3 ms·

Browsing with NoScript, while inconvenient, offers safe-by-default browsing for cases like these. If I see a site I actually want to interact with, I'll fire up

by woogley 12y ago

Browsing with NoScript, while inconvenient, offers safe-by-default browsing for cases like these. If I see a site I actually want to interact with, I'll fire up a different browser profile and look at it there. If it's a site I want to use regularly, I just add to NoScript's whitelist.

fencepost 12y ago
Adding RequestPolicy on as well increases the inconvenience factor somewhat, but also dramatically cuts down on the chances of issues. The biggest headaches I've run into so far with it are sites that use multiple cloudfront addresses or that pull in required content from host or domain names that don't bear any resemblance to the original site. I can figure out if I'm on "chicagotribune.com" that "trbimg.com" and "trb.com" are probably related to it, but there are a lot of sites where there's no clear name relationship.
x1798DE 12y ago
I've been using NoScript for several months now. Seemed crazy at first, but now it doesn't really feel all that inconvenient. If anything, I just tend to get upset with the serious proliferation of needless Javascript out there. I understand why you need Javascript to make a full-featured web-app like GMail or Facebook, but most of the time it's being used in place of CSS for simple layout placement or something. I'm also somewhat shocked at how much JS seems to be directly included from a third-party domain. Again, I understand why you'd want a separate domain for some things (many larger sites tend to have some JS hosted on the main domain and some offloaded to a CDN domain, for example), but a shocking amount of sites are offloading basic design elements of their site to some Google Ajax server for whatever reason.
- Istof 12y ago
  "... now it doesn't really feel all that inconvenient ..." because you white-listed so many domains?
  - x1798DE 12y ago
    Partially that - I don't visit many web sites regularly that require Javascript, but most of the ones I do visit regularly are more or less trustworthy. The biggest problem I have with the whole whitelisting thing is that so many people host code on Google's domains that I'd really prefer a GUI element for "Allow <domain> on this domain only", so I'm not executing any code hosted on Google's servers on every page I go to, just because I occasionally navigate to a Google site. I think there's a way to configure this in the back-end, but it's not really convenient to do so temporarily. The other big part of it is that I'm much more used to seeing a site, noticing if something's missing, then making the decision about whether I really want to let it execute arbitrary code on my machine. I'm not all that confused when a new site I go to is subtly broken.

by woogley 12y ago

fencepost 12y ago

Adding RequestPolicy on as well increases the inconvenience factor somewhat, but also dramatically cuts down on the chances of issues. The biggest headaches I've run into so far with it are sites that use multiple cloudfront addresses or that pull in required content from host or domain names that don't bear any resemblance to the original site. I can figure out if I'm on "chicagotribune.com" that "trbimg.com" and "trb.com" are probably related to it, but there are a lot of sites where there's no clear name relationship.

x1798DE 12y ago

I've been using NoScript for several months now. Seemed crazy at first, but now it doesn't really feel all that inconvenient. If anything, I just tend to get upset with the serious proliferation of needless Javascript out there. I understand why you need Javascript to make a full-featured web-app like GMail or Facebook, but most of the time it's being used in place of CSS for simple layout placement or something. I'm also somewhat shocked at how much JS seems to be directly included from a third-party domain. Again, I understand why you'd want a separate domain for some things (many larger sites tend to have some JS hosted on the main domain and some offloaded to a CDN domain, for example), but a shocking amount of sites are offloading basic design elements of their site to some Google Ajax server for whatever reason.

Istof 12y ago
"... now it doesn't really feel all that inconvenient ..." because you white-listed so many domains?
- x1798DE 12y ago
  Partially that - I don't visit many web sites regularly that require Javascript, but most of the ones I do visit regularly are more or less trustworthy. The biggest problem I have with the whole whitelisting thing is that so many people host code on Google's domains that I'd really prefer a GUI element for "Allow <domain> on this domain only", so I'm not executing any code hosted on Google's servers on every page I go to, just because I occasionally navigate to a Google site. I think there's a way to configure this in the back-end, but it's not really convenient to do so temporarily. The other big part of it is that I'm much more used to seeing a site, noticing if something's missing, then making the decision about whether I really want to let it execute arbitrary code on my machine. I'm not all that confused when a new site I go to is subtly broken.