Noscript for Google Chrome?

Bug reports and enhancement requests
4td8s
Junior Member
Posts: 22
Joined: Thu Jun 03, 2010 10:40 pm

Re: Noscript for Google Chrome?

Post by 4td8s »

GµårÐïåñ wrote: Once again it seems they are making promises to make the majority of the masses to let their guard down and go with their solution thinking a false sense of security while the full benefit and guts of the program are not implemented because why go the full distance when you can fool people into a lesser and incomplete solution, this is asinine. It is shameful that instead of using the expertise and knowledge of a master like Giorgio, they are going to keep dragging their feet and implementing one half ass solution after another. :evil: Plus, if they had what is needed in place for Giorgio to do his thing, you wouldn't have to keep asking Giorgio, it would already be done. Anyone who knows anything about how diligently Giorgio stays on top of things would know that if it was possible, it would have already been done. The pressure and the questions should be directed to the reluctant Google devs who have ignored it all along.
that sure sucks, doesn't it? oh well, it's google's loss. :lol:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a6pre) Gecko/20100629 SeaMonkey/2.1a2
yupa
Posts: 4
Joined: Mon Jun 07, 2010 9:08 am

Re: Noscript for Google Chrome?

Post by yupa »

http://apple.slashdot.org/story/10/07/2 ... ng-Adblock

Is this "resource-blocking-adblock" bringing us closer to Noscript on Chrome?
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.7) Gecko/20100713 Firefox/3.6.7
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Noscript for Google Chrome?

Post by Giorgio Maone »

yupa wrote:http://apple.slashdot.org/story/10/07/2 ... ng-Adblock

Is this "resource-blocking-adblock" bringing us closer to Noscript on Chrome?
Yes, but unfortunately it's not enough for integrating with the internal script blocker :(
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.7) Gecko/20100713 Firefox/3.6.7
yupa
Posts: 4
Joined: Mon Jun 07, 2010 9:08 am

Re: Noscript for Google Chrome?

Post by yupa »

It seems issue 35897 of the Chromium project is the one which needs to be solved to make Noscript for Chrome possible.

Star it if you want Noscript for Chrome!
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Noscript for Google Chrome?

Post by Giorgio Maone »

yupa wrote:It seems issue 35897 of the Chromium project is the one which needs to be solved to make Noscript for Chrome possible.
No it's not. At this moment "beforeload" pretty much covers the needs related to that bug from NoScript's standpoint.
The real show stopper at this moment is the (missing) ability for extensions to interact with browser's script execution permissions.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
yupa
Posts: 4
Joined: Mon Jun 07, 2010 9:08 am

Re: Noscript for Google Chrome?

Post by yupa »

Is there a corresponding issue we can star?
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Noscript for Google Chrome?

Post by Giorgio Maone »

yupa wrote:Is there a corresponding issue we can star?
I've just asked someone who should know: https://twitter.com/ma1/status/19810257922
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
tlu
Senior Member
Posts: 129
Joined: Fri Jun 05, 2009 8:01 pm

Re: Noscript for Google Chrome?

Post by tlu »

I just saw that somebody has now developed a Chrome extension called NotScripts. I don't know how it compares to Noscript (and I don't use Chrome anyway) but it might be interesting for Giorgio to have a look at it. Details on http://optimalcycling.com/other-projects/notscripts/
Mozilla/5.0 (X11; U; Linux x86_64; de-DE; rv:1.9.2.9pre) Gecko/20100814 Ubuntu/10.04 (lucid) Namoroka/3.6.9pre
qaelith.2112
Posts: 1
Joined: Tue Aug 17, 2010 6:54 pm

Re: Noscript for Google Chrome?

Post by qaelith.2112 »

TLU, thank you for that link. I've just spent a bit of time playing with NotScript, and it appears that it'll improve our security reasonably well for now, until the APIs are improved to the point that the real NoScript can be ported. Of course, this is a very minimal extension and obviously doesn't do even a fraction of what NoScript will do. It does beat just turning off scripting in Chrome and whitelisting as needed, which is a royal pain and doesn't allow for resources within a page to be turned on while others are left disabled. What it currently lacks that I believe could be added is a TEMPORARY whitelisting by resource. It includes a permanent whitelisting by resource, as well as a temporary whitelisting for everything. Basically if you need to temporarily allow just one thing, you either have to permanently allow and then disallow again later (good luck remembering to do that) or temporarily allow everything on the page and risk opening the floodgates for the scripts inside banner ads and everything else.

That's just the basics, though. I'm not even talking about all of the other cool stuff NoScript does, such as ABE, clickjacking protection, etc.

