Noscript for Google Chrome?

Bug reports and enhancement requests

Re: Noscript for Google Chrome?

Postby 4td8s » Thu Jul 01, 2010 3:02 am

GµårÐïåñ wrote:Once again it seems they are making promises to make the majority of the masses to let their guard down and go with their solution thinking a false sense of security while the full benefit and guts of the program are not implemented because why go the full distance when you can fool people into a lesser and incomplete solution, this is asinine. It is shameful that instead of using the expertise and knowledge of a master like Giorgio, they are going to keep dragging their feet and implementing one half ass solution after another. :evil: Plus, if they had what is needed in place for Giorgio to do his thing, you wouldn't have to keep asking Giorgio, it would already be done. Anyone who knows anything about how diligently Giorgio stays on top of things would know that if it was possible, it would have already been done. The pressure and the questions should be directed to the reluctant Google devs who have ignored it all along.


that sure sucks, doesn't it? oh well, it's google's loss. :lol:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a6pre) Gecko/20100629 SeaMonkey/2.1a2
4td8s
 
Posts: 7
Joined: Thu Jun 03, 2010 10:40 pm

Re: Noscript for Google Chrome?

Postby yupa » Sat Jul 24, 2010 12:34 pm

http://apple.slashdot.org/story/10/07/2 ... ng-Adblock

Is this "resource-blocking-adblock" bringing us closer to Noscript on Chrome?
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.7) Gecko/20100713 Firefox/3.6.7
yupa
 
Posts: 4
Joined: Mon Jun 07, 2010 9:08 am

Re: Noscript for Google Chrome?

Postby Giorgio Maone » Sat Jul 24, 2010 12:54 pm

yupa wrote:http://apple.slashdot.org/story/10/07/20/0421257/Google-Chrome-Now-Has-Resource-Blocking-Adblock

Is this "resource-blocking-adblock" bringing us closer to Noscript on Chrome?

Yes, but unfortunately it's not enough for integrating with the internal script blocker :(
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.7) Gecko/20100713 Firefox/3.6.7
User avatar
Giorgio Maone
Site Admin
 
Posts: 7328
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy

Re: Noscript for Google Chrome?

Postby yupa » Wed Jul 28, 2010 1:10 pm

It seems issue 35897 of the Chromium project is the one which needs to be solved to make Noscript for Chrome possible.

Star it if you want Noscript for Chrome!
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
yupa
 
Posts: 4
Joined: Mon Jun 07, 2010 9:08 am

Re: Noscript for Google Chrome?

Postby Giorgio Maone » Wed Jul 28, 2010 1:56 pm

yupa wrote:It seems issue 35897 of the Chromium project is the one which needs to be solved to make Noscript for Chrome possible.

No it's not. At this moment "beforeload" pretty much covers the needs related to that bug from NoScript's standpoint.
The real show stopper at this moment is the (missing) ability for extensions to interact with browser's script execution permissions.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
User avatar
Giorgio Maone
Site Admin
 
Posts: 7328
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy

Re: Noscript for Google Chrome?

Postby yupa » Thu Jul 29, 2010 8:09 am

Is there a corresponding issue we can star?
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
yupa
 
Posts: 4
Joined: Mon Jun 07, 2010 9:08 am

Re: Noscript for Google Chrome?

Postby Giorgio Maone » Thu Jul 29, 2010 8:31 am

yupa wrote:Is there a corresponding issue we can star?

I've just asked someone who should know: https://twitter.com/ma1/status/19810257922
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
User avatar
Giorgio Maone
Site Admin
 
Posts: 7328
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy

Re: Noscript for Google Chrome?

Postby tlu » Tue Aug 17, 2010 2:50 pm

I just saw that somebody has now developed a Chrome extension called NotScripts. I don't know how it compares to Noscript (and I don't use Chrome anyway) but it might be interesting for Giorgio to have a look at it. Details on http://optimalcycling.com/other-projects/notscripts/
Mozilla/5.0 (X11; U; Linux x86_64; de-DE; rv:1.9.2.9pre) Gecko/20100814 Ubuntu/10.04 (lucid) Namoroka/3.6.9pre
tlu
Senior Member
 
Posts: 129
Joined: Fri Jun 05, 2009 8:01 pm

Re: Noscript for Google Chrome?

Postby anonymous_user » Tue Aug 17, 2010 3:34 pm

IT'S HERE

NotScripts

NotScripts is inspired by the “NoScript” addon for Firefox and seeks to emulate it within the limitations of the Google Chrome extensions API. It is not affiliated with “NoScript“, I just happen to like it’s functionality and wanted it on Google Chrome.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
User avatar
anonymous_user
Senior Member
 
Posts: 66
Joined: Mon Mar 23, 2009 5:11 pm

Re: Noscript for Google Chrome?

Postby qaelith.2112 » Tue Aug 17, 2010 7:10 pm

TLU, thank you for that link. I've just spent a bit of time playing with NotScript, and it appears that it'll improve our security reasonably well for now, until the APIs are improved to the point that the real NoScript can be ported. Of course, this is a very minimal extension and obviously doesn't do even a fraction of what NoScript will do. It does beat just turning off scripting in Chrome and whitelisting as needed, which is a royal pain and doesn't allow for resources within a page to be turned on while others are left disabled. What it currently lacks that I believe could be added is a TEMPORARY whitelisting by resource. It includes a permanent whitelisting by resource, as well as a temporary whitelisting for everything. Basically if you need to temporarily allow just one thing, you either have to permanently allow and then disallow again later (good luck remembering to do that) or temporarily allow everything on the page and risk opening the floodgates for the scripts inside banner ads and everything else.

