Latest NoScript version (1.9.2) breaks Adblock Plus

General discussion about the NoScript extension for Firefox
Locked
User avatar
Giorgio Maone
Site Admin
Posts: 8769
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by Giorgio Maone » Sat May 02, 2009 5:26 am

I'm unlocking this topic for transparence sake.
Thanks GµårÐïåñ, I appreciated your defensive intentions but openness is the most important thing at this moment.

I'm quite tired, having spent all the night (7.20 AM here) coding on a notebook (my workstation choose the best moment to melt down), but I wanted to let you know NoScript 1.9.2.5 is available now, albeit not on AMO yet (use the direct link, please).
It adds the "ask beforehand" retroactive one-time prompt, asking user if he wants to keep/install or remove permanently the "infamous" whitelisting filterset.
This was planned to be delivered tomorrow (today?) evening, but the notorious events hurried it up.

I think I'll have to resist some minutes yet, to prepare some Hackademix response too.
Have a nice day (night?)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)

Guest

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by Guest » Sat May 02, 2009 5:39 am

Frankly I hope Mozilla bans you from their add-ons page for f**king with other people's extensions.

I was a NoScript supporter and encouraged friends and family to install it. No more. You've shown you can't be trusted.
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)

Tom T.
Field Marshal
Posts: 3620
Joined: Fri Mar 20, 2009 6:58 am

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by Tom T. » Sat May 02, 2009 5:57 am

Guest wrote:Frankly I hope Mozilla bans you from their add-ons page for f**king with other people's extensions.

I was a NoScript supporter and encouraged friends and family to install it. No more. You've shown you can't be trusted.

"Assuming", for the sake of argument, that someone makes a mistake, if they correct it when it's called to their attention, does that not regain that trust?

To pick an example at random, Microsoft has had thousands of mistakes called to their attention, some unpatched for many months, some ignored, yet 90% of the global market still uses them. (Self included, for price, convenience, and the ability to reproduce 90% of the issues reported here, among other reasons, but with numerous safeguards added). This whole issue burst up within a day or two, and within another day or two, Giorgio released a corrective build.

Show me how many other developers respond that quickly to any issue, regardless of whether the developer made an innocent error, a bad decision, whatever. Thank you.

Edit: As I've posted elsewhere, you're punishing yourself and your friends. Instead of relying on one person who made a decision you didn't like (and corrected it), you're now at the mercy of every malicious script, XSS, CSRF, clickjack attack, unsecured SSL cookie, meta-redirects, etc.... unless you disable scripting in IE, which will break most of the web. Weigh that carefully, please.
Last edited by Tom T. on Sat May 02, 2009 6:00 am, edited 1 time in total.
Reason: user punishing self
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US at an expert level; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20 diehard

User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3339
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by GµårÐïåñ » Sat May 02, 2009 6:02 am

Giorgio Maone wrote:I'm unlocking this topic for transparence sake.
Thanks GµårÐïåñ, I appreciated your defensive intentions but openness is the most important thing at this moment.

I'm quite tired, having spent all the night (7.20 AM here) coding on a notebook (my workstation choose the best moment to melt down), but I wanted to let you know NoScript 1.9.2.5 is available now, albeit not on AMO yet (use the direct link, please).
It adds the "ask beforehand" retroactive one-time prompt, asking user if he wants to keep/install or remove permanently the "infamous" whitelisting filterset.
This was planned to be delivered tomorrow (today?) evening, but the notorious events hurried it up.

I think I'll have to resist some minutes yet, to prepare some Hackademix response too.
Have a nice day (night?)


I didn't do it for defensive reasons or to hide anything or to be any less transparent or I would have just deleted the offending posts. I just simply wanted the unhelpful and remarkably ignorant comments, like the one that followed you opening the thread and Tom responded to to stop. It serves no purpose and serves no transparency for cowards to come here and anonymously throw out insults and get on the band wagon. But its your site and your choice, as long as you are the one reverting this decision, its your call.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10

DecidedlyUnhappy

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by DecidedlyUnhappy » Sat May 02, 2009 6:07 am

Giorgio Maone wrote:NoScript 1.9.2.5 is available now... It adds the "ask beforehand" retroactive one-time prompt, asking user if he wants to keep/install or remove permanently the "infamous" whitelisting filterset.

Dear god you're a monster... it does not do any such thing! There's a confusing prompt that 99% of users won't understand and then "OK" and "Cancel" buttons. Of course people are going to press "OK" when the question is crazy-unclear!!

