7 ms·

NoScript Not Available for Latest Firefox

66 points by Amezarak 9y ago

andrei_says_ 9y ago
The title of this post is incorrect. Seems like it is available, just in the old extension format. From the noscript site: > Please be patient: if you feel naked while you're waiting for the "brand new" NoScript, you can still use the "regular" NoScript 5.x (and all the other extensions of yours) on Firefox 52 ESR, which will receive security updates until June 2018. See you soon! Edit: my statement is incorrect, the noscript page refers to the ESR version of firefox. > authors suggest to use ESR, which is Extended Support Release, not the latest firefox.
- ycmbntrthrwaway 9y ago
  It is not, authors suggest to use ESR, which is Extended Support Release, not the latest firefox.
  - andrei_says_ 9y ago
    I see, my bad.
- pbhjpbhj 9y ago
  Latest Firefox is 57.0 "Quantum", for which it's not available, as in the title. I feel the way addons were handled in the upgrade was wrong, most of mine were just removed rather than being listed and marked as "incompatible". That seems wrong to me.
- zython 9y ago
  Or you know, "if you feel unsafe" you can always downgrade to 56 or chromium.
  - mariuolo 9y ago
    Or ESR if you are willing to re-create your profile. It's based on 52.x and is going to be supported until March 2018. Webextensions should have been sorted out by then. Hopefully.
gdulli 9y ago
The utility of the long tail of Firefox plugins was what gave it its value. I've been using a hybrid of Pale Moon and Firefox since the last round of losing plugins and now don't see a reason to keep Firefox at all.
- Etheryte 9y ago
  While I definitely see where you’re coming from, I certainly prefer building for better peformance as opposed to supporting everything forever. Analogous to Windows, supporting all the old things gave them a strong edge in their business, but they also paid a very hefty price on it (performance issues, security loopholes, BSODs to name a few).
- pbhjpbhj 9y ago
  I'd value a resource with a simple explanation of the changes that prevent a compatibility layer from enabling all the old plugins?
  - majewsky 9y ago
    In one sentence, the move to more aggressive multithreading and sandboxing. The old extension model conflicts with the boundaries that had to be established for both these things.
    - noisem4ker 9y ago
      They used to provide shims to ease making old addons compatible with multiprocessing, although with serious performance implications.
  - noisem4ker 9y ago
    Part of the breakage is precisely due to the explicit intention to drop all the legacy APIs and the respective shims that have become too much of a burden to maintain over time. One major technical change would be the deprecation plan of XUL/XBL (the toolkit used to build the interface, which could be freely accessed by addons) in favor of a wholly HTML future.
K0nserv 9y ago
I use UBlock Origin to achieve pretty much the same behaviour as NoScript. Haven't found a reason to use NoScript since I started doing that.
- notanote 9y ago
  Yes, once you turn on the "I am an advanced user" setting, you can fine tune script blocking in Ublock Origin. It's called dynamic filtering. https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-quick-guide https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...
- jszymborski 9y ago
  I've used NoScript for quite a while, and was sad to let it go when I switched to Quantum in Beta a while back. I tried using uMatrix, which is from the same folks that made uBlock Origin, and I have to say I'm supperr happy with it. It applies the same heuristics that I usually apply manually (namely, allow 1st-party scripts automatically, allow 3rd-party manually as required). I'm going to install NoScript when the WebExt version comes out, mainly for the excellent XSS/Canvas/misc. support. It remains to be seen which I'll use for blocking scripts, but I'm glad to have options.
- topspin 9y ago
  I use UBlock on mobile hardware where I want more aggressive filtering and Ghostery on the desktop. Both work in FF 57. I used NoScript in Chrome for many years and for a long time it worked very well, but the web evolved and I found myself forever wading through blocked scripts and unblocking or disabling NoScript altogether to get sites to function properly.
- ehllo 9y ago
  I use also UBlock Origin and there is really clear difference. With NoScript you can Browse most of the Sites without Javascript-Gimmicks like Parallax-News-Scrolling (for example Bloomberg) or On-Site-Embeded-Advertisemet (no JS no Ads). UBlock is nice but without NoScript it is not good enough for my personal taste.
- forapurpose 9y ago
smegel 9y ago
