Noscript for Google Chrome?

Bug reports and enhancement requests
Locked
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3339
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ » Thu Sep 22, 2011 11:10 pm

Oh yeah Fx is HORRIBLE when it comes to memory, it hogs it like there is no tomorrow, bloats and nearly becomes unusable after a while and when you kill it, its forever before it disappears and often times it still needs to be hard killed with process tree kill to get it completely off the plate. Its a hassle.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/6.9 (Windows NT 6.9; rv:6.9) Gecko/69696969 Firefox/6.9

DerekMessina
Posts: 1
Joined: Thu Nov 24, 2011 12:36 am

Re: Noscript for Google Chrome?

Post by DerekMessina » Wed Dec 07, 2011 5:33 am

Yeah! I agree, although chrome is a new kind of browser and its somewhat convenient to use, there is one thing I notice about chrome it lacks add-ons. I hope google will improve it like what firefox has.
Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2

Tom T.
Field Marshal
Posts: 3620
Joined: Fri Mar 20, 2009 6:58 am

Re: Noscript for Google Chrome?

Post by Tom T. » Wed Dec 07, 2011 12:26 pm

GµårÐïåñ wrote:Oh yeah Fx is HORRIBLE when it comes to memory, it hogs it like there is no tomorrow, bloats and nearly becomes unusable after a while and when you kill it, its forever before it disappears and often times it still needs to be hard killed with process tree kill to get it completely off the plate. Its a hassle.

Which is exactly why I stayed on the 2.x branch as long as possible, and will stay on the 3.6 branch as long as possible for my own use, even though I need a working copy of the latest stable release to do support here. (Fx using 74 MB RAM ATM; rarely goes much above the low 100s.)

Alan Baxter may call me a Luddite, and he's right :D , but you've just given additional evidence to support my Luddite-ism. ;)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.24) Gecko/20111103 Firefox/3.6.24

Tom T.
Field Marshal
Posts: 3620
Joined: Fri Mar 20, 2009 6:58 am

Re: Noscript for Google Chrome?

Post by Tom T. » Wed Dec 07, 2011 1:15 pm

nanotec89 wrote:For those curious as to why people are waiting for NoScript to be ported to Chrome before they bail on Firefox, I think I can sum it up here:
(snip)
2. Smooth, clean interface (i.e. tab moving and tearing)

That's strictly personal taste. I liked Fx 2's GUI much better than 3, and 3 infinitely better than 4+, after a few CSS hacks to clean up 3.
3. Extensions don't break. If an an extension works in Chrome 5, it will work in Chrome 15.

Probably because there are far fewer of them; tightly-restricted API (may be a safety advantage, admittedly). Fx has literally thousands of add-ons, and anyone can write one to suit a particular niche. There are downsides to that, of course, but you should consider both sides of the coin.
I felt inclined to post because I feel the majority of online comparisons between Chrome and Firefox fail to acknowledge point 3, considering how Firefox's rapid release schedule has been criticized for breaking addon's with each version.

IMHO, Firefox did the rapid-release thing to copy Chrome, a huge mistake, again IMHO. *But* -- they still maintain the 3.6 branch, which they've been threatening to discontinue since April 2011, and yet... Indicating that they're responsive to some users' preference for relative stability vs. bells and whistles. If they're smart, they'll continue to keep the workhorse running while they play with the shiny toys.
dhouwn wrote:I hope you find that the rapid release process in Google Chrome just as disappointing. ;-)

(On other forums, I have read about people proclaiming that they are unhappy about the rapid-release process for Firefox or the fact that there is no more separate feature and bugfix branch, and that they therefore plan on switching to Chrome or Opera, which is kind of amusing.)

Yep. :mrgreen:
I have heard the question asked "What is more secure, Firefox with NoScript or Default Chrome?" If both had full NoScript functionality, would you consider one more secure than the other?

I've seen some very informed opinions that Chrome plus full NoScript would be "safer", but I personally will never trust a browser, OSS or not, made by a company that gets 99% of its revenue from selling targeted advertising, or even worse, collecting dossiers on every user and selling the data to any buyer, and is the target of constant lawsuits for violation of data-privacy laws and ethics. IMHO. YMMV.
nickr wrote:-Chrome integrates searching from the URL-bar by default. And typing Ctrl + K allows users to search a web address itself.

Undoubtedly locking the user into Google searches, which no matter what the *browser* Privacy Policy says, when you search, you're subject to the Google Search policy, which is known to store logs of all your search queries, by IP and other data, collate them, and keep them for two years or more. No one really knows. You are comfortable with that? ... You do a school assignment to research AIDS. A few months later, no one will hire you, rent you an apartment...
-Chrome tabs blur the end of the Tab's Title instead of using an ellipsis (...). A nice feature.

