6 ms·

NoScript implemented this over a decade ago, as part of its surrogate scripts feature: https://hackademix.net/2009/01/25/surrogate-scripts-vs-google-analytics/

NoScript implemented this over a decade ago, as part of its surrogate scripts feature: https://hackademix.net/2009/01/25/surrogate-scripts-vs-google-analytics/ https://hackademix.net/2009/01/25/surrogate-scripts-vs-googl... This was one of my favorite examples of how there was much more to NoScript than most people assumed, and it had a depth of features that could not be matched by "alternatives" like uMatrix. But that feature was killed by the mass extension breakage in Firefox 57: https://github.com/hackademix/noscript/issues/133#issuecomment-593150495 https://github.com/hackademix/noscript/issues/133#issuecomme... So in a way, this feature can be seen as more than three years overdue.

crazypython 6y ago
I thought NoScript was a single-purpose extension for disabling scripts. Naming and messaging matters, I guess. "JSControl" would've been a better name.
- wtallis 6y ago
  The full name as shown on addons.mozilla.org is "NoScript Security Suite", which more accurately conveys its purpose. Some of the features it provided really had nothing to do with JavaScript, such as NoScript's implementation of Strict Transport Security about 1.5 years before Firefox itself implemented that feature.
  - z77dj3kl 6y ago
    > "NoScript Security Suite", which more accurately conveys its purpose. No, that just makes the name more confusing!
  - dividedbyzero 6y ago
    Still sounds like a JavaScript blocker, that doesn't clarify anything for me. I've never even looked at it as I've somehow associated it with "block all Javascript", seems like I missed out.
    - wtallis 6y ago
      "Block all JavaScript" never required an extension. All the browsers have an option to turn JavaScript off entirely. NoScript started out as a way to provide an easy UI for selective blocking of scripts. But it experienced the best kind of scope creep: it gained the ability to block other dangerous web features (eg. Flash and other plugin objects, web fonts, etc.), gained features to make life easier when blocking scripts (ie. the surrogate scripts feature), gained other security features for blocking evil actions by the scripts that are permitted (XSS blocking, clickjacking protection), and helped pioneer some security measures that weren't related to scripting (HSTS, ABE as a precursor to and superset of CORS).
      - mfontani 6y ago
        IIRC if you turn JS off in the browser, the "noscript" blocks on sites get executed. But if you turn NoScript on, the "noscript" blocks aren't executed.
        vbezhenar 6y ago
        They are not "executed". They are displayed to user.
        mfontani 6y ago
        Thanks for the correction. My point remains that the "NoScript" extension doesn't do anything with those "noscript" blocks, so they're not shown to the user despite the user not executing JS on the site. This is a bit of a PITA when one tries to make the site "work well" with JS both enabled and disabled; or provide _alternatives_ for when the user-agent isn't running JS. Those work really well when the user-agent is blocking JS globally, but not for NoScript: broken behaviour everywhere.
        account42 6y ago
        IIRC the noscript extension had the option to parse <noscript> if you disable scripts. But if you are doing progressive enhancement correctly you should not need any <noscript> so this becomes a moot issue.
- croes 6y ago
  NoScript evolved over time.
- kumarharsh 6y ago
  NoScript evolved over time. It's not like you downloaded a Mozilla's executable one day and expected to see a Flaming Canine instead of a web browser.
matheusmoreira 6y ago
I'm happy with this. Some extensions are so important they should be integrated into the browsers themselves. NoScript, uBlock Origin, uMatrix and Privacy Badger should just be standard browser features.
- viraptor 6y ago
  That would give the browser owners control over ad blocking behaviours, while they rely on funding from companies which sell ads. That's not a great situation for the users. The authors providing an unopinionated API for plugins is much safer.
  - matheusmoreira 6y ago
    You're absolutely right. Though the problem is the conflict of interest, not the idea that these things should be browser features. The truth is everyone trusta these particular extensions and so they should have more privileges and deeper integration. For example, Google's new extension APIs actually make a lot of sense: they allow extensions to do useful things without actually looking at user data. This is a big improvement and it should be imposed on all extensions on their store. It's just that uBlock Origin is so important that it shouldn't be subjected to these limitations. That's why I say it might as well become a browser feature.
    - pseudalopex 6y ago
      Manifest v3 doesn't stop extensions observing requests. Just blocking them.
      - taneq 6y ago
        That tell you a bit about priorities then.
      - jimmydorry 6y ago
        Manifest v3 still had loopholes that allowed looking at data, but it was very clear what this was a step change toward.
madars 6y ago
uBlock origin exposes this via https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-rule-syntax https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-ru... . In particular, https://github.com/uBlockOrigin/uAssets/blob/master/filters/privacy.txt#L45 https://github.com/uBlockOrigin/uAssets/blob/master/filters/... will translate requesting google-analytics.com/analytics.js into this stub: https://github.com/gorhill/uBlock/blob/master/src/web_accessible_resources/google-analytics_analytics.js https://github.com/gorhill/uBlock/blob/master/src/web_access... . Not sure if you can easily substitute arbitrary scripts (would probably be placing too much trust into filter lists) but the resource library seems to be quite extensive: https://github.com/gorhill/uBlock/wiki/Resources-Library#url-specific-sanitized-redirect-resources-surrogates https://github.com/gorhill/uBlock/wiki/Resources-Library#url...
- Groxx 6y ago
  Does this imply NoScript just hasn't migrated to newer APIs, or does uBlock do something extreme to achieve it?
SilasX 6y ago
Well, you should be able to remake it by now, since that was in 2016, so Firefox should have replaced all the functionality the previous extensions had, right? Edit: Not you specifically, but someone.
stjohnswarts 6y ago
No script blocks all scripts though so it's a tad bit extreme. They had bigger fish to fry but they finally got around to this. I'm happy they're doing it and I'm not going to complain about water under the bridge.
- wtallis 6y ago
  NoScript selectively blocks scripts on a per-domain basis, which is almost always sufficient to block the bad scripts but allow the necessary scripts on a site. The exceptions where a surrogate script (or blocking scripts by URL regex) is required are relatively rare.
  - stjohnswarts 6y ago
    It requires a lot of work from the user unlike something like ublock. It's fine for power users and hardcore privacy adherents but I would never recommend it for your general internet user as they'll just get confused.
Causality1 6y ago
Too little too late for me personally. I couldn't keep my two versions of Firefox from interfering with each other so these days it's Chrome for all my casual browsing and Firefox 56 for the functions I can't do without.

