Latest NoScript version (1.9.2) breaks Adblock Plus

[Guest]

NoScript author(s), I've been an avid supporter for years, but not anymore after this disgusting act of modifying my Adblock filters without my knowledge and patching other people's extensions for your own financial benefit. You've lost my trust forever. I'm uninstalling the extension. It is certain at this point that a clean, trustworthy fork is imminent.

[FutureAxeMurderer]

I wonder just how many of these posters for your support are sock-puppets Giorgio?

The base line is this.
Once you do something intentionally to deceive, subvert, and/or negatively change something to for your own benefit you deserve the blowback you get.

That said, I try and stick by my principle's. I try and give everyone/thing a 3 strike policy.
You are on 2.
One more and you get blacklisted and nothing you ever have contact with gets touched by me.

On a more personal side, I wouldn't lose any sleep over Mozilla blasting your ass completely off the FireFox site completely and blacklisting you for life for placing invasive malware.
You reap what you sow.
Enjoy your blowback.
The only recourse you have now is to admit guilt and render a public apology.
That at least may garner you some slim recourse from what you've intentionally done.

[Sven]

Trust is hard to earn and is easily lost. You created a piece of malware once, who can be sure that you will not do it again if your revenues are not enough for you?

In my opinion this trust can only be brought back by hosting the source code at mozdev (e.g.) so that everyone who is interested can follow the changes made to the source code and can discover "code injections" that could harm over extensions.
With adding the filter set to ADP I had no problem as I read the change log and could react. Adding source code to prevent ADP from working as desired however is the worst thing to be done for an extension that calls itself a security project.

[Tom T.]

NoScript author(s), I've been an avid supporter for years, but not anymore after this disgusting act of modifying my Adblock filters without my knowledge and patching other people's extensions for your own financial benefit. You've lost my trust forever. I'm uninstalling the extension. It is certain at this point that a clean, trustworthy fork is imminent.

That's the beauty of open-source code. Anyone can make their own version.
It will be interesting to see if and when they appear, and how many -- and if they're maintained and enhanced as regularly as the original.
It will also be interesting to see whether anyone who doesn't have the (literally) thousands of hours invested in this project that Giorgio does can gain a comparable following, despite this particular controversy.
I look forward to seeing if such forks appear. Thanks for your input.

[Calm down]

According to his f.a.q and other sources. All he did was add extra lines to the abp filterset.

No, that was version 1.9.2.3. Apparantly version 1.9.2.2 did patch adblock plus with obfuscated code.

The way I understand it:

• Easylist updated their list to block ads on noscript.net
• Noscript updated to counteract this and Easylist retaliated with more complicated blocking expressions that eventually broke some functionality of noscript.net
• Noscript updated to 1.9.2 that interfered directly with ABP code, using obfuscated code to patch it so that it wouldn't block noscript.net's ads. This broke all adblocking by mistake
• ABP producds a beta that would prevent this happening
• Noscript updated to 1.9.2.3 that abandons attempts to patch adblock's code directly, but silently introduced a whitelist to the filterset allowing noscript.net's to show ads. Giorgio 'forgot' to include the code to ask consent
• Excrement hits the fan, Wlad complains to addons.mozilla.org, Giorgio's antics get covered on slashdot and reddit etc
• Noscript updated to to 1.9.2.5 which now asks permission to install the whitelist, (although still defaults to yes)
  A couple hours later Noscript updated to 1.9.2.6 which now gets rid of the whitelist together.

Unfortunately the damage is already done, the slashdot and reddit crowd have swarmed on AMO and voted down NoScript's rating en masse. It used to have an unblemished 5 star rating, now it's dropping fast.

[Calm Down]

BTW this was the offending code - it uses code and url obfuscation (why?):

http://pastebin.com/f256a5456

[Tom T.]

I wonder just how many of these posters for your support are sock-puppets Giorgio?

Choosing a name like that is not the best way to achieve credibility for your post.