You have sat here for how long preaching about how you protect everyone from the evil internet and then you turn this thing into a virus! Then you lie repeatedly about your intentions and actions. Now you say you've solved it but you're still doing it in a backhanded, obfuscated manner.

I am done with noscript. All trust of you is lost. All of your sacred sites will be blocked in my hosts file. Good riddance.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)

Guest

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by Guest » Sat May 02, 2009 6:18 am

Tom T. wrote:"Assuming", for the sake of argument, that someone makes a mistake, if they correct it when it's called to their attention, does that not regain that trust?

To pick an example at random, Microsoft has had thousands of mistakes called to their attention, some unpatched for many months, some ignored, yet 90% of the global market still uses them. (Self included, for price, convenience, and the ability to reproduce 90% of the issues reported here, among other reasons, but with numerous safeguards added). This whole issue burst up within a day or two, and within another day or two, Giorgio released a corrective build.

Show me how many other developers respond that quickly to any issue, regardless of whether the developer made an innocent error, a bad decision, whatever. Thank you.

Edit: As I've posted elsewhere, you're punishing yourself and your friends. Instead of relying on one person who made a decision you didn't like (and corrected it), you're now at the mercy of every malicious script, XSS, CSRF, clickjack attack, unsecured SSL cookie, meta-redirects, etc.... unless you disable scripting in IE, which will break most of the web. Weigh that carefully, please.


Many of us feel betrayed because NoScript is doing things behind our backs, and then got caught with its pants down. Reversing a rulebreaking bad decision in itself is not grounds for forgiveness, because now the seed of doubt has been planted. Fixing a simple mistake that made it through the woodwork and getting caught doing something you shouldn't be are different things in the trust spectrum.
Opera/9.64 (Windows NT 6.0; U; en) Presto/2.1.1

Unbelievable

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by Unbelievable » Sat May 02, 2009 6:25 am

What you have done is the equivalent of an anti-virus author spreading viruses in order to increase sales of their product. No matter what you say, your actions have proven your real intent. You wrote your plugin to disable the functionality of another plugin in order to financially benefit you. You obfuscated the code to hide it. Adblock Plus was modified several times to fix the "bug" you created, and each time you turned around and broke it again. What really galls me is that I swore by your plugin and recommended it to everyone I know. This is a betrayal of trust to everyone that used Noscript.

You are unscrupulous, lack ethics, and anyone with a lick of sense will never use your products or do business ever again.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)

User avatar
Giorgio Maone
Site Admin
Posts: 8769
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by Giorgio Maone » Sat May 02, 2009 6:31 am

OK, it's 8.27 AM here, I'm not sure if I'm still awake or not, but I'm making last try:

v 1.9.2.6
=====================================================================
x NoScript now automatically removes the controversial "NoScript
Development Support Filterset" on startup, permanently and with no
questions asked.



Good night USA, good morning Europe, I'm off for a few hours.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)

I have to post this

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by I have to post this » Sat May 02, 2009 6:44 am

i DONT USE ADBLOCK PLUS AND NOSCRIPT IS WONDERFUL. SO WTF PEOPLES. DONT GIVE THIS GUY CRAP, THINK ABOUT MANY OTHER SITES THAT DONT GET ANY REVENUE BECAUSE UR BLOCKING THEIR ADS. ANNOYING AS THEY MAY BE I DONT EVEN USE NOSCRIPT TO BLOCK THEM.
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)

I HAVE TO POST THIS

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by I HAVE TO POST THIS » Sat May 02, 2009 6:49 am

Oh i see you have released a new version. good work son. now everyone can get a good night sleep.
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)

Tom T.
Field Marshal
Posts: 3620
Joined: Fri Mar 20, 2009 6:58 am

IT'S FIXED: DON'T PUNISH YOURSELF BY REMOVING NOSCRIPT

Post by Tom T. » Sat May 02, 2009 6:54 am

Giorgio Maone wrote:OK, it's 8.27 AM here, I'm not sure if I'm still awake or not, but I'm making last try:

v 1.9.2.6
=====================================================================
x NoScript now automatically removes the controversial "NoScript
Development Support Filterset" on startup, permanently and with no
questions asked.



Good night USA, good morning Europe, I'm off for a few hours.

