Firefox 57 and NoScript

[barbaz]

like I said before, I'm using uMatrix with FF57 though it took me a while on getting used to it (along with an already webext version of adblock plus 3.0x made for FF57).

µMatrix + ABP isn't a full replacement for NoScript nor even just the features I listed.

[Dev-A]

I feel like a fish out of water without NS. If there are "major" delays, then please advise. If its longer than a week, then I will gladly stick with firefox56 till then.

Another donation will be well earned for this major update, I encourage others to do the same

Godspeed Giorgio, we're counting on you

I don't really understand why you people complain so much about NoScript not yet released, I mean don't get offended I'm not talking about you in particular but in general. Unlike previous versions, Firefox 57 comes with most kind of scripts blocked by default (Java, Silverlight, ...) and Flash can only be enabled on request, so surfing on the web with FF57 has nothing to do with previous versions, having on mind that most of those scripts wich used to cause PITA where Java ones...

I even wonder, once now Firefox disabled all of this by default, what will the WebExt protect us from, I mean by this I'm expecting to see detailed description of specs from Giorgio Maone and staff about this new version once it is released to better uderstand why it is still useful.

There will always be bugs and exploits. With new systems have a high chance to be exploited, not saying they will be. For security/safety I prefer to air on the side of caution. I prefer having peace of mind on tried and true systems then to jump the boat too soon and hope for the best.

I'm sure many will find this link helpful https://support.mozilla.org/en-US/kb/in ... of-firefox
Don't forget to change your automatic update settings in firefox.

[barbaz]

will our whitelisted sites automatically transfer over to the new release?

I think so -

NoScript 5.x living as a hybrid one to allow for smooth user data migration.

NoScript 10 is very different from 5.x: some things are simpler, some things are improved, some are still missing and need to wait for WebExtensions APIs not available yet in Firefox 57. Anyway, whenever you decide to migrate, your old settings are kept safe, ready to be used as soon as the feature they apply to gets deployed.

[Guest]

GOGI, NoScript is a lot more than just a plugin blocker. It also blocks Javascript, filters cross-site scripting attacks, prevents websites from tampering with your local network, blocks clickjacking, blocks online resource abuse, enforces HTTPS, manages secure cookies, ...and the list goes on.

The loss of NoScript is the loss of a significant amount of security, and no matter how temporary the loss is, "complaining" about it is well justified.

You're right, and that's what I said about Javascript blocked by default now in FF, as tracking protection being enforced, pop-ups can be disabled (and works well for the moment), improved protection against phising (not sure if clickjacking is included in, didn't read full specs), and so on...
But you're right, the list above exhaustive for sure (your list about NoScript), and there are plenty of protections still brought by this extension, but actually my previous post was to mention and compare what is done now natively by FF, and what is still implemented by NoScript, to be more precise.

But we'll see that later, when NoScript is released, and then maybe open a new dedicated topic...

Just be careful who you're complaining at.

you're right

[GOGI]

like I said before, I'm using uMatrix with FF57 though it took me a while on getting used to it (along with an already webext version of adblock plus 3.0x made for FF57).

µMatrix + ABP isn't a full replacement for NoScript nor even just the features I listed.

Not to say that, even it eventually fullfills its purpose well, uMatrix is such a PITA to configure, compared to NoScript.

Question appart, which may be off-topic, but as you're mentioning ABP, is it useful to have ABP or uBlock_Origin in complement with NoScript as Ghostery or not?

[barbaz]

Question appart, which may be off-topic, but as you're mentioning ABP, is it useful to have ABP or uBlock_Origin in complement with NoScript as Ghostery or not?

off-topic: Absolutely yes. Of these addons, I would recommend using just NoScript + uBlock Origin. NoScript is a security suite designed to provide security. uBlock Origin is a generic content blocker: you can configure it to handle the stuff NoScript isn't really geared for, such as privacy, ad blocking, annoyance removal, etc.

If you wish to continue this discussion, please start a new thread in Web Tech.

[GOGI]

off-topic: Absolutely yes. Of these addons, I would recommend using just NoScript + uBlock Origin. NoScript is a security suite designed to provide security. uBlock Origin is a generic content blocker: you can configure it to handle the stuff NoScript isn't really geared for, such as privacy, ad blocking, annoyance removal, etc.

I was already using this combination until now, until I switched to FF 57 a month ago (I'm on Fedora 27), and of course NoScript stopped working. And yes, uBlock is very good at ad blocking and I really advise it instead of ABP, it's lighter and doesn't require some specific configuration.

If you wish to continue this discussion, please start a new thread in Web Tech.

No, not for the moment, I have to dig deeper in Ghostery at first to understand by myself how it is working exactly, and then we'll see...
Anyway thank you for the answer and advice.

[barbaz]

You're welcome.

[Un Owen]

Its just when you stop recieving service you have used, when you understand how important it is to you! uMatrix is not the same.
Maybe i should donate for InformAction/Giorgio Maone for all their efforts to create such a great service.

.. and maybe you should too.

[ng4ever]

This reminds me of Ad Muncher all over again.

[Guest]

this is very bad, newest firefox update i can no longer even install noscript.. i dont like this..

[Cvnk]

I feel like a fish out of water without NS. If there are "major" delays, then please advise. If its longer than a week, then I will gladly stick with firefox56 till then.

Another donation will be well earned for this major update, I encourage others to do the same

Godspeed Giorgio, we're counting on you

I don't really understand why you people complain so much about NoScript not yet released, I mean don't get offended I'm not talking about you in particular but in general. Unlike previous versions, Firefox 57 comes with most kind of scripts blocked by default (Java, Silverlight, ...) and Flash can only be enabled on request, so surfing on the web with FF57 has nothing to do with previous versions, having on mind that most of those scripts wich used to cause PITA where Java ones...

I even wonder, once now Firefox disabled all of this by default, what will the WebExt protect us from, I mean by this I'm expecting to see detailed description of specs from Giorgio Maone and staff about this new version once it is released to better uderstand why it is still useful.

You don't seem to recognize there's a difference between Java and Javascript. They are not the same thing at all.

Java apps are essentially compiled executables that rely on the Java Runtime Engine. The web browser is just used as a convenient delivery mechanism but in general they only use the browser as a display surface. The same applies to Silverlight (which is just the .NET analog of a Java app). Since bother require runtime engines that are independent of the browser and aren't even likely to be installed these days they are not that common a method for distributing malware.

Javascript on the other hand is entirely handled by each browser's own parsing engine. This is what the vast majority of web-based exploits and malware use to do their thing.

And while FF 57 may block Java and Silverlight by default (honestly I assumed web browsers were already doing this long ago) it certainly does NOT block all javascript by default. That would completely break the web far every FF user. Anyone who uses NoScript should be intimately familiar with the consequences of disabling any site's javascript and there's no way Firefox would force that situation on the general public.

[wtf]

Firefox 57 comes with most kind of scripts blocked by default (Java, Silverlight, ...) and Flash can only be enabled on request.

I don't really understand why people without the slightest idea what tey are takling about writing posts at all
Java is not a script nor are Flash or Silverlight

[barbaz]

I don't really understand why people without the slightest idea what tey are takling about writing posts at all

Tone it down.

[Forka]

Could somebody (or maybe Giorgio will make it) do a configuration file or screenshots from the NoScript 10.0 for ultra-paranoic users?

I used to use the NoScript Tails (Linux OS) configuration, and also I would like to know if it's the safest configuration and why.

Thankyou Giorgio for the work you did and still doing!!