Latest NoScript version (1.9.2) breaks Adblock Plus

[Tester]

I think what the developer of Noscript did is not excusable and shows that he is not at all a trustworthy person. So logicly I just uninstalled Noscript. BTW: I m not 13 but 38. But I still think that I don't want to have anything to do with someone who tries to trick me just in order to make more $$$ CASH $$$ by betraying me behind my back.
If other people think that this behavior is normal or excusable they are free to do so. I personally hope that some laywer sues the Noscript-Author for what he did to computers of total strangers without ANY permission...

You should try harder next time. Obvious troll/sarcasm is obvious. Thank you for your hilarious post.

It was not ment to be funny or anything like that. From my point of view he acted like a criminal and that is how he should be treated...
At least he is a good roleplayer( :O[ ): http://forums.informaction.com/viewtopi ... t=15#p2656
I for instance always thought that I block every single google-/googleanalytics-/googlewhatever-script. Only to find out now that this guy made fun of me.
He is not even shy to point out that he did so for several years in order to get more $$$ revenues $$$. Agghhh. How ugly can one persons mind be?!

[Giorgio - Blanket, written commitment?]

Giorgio,

As someone who donated money to support development, i'm dismayed to learn about this issue. I appreciate your apology, but users are left to wonder what else NoScript is doing. I know I would appreciate a prominently placed (e.g., on the homepage), blanket assurance that NoScript does nothing else illicit.

I think it should assure that the software performs only clearly documented actions, and the only actions it does take are to add itself as an addon to FF in the standard way and modify webpages by blocking scripts.

NoScript is a valuable resource to the Firefox community. I hope this problem can be resolved.

g

[GµårÐïåñ]

Giorgio,

As someone who donated money to support development, i'm dismayed to learn about this issue. I appreciate your apology, but users are left to wonder what else NoScript is doing. I know I would appreciate a prominently placed (e.g., on the homepage), blanket assurance that NoScript does nothing else illicit.

I think it should assure that the software performs only clearly documented actions, and the only actions it does take are to add itself as an addon to FF in the standard way and modify webpages by blocking scripts.

NoScript is a valuable resource to the Firefox community. I hope this problem can be resolved.

g

Well said, thank you.

[A disenchanted user. (Now previous user)]

Not saying ABP is not useful, I use it myself but it can easily be replaced without lifting a single finger or writing a single filter by RequestPolicy which blocks anything and everything unless you allow it explicitly. Especially that element hiding in ABP doesn't really block anything, just hides it and if its being pushed by script and is blocked by NS then its already done and no need for ABP to do anything. I am so sick of this crap.

What is even more dismaying than Giorgio doing something so stupid as to turn his security software into a piece of malware by having it alter other software on user machines is the attitude of the others on the project.

Instead of pulling him aside, letting him know that he was going down a bad path:
1) They spend their time defending his bad actions.
2) Insulting their security-minded user base, who obviously only installed NoScript to prevent this kind of crap.
3) Bash another Firefox extension that was only doing exactly what it is for, and what it's users installed it for: blocking ads.

An EXTREMELY shortsighted and stupid move by Giorgio I might have forgiven. But seeing how those he surrounds himself with also act, I no longer want to have any part with any software they produce.

[artfuldodoga]

i'm also a little concerned that while i have google etc blocked out of data mining and privacy concerns, it very well could be let through behind the scenes via noscript... somebody needs to investivate this, i guess i was right in another thread, trust is on shakey grounds and probably for good reason...

[Ricksterto]

FAQ's are not placed to put in important information such as when your coding bypasses the functionality of the programming. In addition, what exactly is the about:config line "noscript.xblHack with value http://hackademix.net/". I don't see that anywhere in your GUI lists.

This is a relic of the element unhiding code: since hackademix.net is not in the scripting whitelist, it was added from that preference to the element unhiding whitelist (which is separated: I wouldn't even override the scripting whitelist, being a serious security breach).
Thanks for reminding me about removing it, since it's useless now.

and perhaps a bug? [...]
Background, site has scripts on, adbrite is blocked however. [...]
Adbrite script runs perfectly and is not blocked.

The question is, are these "Adbrite scripts" loaded from adbrite.com (in which case they would be blocked) or inlined in the main page (which you said has "scripts on")?
If the latter applies, as I suspect, it's normal behaviour: those are not "Adbrite scripts", they're "main site scripts" which happen to contain indentifiers named AdBriteThis and AdBriteThat (the fact they've been probably provided to publisher for copy & paste by AdBrite corp. is irrelevant, from a domain-based security point of view).

The adbrite script was being loaded from Adbrite. The site's script called the adbrite script from the adbrite site and poof, it ran. I know this is off-topic, so I can send the details of the site to you or start a thread in the appropriate forum.

[Guest]

I just learned about this today and was pretty sad that noscript fell into such a bad policy.
I'm glad you chanced it back to how it should and has to work within a few days.

But as one of the first posters said, this definitely did cost you a lot of trust if not users.

Personally, I don't use Adblocks plus, but such actions are in no means acceptable.
I display ads where I see fit, to support. But I wouldn't ever want to support a plugin/program that secretly does things I don't know of.

Anyway, I'll stick with noscript for now.

Btw, I find the topic and first post quite strange. Someone is pretty sure of himself and his plugin there...

[Alan Baxter]

Start another thread, Ricksterto. I would like to investigate your issue too.

[GµårÐïåñ]

Yes I would be very interested in this as well. Thank you for starting another thread specific to this issue.

[ContextFree]

Giorgio, I just wanted to put forth my take on this.

I believe you did what you did in anger, and I'm glad that you've admitted it was wrong, not malicious, etc.

