bullshit) Bonus: The extension goes the extra mile to disable specific adblock filters during its installation + the website is displayed automatically on every extension update.

Karlozkiller 10y ago
I might be misinterpreting what you're saying. But it almost sounds like you're saying this is not such a bad thing. I would regardless ask the question in the punchline of the article: "why would you trust a security suite when they pull tricks like that"? (not verbatim)
- user5994461 10y ago
  You're misinterpreting. I am simply giving the main points of the article so people can follow the news without reading everything.
  - cdubzzz 10y ago
    In American English this is generally called a summary. Your use of "resume" confused me here as well.
    - user5994461 10y ago
      Fixed.
nine_k 10y ago
What to use instead? Having scripts disabled by default saves battery life significantly.
- Zekio 10y ago
  uBlock Origin and uMatrix works great :)
- Davidbrcz 10y ago
  YesScript
- PeCaN 10y ago
  uMatrix! It's a brilliant addon that lets you control what gets run at a pretty fine-grained level (per domain, per subdomain, whitelists can be local to a site, etc) without being at all clunky (easier to use than NoScript in spite of being more flexible).
Klathmon 10y ago
Important thing to note, the ad the article is talking about is hardcoded and always shows up to windows users. This isn't a case of someone using a shady ad network, this is a case of the noscript author knowingly trying to get their users to download and install malware. Edit: As another user pointed out lower in this submission. The software isn't exactly malware, and does do what it says on the box. If that's the case, this isn't really an issue to me. It's just an ad for software that I have no need for.
- hackuser 10y ago
  > the ad the article is talking about is hardcoded and always shows up to windows users NoScript has a checkbox to disable displaying the page on updates.
  - Klathmon 10y ago
    That doesn't change the fact that the ad is always displayed to any windows users that visit the website. Even if this page was never shown during install/updates, it would still be an issue. Is it really too much to ask that the author of a security/privacy related application not try to push malware?
    - k1m 10y ago
      Exactly. I find it bizarre that so many here seem to see this as no big issue. An application touting itself as something to keep you safe on the web uses its website to advertise malware, and the author of this application goes to great lengths to make its ad for this malware as difficult to block as possible - even for users who've gone to trouble of protecting themselves (ie. by installing an adblocker). Why anyone would want to downplay this or continue to use an application from someone who does this is beyond me.
      - Klathmon 10y ago
        As another user pointed out lower in this submission. The software isn't exactly malware, and does do what it says on the box. If that's the case, this isn't really an issue to me. It's just an ad for software that I have no need for.

zerognowl 10y ago

I prefer to turn JavaScript off in the browser itself. NoScript just increases the attack surface and also increases browser fingerprintability. There has to be a small subset of users who disable embeddings in the NoScript config, or turning off IFRAMEs, and even a smaller subset of people creating custom whitelists, which can all be checked for.

necessity 10y ago
But disabling it on the browser doesn't allow you to whitelist certain websites, which is the general use case for NoScript. I wish the web didn't break without JS, but that's just not the reality we live in.
- ryanmccullagh 10y ago
  In Chrome, you can in fact white-list certain websites. It's actually quite nice. In Chrome, the advanced settings has an exceptions button that allows you to include websites that can bypass the rule.
  - icebraining 10y ago
    How does that work for a site that imports JS from multiple domains, as is usual? Does adding the top domain mean that it can load JS from everywhere, or do you have to manually find out which domains it needs whitelisted to work? Neither solutions seem particularly attractive; NoScript allows you to enable JS for that domain and stuff like CDNs without having to allow other sutff.
  - timlyo 10y ago
    There's also an extension to make it easier to do https://github.com/maximelebreton/quick-javascript-switcher https://github.com/maximelebreton/quick-javascript-switcher
- zerognowl 10y ago
  > I wish the web didn't break without JS, but that's just not the reality we live in. Every time you temporarily enable JavaScript / whitelist a website you are performing a micro violation of your own privacy. In some cases even performing a large violation of your own privacy. Sure, there are some cases where I absolutely must have JavaScript turned on, but those cases are so rare that having JS permanently turned off is preferable in most cases.