> NoScript's unique whitelist based pre-emptive script blocking approach Is that unique apart from what Chrome has built in by default? (obviously you still need to opt-in).
akerro 9y ago
Brave Browser has "Shield" mechanism where you can block ads/trackers and JS. It's built-in feature, you can set it up to be enabled by default or per-domain.
- majewsky 9y ago
  Switching browsers just because some extension does not work for a few days after an upgrade seems like blowing it waaaay out of proportion.
  - digi_owl 9y ago
    People stuck with Firefox because of the old, potent, extension framework. Now they have no reason to stick with Firefox because the extension framework is just another Chrome clone, so why not switch to an actual Chrome clone?
    - majewsky 9y ago
      Because I trust Mozilla more than both Google and $random_developer.
      - akerro 9y ago
        Brave Browser is a product from Brendan Eich, ex-CEO of Mozilla and creator of JS.
  - babuskov 9y ago
    > does not work for a few days after an upgrade "A few days" is an understatement. Extension developers have known for months that these changes would break. If they hadn't created compatible versions by now, they certainly won't be able to do some in just a couple of days.
0xcde4c3db 9y ago
It's probably better to go straight to the blog post about the migration: https://hackademix.net/2017/11/14/double-noscript/ https://hackademix.net/2017/11/14/double-noscript/ Basically, the work to adapt NoScript and correspondingly expand the WebExtensions API has been going on for years, the original plan was to have a smooth transition when Firefox 57 came out, but there were some delays in the final days leading up to the release. Not recommended to stay on Firefox 56 because it won't get security patches; move to 52 ESR instead.
- shock 9y ago
  Moving to Firefox 52 isn't really an option for me because it's a pig compared to 55/56 (it consumes almost 5GBs of RAM compared to 1GB for 56).
  - sp332 9y ago
    I think you can switch to an unbranded build of 57, and enable legacy addons. https://wiki.mozilla.org/Add-ons/Extension_Signing#Latest_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Latest_Bu... You could also install the Developer Edition or a Nightly build. They're slightly less stable (usually pretty good for me) but they have the same option. https://www.mozilla.org/en-US/firefox/channel/desktop/ https://www.mozilla.org/en-US/firefox/channel/desktop/
    - sebazzz 9y ago
      > enable legacy addons Does that mean the XPCOM system has just been flagged as disabled, but not been removed yet?
      - sp332 9y ago
        As far as I know, yes. Firefox has already decided to transaction away from XUL, so the extensions will break eventually. It's just a question of when the particular APIs your extension relies on get removed.
      - 9y ago
user98793728364 9y ago
The correct title should be "NoScript Not YET Available for Latest Firefox"
- el_benhameen 9y ago
  Yeah, when I saw the title and that the link was to the noscript site, I thought there must be some bad blood or something between Mozilla and noscript. Instead it’s just a polite “hey everyone, working hard!”. Which is great, but not really what the title indicates.
- Amezarak 9y ago
  I thought about making the title something like that, but I didn't want it to seem as if the author should be maligned for not having it finished yet and I felt that it would have that connotation. I thought the title as written would be more neutral in that respect. I personally consider NoScript an absolute must for security reasons, so I am not updating most of my machines until it is available. I thought that would be newsworthy for other people who have a similar mindset.
mrich 9y ago
The plugin breakage is the only downside of the new Firefox, the rest is just awesome. I'm still looking for a new auto form filler that can have multiple profiles and fills in all fields at once with a hotkey. This is useful for filling in bugzilla bug reports where some fields always get the same data.
- kreetx 9y ago
  Yes for awesome, and the new Web Extension API which now breaks things will make cross-browser browser extension development possible (as far as I have read!). I can very well live in default-land for a couple of weeks for that. Also, this extension-breakage taking place right now seems to be mostly the extension developers' fault, since they've known well in advance that this is coming. (Not judging, just saying -- many/most extensions are probably hobby projects, and porting them appears to take a non-trivial effort.) EDIT: removed a word from a wrong place :) Definitely not a spelling mistake, not wording either, hmm, what should I write here.
  - awirth 9y ago
