8 ms·

Alternative: uMatrix https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix Made by the same developer of uBlock Origin, allows blocking of Jav

Alternative: uMatrix https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix Made by the same developer of uBlock Origin, allows blocking of Javascript and other aspects of the site. I switched awhile back and found it somewhat more usable than NoScript, insofar as it usually allows Javascript on the local site by default, while automatically blocking JS on third-party domains. There are some growing pains associated with it, as there are with NS. Some of the drawbacks I've noticed: - It will take about three or four refreshes before you can whitelist everything necessary to get Youtube working. First youtube, then s.ytimg.com, then googlevideo.com, THEN you might finally get a video. - Any page with a Google Captcha on it will take several refreshes to completely let them through. This is particularly irritating if there's a captcha on a form. - Anything which needs to reach out to jquery, ajax, etc. will fail. But you should be able to whitelist those once then add them to your permanent whitelist. - I have yet to find a good tutorial for uMatrix yet on how to make some pre-defined rules for common sites. That would greatly reduce the learning curve.

ars 10y ago
> insofar as it usually allows Javascript on the local site by default NoScript can do this too BTW. The web is almost unusable without that setting enabled. The drawbacks you identified are exactly the same on NoScript so they should not be used as a reason to pick one over the other. It takes a LONG time to get a good list of whitelisted sites, now that mine is more or less usable I don't intend to switch - especially since I disabled the "show webpage with ads" thing on NoScript, so I don't have the problem in the article.
- hackuser 10y ago
  One advantage of uMatrix: You can filter based on host-destination pairs. That is, in NoScript you can only filter based on the destination. For example, if you allow one site to run scripts from cloudfront.net, every site can. Effective the rules are, DENY * * ALLOW * cloudfront.net In uMatrix, you can write rules based on host-destination pairs, permitting scripts from, e.g., cloudfront.net to run on your bank's website but not on any others: DENY * * ALLOW mybank.com cloudfront.net Finally, you can filter by host & destination & function: DENY * * ALLOW mybank.com cloudfront.net JavaScript ... which would not allow plugins, images, CSS or anything else from cloudfront.net, only JavaScript. EDIT: Add, improve examples
- prodigal_erik 10y ago
  Google, Bing, Gmail, Yahoo Mail, Facebook, Twitter, Reddit, HN, Slashdot, and Github all work with Javascript disabled. If a site does not (e.g., Office 365, Slack, Instagram), that tells me something about the competence of the developers they are willing to hire.
  - carterehsmith 10y ago
    Does Google Docs work without Javascript?
    - witty_username 10y ago
      IIRC you can only view the document, which makes sense.
  - morgante 10y ago
    > If a site does not (e.g., Office 365, Slack, Instagram), that tells me something about the competence of the developers they are willing to hire. How exactly do you think Slack is supposed to work without JavaScript? It's probably the poster child of why web applications need JS.
    - SquareWheel 10y ago
      It's the outdated notion that "the web is still a collection of hypertext documents". Yet the reality is that JS webapps have been the standard for some time now, and won't be going away any time soon.
      - prodigal_erik 10y ago
        I agree the trend is toward thick Javascript apps, but I call that the death of the web and a wholesale regression to client/server architecture where data is entombed and only usable by a single piece of software that you don't maintain.
        10y ago
- zeveb 10y ago
  > The web is almost unusable without that setting enabled. The web (i.e., the web of hypertext documents linked together) is perfectly usable with JavaScript disabled; what doesn't work are all the single-page apps which hijack the web's infrastructure in order to break it. This is somewhat like a medicine which does not interfere with the operation of human cells but which disrupts the replication of viruses.
hackuser 10y ago
NoScript provides many features that uMatrix does not: * Shift+click on host name, and pull up info on trustability from NoScript.net database * Filters WebGL, XSLT, @font-face * Sophisticated XSS protection: Look up XSS on these pages: https://noscript.net/features https://noscript.net/features https://noscript.net/faq https://noscript.net/faq * CSRF protection * Clearclick: Detects invisible elements which cover clicked visible elements https://hackademix.net/2008/10/08/hello-clearclick-goodbye-clickjacking/ https://hackademix.net/2008/10/08/hello-clearclick-goodbye-c... * A pretty sophisticated firewall in your browser, Application Boundaries Enforcer (ABE), where you can even write your own policies: "Living inside the browser, the ABE component can take advantage of its privileged placement for enforcing web application boundaries, because it always knows the real origin of each HTTP request" "Many of the threats NoScript is currently capable of handling, such as XSS, CSRF or ClickJacking, have one common evil root: lack of proper isolation at the web application level." "The idea behind the Application Boundaries Enforcer (ABE) module is hardening the web application oriented protections ... by delivering a firewall-like component running inside the browser ... specialized in defining and guarding the boundaries of each sensitive web application" More here: https://noscript.net/abe/ https://noscript.net/abe/ Also, there's a project to create a GUI for just the ABE component, called SABER https://forums.informaction.com/viewtopic.php?f=19&t=8059 https://forums.informaction.com/viewtopic.php?f=19&t=8059
