6 ms·

I feel whitelisting JS is becoming the sanest approach, despite all its shortcomings.

by Momquist 9y ago

shostack 9y ago
Is there anything comparable to NoScript that works in Firefox Quantum?
- Momquist 9y ago
  uMatrix, although it doesn't have the various anti-XSS protections of NoScript. But its UI is great, much better than NS IMHO, and it's not limited to script blocking. https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix
  - gorhill 9y ago
    The dev build support specifically blocking web workers, typically used by cryptominers. So at this point I think it will be a good idea to block web workers by default everywhere, and enable only if a trusted site needs them.
- KwanEsq 9y ago
  NoScript[1] works pretty well. [1] https://addons.mozilla.org/firefox/addon/noscript/ https://addons.mozilla.org/firefox/addon/noscript/
  - shostack 9y ago
    Huh...for some reason I thought it was not compatible. Ugh, now the only thing holding me back from upgrading is some of my other addons. I hate having to wait forever to upgrade because I use some less popular addons with long update cycles.
    - CannisterFlux 9y ago
      I ditched a load of addons for Firefox 57. Just embrace the change, find replacements, or move on and stop using them. It's hard, but I found I adapted quite quickly. For NoScript, even though it is now available, I switched to ublock in medium-mode since NS was delayed until a couple of weeks after 57 hit. Both ublock and NS now use the same Content-Security-Policy filtering approach (NoScript switched to CSP for the webextension release, ublock did it this way before) and so both now suffer from this bug that means noscript tags are not rendered/parsed at all https://github.com/gorhill/uBlock/issues/308 https://github.com/gorhill/uBlock/issues/308 - so I felt I may as well just use ublock. Full-on global-disallow NoScript with that bug makes many sites completely unusable since their graceful-degraded noscript blocks are not shown, and UI changes in the webextension release made it too fiddly to use IMO.
      - shostack 9y ago
        Is there decent mouse gesture support for 57? That's one thing I'm not willing to budge on in terms of ditching old functionality from addons. Mouse gestures have become a way of life for me.
        CannisterFlux 9y ago
        Yes, me too. This was more of a pain than NoScript, but after trying a few I switched to "Foxy Gestures" and I'm mostly happy with it. It has right-button+move-in-a-pattern gestures, as well as "chorded" right/left clicks and wheel gestures. It does have 2 issues - 1st it does not work on special pages due to security restrictions. This means stuff like about:blank, when a page fails to load, preferences pages, and Mozilla's add-on site. There's nothing you can do about this regardless of the gestures add-on you use - life is worse due to security concerns, this is why we can't have nice things, etc. And 2nd on Linux (maybe Mac too) Foxy Gestures did not work at all by default since the right-click menu triggers on mouse down, not mouse up. That stopped the gesture in their tracks. The FoxyGestures developer mitigated this problem by making right-menu take 2 clicks to trigger as an option enabled by default on Linux, but that can be annoying as now the regular right-click menu doesn't appear when you expect. Fortunately a patch is in Firefox for a future version that adds the option "ui.context_menus.after_mouseup", which makes the right-click menu work like on Windows. Also, a bonus, on Arch Linux the packager backported that preference to Firefox 57, so nice of them, which made everything work almost as well as in the pre-57 days.
    - Sylos 9y ago
      It used to not be compatible until a few weeks after the release of Firefox Quantum. It's also been completely rewritten, so it's not the same NoScript that you know. The new UI definitely takes some getting used to and the dev is still in the process of polishing the new UI. And it's also still missing some features compared to the old version, which the NoScript dev wants to have ready for the next LTS release of Firefox (which is going to be Firefox 60), as that's what Tor Browser will be based on, which needs NoScript. On the other hand, the new version has significantly better performance and also works on Android.
      - shostack 9y ago
        Any major features missing?
        Sylos 9y ago
        I think, ClearClick and ABE are still missing. (According to this post [1] from a few weeks ago, they're supposed to be coming in the next few weeks...) Or well, active content blocking and XSS protection are definitely in there. [1]: https://hackademix.net/2017/11/21/noscript-1011-quantum-powerball-finish-and-rebooting/ https://hackademix.net/2017/11/21/noscript-1011-quantum-powe...
userbinator 9y ago
Indeed, with all the CPU sidechannel attacks that just came out, allowing any untrusted code to run on your machine, even sandboxed in a browser, seems like a horrible idea.
ChrisSD 9y ago
I usually prefer to whitelist domains rather than individual scripts. Either I trust a domain enough to serve scripts or I don't, there's rarely a middle ground.