Svip 10y ago

So what's the alternative to NoScript? And I don't mean an adblocker, I mean an extension that allows one to disable/enable JavaScript execution by domain.

XzetaU8 10y ago
"uMatrix" https://addons.mozilla.org/nn-NO/firefox/addon/umatrix/ https://addons.mozilla.org/nn-NO/firefox/addon/umatrix/
- digi_owl 10y ago
  I get the impression that while noscript operates around a default-deny/whitelist scheme, umatrix is more default-allow/blacklist.
  - bigcheesegs 10y ago
    It all depends on how you configure it. I use it in 1st party allowed and all others white-listed approach.
    - digi_owl 10y ago
      Yeah, but out of the proverbial box noscript is at first appearance more secure.
      - gorhill 10y ago
        uMatrix is default-deny by default, except 1st-party scripts. It also comes with an extensive lists of hosts files enabled (representing 10s of thousands hostnames and their subdomains) by default for which scripts won't be allowed at all, even as 1st-party. NoScript is default-deny by default, except for its preset list of whitelisted hostnames for which scripts are allowed to execute. In both cases, with a few clicks one can reconfigure to their liking, to further restrict or relax existing rules. Here is my thinking on this: between blocking everything and allowing everything, there is a point I consider optimal, which is what I picked for uMatrix. Not blocking enough out of the box will defeat the primary purpose of the tool. Blocking too much out of the box will discourage many users from using the tool at all -- they will uninstall. My goal is for as many people to protect themselves, and this won't be accomplished if I set uMatrix's default to cause too much work out of the box that they uninstall it out of tediousness. Blocking everything 3rd-party by default except images/css is what I personally identified as the optimal -- this would correspond to "medium mode" on the graph at that page: https://github.com/gorhill/uBlock/wiki/Blocking-mode https://github.com/gorhill/uBlock/wiki/Blocking-mode Again regarding the tediousness factor, another important aspect of a tool such as uMatrix is how easy it is to set rules to block/allow things, including on a per-site basis: one can easily change default settings after install, but how easy/difficult it is to set/remove rules is something which can't be changed. To dismiss the ease to create rules and other core features in uMatrix because one personally disagree with its (easily changed) default settings out of the box does not make much sense to me. If the end result is that the aggregate number of stuff blocked by all users of uMatrix with default settings is higher than the aggregate number of stuff blocked by all users of uMatrix with hardcore settings, then i reached my goal. In any case, as said, the defaults can be changed easily with a few clicks, there is no "hidden" settings, what is blocked or not is up front and visible right after install by just looking at the popup panel matrix. One thing I would like people to keep in mind: uMatrix is not NoScript or RequestPolicy, it is its own thing.

Kenji 10y ago

Phew, for a moment there I thought it was a drive-by installer. I am mortified of these as it already happened to me while casually browsing the web. Nah, it's just a plain old exe you download and execute if you're dumb.

daenney 10y ago
That people are dumb, for whatever definition of dumb we feel like adhering to today, does little against the fact that someone promoting their extension as a security mechanism goes above and beyond to try and get you to install some malware.
- Kenji 10y ago
  The difference between drive-by viruses and downloadable exe viruses that have to be manually executed is like the difference between someone who pretends to be your relative to convince you to give him money and someone who robs you at gunpoint. You're immune to one thing if you're not gullible and dumb, but completely powerless against the other, all it takes is unfortunate circumstances. Now, both are bad, of course, but one is vastly more concerning and hard to protect oneself against.
RaleyField 10y ago
> if you're dumb Everyone should get CS degree to operate a computer. /s

an0nyrn0us 10y ago

Yeah, but gee, how much does JavaScript itself cost us by promoting and enabling so much "dogshit" in the first place. Oh, wait. JavaScript is so good, that no one should ever question whether to permit untested random code from anyone ever, because JavaScript is just implicitly safe at all times. Just use JavaScript, and never ask why. Trust us. Sincerely, Anonymous

Kiro 10y ago
So you mean we should be fine with this or what?