- ryuuchin 10y ago
  Some of these features can be accomplished simply through blocking javascript.
  - hackuser 10y ago
    Which ones are you thinking about? Sometimes you want to enable JavaScript and still be protected from attacks.
  - arviewer 10y ago
    For us tech-savvy people that might be an option. But for the average user it's not. Too many things don't work. I use Privacy Badger and install it on every system that I maintain. It's simple and clean, and set up by an organisation that doesn't need shady ads on its website.
pmoriarty 10y ago
You say uMatrix is "somewhat more usable than NoScript, insofar as it usually allows Javascript on the local site by default, while automatically blocking JS on third-party domains" But that's exactly the default I do not want. One of the main reasons I use NoScript in the first place is to protect against Javascript vulnerabilities. If the default is to enable Javascript, that defeats that protection.
- Dylan16807 10y ago
  You can toggle it on both extensions.
- stephengillie 10y ago
  A more useful alternative may be disabling JavaScript globally, and maintaining a clearlist of sites allowed to run it. Or combine this with uMatrix, giving yourself a global blocklist with 3rd party granularity on the sites you do clearlist.
  - stephengillie 10y ago
    Was this comment really so unhelpful as to merit a downvote?
- ryuuchin 10y ago
  You can change this behavior in both NoScript and uMatrix. In uMatrix all you have to do is disable first party scripts in the global (*) profile. NoScript defaults to the opposite (don't allow any scripts) but the behavior can be changed to allow first party scripts by default.
  - Houshalter 10y ago
    How do I disable scripts for just one site? I tried to use uMatrix once as it was suggested as the alternative of noscript for chrome. I just wanted to get rid of those annoying anti-adblock popups on wired.com. However every setting I tried on the drop down menu failed to block javascript, or just blocked all content on the domain wired.com. I tried going deeper into the settings but I found the user interface confusing and nothing was labelled. It's definitely not a convenient alternative for noscript/javascript blocking. Even if it may be possible to achieve that with it.
cesarb 10y ago
Another alternative: uBlock Origin with "advanced mode" enabled. You can tell it to globally block "inline scripts", "1st-party scripts", "3rd-party scripts", and "3rd-party frames", and selectively undo that block when needed. See https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-quick-guide https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu... for an explanation with screenshots.
- ryuuchin 10y ago
  uMatrix provides a more fine grained approach to blocking and has an interface to match this. uBlock's interface can be easier for a more coarse grained approach (see dynamic filtering, medium mode).
  - iripu 10y ago
    I never tried uMatrix. uBlock has the ability to block a particular set of links e.g. abc.com/min/* and whitelist some links within that set e.g. abc.com/min//.png. I think that's a fine grain approach. Can uMatrix do things like this?
    - keeperofdakeys 10y ago
      Here is a quick tutorial showing what uMatrix can do https://github.com/gorhill/uMatrix/wiki/Very-bare-walkthrough-for-first-time-users https://github.com/gorhill/uMatrix/wiki/Very-bare-walkthroug.... As you can see, it gives you an easier way to have fine-grained control of each individual type of resource. It also allows you to configure third-party domain resources globally, or per domain. This allows you to do something like allow youtube embedding (js + xhr) on all websites at once.
ryuuchin 10y ago
> It will take about three or four refreshes before you can whitelist everything necessary to get Youtube working. First youtube, then s.ytimg.com, then googlevideo.com, THEN you might finally get a video. > Any page with a Google Captcha on it will take several refreshes to completely let them through. This is particularly irritating if there's a captcha on a form. > Anything which needs to reach out to jquery, ajax, etc. will fail. But you should be able to whitelist those once then add them to your permanent whitelist. These should all be one time deals though. You can whitelist some or all of this stuff in the global scope so it applies to all web pages (if you want to do this). For example you can whitelist the youtube stuff in the global scope so that any page which has imbedded youtube videos will show them. This should be a safe practice as the google domains should generally be trustable. Or don't do this. And whitelist it on a site by site basis. The choice is yours.
hjek 10y ago
Another alternative (for Mozilla-based browsers): LibreJS https://www.gnu.org/software/librejs/ https://www.gnu.org/software/librejs/ https://ftp.gnu.org/gnu/librejs/gnu_librejs-6.0.13-fx.xpi https://ftp.gnu.org/gnu/librejs/gnu_librejs-6.0.13-fx.xpi - Blocks non-free Javascript
- ryan-c 10y ago
  LibreJS is not a security tool, and the filtering it provides is fairly easy to bypass.
anc84 10y ago
If you use Firefox, you could add https://addons.mozilla.org/de/firefox/addon/decentraleyes/ https://addons.mozilla.org/de/firefox/addon/decentraleyes/ , it might make the common CDN stuff easier.
- lanna 10y ago
  for the english speakers amongst us: https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/ https://addons.mozilla.org/en-US/firefox/addon/decentraleyes...
_JamesA_ 10y ago
Another advantage is uMatrix on Firefox is already multiprocess compatible and NoScript is not.