***************************
Thank you for your time and effort, Giorgio. Sleep well.

I've said this in a number of threads, so let me say it here in a new topic, to all concerned:

1) You installed NoScript because you believed that it made for the safest browsing possible, and that NoScript was a vital part of using the Internet. You were right.
2) The developer made a decision that made some people unhappy.
3) The issue was discussed intensely.
4) The developer stayed up all night (until 8:27am Italian time) writing a version that addressed the issue.
5) You can have that version right now, at no cost or obligation. Click the link above.
6) Some of you are saying you will never use NS again. Read (1) again. There is no substitute or equal.

It's understandable that some people are upset. But do you want to punish *yourself* by exposing yourself to the dangers of the Web, especially now that the issue has been resolved?

There is a saying in English (en-US, at least) "Cutting off your nose to spite your face". Don't cut off your safe browsing capability to spite the developer for a single decision (among thousands over the years) with which you disagreed.

I will also suggest to the developer the possibility of going the way of most "freeware", and offering a paid version, with paid subscription updates, and no ads or update redirects ever, for the going range of about USD 30-50, or about EUR 22-37, or GBP 20-33, or JPY 30,000-50,000, plus annual update fees. If you would prefer such an option, please say so.

Thank you.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US at an expert level; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20 diehard

hmmmm

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by hmmmm » Sat May 02, 2009 6:54 am

I still don't understand all the confusion...

-Adblock Plus blocks ads. Users install it to do such.
-Noscript blocks scripts. Users install it to do such.

The creator of Noscript openly admits to trying to subvert ADP's (and thus all of the users who use the plugin) because he somehow feels like he knows what's best rather than the users who installed it. His changes cause errors with ADP. ADP updates itself for the sake of its users.

And then... Giorgio claims that somehow it is ADP's fault?

What if I designed a plugin which subverted noscript on my site? Would you update your program for the sake of your users? What if I updated my program to completely mess with yours and you had no choice but to defend yourself?

Such a hypocrite. Instead of just apologizing and admitting what you attempted to do and letting that be the end of it... you continue to try to play the victim. Grow a pair and take responsibility.
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10 GTB5

annoyed but still a user

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by annoyed but still a user » Sat May 02, 2009 6:56 am

While this whole fiasco is annoying and does give one pause for thought, without doing a careful code audit you can't be too sure about any plugin. This one seems more of a betrayal simply because it's specifically designed to protect against scripts and malicious sites, so messing with your browser seems particularly wrong. That said, as many have pointed out, it has been addressed AND more importantly, NoScript is the single best security add-on out there. Removing it in response to this fiasco means that you are trusting essentially every site on the web, every possibly-compromised remote call, etc, in order to avoid having to trust one guy who made a mistake and fixed it (bad blood or no). This strikes me as tremendously unwise.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10

AySz88

Re: Latest NoScript version (1.9.2) breaks Adblock Plus

Post by AySz88 » Sat May 02, 2009 6:57 am

Honestly, this is all really childish. I don't know or really care who did what first; the escalation in rhetoric (not just code) needs to stop. I'm glad that Giorgio seems to have taken a first step here. These absurd posts from AdBlock supporters aren't helping any either. Yes, NoScript needs to not try to meddle with what AdBlock does; seriously, that's not cool. But AdBlock's been retaliating in kind and that needs to stop too. I don't use AdBlock now, myself; I suggest maybe AdBlock needs to rethink whether they're going beyond their scope - I'd personally expect them to limit themselves to large third-party ad networks that might have privacy implications, not every little sponsored thing on every site. AdBlock's rhetoric makes me very wary of whether they have their heads on straight.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4) Gecko/20090429 Firefox/3.5b4 GTB5 (.NET CLR 3.5.30729) (pigfoot)

Guest

Re: IT'S FIXED: DON'T PUNISH YOURSELF BY REMOVING NOSCRIPT

Post by Guest » Sat May 02, 2009 6:57 am

1) You installed NoScript because you believed that it made for the safest browsing possible, and that NoScript was a vital part of using the Internet. You were right.

No we were WRONG. because noscript turned into MALWARE.

2) The developer made a decision that made some people unhappy.

The developer made the extension into MALWARE. That makes everyone unhappy.

3) The issue was discussed intensely.

Yes.

4) The developer stayed up all night (until 8:27am Italian time) writing a version that addressed the issue.

Serves him right.

5) You can have that version right now, at no cost or obligation. Click the link above.

How about NOT PUTTING MALWARE INTO MY FIREFOX IN THE FIRST PLACE ??

6) Some of you are saying you will never use NS again. Read (1) again. There is no substitute or equal.

Good. Now we just have to FORK noscript so this never happens again.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20

Locked