ladzoppelin 10y ago

I recently had to go back to NoScript after browsing with UBlock for a month. I was on a random webpage and all of sudden the browser would not close, and some lady was telling me "to call this number my computer is infected". I seriously doubt the author of NoScript was trying to infect people with malware. He might of made sure you see adds by disabling filters but the malware is problem with adds in general. In other words, browsing without Noscript is risky. Edit: It was UBlock orgin. NoScript is the only thing that works but I have no idea if the guy is shady or not. Keep in mind I install the DEV addition so this has never happened to me.

kodr 10y ago
UBlock or UBlock Origin? They aren't the same.
- deleted 10y ago
  [deleted]
Klathmon 10y ago
The article states that this ad is hardcoded, so the author fully knows the application that he/she is pushing on their users.
gorhill 10y ago
By default, uBlock Origin ("uBO") works with a set of block lists, it does not block javascript -- out of the box you can't compare NoScript to uBO, they are two different things, it's not a case of "which one to use?". Given the symptoms you describe, it seems you went to a site which launched popups. This is usually addressed by filters in the default block lists (EasyList, etc.), but when there is no filter, unwanted popups may occur. One solution is to report to block lists maintainers, so that they can add a filter. There is also a per-site switch in uBO to unconditionally block all popups for a given site -- so no need to wait for a filter. That said, you can block scripts by default with uBO if you want. It also allows to block specifically all inline script tags on a page without disabling all javascript. uBO works well with NoScript, and many people use it in concert with NoScript, they consider they complement well each others.

necessity 10y ago

As I mentioned on /r/netsec it's valid to point out the author does shady shit, but the title is clickbaity at best - the NoScript website advertises malware, there is no evidence that NoScript itself is harmful to the user. And btw you shouldn't let your extensions auto-update on Firefox anyway, specially if you use Tor, as it's vulnerable to MITM as someone posted here a few days ago. I might switch to uMatrix, but I don't really have the time right now to learn it.

corndoge 10y ago
Takes about five minutes to learn. For NoScript equivalence, click the matrix and deselect the JavaScript column.
- vesinisa 10y ago
  I can second this. Recently migrated from NoScript to uMatrix. I was finally confident enough to put NoScript to "globally allow all" mode this week and use uMatrix alone for controlling scripting permissions. (After reading this disabled NoScript altogether.) uMatrix allows more fine-grained control than NoScript. It's basically based on three contexts (scopes): host, domain and global, but my experience is I only ever use the global and domain scopes. I would recommend starting by globally white-listing the popular CDNs (so scripts on all sites delivered e.g. through Google's CDN are always executed and <script> snippets to integrate Google widgets work). Then, for a majority of trusted sites it's enough to just white-list the local domain (allow executing scripts from example.com when you are visiting example.com sites). Scripts included on foobar.org from example.com still remain blocked – this is the crucial difference between global and local scopes that NoScript doesn't lend to. I would recommend always allowing XHR and iframes in the site-local scope. IIRC this is not in the default config but since XHR anyway requires scripting you can then easily control both XHR / scripting by just white-listing the site for scripting. So this is my uMatrix base configuration currently and a good starting point for migrating from NoScript: * * * block * * css allow * * image allow * 1st-party cookie allow * 1st-party frame allow * 1st-party xhr allow I.e. CSS / images allowed from all sources (except those blocked explicitly). Cookies, frames and XHR allowed from the same site you are currently visiting. Only scripting must be allowed per-site, just like with NoScript.

Fiahil 10y ago

TLDR: NoScript's website display shady ads. Something that is only happening because we let ads networks and advertisers push all the shit they want on our webpages. How long before we actually start vetting (for nuisance and performance) what is put bellow users' eyes?