ars 10y ago

> insofar as it usually allows Javascript on the local site by default NoScript can do this too BTW. The web is almost unusable without that setting enabled. The drawbacks you identified are exactly the same on NoScript so they should not be used as a reason to pick one over the other. It takes a LONG time to get a good list of whitelisted sites, now that mine is more or less usable I don't intend to switch - especially since I disabled the "show webpage with ads" thing on NoScript, so I don't have the problem in the article.

hackuser 10y ago
One advantage of uMatrix: You can filter based on host-destination pairs. That is, in NoScript you can only filter based on the destination. For example, if you allow one site to run scripts from cloudfront.net, every site can. Effective the rules are, DENY * * ALLOW * cloudfront.net In uMatrix, you can write rules based on host-destination pairs, permitting scripts from, e.g., cloudfront.net to run on your bank's website but not on any others: DENY * * ALLOW mybank.com cloudfront.net Finally, you can filter by host & destination & function: DENY * * ALLOW mybank.com cloudfront.net JavaScript ... which would not allow plugins, images, CSS or anything else from cloudfront.net, only JavaScript. EDIT: Add, improve examples
prodigal_erik 10y ago
Google, Bing, Gmail, Yahoo Mail, Facebook, Twitter, Reddit, HN, Slashdot, and Github all work with Javascript disabled. If a site does not (e.g., Office 365, Slack, Instagram), that tells me something about the competence of the developers they are willing to hire.
- carterehsmith 10y ago
  Does Google Docs work without Javascript?
  - witty_username 10y ago
    IIRC you can only view the document, which makes sense.
- morgante 10y ago
  > If a site does not (e.g., Office 365, Slack, Instagram), that tells me something about the competence of the developers they are willing to hire. How exactly do you think Slack is supposed to work without JavaScript? It's probably the poster child of why web applications need JS.
  - SquareWheel 10y ago
    It's the outdated notion that "the web is still a collection of hypertext documents". Yet the reality is that JS webapps have been the standard for some time now, and won't be going away any time soon.
    - prodigal_erik 10y ago
      I agree the trend is toward thick Javascript apps, but I call that the death of the web and a wholesale regression to client/server architecture where data is entombed and only usable by a single piece of software that you don't maintain.
      - 10y ago
zeveb 10y ago
> The web is almost unusable without that setting enabled. The web (i.e., the web of hypertext documents linked together) is perfectly usable with JavaScript disabled; what doesn't work are all the single-page apps which hijack the web's infrastructure in order to break it. This is somewhat like a medicine which does not interfere with the operation of human cells but which disrupts the replication of viruses.

hackuser 10y ago

NoScript provides many features that uMatrix does not: * Shift+click on host name, and pull up info on trustability from NoScript.net database * Filters WebGL, XSLT, @font-face * Sophisticated XSS protection: Look up XSS on these pages: https://noscript.net/features https://noscript.net/features https://noscript.net/faq https://noscript.net/faq * CSRF protection * Clearclick: Detects invisible elements which cover clicked visible elements https://hackademix.net/2008/10/08/hello-clearclick-goodbye-clickjacking/ https://hackademix.net/2008/10/08/hello-clearclick-goodbye-c... * A pretty sophisticated firewall in your browser, Application Boundaries Enforcer (ABE), where you can even write your own policies: "Living inside the browser, the ABE component can take advantage of its privileged placement for enforcing web application boundaries, because it always knows the real origin of each HTTP request" "Many of the threats NoScript is currently capable of handling, such as XSS, CSRF or ClickJacking, have one common evil root: lack of proper isolation at the web application level." "The idea behind the Application Boundaries Enforcer (ABE) module is hardening the web application oriented protections ... by delivering a firewall-like component running inside the browser ... specialized in defining and guarding the boundaries of each sensitive web application" More here: https://noscript.net/abe/ https://noscript.net/abe/ Also, there's a project to create a GUI for just the ABE component, called SABER https://forums.informaction.com/viewtopic.php?f=19&t=8059 https://forums.informaction.com/viewtopic.php?f=19&t=8059

ryuuchin 10y ago
Some of these features can be accomplished simply through blocking javascript.
- hackuser 10y ago
  Which ones are you thinking about? Sometimes you want to enable JavaScript and still be protected from attacks.
- arviewer 10y ago
  For us tech-savvy people that might be an option. But for the average user it's not. Too many things don't work. I use Privacy Badger and install it on every system that I maintain. It's simple and clean, and set up by an organisation that doesn't need shady ads on its website.

pmoriarty 10y ago

You say uMatrix is "somewhat more usable than NoScript, insofar as it usually allows Javascript on the local site by default, while automatically blocking JS on third-party domains" But that's exactly the default I do not want. One of the main reasons I use NoScript in the first place is to protect against Javascript vulnerabilities. If the default is to enable Javascript, that defeats that protection.