crazypython 6y ago

I thought NoScript was a single-purpose extension for disabling scripts. Naming and messaging matters, I guess. "JSControl" would've been a better name.

wtallis 6y ago
The full name as shown on addons.mozilla.org is "NoScript Security Suite", which more accurately conveys its purpose. Some of the features it provided really had nothing to do with JavaScript, such as NoScript's implementation of Strict Transport Security about 1.5 years before Firefox itself implemented that feature.
- z77dj3kl 6y ago
  > "NoScript Security Suite", which more accurately conveys its purpose. No, that just makes the name more confusing!
- dividedbyzero 6y ago
  Still sounds like a JavaScript blocker, that doesn't clarify anything for me. I've never even looked at it as I've somehow associated it with "block all Javascript", seems like I missed out.
  - wtallis 6y ago
    "Block all JavaScript" never required an extension. All the browsers have an option to turn JavaScript off entirely. NoScript started out as a way to provide an easy UI for selective blocking of scripts. But it experienced the best kind of scope creep: it gained the ability to block other dangerous web features (eg. Flash and other plugin objects, web fonts, etc.), gained features to make life easier when blocking scripts (ie. the surrogate scripts feature), gained other security features for blocking evil actions by the scripts that are permitted (XSS blocking, clickjacking protection), and helped pioneer some security measures that weren't related to scripting (HSTS, ABE as a precursor to and superset of CORS).
    - mfontani 6y ago
      IIRC if you turn JS off in the browser, the "noscript" blocks on sites get executed. But if you turn NoScript on, the "noscript" blocks aren't executed.
      - vbezhenar 6y ago
        They are not "executed". They are displayed to user.
        mfontani 6y ago
        Thanks for the correction. My point remains that the "NoScript" extension doesn't do anything with those "noscript" blocks, so they're not shown to the user despite the user not executing JS on the site. This is a bit of a PITA when one tries to make the site "work well" with JS both enabled and disabled; or provide _alternatives_ for when the user-agent isn't running JS. Those work really well when the user-agent is blocking JS globally, but not for NoScript: broken behaviour everywhere.
        account42 6y ago
        IIRC the noscript extension had the option to parse <noscript> if you disable scripts. But if you are doing progressive enhancement correctly you should not need any <noscript> so this becomes a moot issue.
croes 6y ago
NoScript evolved over time.
kumarharsh 6y ago
NoScript evolved over time. It's not like you downloaded a Mozilla's executable one day and expected to see a Flaming Canine instead of a web browser.