    I have a small extension (~100 users) that I forgot to upgrade until 57 landed and broke it. I hastily threw together a WebExt version and pushed on Wednesday night, but forgot to set the strict_min_version flag correctly (which was, unfortunately, Firefox 57). The new version worked fine for people on 57, but for anyone that was on ESR or a slightly out-of-date version of firefox and updated they got a broken WebExtension that I couldn't push another update to to fix it - Firefox doesn't let you "downgrade" from a WebExtension to a native extension. Thankfully a user emailed me about it and I had it fixed in less than 48 hours, but it was still a mess. All I could do was add a note to the addon description and disable the bad versions and anyone that got broke had to manually downgrade. The new Webextensions are nice, but it was definitely easy to shoot yourself in the foot with the transition. I know that NoScript also needs the same API that I was using (the ability to inspect response bodies), FWIW. The extension is https://addons.mozilla.org/en-US/firefox/addon/gpsdetect/ https://addons.mozilla.org/en-US/firefox/addon/gpsdetect/ for those curious EDIT: brevity
- tempestn 9y ago
staticassertion 9y ago
I just use uMatrix.
benjaminjackman 9y ago
Anyone know if xmarks is going to end up working with it? It works in Chrome and has for a long time, so it should be pretty straightforward to port, though xmarks doesn't get a lot of development at all (not even sure it needs it). If not is there an alternative sync bookmarks between chrome and firefox solution anyone can recommend?
ryuuchin 9y ago
uBlock Origin and uMatrix can both do the same thing and are compatible. This is just my opinion but both have better and more intuitive interfaces as well.
- csdreamer7 9y ago
  Love uBlock Origin. The author made it compatible months ago.
- solnyshok 9y ago
  one more vote for uBo. Since I discovered its advanced script blocking interface, I went and disabled NoScript.
- milofeynman 9y ago
  uMatrix felt like a lot of work. But I finally took the plunge and I love it. It is insightful how different websites are pieced together.
- forapurpose 9y ago
  They do some of the same things, but there's a lot they don't do. https://news.ycombinator.com/item?id=15730800 https://news.ycombinator.com/item?id=15730800
old-gregg 9y ago
I've always used YesScript, it has a much simpler UI -> basically a single button which remembers if JS is on/off for a given site. It's always been puzzling to me why YesScript is less popular... And yes, it's available for the latest FF as YesScript2 [1] [1] https://addons.mozilla.org/en-US/firefox/addon/yesscript2/ https://addons.mozilla.org/en-US/firefox/addon/yesscript2/
- TheDong 9y ago
  "YesScript" is significantly less secure and powerful. Most importantly, with NoScript I can block tracking and ad-related javascript while still running the page's first-party javascript. With yesscript, I don't get that granularity. Perhaps that's why it's less popular. I also believe that it came out later and thus hasn't had the time to gather such a following as noscript has (though who would use a worse version of noscript instead?)
  - log69 9y ago
    Hi, I'm the developer of YesScript2 and I've just released a new version with 3 state blocking that makes it even better alternative I believe because you have 3 options: 1) no blocking (grey icon) 2) half blocking (allowing internal scripts and blocking external, blue icon, so you can allow now first-party Javascript as you mentioned) and full blocking (blocking internal and external scripts too, red icon).
ufo 9y ago
BTW, is anyone here knowledgeable enough about NoScript's development to know whether their "until the end of this week" prediction is solid or if it is more vague like ValveTime?
vesinisa 9y ago
uMatrix is a replacement extension from the creator, and compatible with, uBlock. uMatrix migrated to Quantum leveraging the existing Chrome codebase already about a month ago: https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix Some learning curve is required compared to NoScript since uMatrix allows even finer grained control (not just scripts, but images, cookies, iframes and XHR as well), but I personally migrated about a year ago successfully. Very happy with uMatrix so far with the latest Firefox.
- forapurpose 9y ago
