7 ms·

Didn't work for me. Then I remembered to tell noscript to enable js. Does anyone still need convincing that they should be using noscript?

robryan 16y ago
How do you browse though given that the vast majority of modern websites made use of javascript?
- 16s 16y ago
  With noscript, browsing still works fine, you just have to explicitly allow the javascript you want/need rather than allowing just any site to execute code in your browser.
  - steveklabnik 16y ago
    ... so if I want to XSS you, I just have to do it on a site that requires JS to function. Don't get me wrong, I can appreciate reducing your attack surface... but noscript just doesn't seem like that great of an idea, still.
    - jrockway 16y ago
      noscript is per-source, so you can whitelist their <script> blocks and jquery.js, but that random javascript in an onmouseover in a forum comment will do nothing.
      - steveklabnik 16y ago
        Fair enough. Seems like a whole lot of effort for very little gain.
        deleted 16y ago
        [deleted]
        mike-cardwell 16y ago
        The main gain is that you no longer have to worry about getting hit by this class of attack whilst browsing as normal. XSS attacks are happening all the time, even on major websites run by extremely clever techies. You think that is very little gain. To me, that gain is worth the hassle of having to manage NoScript. There is also a positive secondary benefit in that most websites which don't require js to work will run a little faster with NoScript enabled.
        steveklabnik 16y ago
        I'm sure my opinion will change as soon as one of my accounts are compromised. Since it hasn't happened yet, it's basically off my radar. Humans are quite irrational sometimes...
        mike-cardwell 16y ago
        You might be right. I was personally hit by a Twitter XSS once. The only reason I enabled JavaScript on twitter.com was because you can't post (or at least couldn't) post new items without enabling it first. I don't use the twitter.com website any more. Prefering to use clients that don't run JavaScript. Whenever I can use something other than a web browser to access a service, I will take that path. I use NoScript when that isn't an option. I also found (and reported responsibly) an XSRF flaw in Linode.com a few months back that I believe has now been fixed. That was quite a dangerous one. I also found an XSS flaw in DuckDuckGo a few weeks back. Maybe this is the reason I'm so "paranoid" about JavaScript. Maybe I'm right to be.
      - pyre 16y ago
        Maybe it's been a while, but I thought that NoScript was per-domain. In the event of a XSS, the javascript maybe included from the page's domain. NoScript wouldn't help you here. IIRC, NoScript wouldn't say, "Hey this script wasn't here the last time you visited this domain, do you want to allow it?"
    - profquail 16y ago
      No, even when you do allow a site to run JS, NoScript includes additional XSS, XSRF, and "click-jacking" protections that aren't normally offered by Firefox.
- mike-cardwell 16y ago
  The vast majority of modern websites use JavaScript for trivial purposes. Like adding advertising, or auto focusing on fields. Most of them still work fine without JavaScript. Some bits of github don't work unless you enable JavaScript, but most of it does. So I only enable it when I'm using those bits. I also make sure I log out of github before I start browsing other websites.
  - copper 16y ago
    I have a very warped model of browser usage, which in practice has translated to using: * IE for two banks * firefox+adblock for gmail, github and chesscube * chrome for facebook * opera for everything else, which includes HN. Just looking back at that list makes it seem even more terrible than it actually is :(
16s 16y ago
Most people do not realize that javascript runs locally in their browser on their device. That's been my experience anyway. When I try to explain this to friends, they respond with, "No, it's only on that webpage I visit."
- jacobbijani 16y ago
  Most people don't realize how anything they rely on work, not exclusive to the internet.
ceejayoz 16y ago
Most folks who use Github would probably whitelist the domain.
- mike-cardwell 16y ago
  I use github. I don't whitelist it in noscript. Because I use noscript in the way it was intended to be used.
  - ceejayoz 16y ago
    Congratulations, you've proven that the definition of "most" includes "not all".
    - mike-cardwell 16y ago
      Congratulations, you've taken offence for no reason. At no point did I disagree with you.
mike-cardwell 16y ago
It's funny how when you mention NoScript in the presence of web "2.0" developers, most hate it, but if you mention it in the presence of sysadmins, network admins, security bods, general techies, they love it.
- deleted 16y ago
  [deleted]
  - acdha 16y ago
    You know, having used the web extensively since JavaScript was called LiveScript, I've never had a security issue where blocking JavaScript would have helped. Plugins, yes, using IE and ActiveX a thousand times yes but the only problems JavaScript has caused have been annoyances like ads. The reason is simple: JavaScript actually has a security model and browsers are one of the few bits of software with widely used update systems; plugins and most other applications are much easier targets (all of that juicy native code not coded defensively) and drift horribly out of date. So, yes, put me firmly on the list of people who find NoScript 70% PR, 20% clunk UI, and 10% meaningful improvement. Something like Chrome's sandbox and click-to-play will actually make a noticeable benefit for the web because it'll actually be used - and even that's somewhat minor since we're still losing the user education battle where most exploits are actively assisted by the user.
    - simonw 16y ago
      Are you sure you fully understand XSS? The whole problem with XSS is that it works within the browser's security model. Sandboxing is a totally separate issue.
redthrowaway 16y ago
Noscript uses a sledgehammer to do a scalpel's job. It would be much more widely used if it was a little more subtle, and less noticeable as most browser extensions are. Scorched Earth-like blocking is safe, but it very strongly degrades the web surfing experience. I would much rather they use a heuristics-based approach to warn users when potentially malicious scripts were trying to run, than simply block all scripts. I used it for a couple years, but stopped when I realized how annoying it made my browsing experience.
- lukeschlather 16y ago
  It's so much faster though, especially when browsing over a slow satellite link on a netbook. Mostly I browse to read, and NoScript eliminates a ton of pointless HTTP requests and CPU cycles.
  - deleted 16y ago
    [deleted]
  - redthrowaway 16y ago
    That's a fair point, but a very limited usage case.
    - lukeschlather 16y ago
      Netbook over 3G would probably show significant gains, and I use it on broadband too, and I still feel a noticeable speed improvement.
  - dataminer 16y ago
    noscript + flashblock + adblock give me a faster browsing experience too. I do disable adblock on nytimes, reddit, google and any other site which provides good content so that it keeps on getting revenue from ads.
    - bconway 16y ago
      Agreed, although I use NoScript + apply-confirmations-to-whitelisted-sites setting and ditched Flashblock.