Chrome is shaping up to be a fabulous browser, but damn it, I continue to be disappointed in some of the BASIC things that are missing (essential extension API elements, print preview, bookmark tags, on and on...) while precious time is being spent going back and forth on what the menus should look like and where the bookmark star is to appear.

Anyway, thank you very much, Giorgio, for your persistence in trying to badger the Chrome Team into doing what should be done with respect to the extensions APIs, and for keeping the port of NoScript in mind. When that eventually happens, I won't be the only one who is indescribably grateful for it. The Chrome Team should see the development of these features as being important for the securability / security of the browser.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/6.0.490.1 Safari/534.6
optimalcycling
Posts: 7
Joined: Tue Aug 17, 2010 10:19 pm

Re: Noscript for Google Chrome?

Post by optimalcycling »

Hello all, my name is Eric Wong. I'm the author of the NotScripts extension for Google Chrome, http://www.optimalcycling.com. Thought I should drop by and register.

@ qaelith.2112
Lots of people have been asking me to implement the temporary allow this site feature so that is a top priority feature now. It will be pushed out when I code it up and get the drop down menu clean enough with the extra buttons required. I want to keep that part of the interface as simple as possible.

As for implementing other features that NoScript has, that may or may not be possible. I haven't looked into it.
Author of NotScripts for Google Chrome, http://optimalcycling.com/other-projects/notscripts/
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.126 Safari/533.4
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Noscript for Google Chrome?

Post by Giorgio Maone »

Hi Eric,

thanks for your effort.
I appreciate the fact you're calling it "NotScripts", rather than NoScript, and keep the distinction clear.
It's been also honest from you putting a "limitations" section in your docs.
You should also warn your users that they shouldn't rely on NotScript for their security (as they can do with NoScript), because there are many ways for a malicious attacker to work around it and it doesn't provide any of the additional security protections given by NoScript beyond 3rd party script blocking.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3365
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Noscript for Google Chrome?

Post by GµårÐïåñ »

I personally believe that the name is too similar as-is and could be mistaken as a legit NoScript solution. I wish they had picked a more original name of their own uniqueness and not play on the linguistic similarities to NoScript. Its like someone creating "Gooogle.com" and saying they had no intention to play off of the popularity of Google in picking the name. Or "Wallmart.com" to try and play on "Walmart.com" you get the idea. I would be more comfortable with a wider separation of identity on this item.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
optimalcycling
Posts: 7
Joined: Tue Aug 17, 2010 10:19 pm

Re: Noscript for Google Chrome?

Post by optimalcycling »

Giorgio Maone wrote:Hi Eric,

thanks for your effort.
I appreciate the fact you're calling it "NotScripts", rather than NoScript, and keep the distinction clear.
It's been also honest from you putting a "limitations" section in your docs.
You should also warn your users that they shouldn't rely on NotScript for their security (as they can do with NoScript), because there are many ways for a malicious attacker to work around it and it doesn't provide any of the additional security protections given by NoScript beyond 3rd party script blocking.
Thanks.

Yes, I should add in the limitations that there is no support for clickjacking protection or other advanced methods yet.

Edit: I've added this to the limitations page on the web (http://optimalcycling.com/other-project ... mitations/) and will go into the extension's limitations page next release:

Please note that NotScripts is not a guarantee of security and users should always practice secure web surfing habits. Currently NotScripts does not provide advanced protection for things such as clickjacking and other methods found in the "NoScript<link>" addon for Firefox and a malicious website may still be able to successfully use such techniques.
Last edited by optimalcycling on Thu Aug 19, 2010 8:30 pm, edited 2 times in total.
Author of NotScripts for Google Chrome, http://optimalcycling.com/other-projects/notscripts/
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.126 Safari/533.4
optimalcycling
Posts: 7
Joined: Tue Aug 17, 2010 10:19 pm

Re: Noscript for Google Chrome?

Post by optimalcycling »

GµårÐïåñ wrote:I personally believe that the name is too similar as-is and could be mistaken as a legit NoScript solution. I wish they had picked a more original name of their own uniqueness and not play on the linguistic similarities to NoScript. Its like someone creating "Gooogle.com" and saying they had no intention to play off of the popularity of Google in picking the name. Or "Wallmart.com" to try and play on "Walmart.com" you get the idea. I would be more comfortable with a wider separation of identity on this item.
I've put the disclaimer that NotScripts is not affiliated with NoScripts for Firefox on both my website and on the Google Chrome extension page. I've also put links back to http://noscript.net on my website, the NotScripts about page in the extension, and on the Google Chrome extension page: https://chrome.google.com/extensions/de ... dajjpkkcfn
Author of NotScripts for Google Chrome, http://optimalcycling.com/other-projects/notscripts/
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.126 Safari/533.4
Locked