  To add some important points: > uMatrix is a replacement extension from the creator, and compatible with, uBlock. To avoid any confusion, I think the parent means, 'from the creator of ... uBlock'. uMatrix is not by the creator of NoScript. Also, blocking just JavaScript is quicker and easier in uMatrix (at least easier than the current NoScript; I don't know about the upcoming version). The UI is far more efficient, and you configure it by origin/remote pairs (e.g., on foo.example.com allow googleapis.com; on other example.com hosts, block it; on example.org allow it everywhere). But NoScript does far more than block JavaScript; it's a sophisticated firewall, in some ways. Look through the options menus and lookup the features, such as ABE; it's impressive. uMatrix doesn't replace much of that functionality.
  - vesinisa 9y ago
    Thank you, dropped an of there indeed. For me personally, #1 reason for using NoScript was controlling which domains can execute JS. uMatrix delivers that superbly, and more. Sadly, ever since NoScript started pushing malware[1] to users with every update, I lost all confidence with the author for securing my browsing experience. [1]: https://liltinkerer.surge.sh/noscript.html https://liltinkerer.surge.sh/noscript.html
amenod 9y ago
I upgraded to Firefox 57 only to find all 4 of my extensions missing... I can live without others, but being without NoScript felt like walking on streets naked. So the first thing I did was downgrade to Firefox ESR, then I started looking for alternatives. Turns out that uMatrix fills this role perfectly (for me of course). Not only can I block/allow JS, CSS and similar resources, but I can do it based on domain / 3rd party domain matrix... Nice, I always hated that when I allow `gstatic.com` in NoScript for some domain it is allowed globally (for all domains). I will test uMatrix for a few more days just to see if I feel comfortable without NoScript, then I'll upgrade back to FF 57. It looks like this might have a silver lining after all. :) (for the record: I hate it that they broke compatibility with older extensions, and I hate that they changed UI, but if that gives FF greater market share, then I'm all for it)
- jchw 9y ago
  Killing the old extension API is a painful, but important, step. From a security standpoint, WebExtensions are a lot better, since they are sandboxed and require explicit permissions to be granted for many things. From a developer standpoint, they are easier to deal with, being JavaScript, and since Chrome and Edge support similar APIs, developers will no longer need multiple codebases to support their extensions on multiple browsers. They also work better with a highly concurrent browser. They use asynchronous APIs that don't directly call into browser APIs. FFs old extensions were known for leaking memory, which is a lot less of an issue with WebExtensions. Compatibility is another huge thing. With old Firefox extensions, compatibility was just an extension author saying, "Yep, the APIs still work the way I'm using them." They often broke in subtle ways and you could get them partially working by overriding the versions supported in the extension manifest. Not so great imo. WebExtension APIs are more or less like JavaScript APIs and compatibility is mostly going to be limited by support for capabilities. Like, I'm sure Firefox does not support the USB API that Chrome does. There's so much to be gained from getting rid of the old extension system for concurrency, extension compatibility, and the health of the ecosystem and individual browser installations. Many will be angry and stick to ESRs and others will be mildly upset but I think in the long run this will have been one of the better Mozilla decisions that make Quantum a success.
mnl 9y ago
And no MAFF nor MHTML support in Quantum... as MAFF is/was great, now I have to keep yet another browser just to read my old files.
Asdfbla 9y ago
While I can understand that the switch to the new system was necessary, I hope they improve the new extension functionality a bit further. One negative thing that I noticed that extensions don't seem to be able to interact with the tabs before those have largely (or completely?) loaded - for instance I can't use mouse gestures in a tab that's currently loading or interact with the vimperator replacement (Vim Vixen). Is that inherent to the new system with the extension system having lower priority than the page rendering or is it just those specific extensions I use? Another thing that would be nice to fix is extensions (at least those that I have tested) seemingly not working in Firefox-internal pages like about:addons.
Crontab 9y ago
Yeah, I leapt right in, and had to revert to Firefox ESR when I realized that RequestPolicy Continued doesn't yet work. (BTW - thanks to @fghtr for letting me know about it this extension.)
Master_of_Lemon 9y ago
Seamonkey is thankfully not affected by this. Running the latest Seamonkey with NoScript still working
seba_dos1 9y ago
And it's available now: https://noscript.net/getit https://noscript.net/getit