robryan 16y ago

How do you browse though given that the vast majority of modern websites made use of javascript?

16s 16y ago
With noscript, browsing still works fine, you just have to explicitly allow the javascript you want/need rather than allowing just any site to execute code in your browser.
- steveklabnik 16y ago
  ... so if I want to XSS you, I just have to do it on a site that requires JS to function. Don't get me wrong, I can appreciate reducing your attack surface... but noscript just doesn't seem like that great of an idea, still.
  - jrockway 16y ago
    noscript is per-source, so you can whitelist their <script> blocks and jquery.js, but that random javascript in an onmouseover in a forum comment will do nothing.
    - steveklabnik 16y ago
      Fair enough. Seems like a whole lot of effort for very little gain.
      - deleted 16y ago
        [deleted]
      - mike-cardwell 16y ago
        The main gain is that you no longer have to worry about getting hit by this class of attack whilst browsing as normal. XSS attacks are happening all the time, even on major websites run by extremely clever techies. You think that is very little gain. To me, that gain is worth the hassle of having to manage NoScript. There is also a positive secondary benefit in that most websites which don't require js to work will run a little faster with NoScript enabled.
        steveklabnik 16y ago
        I'm sure my opinion will change as soon as one of my accounts are compromised. Since it hasn't happened yet, it's basically off my radar. Humans are quite irrational sometimes...
        mike-cardwell 16y ago
        You might be right. I was personally hit by a Twitter XSS once. The only reason I enabled JavaScript on twitter.com was because you can't post (or at least couldn't) post new items without enabling it first. I don't use the twitter.com website any more. Prefering to use clients that don't run JavaScript. Whenever I can use something other than a web browser to access a service, I will take that path. I use NoScript when that isn't an option. I also found (and reported responsibly) an XSRF flaw in Linode.com a few months back that I believe has now been fixed. That was quite a dangerous one. I also found an XSS flaw in DuckDuckGo a few weeks back. Maybe this is the reason I'm so "paranoid" about JavaScript. Maybe I'm right to be.
    - pyre 16y ago
      Maybe it's been a while, but I thought that NoScript was per-domain. In the event of a XSS, the javascript maybe included from the page's domain. NoScript wouldn't help you here. IIRC, NoScript wouldn't say, "Hey this script wasn't here the last time you visited this domain, do you want to allow it?"
  - profquail 16y ago
    No, even when you do allow a site to run JS, NoScript includes additional XSS, XSRF, and "click-jacking" protections that aren't normally offered by Firefox.
mike-cardwell 16y ago
The vast majority of modern websites use JavaScript for trivial purposes. Like adding advertising, or auto focusing on fields. Most of them still work fine without JavaScript. Some bits of github don't work unless you enable JavaScript, but most of it does. So I only enable it when I'm using those bits. I also make sure I log out of github before I start browsing other websites.
- copper 16y ago
  I have a very warped model of browser usage, which in practice has translated to using: * IE for two banks * firefox+adblock for gmail, github and chesscube * chrome for facebook * opera for everything else, which includes HN. Just looking back at that list makes it seem even more terrible than it actually is :(