That's just the basics, though. I'm not even talking about all of the other cool stuff NoScript does, such as ABE, clickjacking protection, etc.

Chrome is shaping up to be a fabulous browser, but damn it, I continue to be disappointed in some of the BASIC things that are missing (essential extension API elements, print preview, bookmark tags, on and on...) while precious time is being spent going back and forth on what the menus should look like and where the bookmark star is to appear.

Anyway, thank you very much, Giorgio, for your persistence in trying to badger the Chrome Team into doing what should be done with respect to the extensions APIs, and for keeping the port of NoScript in mind. When that eventually happens, I won't be the only one who is indescribably grateful for it. The Chrome Team should see the development of these features as being important for the securability / security of the browser.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/6.0.490.1 Safari/534.6
qaelith.2112
 
Posts: 1
Joined: Tue Aug 17, 2010 6:54 pm

Re: Noscript for Google Chrome?

Postby optimalcycling » Tue Aug 17, 2010 10:26 pm

Hello all, my name is Eric Wong. I'm the author of the NotScripts extension for Google Chrome, http://www.optimalcycling.com. Thought I should drop by and register.

@ qaelith.2112
Lots of people have been asking me to implement the temporary allow this site feature so that is a top priority feature now. It will be pushed out when I code it up and get the drop down menu clean enough with the extra buttons required. I want to keep that part of the interface as simple as possible.

As for implementing other features that NoScript has, that may or may not be possible. I haven't looked into it.
Author of NotScripts for Google Chrome, http://optimalcycling.com/other-projects/notscripts/
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.126 Safari/533.4
optimalcycling
 
Posts: 7
Joined: Tue Aug 17, 2010 10:19 pm

Re: Noscript for Google Chrome?

Postby Giorgio Maone » Thu Aug 19, 2010 7:28 am

Hi Eric,

thanks for your effort.
I appreciate the fact you're calling it "NotScripts", rather than NoScript, and keep the distinction clear.
It's been also honest from you putting a "limitations" section in your docs.
You should also warn your users that they shouldn't rely on NotScript for their security (as they can do with NoScript), because there are many ways for a malicious attacker to work around it and it doesn't provide any of the additional security protections given by NoScript beyond 3rd party script blocking.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
User avatar
Giorgio Maone
Site Admin
 
Posts: 7328
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy

Re: Noscript for Google Chrome?

Postby GµårÐïåñ » Thu Aug 19, 2010 10:42 am

I personally believe that the name is too similar as-is and could be mistaken as a legit NoScript solution. I wish they had picked a more original name of their own uniqueness and not play on the linguistic similarities to NoScript. Its like someone creating "Gooogle.com" and saying they had no intention to play off of the popularity of Google in picking the name. Or "Wallmart.com" to try and play on "Walmart.com" you get the idea. I would be more comfortable with a wider separation of identity on this item.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
[ Major's Blog ] .:. [ Security Pack ] .:. [ Productivity ]
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
User avatar
GµårÐïåñ
Lieutenant Colonel
 
Posts: 2923
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA

Re: Noscript for Google Chrome?

Postby optimalcycling » Thu Aug 19, 2010 8:13 pm

Giorgio Maone wrote:Hi Eric,

thanks for your effort.
I appreciate the fact you're calling it "NotScripts", rather than NoScript, and keep the distinction clear.
It's been also honest from you putting a "limitations" section in your docs.
You should also warn your users that they shouldn't rely on NotScript for their security (as they can do with NoScript), because there are many ways for a malicious attacker to work around it and it doesn't provide any of the additional security protections given by NoScript beyond 3rd party script blocking.


Thanks.

Yes, I should add in the limitations that there is no support for clickjacking protection or other advanced methods yet.

Edit: I've added this to the limitations page on the web (http://optimalcycling.com/other-project ... mitations/) and will go into the extension's limitations page next release:

Please note that NotScripts is not a guarantee of security and users should always practice secure web surfing habits. Currently NotScripts does not provide advanced protection for things such as clickjacking and other methods found in the "NoScript<link>" addon for Firefox and a malicious website may still be able to successfully use such techniques.
Last edited by optimalcycling on Thu Aug 19, 2010 8:30 pm, edited 2 times in total.
Author of NotScripts for Google Chrome, http://optimalcycling.com/other-projects/notscripts/
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.126 Safari/533.4
optimalcycling
 
Posts: 7
Joined: Tue Aug 17, 2010 10:19 pm

Re: Noscript for Google Chrome?

Postby optimalcycling » Thu Aug 19, 2010 8:18 pm

GµårÐïåñ wrote:I personally believe that the name is too similar as-is and could be mistaken as a legit NoScript solution. I wish they had picked a more original name of their own uniqueness and not play on the linguistic similarities to NoScript. Its like someone creating "Gooogle.com" and saying they had no intention to play off of the popularity of Google in picking the name. Or "Wallmart.com" to try and play on "Walmart.com" you get the idea. I would be more comfortable with a wider separation of identity on this item.


I've put the disclaimer that NotScripts is not affiliated with NoScripts for Firefox on both my website and on the Google Chrome extension page. I've also put links back to http://noscript.net on my website, the NotScripts about page in the extension, and on the Google Chrome extension page: https://chrome.google.com/extensions/de ... dajjpkkcfn
Author of NotScripts for Google Chrome, http://optimalcycling.com/other-projects/notscripts/
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.126 Safari/533.4
optimalcycling
 
Posts: 7
Joined: Tue Aug 17, 2010 10:19 pm

PreviousNext

Return to NoScript Development

Who is online

Users browsing this forum: No registered users and 5 guests