66 points by Amezarak 9y ago

The title of this post is incorrect. Seems like it is available, just in the old extension format. From the noscript site: > Please be patient: if you feel naked while you're waiting for the "brand new" NoScript, you can still use the "regular" NoScript 5.x (and all the other extensions of yours) on Firefox 52 ESR, which will receive security updates until June 2018. See you soon! Edit: my statement is incorrect, the noscript page refers to the ESR version of firefox. > authors suggest to use ESR, which is Extended Support Release, not the latest firefox.

ycmbntrthrwaway 9y ago
It is not, authors suggest to use ESR, which is Extended Support Release, not the latest firefox.
- andrei_says_ 9y ago
  I see, my bad.
pbhjpbhj 9y ago
Latest Firefox is 57.0 "Quantum", for which it's not available, as in the title. I feel the way addons were handled in the upgrade was wrong, most of mine were just removed rather than being listed and marked as "incompatible". That seems wrong to me.
zython 9y ago
Or you know, "if you feel unsafe" you can always downgrade to 56 or chromium.
- mariuolo 9y ago
  Or ESR if you are willing to re-create your profile. It's based on 52.x and is going to be supported until March 2018. Webextensions should have been sorted out by then. Hopefully.

gdulli 9y ago

The utility of the long tail of Firefox plugins was what gave it its value. I've been using a hybrid of Pale Moon and Firefox since the last round of losing plugins and now don't see a reason to keep Firefox at all.

Etheryte 9y ago
While I definitely see where you’re coming from, I certainly prefer building for better peformance as opposed to supporting everything forever. Analogous to Windows, supporting all the old things gave them a strong edge in their business, but they also paid a very hefty price on it (performance issues, security loopholes, BSODs to name a few).
pbhjpbhj 9y ago
I'd value a resource with a simple explanation of the changes that prevent a compatibility layer from enabling all the old plugins?
- majewsky 9y ago
  In one sentence, the move to more aggressive multithreading and sandboxing. The old extension model conflicts with the boundaries that had to be established for both these things.
  - noisem4ker 9y ago
    They used to provide shims to ease making old addons compatible with multiprocessing, although with serious performance implications.
- noisem4ker 9y ago
  Part of the breakage is precisely due to the explicit intention to drop all the legacy APIs and the respective shims that have become too much of a burden to maintain over time. One major technical change would be the deprecation plan of XUL/XBL (the toolkit used to build the interface, which could be freely accessed by addons) in favor of a wholly HTML future.

K0nserv 9y ago

I use UBlock Origin to achieve pretty much the same behaviour as NoScript. Haven't found a reason to use NoScript since I started doing that.

notanote 9y ago
Yes, once you turn on the "I am an advanced user" setting, you can fine tune script blocking in Ublock Origin. It's called dynamic filtering. https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-quick-guide https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...
jszymborski 9y ago
I've used NoScript for quite a while, and was sad to let it go when I switched to Quantum in Beta a while back. I tried using uMatrix, which is from the same folks that made uBlock Origin, and I have to say I'm supperr happy with it. It applies the same heuristics that I usually apply manually (namely, allow 1st-party scripts automatically, allow 3rd-party manually as required). I'm going to install NoScript when the WebExt version comes out, mainly for the excellent XSS/Canvas/misc. support. It remains to be seen which I'll use for blocking scripts, but I'm glad to have options.
topspin 9y ago
I use UBlock on mobile hardware where I want more aggressive filtering and Ghostery on the desktop. Both work in FF 57. I used NoScript in Chrome for many years and for a long time it worked very well, but the web evolved and I found myself forever wading through blocked scripts and unblocking or disabling NoScript altogether to get sites to function properly.
ehllo 9y ago
I use also UBlock Origin and there is really clear difference. With NoScript you can Browse most of the Sites without Javascript-Gimmicks like Parallax-News-Scrolling (for example Bloomberg) or On-Site-Embeded-Advertisemet (no JS no Ads). UBlock is nice but without NoScript it is not good enough for my personal taste.
forapurpose 9y ago

smegel 9y ago

> NoScript's unique whitelist based pre-emptive script blocking approach Is that unique apart from what Chrome has built in by default? (obviously you still need to opt-in).