tarancato 10y ago
Before providing a "tldr" please read the article.
- bbcbasic 10y ago
  What makes you think he or she didn't?
Klathmon 10y ago
This ad in particular is hard coded by the author. This isn't a case of someone using a shitty ad network, the author is knowingly pushing malware to the users of their application.
- pbhjpbhj 10y ago
  Hmm, not sure really where to go with this - I certainly don't want to support malware, but what's the "speedupmypc.exe" actually do that's malicious. I ran it through online tools: * https://www.virustotal.com/en/file/3d9e6b1e9f1296e0ce85061e0a6a0b571a1361565fc2924a22940d27bd2a2ebb/analysis/1475446511/ https://www.virustotal.com/en/file/3d9e6b1e9f1296e0ce85061e0... (17/57) * https://www.metadefender.com/#!/results/file/5fd5ceb2e10942d4873220572503b173/regular/analysis https://www.metadefender.com/#!/results/file/5fd5ceb2e10942d... (5/42) * http://scanthis.net/scan/f74a94435ae047770b0fb26c4752d43b http://scanthis.net/scan/f74a94435ae047770b0fb26c4752d43b (result pending) a lot of the big name antivirus companies don't report this as a malicious file (according to these tools). e.g. looking at the first scan results Ad-Aware, Avast, BitDefender, Symantec, etc., etc., all find no problem with the file. The obfuscation would be needed to load ads for the market that NoScript is targetting. To get ad revenue they would need some system to load the ads [as if] from the local server or they'll get blocked. Indeed isn't this what people often ask for from adverts that they won't use external providers in order to improve page-load times. If you look at the source for the page at noscript.net you see that the section is tagged as if it's included code from an automated script. So yes, he's clearly gone to trouble to hide the ad, but that's because it's an ad and not necessarily because it's malicious. So, it hinges on whether the speedupmypc.exe is truly malicious IMO. Cnet & Tucows endorse it, not sure that tells us much ... installing the app (on a vbox) it looks like reasonably useful app after the type of PC-decrapifier or CC or whatever. I got a freemium app which gave a scan (results looked kosher) and offered a £20 unlock to fix the issues found. Not the greatest software but not quite what I'd call malware. Perhaps oversold-stuff-people-dont-really-need-ware?? Unless, like I said, there's a hidden payload?

jasonkostempski 10y ago

Maybe Mozilla could take a few days off from Flash and PDF and build in some good white-listing features. It's the last feature browsers actually need. After that it's nothing but speed and security.

DeepYogurt 10y ago
I for one would love if mozilla built in some javascript controls in by default.
TD-Linux 10y ago
Like this, released last week? https://testpilot.firefox.com/experiments/tracking-protection https://testpilot.firefox.com/experiments/tracking-protectio...
- Sylos 10y ago
  That wasn't really released last week. It's been in Firefox and default-enabled in Private Browsing for probably a year already. This just enables it in normal browsing as well, and they've only published it via Test Pilot for testing, as you could already enable it in normal browsing before by setting "privacy.trackingprotection.enabled" in about:config to true.
- nercht12 10y ago
  It tells me I need Javascript. Ironic, no?
- digi_owl 10y ago
  That do not seem to offer the detailed control that noscript does.
  - TD-Linux 10y ago
    Nor would I expect it to - that's what extensions are for. This is a one-click tool.
acqq 10y ago

ryanmccullagh 10y ago

For what my comment is worth, I ended up removing NoScript and doing and clean install of Debian after noticing that the the NoScript extension would seem to auto-update often, and then would launch an instance of the noscript.net website each time I opened firefox. It did sketch me out, and I can't recommend installing this.

pbhjpbhj 10y ago
Go to about:addons, click the "more" text at the end of the NoScript description on the right and set auto-update to "off". Next go to about:addons again and "preferences" of NoScript, on the "Notifications" tab uncheck "Display the release notes". Done. My 2¢ is that it certainly does appear to offer updates more often than one might expect (a bit like browsers themselves) but I have these two settings so I don't really notice. I choose to update manually because I don't like stuff breaking automatically (and am happy to keep on top of security warnings and such).
driverdan 10y ago
Why would you reinstall your OS for an extension that updates frequently?
- wtallis 10y ago
  More importantly, why would you be distressed by security software updating frequently?
  - ryanmccullagh 10y ago
    I was exaggerating quite a bit, but I did end up installing another OS, but not really because of NoScript.
Dylan16807 10y ago
Lots of extensions open a changelog after they update. I'm not sure why that would be the thing that bothers you.

leeoniya 10y ago

switched to uMatrix + uBlock Origin and never looked back.