16s 16y ago

Most people do not realize that javascript runs locally in their browser on their device. That's been my experience anyway. When I try to explain this to friends, they respond with, "No, it's only on that webpage I visit."

jacobbijani 16y ago
Most people don't realize how anything they rely on work, not exclusive to the internet.

ceejayoz 16y ago

Most folks who use Github would probably whitelist the domain.

mike-cardwell 16y ago
I use github. I don't whitelist it in noscript. Because I use noscript in the way it was intended to be used.
- ceejayoz 16y ago
  Congratulations, you've proven that the definition of "most" includes "not all".
  - mike-cardwell 16y ago
    Congratulations, you've taken offence for no reason. At no point did I disagree with you.

mike-cardwell 16y ago

It's funny how when you mention NoScript in the presence of web "2.0" developers, most hate it, but if you mention it in the presence of sysadmins, network admins, security bods, general techies, they love it.

deleted 16y ago
[deleted]
- acdha 16y ago
  You know, having used the web extensively since JavaScript was called LiveScript, I've never had a security issue where blocking JavaScript would have helped. Plugins, yes, using IE and ActiveX a thousand times yes but the only problems JavaScript has caused have been annoyances like ads. The reason is simple: JavaScript actually has a security model and browsers are one of the few bits of software with widely used update systems; plugins and most other applications are much easier targets (all of that juicy native code not coded defensively) and drift horribly out of date. So, yes, put me firmly on the list of people who find NoScript 70% PR, 20% clunk UI, and 10% meaningful improvement. Something like Chrome's sandbox and click-to-play will actually make a noticeable benefit for the web because it'll actually be used - and even that's somewhat minor since we're still losing the user education battle where most exploits are actively assisted by the user.
  - simonw 16y ago
    Are you sure you fully understand XSS? The whole problem with XSS is that it works within the browser's security model. Sandboxing is a totally separate issue.

redthrowaway 16y ago

Noscript uses a sledgehammer to do a scalpel's job. It would be much more widely used if it was a little more subtle, and less noticeable as most browser extensions are. Scorched Earth-like blocking is safe, but it very strongly degrades the web surfing experience. I would much rather they use a heuristics-based approach to warn users when potentially malicious scripts were trying to run, than simply block all scripts. I used it for a couple years, but stopped when I realized how annoying it made my browsing experience.

lukeschlather 16y ago
It's so much faster though, especially when browsing over a slow satellite link on a netbook. Mostly I browse to read, and NoScript eliminates a ton of pointless HTTP requests and CPU cycles.
- deleted 16y ago
  [deleted]
- redthrowaway 16y ago
  That's a fair point, but a very limited usage case.
  - lukeschlather 16y ago
    Netbook over 3G would probably show significant gains, and I use it on broadband too, and I still feel a noticeable speed improvement.
- dataminer 16y ago
  noscript + flashblock + adblock give me a faster browsing experience too. I do disable adblock on nytimes, reddit, google and any other site which provides good content so that it keeps on getting revenue from ads.
  - bconway 16y ago
    Agreed, although I use NoScript + apply-confirmations-to-whitelisted-sites setting and ditched Flashblock.