Blurring sounds worse, though I haven't tried it. And what's so hard about hovering the mouse pointer over a tab to see the full address?
3. Chrome has built-in Flash and PDF reader. everything the user needs for the web is present.

There was an entire thread about adding a PDF extension to Firefox. In the name of all that is -- WHY??? I have a 4 MB desktop program, Foxit Reader, that I need anyway to open pdfs on the desktop. With absolutely no effort on my part, Firefox detected that, and offers it as the (only, since I don't have Adobe :roll: ) choice to open or to save to disk.

Idk about Chrome's Flash setup. Can one block it by default, as with NoScript?
4. Chrome auto-updates itself and all its components, e.g., Flash, PDF, plugins, extensions. This improves security and lessens the burden on the user.

Firefox updates itself with all components, plug-ins, and extensions, if configured to do so. I prefer only to be notified. I don't want to be in the middle of online banking, and have something suddenly d/l-ing and prompting me, etc.

As for the pdf reader, the older version of Foxit is safer, because it has *no* native support for *any* executable content. Kinda' hard to exploit that. Not saying impossible, but waaay harder than new readers, of whatever brand, that support not only JS, but embedded Flash, Java, Silverlight, Trojans....
5. Chrome gives Linux more attention than Firefox. For example, Firefox gave Microsoft Windows users super-neat STRATA themed toolbar buttons, but Linux distros are stuck with crappy GTK buttons. Chrome gives Linux users a choice of GTK or the Microsoft Windows Themed buttons in the default install. How come Firefox didn't do the same for its Linux users?

OMG, the buttons are fancier! I gotta change browsers immediately! :roll:

Anyone can create a theme for Firefox. You want different buttons, write them yourself, and offer them to the pubic, if you like.
(IDK what a STRATA or GTK button is. So long as I know where to click, who gives a flying flea what the "style" is? ... I'll bet you have a $500 doorbell. :P )
And, uh, don't all these fancier themes and images consume more resources, while others are complaining about increased resource use? Do the math ...
6. Firefox users have been complaining for a long while that things can install plugins without user permission. Plus some plugins get installed without user permission and then they can't be easily uninstalled.

MS did that, in a MS Update. They were severely chastised, won't do it again, and MZ has tightened that process.
We're back to Chrome's limited API and limited add-ons. (including stalling for more than *two years* on supporting NoScript, still with no definite date in sight.) You can't have your cake and eat it, too.
... people asking for mozilla to implement functions similar to what Chrome ended up implementing in its FIND function. Chrome has them implemented. Firefox still hasn't, yet this is a major tool that users use on a daily basis while surfing the web (at least I do).

You and five other people don't represent all users, any more than I do. "De gustibus non disputandum est". (good one to look up if Udk it.)
See above about locking into Google. I don't *want* my address bar sniffed, or my browser fetching things for me from some pre-determined source. I've chosen my source: https://ssl.scroogle.org. If I can't break Chrome's lock on searches, that's a deal-breaker right there, AFAIC.
I look forward to returning to Firefox. At least I hope too. But they need to address many issues where they've fallen behind. I think the rapid-release cycle is a smart move on Mozilla's part. I think Chrome woke Mozilla up. Thankfully :)

I think it's a dumb one, and responsible for much of what you complained about, but then, difference of opinion is what makes horse races. :D
Cheers.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.24) Gecko/20111103 Firefox/3.6.24

tlu
Senior Member
Posts: 129
Joined: Fri Jun 05, 2009 8:01 pm

Re: Noscript for Google Chrome?

Post by tlu » Wed Dec 07, 2011 5:01 pm

Tom T. wrote:Idk about Chrome's Flash setup. Can one block it by default, as with NoScript?


Yes, you can - see http://www.howtogeek.com/58058/how-to-enable-flashblock-in-chrome-and-make-it-5000-more-secure/. It's actually more flexible than the current NS version as you block flash by default but can still allow it for specific sites. However, NS 3.0 will change that for the better :) Can't hardly wait for it ... ;)
Mozilla/5.0 (Windows NT 6.1; rv:6.0) Gecko/20100101 Firefox/6.0

dhouwn
Bug Buster
Posts: 968
Joined: Thu Mar 19, 2009 12:51 pm

Re: Noscript for Google Chrome?

Post by dhouwn » Wed Dec 07, 2011 5:41 pm

Tom T. wrote:If they're smart, they'll continue to keep the workhorse running while they play with the shiny toys.
They will probably keep 3.6 running until https://wiki.mozilla.org/Enterprise/Firefox/ExtendedSupport:Proposal becomes reality.