SamuelAdams 10y ago

Especially to Windows users. Every time NoScript updates itself, the users are shown the homepage of the extension. Options > Notifications > Uncheck "Display the release notes on updates". I get that this sucks but there is an easy way to mitigate this problem without changing to another extension.

svenfaw 10y ago

Relevant Tor ticket: https://trac.torproject.org/projects/tor/ticket/19280 https://trac.torproject.org/projects/tor/ticket/19280

tunap 10y ago

Damn! I took the click-bait. For more on the so-called harm, here's a good summary of giorgio & wlad's pissing contest: http://www.dedoimedo.com/computers/adblock-noscript.html http://www.dedoimedo.com/computers/adblock-noscript.html

oridecon 10y ago

I'll wait for the NoScript origin fork. uMatrix is too weird for me (I love uBlock though).

gorhill 10y ago
What is "weird" about uMatrix, specifically? The logic of the matrix is completely straightforward, once you get the basic rule that narrower rules override broader ones, all interactions with the matrix will become obvious, easy to understand in advance what will happens when adding/removing a specific rule -- and in any case, the visual feedback when adding/removing a rule through the popup panel matrix should be obvious enough to understand what will end up blocked/allowed.

VertexRed 10y ago

1. You'd have to actually click and willingly install the software to be infected. 2. Even though he's able to randomize the banner code the redirect to the advertiser's site will most likely be caught by ad blockers. --- Still it's a pretty hypocritical thing to do when you're the creator of a plugin which aims to increase the user's security.

wbkang 10y ago
"1. You'd have to actually click and willingly install the software to be infected." This is how most Windows malware/unwanted software are installed today, not via some rare zero-day Chrome exploits.

AdmiralAsshat 10y ago

Alternative: uMatrix https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix Made by the same developer of uBlock Origin, allows blocking of Javascript and other aspects of the site. I switched awhile back and found it somewhat more usable than NoScript, insofar as it usually allows Javascript on the local site by default, while automatically blocking JS on third-party domains. There are some growing pains associated with it, as there are with NS. Some of the drawbacks I've noticed: - It will take about three or four refreshes before you can whitelist everything necessary to get Youtube working. First youtube, then s.ytimg.com, then googlevideo.com, THEN you might finally get a video. - Any page with a Google Captcha on it will take several refreshes to completely let them through. This is particularly irritating if there's a captcha on a form. - Anything which needs to reach out to jquery, ajax, etc. will fail. But you should be able to whitelist those once then add them to your permanent whitelist. - I have yet to find a good tutorial for uMatrix yet on how to make some pre-defined rules for common sites. That would greatly reduce the learning curve.

ars 10y ago
> insofar as it usually allows Javascript on the local site by default NoScript can do this too BTW. The web is almost unusable without that setting enabled. The drawbacks you identified are exactly the same on NoScript so they should not be used as a reason to pick one over the other. It takes a LONG time to get a good list of whitelisted sites, now that mine is more or less usable I don't intend to switch - especially since I disabled the "show webpage with ads" thing on NoScript, so I don't have the problem in the article.
- hackuser 10y ago
  One advantage of uMatrix: You can filter based on host-destination pairs. That is, in NoScript you can only filter based on the destination. For example, if you allow one site to run scripts from cloudfront.net, every site can. Effective the rules are, DENY * * ALLOW * cloudfront.net In uMatrix, you can write rules based on host-destination pairs, permitting scripts from, e.g., cloudfront.net to run on your bank's website but not on any others: DENY * * ALLOW mybank.com cloudfront.net Finally, you can filter by host & destination & function: DENY * * ALLOW mybank.com cloudfront.net JavaScript ... which would not allow plugins, images, CSS or anything else from cloudfront.net, only JavaScript. EDIT: Add, improve examples

tarancato 10y ago

A honest thought: the typical user of NoScript won't fall for those ads, I think.