Dylan16807 10y ago
You can toggle it on both extensions.
stephengillie 10y ago
A more useful alternative may be disabling JavaScript globally, and maintaining a clearlist of sites allowed to run it. Or combine this with uMatrix, giving yourself a global blocklist with 3rd party granularity on the sites you do clearlist.
- stephengillie 10y ago
  Was this comment really so unhelpful as to merit a downvote?
ryuuchin 10y ago
You can change this behavior in both NoScript and uMatrix. In uMatrix all you have to do is disable first party scripts in the global (*) profile. NoScript defaults to the opposite (don't allow any scripts) but the behavior can be changed to allow first party scripts by default.
- Houshalter 10y ago
  How do I disable scripts for just one site? I tried to use uMatrix once as it was suggested as the alternative of noscript for chrome. I just wanted to get rid of those annoying anti-adblock popups on wired.com. However every setting I tried on the drop down menu failed to block javascript, or just blocked all content on the domain wired.com. I tried going deeper into the settings but I found the user interface confusing and nothing was labelled. It's definitely not a convenient alternative for noscript/javascript blocking. Even if it may be possible to achieve that with it.

cesarb 10y ago

Another alternative: uBlock Origin with "advanced mode" enabled. You can tell it to globally block "inline scripts", "1st-party scripts", "3rd-party scripts", and "3rd-party frames", and selectively undo that block when needed. See https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-quick-guide https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu... for an explanation with screenshots.

ryuuchin 10y ago
uMatrix provides a more fine grained approach to blocking and has an interface to match this. uBlock's interface can be easier for a more coarse grained approach (see dynamic filtering, medium mode).
- iripu 10y ago
  I never tried uMatrix. uBlock has the ability to block a particular set of links e.g. abc.com/min/* and whitelist some links within that set e.g. abc.com/min//.png. I think that's a fine grain approach. Can uMatrix do things like this?
  - keeperofdakeys 10y ago
    Here is a quick tutorial showing what uMatrix can do https://github.com/gorhill/uMatrix/wiki/Very-bare-walkthrough-for-first-time-users https://github.com/gorhill/uMatrix/wiki/Very-bare-walkthroug.... As you can see, it gives you an easier way to have fine-grained control of each individual type of resource. It also allows you to configure third-party domain resources globally, or per domain. This allows you to do something like allow youtube embedding (js + xhr) on all websites at once.

ryuuchin 10y ago

> It will take about three or four refreshes before you can whitelist everything necessary to get Youtube working. First youtube, then s.ytimg.com, then googlevideo.com, THEN you might finally get a video. > Any page with a Google Captcha on it will take several refreshes to completely let them through. This is particularly irritating if there's a captcha on a form. > Anything which needs to reach out to jquery, ajax, etc. will fail. But you should be able to whitelist those once then add them to your permanent whitelist. These should all be one time deals though. You can whitelist some or all of this stuff in the global scope so it applies to all web pages (if you want to do this). For example you can whitelist the youtube stuff in the global scope so that any page which has imbedded youtube videos will show them. This should be a safe practice as the google domains should generally be trustable. Or don't do this. And whitelist it on a site by site basis. The choice is yours.

hjek 10y ago

Another alternative (for Mozilla-based browsers): LibreJS https://www.gnu.org/software/librejs/ https://www.gnu.org/software/librejs/ https://ftp.gnu.org/gnu/librejs/gnu_librejs-6.0.13-fx.xpi https://ftp.gnu.org/gnu/librejs/gnu_librejs-6.0.13-fx.xpi - Blocks non-free Javascript

ryan-c 10y ago
LibreJS is not a security tool, and the filtering it provides is fairly easy to bypass.

anc84 10y ago

If you use Firefox, you could add https://addons.mozilla.org/de/firefox/addon/decentraleyes/ https://addons.mozilla.org/de/firefox/addon/decentraleyes/ , it might make the common CDN stuff easier.

lanna 10y ago
for the english speakers amongst us: https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/ https://addons.mozilla.org/en-US/firefox/addon/decentraleyes...

_JamesA_ 10y ago

Another advantage is uMatrix on Firefox is already multiprocess compatible and NoScript is not.