akerro 9y ago

Brave Browser has "Shield" mechanism where you can block ads/trackers and JS. It's built-in feature, you can set it up to be enabled by default or per-domain.

majewsky 9y ago
Switching browsers just because some extension does not work for a few days after an upgrade seems like blowing it waaaay out of proportion.
- digi_owl 9y ago
  People stuck with Firefox because of the old, potent, extension framework. Now they have no reason to stick with Firefox because the extension framework is just another Chrome clone, so why not switch to an actual Chrome clone?
  - majewsky 9y ago
    Because I trust Mozilla more than both Google and $random_developer.
    - akerro 9y ago
      Brave Browser is a product from Brendan Eich, ex-CEO of Mozilla and creator of JS.
- babuskov 9y ago
  > does not work for a few days after an upgrade "A few days" is an understatement. Extension developers have known for months that these changes would break. If they hadn't created compatible versions by now, they certainly won't be able to do some in just a couple of days.

0xcde4c3db 9y ago

It's probably better to go straight to the blog post about the migration: https://hackademix.net/2017/11/14/double-noscript/ https://hackademix.net/2017/11/14/double-noscript/ Basically, the work to adapt NoScript and correspondingly expand the WebExtensions API has been going on for years, the original plan was to have a smooth transition when Firefox 57 came out, but there were some delays in the final days leading up to the release. Not recommended to stay on Firefox 56 because it won't get security patches; move to 52 ESR instead.

shock 9y ago
Moving to Firefox 52 isn't really an option for me because it's a pig compared to 55/56 (it consumes almost 5GBs of RAM compared to 1GB for 56).
- sp332 9y ago
  I think you can switch to an unbranded build of 57, and enable legacy addons. https://wiki.mozilla.org/Add-ons/Extension_Signing#Latest_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Latest_Bu... You could also install the Developer Edition or a Nightly build. They're slightly less stable (usually pretty good for me) but they have the same option. https://www.mozilla.org/en-US/firefox/channel/desktop/ https://www.mozilla.org/en-US/firefox/channel/desktop/
  - sebazzz 9y ago
    > enable legacy addons Does that mean the XPCOM system has just been flagged as disabled, but not been removed yet?
    - sp332 9y ago
      As far as I know, yes. Firefox has already decided to transaction away from XUL, so the extensions will break eventually. It's just a question of when the particular APIs your extension relies on get removed.
    - 9y ago

user98793728364 9y ago

The correct title should be "NoScript Not YET Available for Latest Firefox"

el_benhameen 9y ago
Yeah, when I saw the title and that the link was to the noscript site, I thought there must be some bad blood or something between Mozilla and noscript. Instead it’s just a polite “hey everyone, working hard!”. Which is great, but not really what the title indicates.
Amezarak 9y ago
I thought about making the title something like that, but I didn't want it to seem as if the author should be maligned for not having it finished yet and I felt that it would have that connotation. I thought the title as written would be more neutral in that respect. I personally consider NoScript an absolute must for security reasons, so I am not updating most of my machines until it is available. I thought that would be newsworthy for other people who have a similar mindset.

mrich 9y ago

The plugin breakage is the only downside of the new Firefox, the rest is just awesome. I'm still looking for a new auto form filler that can have multiple profiles and fills in all fields at once with a hotkey. This is useful for filling in bugzilla bug reports where some fields always get the same data.