JabavuAdams 10y ago
There's no reason to believe that. How many people install NoScript on friends' and family's machines?
- serf 10y ago
  very few i'm betting, it takes hours to build a usable white-list for NoScript, and it breaks everything by default.
- tarancato 10y ago
  I am sure more sites would work with IE6 than with the default configuration of NoScript.
- revanx_ 10y ago
  Imagine the conversation with a none-tech savy person on how to use Noscript, jeeeezzz.

gcb0 10y ago

response: https://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users-dear-mozilla-community/ https://hackademix.net/2009/05/04/dear-adblock-plus-and-nosc... it wasn't circumventing the filters just to show ads. It was circumventing the filters because the filter were blocking everything, including the install extension button.

Vindicis 10y ago

Here's the site that ad on noscript.net takes you to: uniblue.com/cm/deletedcmunits/speedupmypc/spdeletedcmunits/download/?aff=3257&x-at=noscriptt1 After 4-5 clicks, the exe finally downloaded. Seems like a lot of work to download malware doesn' it? So I downloaded the exe and uploaded it to Kaspersky's online scanner https://scan.kaspersky.com/Home/Result https://scan.kaspersky.com/Home/Result and it says the file is safe. It almost seems like he has an axe to grind or something. Maybe I'm just reading too much into such a terrible article, and it's just that though.

consto 10y ago
Upload to virus total, passing one scanner isn't enough.
- Vindicis 10y ago
  I did that, and, it seems that although it fails some virus scanners, it would be what I like to call a false positive. Just to link a description of what one of them found: https://www.symantec.com/security_response/writeup.jsp?docid=2014-071815-0057-99&tabid=2 https://www.symantec.com/security_response/writeup.jsp?docid... Basically it could be an unwanted application that "The application reports an exaggerated number of problems." Shitty software? Sure. Malware? Not to me. YMMV. Here's a screen shot of the ones it failed from that total scanner: https://i.imgur.com/vwy9sXY.jpg https://i.imgur.com/vwy9sXY.jpg
  - deleted 10y ago
    [deleted]
  - 59nadir 10y ago
    It's funny that you mention axes to grind (hidden motives). It's exactly what I think when I read the apologist threads/posts like yours. To look at obviously shady behavior and start giving excuses for it just reeks of misguided fanboyism. If this were a bigger entity I'd assume you were all corporate astroturfers.

nickphx 10y ago

PUP != malware. PUP = potentially unwanted software. It's no more aggressive than the typical scareware tactics anti-virus companies use..

carterehsmith 10y ago
So they mention, among others, "Trojan.Win32.Generic!BT" So I Googled that, and no, not a pup, more like a trojan that hijacks your pc and joins a botnet.

Stratoscope 10y ago

Another sleazy thing... The NoScript site calls the code "open source" and "Free Software" (complete with a link to the FSF), but nowhere on the site can I find the source code. I searched GitHub and didn't find any source code from the NoScript author there either. As far as I can tell, the only way to get the source code is to actually install the extension and then extract the code from there. It appears that GitHub user 'avian2' did exactly that: https://github.com/avian2/noscript https://github.com/avian2/noscript Thanks avian2! And no thanks to the NoScript author.

quesera 10y ago
An XPI is just a zip file. You can download it without installing it. Not as convenient as a github repo, but equally open source.
- Stratoscope 10y ago
  Ah, thank you. In that case, I stand corrected!
- digi_owl 10y ago
  Yeah we should not forget that Firefox extensions became popular because most of the UI was made out of XML and JS.

lbstr_ftw 10y ago

The article never substantiates the claim that "NoScript is harmful". They talk about NoScript's website serving questionable software, not NoScript itself.

digi_owl 10y ago

From a blog with two entries, with an attached twitter that looks more like bot spam than someone actually using it, and a github account that is all about messing with adblockers(?). Why do this feel like a schoolyard pissing match between "1337 haxors"?

revanx_ 10y ago

For how long has that malware link been on the update page? The article mentions the author has a history of doing shady things, can someone provide more background into this?

angry-hacker 10y ago
Disabling adblock filters to whitelist himself. Easy to find on Google.

bbcbasic 10y ago

Clickbaity title