My real question I guess is this...

You said the reason you put it in was to fix your site, but what does the fact that people use your plugin have anything to do with your site having problems functioning? To me, this is a lot like a bank I have an account with spamming me with insurance offers, it's something isn't evil, but it's sort of sleazy and irritating, because you're leveraging a position you have to benefit yourself.

So I guess my real questions is, did it just not occur to you? I know in the heat of anger, sometimes it does, but I mean, that's the big question for me as far as trust goes. Did the realization that just because you have a popular plugin doesn't give you an entitlement to fix your problems a back-doorish way occur to you? This is mainly referring to the filterset and ABP+ mangling without notification, adding notification is one thing, I see that as someone asking me if it's okay if they get some benefit from me, and I'd have been fine with it. But you didn't ask, and even if it was a mistake, it's a damn big mistake to just assume it's okay to benefit off people like that. So what went through your head :/?

Sorry if it seems trollish, I'm just legitimately curious, and when you answer that, I'll feel a lot more comfortable using your software again.

Thanks.

[PeterSP]

What is even more dismaying than Giorgio doing something so stupid as to turn his security software into a piece of malware by having it alter other software on user machines is the attitude of the others on the project.

Instead of pulling him aside, letting him know that he was going down a bad path:
1) They spend their time defending his bad actions.
2) Insulting their security-minded user base, who obviously only installed NoScript to prevent this kind of crap.
3) Bash another Firefox extension that was only doing exactly what it is for, and what it's users installed it for: blocking ads.

An EXTREMELY shortsighted and stupid move by Giorgio I might have forgiven. But seeing how those he surrounds himself with also act, I no longer want to have any part with any software they produce.

I think perhaps people got very irritated at the bandwagon attacking him without a full understanding. Having explored both sides I feel there is fault on both sides, and Giorgio crossed a line in 1.9.2 with his disturbance of AdBlock's inner workings. Personally, I accept his apology for that on the understanding that he will be more careful about things he does while sleepy/angry/etc in future.

[Periscope Up!]

But please believe that it was made out of anger and hurry, rather than greed, since at that time literally everything was blocked by EasyList on my sites. This was a war between Ares and me, but my foolish moves made the collateral damages of users' trust prevail on anything else.

Interested lurker here for the last day, watching the skirmish. But this post struck a personal note with me so I'm throwing in my hat:

Giorgio, this "crime of passion" defence is ridiculous. People receive consideration and clemency for their wrongdoings when they are overtaken by emotion and act irrationally in the heat of the moment. You appear to have:

1. decided on the need to retaliate
2. dug in to "the low level implementation of ABP blocking internals"
3. conceived of a software solution
4. written a chunk of code
5. refactored/debugged/bench tested said code
6. decided that some level of obfuscation was required
7. figured out that you wanted to use and the details of the hex unicode escaping
8. writing the 1.9.2 changelog (omitting mention of your new code)
9. Building, releasing to users
10. Updating your website etc etc.

Offering your anger as an explanation gets you consideration as far as maybe the third step of the above list of actions. After that is pure bad judgement and maliciousness resulting in unethical behaviour.

Be a man and just say that. No need to drag it on for another 3 paragraphs, all amounting to "... but I think I was justified and really don't mean the apology I just kind of hinted at."

While I'm being all high-and-mighty and self-righteous, let me also say that "he started it" is a compelling argument for 5 year olds, not adults. You feel wronged by EasyFilter. OK. You are still responsible for your own actions.

Anyway, I recently went through a refresh of my machines and somehow never got around to installing NoScript in my new primary machine. Just done. Thanks for the great extension.

[no carrier]

Since when code is 100% secure, all these add blocker users flippin. have reason to complaint, but defacing the guy (giorgio) is pure lameness.

1) complacence is SECURITY'S WORSE ENEMY. never have complacence about any product , no matter how long you used it or rely on it it can always break on you.

2) this "terrorist" attitude of forcing giorgio to revert code and still bash him down is unacceptable and ought to be brought back to perpetrators.

3) i packet inspect all what goes out the box too like many people here. and beside distracting me a little , i wasnt at all surprise by this action. i always expected it anyways.


ill keep using noscript for my sandbox , anyhow it gets lobotomised every given day and refresh to whats should be the standard working platform.

if yall want to porn 100% safe just boot it from an live cd and shutup or recode the whole xpi youselfves.


thanks giorgio for all the times you app saved my time and got me to the content unaffected.


n

[Guest]

2) Insulting their security-minded user base, who obviously only installed NoScript to prevent this kind of crap.
3) Bash another Firefox extension that was only doing exactly what it is for, and what it's users installed it for: blocking ads.

Bash? A few of my favorite quotes from the Adblock+ crowd, just from the blog alone :

NoScript is a USELESS addon. It was great for Firefox 1, but not 2 and certainly not 3! With all FF 3’s security features, there is simply no need for it!

Indeed, the only reason to use noscript would be to block pop ups that come from “mouse over” javascript feature, other that it’s pretty useless.

Aside from that, Mozilla already HAS a builtin functionality to disable javascript, as someone noted here. Just enable it, you don’t need an extension for that.

“Good luck to those in not getting infected” – so you believe the FUD NoScript is spreading.
There are some features in there that do indeed help security (most of them are worthless still).
Giorgio keeps sending people to the thread where he blames everything on EasyList.

No comments. I love you all.

[Tom T.]

Thank you. I too was sad to see someone so knowledgeable and well-respected as Wladimir say such things, comments whose untruthfulness are self-evident. Hopefully, he too will calm down and return to reason.

Thanks again for your input.