Tom T. wrote:There was an entire thread about adding a PDF extension to Firefox. In the name of all that is -- WHY???
Well, it's certainly a better user experience than displaying PDFs with the browser plugin but then why is there the browser plugin?

Idk about Chrome's Flash setup. Can one block it by default, as with NoScript?
There is a relatively hidden setting for click-to-flash, also a crude black/whitelisting feature for plugins.

Firefox updates itself with all components, plug-ins, and extensions, if configured to do so.
Not plugins, there is just the button linking to the plugin check page and in the past there were checks on the welcome page when popular plugins were exploited ITW.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0) Gecko/20100101 Firefox/9.0

User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3339
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ » Wed Dec 07, 2011 7:55 pm

DerekMessina wrote:Yeah! I agree, although chrome is a new kind of browser and its somewhat convenient to use, there is one thing I notice about chrome it lacks add-ons. I hope google will improve it like what firefox has.

I don't know where you got the idea that Chrome doesn't have addons but it has millions. Just go to your extensions section in Options, click on get more and voila. Or just go here https://chrome.google.com/webstore
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0

User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3339
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ » Wed Dec 07, 2011 7:58 pm

Tom T. wrote:Which is exactly why I stayed on the 2.x branch as long as possible, and will stay on the 3.6 branch as long as possible for my own use, even though I need a working copy of the latest stable release to do support here. (Fx using 74 MB RAM ATM; rarely goes much above the low 100s.)

Alan Baxter may call me a Luddite, and he's right :D , but you've just given additional evidence to support my Luddite-ism. ;)


Regardless of what anyone calls you, which in my opinion is unnecessary as various levels of expertise are a natural part of life, I support your decision and find that if I didn't need to keep up with the latest technology as a consequence of my need to work with it and support clients, I wouldn't bother with much of it. And that is coming from someone who by NO STANDARD would be considered a luddite.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0

User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3339
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ » Wed Dec 07, 2011 8:07 pm

tlu wrote:
Tom T. wrote:Idk about Chrome's Flash setup. Can one block it by default, as with NoScript?


Yes, you can - see http://www.howtogeek.com/58058/how-to-enable-flashblock-in-chrome-and-make-it-5000-more-secure/. It's actually more flexible than the current NS version as you block flash by default but can still allow it for specific sites. However, NS 3.0 will change that for the better :) Can't hardly wait for it ... ;)


You don't to do anything special to get the feature you describe in Chrome/Chromium/Dragon/etc because it has an option to automatically run plugins or block them by default and run per request. That's in no way similar or even close to NS functionality but to each their own, delusions are per taste.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0

User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3339
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ » Wed Dec 07, 2011 8:14 pm

dhouwn wrote:
Idk about Chrome's Flash setup. Can one block it by default, as with NoScript?
There is a relatively hidden setting for click-to-flash, also a crude black/whitelisting feature for plugins.


Crude is putting it mildly, its either all or nothing or you have to manually maintain the list, so not very granular control but its there and its not that hidden.

Firefox updates itself with all components, plug-ins, and extensions, if configured to do so.
Not plugins, there is just the button linking to the plugin check page and in the past there were checks on the welcome page when popular plugins were exploited ITW.


Actually firefox does not automatically update plugins, and neither does Chrome actually given that they have built-in flash, you think they would at least update the damn thing. Instead they just removed the plugin page so you don't see that all your crap is out of date. But you can get to it by typing "chrome://plugins" or if you are using dragon "dragon://plugins" or any other knock off, just substitute its core name in the path. You'll see when you inspect the disaster it "CAN" be at times.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0

dhouwn
Bug Buster
Posts: 968
Joined: Thu Mar 19, 2009 12:51 pm

Re: Noscript for Google Chrome?

Post by dhouwn » Wed Dec 07, 2011 8:21 pm

GµårÐïåñ wrote:by typing "chrome://plugins" or if you are using dragon "dragon://plugins"
Or simply about:plugins just like in Firefox since its dawn. ;-)
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0) Gecko/20100101 Firefox/9.0

User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3339
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ » Wed Dec 07, 2011 9:08 pm

Yes you can but it will still refresh to the path I gave you. I was just trying to avoid the unnecessary refresh, but yes that will work too.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0

Tom T.
Field Marshal
Posts: 3620
Joined: Fri Mar 20, 2009 6:58 am

Re: Noscript for Google Chrome?

Post by Tom T. » Thu Dec 08, 2011 9:42 am

dhouwn wrote:
Tom T. wrote:If they're smart, they'll continue to keep the workhorse running while they play with the shiny toys.
They will probably keep 3.6 running until https://wiki.mozilla.org/Enterprise/Firefox/ExtendedSupport:Proposal becomes reality.