I feel whitelisting JS is becoming the sanest approach, despite all its shortcomings.

shostack 9y ago

Is there anything comparable to NoScript that works in Firefox Quantum?

Momquist 9y ago
uMatrix, although it doesn't have the various anti-XSS protections of NoScript. But its UI is great, much better than NS IMHO, and it's not limited to script blocking. https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix
- gorhill 9y ago
  The dev build support specifically blocking web workers, typically used by cryptominers. So at this point I think it will be a good idea to block web workers by default everywhere, and enable only if a trusted site needs them.
KwanEsq 9y ago
NoScript[1] works pretty well. [1] https://addons.mozilla.org/firefox/addon/noscript/ https://addons.mozilla.org/firefox/addon/noscript/
- shostack 9y ago
  Huh...for some reason I thought it was not compatible. Ugh, now the only thing holding me back from upgrading is some of my other addons. I hate having to wait forever to upgrade because I use some less popular addons with long update cycles.
  - CannisterFlux 9y ago
    I ditched a load of addons for Firefox 57. Just embrace the change, find replacements, or move on and stop using them. It's hard, but I found I adapted quite quickly. For NoScript, even though it is now available, I switched to ublock in medium-mode since NS was delayed until a couple of weeks after 57 hit. Both ublock and NS now use the same Content-Security-Policy filtering approach (NoScript switched to CSP for the webextension release, ublock did it this way before) and so both now suffer from this bug that means noscript tags are not rendered/parsed at all https://github.com/gorhill/uBlock/issues/308 https://github.com/gorhill/uBlock/issues/308 - so I felt I may as well just use ublock. Full-on global-disallow NoScript with that bug makes many sites completely unusable since their graceful-degraded noscript blocks are not shown, and UI changes in the webextension release made it too fiddly to use IMO.
    - shostack 9y ago
      Is there decent mouse gesture support for 57? That's one thing I'm not willing to budge on in terms of ditching old functionality from addons. Mouse gestures have become a way of life for me.
      - CannisterFlux 9y ago
        Yes, me too. This was more of a pain than NoScript, but after trying a few I switched to "Foxy Gestures" and I'm mostly happy with it. It has right-button+move-in-a-pattern gestures, as well as "chorded" right/left clicks and wheel gestures. It does have 2 issues - 1st it does not work on special pages due to security restrictions. This means stuff like about:blank, when a page fails to load, preferences pages, and Mozilla's add-on site. There's nothing you can do about this regardless of the gestures add-on you use - life is worse due to security concerns, this is why we can't have nice things, etc. And 2nd on Linux (maybe Mac too) Foxy Gestures did not work at all by default since the right-click menu triggers on mouse down, not mouse up. That stopped the gesture in their tracks. The FoxyGestures developer mitigated this problem by making right-menu take 2 clicks to trigger as an option enabled by default on Linux, but that can be annoying as now the regular right-click menu doesn't appear when you expect. Fortunately a patch is in Firefox for a future version that adds the option "ui.context_menus.after_mouseup", which makes the right-click menu work like on Windows. Also, a bonus, on Arch Linux the packager backported that preference to Firefox 57, so nice of them, which made everything work almost as well as in the pre-57 days.
  - Sylos 9y ago
    It used to not be compatible until a few weeks after the release of Firefox Quantum. It's also been completely rewritten, so it's not the same NoScript that you know. The new UI definitely takes some getting used to and the dev is still in the process of polishing the new UI. And it's also still missing some features compared to the old version, which the NoScript dev wants to have ready for the next LTS release of Firefox (which is going to be Firefox 60), as that's what Tor Browser will be based on, which needs NoScript. On the other hand, the new version has significantly better performance and also works on Android.
    - shostack 9y ago
      Any major features missing?
      - Sylos 9y ago
        I think, ClearClick and ABE are still missing. (According to this post [1] from a few weeks ago, they're supposed to be coming in the next few weeks...) Or well, active content blocking and XSS protection are definitely in there. [1]: https://hackademix.net/2017/11/21/noscript-1011-quantum-powerball-finish-and-rebooting/ https://hackademix.net/2017/11/21/noscript-1011-quantum-powe...

userbinator 9y ago

Indeed, with all the CPU sidechannel attacks that just came out, allowing any untrusted code to run on your machine, even sandboxed in a browser, seems like a horrible idea.

ChrisSD 9y ago

I usually prefer to whitelist domains rather than individual scripts. Either I trust a domain enough to serve scripts or I don't, there's rarely a middle ground.