matheusmoreira 6y ago

I'm happy with this. Some extensions are so important they should be integrated into the browsers themselves. NoScript, uBlock Origin, uMatrix and Privacy Badger should just be standard browser features.

viraptor 6y ago
That would give the browser owners control over ad blocking behaviours, while they rely on funding from companies which sell ads. That's not a great situation for the users. The authors providing an unopinionated API for plugins is much safer.
- matheusmoreira 6y ago
  You're absolutely right. Though the problem is the conflict of interest, not the idea that these things should be browser features. The truth is everyone trusta these particular extensions and so they should have more privileges and deeper integration. For example, Google's new extension APIs actually make a lot of sense: they allow extensions to do useful things without actually looking at user data. This is a big improvement and it should be imposed on all extensions on their store. It's just that uBlock Origin is so important that it shouldn't be subjected to these limitations. That's why I say it might as well become a browser feature.
  - pseudalopex 6y ago
    Manifest v3 doesn't stop extensions observing requests. Just blocking them.
    - taneq 6y ago
      That tell you a bit about priorities then.
    - jimmydorry 6y ago
      Manifest v3 still had loopholes that allowed looking at data, but it was very clear what this was a step change toward.

madars 6y ago

uBlock origin exposes this via https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-rule-syntax https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-ru... . In particular, https://github.com/uBlockOrigin/uAssets/blob/master/filters/privacy.txt#L45 https://github.com/uBlockOrigin/uAssets/blob/master/filters/... will translate requesting google-analytics.com/analytics.js into this stub: https://github.com/gorhill/uBlock/blob/master/src/web_accessible_resources/google-analytics_analytics.js https://github.com/gorhill/uBlock/blob/master/src/web_access... . Not sure if you can easily substitute arbitrary scripts (would probably be placing too much trust into filter lists) but the resource library seems to be quite extensive: https://github.com/gorhill/uBlock/wiki/Resources-Library#url-specific-sanitized-redirect-resources-surrogates https://github.com/gorhill/uBlock/wiki/Resources-Library#url...

Groxx 6y ago
Does this imply NoScript just hasn't migrated to newer APIs, or does uBlock do something extreme to achieve it?

SilasX 6y ago

Well, you should be able to remake it by now, since that was in 2016, so Firefox should have replaced all the functionality the previous extensions had, right? Edit: Not you specifically, but someone.

stjohnswarts 6y ago

No script blocks all scripts though so it's a tad bit extreme. They had bigger fish to fry but they finally got around to this. I'm happy they're doing it and I'm not going to complain about water under the bridge.

wtallis 6y ago
NoScript selectively blocks scripts on a per-domain basis, which is almost always sufficient to block the bad scripts but allow the necessary scripts on a site. The exceptions where a surrogate script (or blocking scripts by URL regex) is required are relatively rare.
- stjohnswarts 6y ago
  It requires a lot of work from the user unlike something like ublock. It's fine for power users and hardcore privacy adherents but I would never recommend it for your general internet user as they'll just get confused.

Causality1 6y ago

Too little too late for me personally. I couldn't keep my two versions of Firefox from interfering with each other so these days it's Chrome for all my casual browsing and Firefox 56 for the functions I can't do without.