Surely you don't think Giorgio, along with everything else he was doing, had time to create sock puppets and make posts supporting himself? And why? Those who choose another course are free to do so, and those who choose to stay with NS are free to do so. It isn't a vote, with the majority winning.

No team member would ever do such a thing either, for the same reasons: serves no purpose, and we're too busy answering posts under our real names. I'll sign my established account name to everything I post here, and so will the rest of our small team. Thank you.

[Guest]

Thanks. Your attempts at dickery have cost you another (longtime) no-script user. Everywhere I get the chance I will downmod the rating of no-script and everywhere it is discussed I will spread fud about your software. Everywhere I have access, I will remove the software from the computers and everywhere people think about installing it I will warn them that it is dangerous software.

You have done yourself a big disservice and your gain will most certainly not outweigh your losses. Very dumb move.

[Nextnx]

/Uninstall
Learn !!

[Unamused]

Uhm.. guys. It's an extension. Seriously. An extension. While he shouldn't have patched the code of ABP (.. although I'm not sure of that, I'm accepting it for the sake of sanity), it's not malware, it barely qualifies as spyware and even then I'd say that's pushing it.

Secondly, for the love of all that is good in this world, grow up and stop throwing a hissy fit over an extension.

[Unamused]

... I should append something. It is, however, very dirty pool to mess with other people's code. And I'm not agreeing with this action at all. But eh, I admit I can see the reasoning behind it.

[FutureAxeMurderer]

it's not malware, it barely qualifies as spyware and even then I'd say that's pushing it.

from http://dictionary.reference.com/browse/malware.
mal·ware (māl'wâr')
n. Malicious computer software that interferes with normal computer functions or sends personal data about the user to unauthorized parties over the Internet.

No team member would ever do such a thing either

Really?
Credibility seems to be far from reach at the moment.
What's next? No-Script, BotNet version 2.0 ????
That's an actual question too. I just want to know if I'll have to turn off automatic updates beforehand.

[Tduck]

Wake me when this is forked and in the hands of a dev that cares about the community.

This plugin is dead to me.

[guest]

These guys just never grow up. And by insulting them just like that, I've lost the chance to reason with them.
I'm amazed Giorgio never lost his temper while dealing with these guys...
There's really no point arguing with them. I've summarized my conversations with them:

-OMG it's totally ruined my computer. All data has been compromised. Gee, and I used to be your biggest fan too. Until it totally broke every web site. NoScript was on the list but now this totally sealed it.
+You know how to use it right? I mean, every web site broke?
-How dare you insult my intelligence? I can operate Firefox by myself, and I even use Gentoo. 99% of my system is compiled from source!
+A few ads were allowed, which I'm not sure you've even seen before, makes NoScript a virus now?
-Not really virus, malware. See, malware, I've got a dictionary. It's changed things without my consent!!!
+So what was changed, and why?
-A new whitelist was added without my consent. NoScript tried to mess with my ABP, for money of course, it is evil!
+So was your computer compromised?
-No. But I bet others were!
+You realize that you could just forget it and move on right? Everyone has their own lesson to learn here, which you certainly don't have to remind them of.
-What THE heck? No, I'm definitely not gonna let this one go like that. NO. We've got to sue him or something. I mean, I was emotionally hurt. This one has left a permanent scar in my heart. There has to be some kind of compensation. This is supposed to be a security extension, and it's done the WORST THING a security extension could do. IT'S TOO BAD IT'S BEYOND REDEMPTION. I'm gonna uninstall it because I know what I do with my add-on is actually RELEVANT, bet you were scared. And not just that, I SWEAR TO GOD I'LL NEVER USE IT AGAIN. HECK I'LL EVEN DELETE THIS PROFILE. THE GUY SHOULD GO DIE IN A FIRE!!! SOMEONE FORK IT RIGHT NOW, WE'RE GONNA...
[insert your favorite rant]

It's been the lulziest day in the community.

[guest2]

Double post, but still. I liked how my Firefox version was displayed as 2.0.0.0