kreetx 9y ago
Yes for awesome, and the new Web Extension API which now breaks things will make cross-browser browser extension development possible (as far as I have read!). I can very well live in default-land for a couple of weeks for that. Also, this extension-breakage taking place right now seems to be mostly the extension developers' fault, since they've known well in advance that this is coming. (Not judging, just saying -- many/most extensions are probably hobby projects, and porting them appears to take a non-trivial effort.) EDIT: removed a word from a wrong place :) Definitely not a spelling mistake, not wording either, hmm, what should I write here.
- awirth 9y ago
  I have a small extension (~100 users) that I forgot to upgrade until 57 landed and broke it. I hastily threw together a WebExt version and pushed on Wednesday night, but forgot to set the strict_min_version flag correctly (which was, unfortunately, Firefox 57). The new version worked fine for people on 57, but for anyone that was on ESR or a slightly out-of-date version of firefox and updated they got a broken WebExtension that I couldn't push another update to to fix it - Firefox doesn't let you "downgrade" from a WebExtension to a native extension. Thankfully a user emailed me about it and I had it fixed in less than 48 hours, but it was still a mess. All I could do was add a note to the addon description and disable the bad versions and anyone that got broke had to manually downgrade. The new Webextensions are nice, but it was definitely easy to shoot yourself in the foot with the transition. I know that NoScript also needs the same API that I was using (the ability to inspect response bodies), FWIW. The extension is https://addons.mozilla.org/en-US/firefox/addon/gpsdetect/ https://addons.mozilla.org/en-US/firefox/addon/gpsdetect/ for those curious EDIT: brevity
tempestn 9y ago

staticassertion 9y ago

I just use uMatrix.

benjaminjackman 9y ago

Anyone know if xmarks is going to end up working with it? It works in Chrome and has for a long time, so it should be pretty straightforward to port, though xmarks doesn't get a lot of development at all (not even sure it needs it). If not is there an alternative sync bookmarks between chrome and firefox solution anyone can recommend?

ryuuchin 9y ago

uBlock Origin and uMatrix can both do the same thing and are compatible. This is just my opinion but both have better and more intuitive interfaces as well.

csdreamer7 9y ago
Love uBlock Origin. The author made it compatible months ago.
solnyshok 9y ago
one more vote for uBo. Since I discovered its advanced script blocking interface, I went and disabled NoScript.
milofeynman 9y ago
uMatrix felt like a lot of work. But I finally took the plunge and I love it. It is insightful how different websites are pieced together.
forapurpose 9y ago
They do some of the same things, but there's a lot they don't do. https://news.ycombinator.com/item?id=15730800 https://news.ycombinator.com/item?id=15730800

old-gregg 9y ago

I've always used YesScript, it has a much simpler UI -> basically a single button which remembers if JS is on/off for a given site. It's always been puzzling to me why YesScript is less popular... And yes, it's available for the latest FF as YesScript2 [1] [1] https://addons.mozilla.org/en-US/firefox/addon/yesscript2/ https://addons.mozilla.org/en-US/firefox/addon/yesscript2/

TheDong 9y ago
"YesScript" is significantly less secure and powerful. Most importantly, with NoScript I can block tracking and ad-related javascript while still running the page's first-party javascript. With yesscript, I don't get that granularity. Perhaps that's why it's less popular. I also believe that it came out later and thus hasn't had the time to gather such a following as noscript has (though who would use a worse version of noscript instead?)
- log69 9y ago
  Hi, I'm the developer of YesScript2 and I've just released a new version with 3 state blocking that makes it even better alternative I believe because you have 3 options: 1) no blocking (grey icon) 2) half blocking (allowing internal scripts and blocking external, blue icon, so you can allow now first-party Javascript as you mentioned) and full blocking (blocking internal and external scripts too, red icon).

ufo 9y ago

BTW, is anyone here knowledgeable enough about NoScript's development to know whether their "until the end of this week" prediction is solid or if it is more vague like ValveTime?

vesinisa 9y ago

uMatrix is a replacement extension from the creator, and compatible with, uBlock. uMatrix migrated to Quantum leveraging the existing Chrome codebase already about a month ago: https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix Some learning curve is required compared to NoScript since uMatrix allows even finer grained control (not just scripts, but images, cookies, iframes and XHR as well), but I personally migrated about a year ago successfully. Very happy with uMatrix so far with the latest Firefox.