*ONE* year support for major browser branch releases? F2 was supported for (off the top of my head) about 2.5 years. MS guarantees at *least* five years of security updates for any new OS, and XP is now approaching its 11th year of support, not scheduled to end until 2014. And surprise: market share numbers show that its share is in the same range as 7's, and surpasses Vista's. 7 cannibalized Vista users and comes OEM pre-loaded, which means that a lot of XP users aren't paying for the new and unproven when there's something that's been vetted for ten years. Count the number of NT 5.1 user agents on these boards. ;)
dhouwn wrote:
Tom T. wrote:There was an entire thread about adding a PDF extension to Firefox. In the name of all that is -- WHY???
Well, it's certainly a better user experience than displaying PDFs with the browser plugin but then why is there the browser plugin?

What is this browser plugin? When I open about:plugins, I see only the default MZ, plus Shockwave Flash. ... If you're saying that the default plugin is what silently and invisibly detected and used my Foxit reader (never looked into it, because it's never been an issue, and would rather spend time researching genuine problems or enhancements), then what is bad about the experience? it will display web pdf's in the browser, save them to disk, print them, zoom them... Don't know what you're using (Adobe Reader?), but what is bad about your experience with Fx using your installed desktop pdf reader?
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.24) Gecko/20111103 Firefox/3.6.24

dhouwn
Bug Buster
Posts: 968
Joined: Thu Mar 19, 2009 12:51 pm

Re: Noscript for Google Chrome?

Post by dhouwn » Thu Dec 08, 2011 10:18 am

Tom T. wrote:Don't know what you're using (Adobe Reader?), but what is bad about your experience with Fx using your installed desktop pdf reader
This wasn't about me, I was thinking about the user experience of the the browser plugin for displaying PDFs inline in the browser that comes per default with Adobe Reader, which I guess is the PDF reader that the majority of people are using. I have seen people struggling with issues like the different search functionality (because the search then is handled by the plugin and not Firefox).
I myself have all but the most necessary plugins disabled and I prefer to use the standalone applications, but that doesn't mean I would be definitely against native PDF (or even DOC, PS, etc.) support in Firefox.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0) Gecko/20100101 Firefox/9.0

Tom T.
Field Marshal
Posts: 3620
Joined: Fri Mar 20, 2009 6:58 am

Re: Noscript for Google Chrome?

Post by Tom T. » Fri Dec 09, 2011 11:32 am

dhouwn wrote:
Tom T. wrote:Don't know what you're using (Adobe Reader?), but what is bad about your experience with Fx using your installed desktop pdf reader
This wasn't about me, I was thinking about the user experience of the the browser plugin for displaying PDFs inline in the browser that comes per default with Adobe Reader, which I guess is the PDF reader that the majority of people are using. I have seen people struggling with issues like the different search functionality (because the search then is handled by the plugin and not Firefox).

OK, thanks for clarifying. Would you mind naming or pointing to some of those pdf plugins? Not to repeat myself, but if I find a pdf on the web and click the link, Firefox automatically pops up the dialog box; "Open with (dropdown window)", "Save to disk", "Cancel". There is only one choice in the dropdown window, because I have only one pdf reader installed on the machine. But if I do choose "Open", it opens it fine, in the Foxit reader's standard window, with all the same options: Print, Find, Zoom, etc. -- just as if I had downloaded it and then opened it from the desktop. This is why I haven't been able to fathom the complaints about pdfs, or having to add plugins or add-ons to Fx.
dhouwn wrote:I myself have all but the most necessary plugins disabled and I prefer to use the standalone applications, but that doesn't mean I would be definitely against native PDF (or even DOC, PS, etc.) support in Firefox.

The problem I had in the thread about the native PDF was that they wanted to make it the default, or only, reader for pdfs stored on the hard drive, not just those on the Web. This introduces new attack surface, because as NickP pointed out, vulns don't occur only in an OS, an app, or a plug-in. Even if all three are "safe", they can occur in the *interaction between them*.

Right now, I have a browser-OS interaction. If I open a desktop pdf with the installed reader, I have a Program Files exe interacting with the OS. If I open a web PDF, I have the same Program Files exe interacting with the OS, via a download by Fx to a temp file on the HD. The browser does not directly interact with the pdf any more than it would with any other file or installer that you d/l. It's on the HD, but only in a Temp folder. (Actully, it's in a sandboxed temp folder in my case, but n/m...) Their scenario requires three simultaneous paths of interaction instead of one at a time: browser><OS; browser><plug-in; plug-in >< OS. (when using a browser plug-in for what in essence is a desktop app).

You had some brief input in that discussion.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.24) Gecko/20111103 Firefox/3.6.24

Locked