NotScript, a Chrome Extension

[Scott(0)]

There's a new NoScript like extension out for Chrome called NotScript. Before installing it I'm interested to know your thoughts on it.

Thanks for a great product.

NotScript Extension > https://chrome.google.com/extensions/de ... kcfn?hl=en


Scott

[Giorgio Maone]

I'm interested to know your thoughts on it.

Its author is honest when he writes:

NotScripts is inspired by the “NoScript” addon for Firefox (http://noscript.net) and seeks to emulate it within the limitations of the Google Chrome extensions API. It is not affiliated with “NoScript“, I just happen to like it’s functionality.

Due to persisting Chrome/Chromium/Webkit limitations, any clone of NoScript cannot be as complete and reliable as the original.
If/when these limitations were removed, I'd be happy to work on a porting of the one and only NoScript.
In other words, the gist of what I wrote here still stands.

[GµårÐïåñ]

Its a minimally effective tool that doesn't really provide the security and features of NoScript and should not be relied upon as a NoScript replacement AT ALL. Giorgio may be nice and not say it, but don't put your trust in it as you would NoScript, you will be sorely disappointed. In fact, the extension has not been updated for a long while (as of the last time I looked) and it doesn't use any useful or effective API to do what it claims, it rather uses CSS and some other HTML tools to "hide" or interfere with things, the content is still loaded. Either intentionally or simply by incompetence, Google has failed to provide a complete and effective API to accomplish what NoScript does and that's probably motivated by their desire for money and ability to track and gather information on people and probably will not happen anytime soon, so much for "do no harm".

[Scott(0)]

Thanks for the replies.

[GµårÐïåñ]

Thanks for the replies.

You are welcome, just wanted you to walk into this with your eyes open, that's all. The worst thing one can suffer is a false sense of security. Good luck.

[nzpossum]

Will this take care of the problem in Chrome

http://code.google.com/chrome/extension ... quest.html

[Giorgio Maone]

Will this take care of the problem in Chrome

http://code.google.com/chrome/extension ... quest.html

Only partially, since no API is provided to control inline scripting.

[nzpossum]

Will this take care of the problem in Chrome

http://code.google.com/chrome/extension ... quest.html

Only partially, since no API is provided to control inline scripting.

Does this brand new API provide inline script blocking

http://code.google.com/chrome/extension ... tings.html

[Giorgio Maone]

Does this brand new API provide inline script blocking

http://code.google.com/chrome/extension ... tings.html

Not just "brand new" (8 hours ago), but "experimental" (which means it's not available by default in stable Chrome versions yet).

And yes, it is more or less what we discussed with Google more than 2 years ago, but it comes with several limitations and caveats (cross-frame permissions inheritance, blind redirects and so on...)

Furthermore, even if it was safe and ready for prime time (and it is not yet), there's lot more in NoScript aside script blocking (e.g. ClearClick, andvanced XSS filters, HTTPS enhancements or ABE) which can't be done in Chrome yet.

However, maybe we're gonna have a proper "NoScript Lite" for Chrome (branded as such and developed by me) by the end of this year

[nzpossum]

Awesome, the possibility of a Noscript lite sounds great. I think Google is doing a mass rollout of privacy related APIs in the 3rd or 4th quarter so fingers crossed.