forapurpose 9y ago
To add some important points: > uMatrix is a replacement extension from the creator, and compatible with, uBlock. To avoid any confusion, I think the parent means, 'from the creator of ... uBlock'. uMatrix is not by the creator of NoScript. Also, blocking just JavaScript is quicker and easier in uMatrix (at least easier than the current NoScript; I don't know about the upcoming version). The UI is far more efficient, and you configure it by origin/remote pairs (e.g., on foo.example.com allow googleapis.com; on other example.com hosts, block it; on example.org allow it everywhere). But NoScript does far more than block JavaScript; it's a sophisticated firewall, in some ways. Look through the options menus and lookup the features, such as ABE; it's impressive. uMatrix doesn't replace much of that functionality.
- vesinisa 9y ago
  Thank you, dropped an of there indeed. For me personally, #1 reason for using NoScript was controlling which domains can execute JS. uMatrix delivers that superbly, and more. Sadly, ever since NoScript started pushing malware[1] to users with every update, I lost all confidence with the author for securing my browsing experience. [1]: https://liltinkerer.surge.sh/noscript.html https://liltinkerer.surge.sh/noscript.html

amenod 9y ago

I upgraded to Firefox 57 only to find all 4 of my extensions missing... I can live without others, but being without NoScript felt like walking on streets naked. So the first thing I did was downgrade to Firefox ESR, then I started looking for alternatives. Turns out that uMatrix fills this role perfectly (for me of course). Not only can I block/allow JS, CSS and similar resources, but I can do it based on domain / 3rd party domain matrix... Nice, I always hated that when I allow `gstatic.com` in NoScript for some domain it is allowed globally (for all domains). I will test uMatrix for a few more days just to see if I feel comfortable without NoScript, then I'll upgrade back to FF 57. It looks like this might have a silver lining after all. :) (for the record: I hate it that they broke compatibility with older extensions, and I hate that they changed UI, but if that gives FF greater market share, then I'm all for it)

jchw 9y ago
Killing the old extension API is a painful, but important, step. From a security standpoint, WebExtensions are a lot better, since they are sandboxed and require explicit permissions to be granted for many things. From a developer standpoint, they are easier to deal with, being JavaScript, and since Chrome and Edge support similar APIs, developers will no longer need multiple codebases to support their extensions on multiple browsers. They also work better with a highly concurrent browser. They use asynchronous APIs that don't directly call into browser APIs. FFs old extensions were known for leaking memory, which is a lot less of an issue with WebExtensions. Compatibility is another huge thing. With old Firefox extensions, compatibility was just an extension author saying, "Yep, the APIs still work the way I'm using them." They often broke in subtle ways and you could get them partially working by overriding the versions supported in the extension manifest. Not so great imo. WebExtension APIs are more or less like JavaScript APIs and compatibility is mostly going to be limited by support for capabilities. Like, I'm sure Firefox does not support the USB API that Chrome does. There's so much to be gained from getting rid of the old extension system for concurrency, extension compatibility, and the health of the ecosystem and individual browser installations. Many will be angry and stick to ESRs and others will be mildly upset but I think in the long run this will have been one of the better Mozilla decisions that make Quantum a success.

mnl 9y ago

And no MAFF nor MHTML support in Quantum... as MAFF is/was great, now I have to keep yet another browser just to read my old files.

Asdfbla 9y ago

While I can understand that the switch to the new system was necessary, I hope they improve the new extension functionality a bit further. One negative thing that I noticed that extensions don't seem to be able to interact with the tabs before those have largely (or completely?) loaded - for instance I can't use mouse gestures in a tab that's currently loading or interact with the vimperator replacement (Vim Vixen). Is that inherent to the new system with the extension system having lower priority than the page rendering or is it just those specific extensions I use? Another thing that would be nice to fix is extensions (at least those that I have tested) seemingly not working in Firefox-internal pages like about:addons.

Crontab 9y ago

Yeah, I leapt right in, and had to revert to Firefox ESR when I realized that RequestPolicy Continued doesn't yet work. (BTW - thanks to @fghtr for letting me know about it this extension.)

Master_of_Lemon 9y ago

Seamonkey is thankfully not affected by this. Running the latest Seamonkey with NoScript still working

seba_dos1 9y ago

And it's available now: https://noscript.net/getit https://noscript.net/getit