Latest NoScript version (1.9.2) breaks Adblock Plus

[Alan Baxter]

...including breaking his web site until he capitulated.

Again: that was a false positive and it was never intended.

I tend to judge Ares2's intentions by his actions. The filters were overly broad and it was inevitable they'd cause site breakage. Adblock Plus was being reckless. Take a look at the filters if you disagree. They were still in place on Mon Apr 27, 2009 8:11 pm UTC.

Code: Select all

    /flashgot.net/*$script,subdocument,xmlhttprequest
    /hackademix.net/*$script
    /noscript.net/*$script,subdocument,xmlhttprequest
    /oss.informaction.com/*
    informaction.com/*$script,subdocument,xmlhttprequest,domain=flashgot.net|noscript.net|software.informaction.com
    flashgot.net#*(href*=informaction)(href*=com)(href*=%62)
    flashgot.net#*(href*=informaction)(href*=com)(href*=flashgot)
    flashgot.net#*(href*=oss)(href*=informaction)(href*=com)
    flashgot.net#ul(class=tla)
    noscript.net#*(href*=informaction)(href*=com)(href*=%62)
    noscript.net#*(href*=informaction)(href*=com)(href*=noscript)
    noscript.net#*(href*=oss)(href*=informaction)(href*=com)

As you can see, they pretty much disable everything, including any script, frame, or AJAX request, present or future, involving Giorgio's sites.

Then Ares2, the Adblock Plus filter list maintainer that Wladimir picked, came over to this forum to discuss his actions, and said in viewtopic.php?p=2802#p2802

I know those filters are very restrictive but they were never meant to stay the way they are forever. Temporary they seem to work OK

Sounds like he was planning on keeping them in place, temporarily of course, until Giorgio fixed his web site to suit the Adblock Plus team. Adblock Plus and the EasyList filters continued to cause false positives on Giorgio's web sites until Thursday. Malicious? Your guess is as good as mine, but reckless disregard for sure.

[Tester]

Why is it that even very big sites do not fight Adblock as agressive as the noscript-site did?

Because they know that they would lose anyway in the long run. The noscript dev thought he is smarter than that. Ok, that is his choice. So he tried to trick adblockplus ever and ever again. And guess what: adblock reacted with more broad filters against this attempt. That is no attack, no evil fight -> That is exactly what the filterlist-maintainers are there for! They just did their job.

The false positives were provoked by the noscript-author himself through his attempts to fight adblock at any cost. That's what you get. That's what every other site would get. That is the reason why other sites don't even bother to start to play this foolish game, that they can only lose.

But the noscript-author is soooooo muuuuuuch smarter than that... </irony>

[Guest]

As you can see, they pretty much disable everything, including any script, frame, movie, audio clip, Java appet or AJAX request, present or future, involving Giorgio's sites.

These filters would not block movies, audio clips or Java applets on his sites.

[p2u]

I think any further discussion is useless actually; just a repetition of the silly mud-slinging we've been witnessing for 18 pages now. I'm desperately waiting for Giorgio's topic to appear on hackademix, and count on adult-like behavior in the future from both devs. Adblock and NoScript are Firefox's face; we are doing lots of damage to the reputation of the browser itself. I hope you all realize that...

Paul Wynant, Moscow, Russia

[Giorgio Maone]

@tester:
I'm more inclined to believe bigger sites don't fight back because EasyList users are a negligible minority of their audience.
In my case, they were the 80% at least, at least judging by the deltas observable in the logs during this "war".

@Alan:
last guest is right, Java applets and plugins in general are not blocked by those filters.
It's my fault, I must have said something like that very early in this story (thinking "subdocument" included any embedded content), and Alan quoted me.
This doesn't make them less over-restrictive, though.

@id8:
I did not contact Wladimir when this started, because I believed it came out of Aries2 head (new guy, new mentality).
I had contacts with Wladimir later, when I had already crossed the line and was already trying to repair the damage, but I learned he was behind Ares2 all the time only Friday, when he wrote it clearly in his post:

I suggested that EasyList should be extended by a filter to block ads specifically on NoScript’s domains. This finally happened two weeks ago.

[strel]

I've read a whole bunch of nonsenses, childish positions, and cock fightings in this post.

While I dislike the way Giorgio touches ABP list without user's approval, and I think he acted clumsy but I wouldn't say dishonestly, and I think he had to have tried to solve directly with Ares2 his discrepancies with the filters; I understand his motivations. Correct solution for me could had been asking to suscribe ABP "exceptions" list for easylist suscriptors or so.

Anyway I want to thank Giorgio for changing his policy, common sense in the future, please. I do keep using Giorgio's Noscript because I think it's a great work. And this is something I can not say about Easylist, which after give it a try months ago, encouraged me to develop my own filter list, lacking of paranoid, which worked really well.

IMHO all this has served to point vulnerabilities in ABP, what's a very good thing.

[Guest]

While the response was both over-zealous and wrong, the benefits of NoScript are wholly apparent and otherwise exceedingly useful.

I forgive you Giorgio.

[Guest]

Why is it that even very big sites do not fight Adblock as agressive as the noscript-site did?

Because they know that they would lose anyway in the long run. The noscript dev thought he is smarter than that. Ok, that is his choice. So he tried to trick adblockplus ever and ever again. And guess what: adblock reacted with more broad filters against this attempt. That is no attack, no evil fight -> That is exactly what the filterlist-maintainers are there for! They just did their job.

The false positives were provoked by the noscript-author himself through his attempts to fight adblock at any cost. That's what you get. That's what every other site would get. That is the reason why other sites don't even bother to start to play this foolish game, that they can only lose.

This just in:
Defeating Adblock+ means you're smarter than the big guys. By Tester. (Your posts are so impressive that even a jerk like me remembers your name)

Even though I'm an advocate of adblocking myself, there should still be limits. I block ads because they annoy me, not because I want to specifically hurt a website's revenue. I believe that messing with another extension is a bad idea, but trying to specifically hurt a website, instead of ads in general is also wrong. A user prompt would be the most acceptable solution.

But the noscript-author is soooooo muuuuuuch smarter than that... </irony>

Just between you and me, my 2 cents: your sarcasm fails so much, that I imagine you're a fat lady with nothing better to do on a Sunday evening, or a kid with too much free time. Either way it's very rare for sarcasm to make someone look even more stupid than they should be.

[Guest]

You should have given users the option to allow ads on your website by saying that it was to support development of NoScript. Forcing them on us has just created great amounts of animosity towards you and your extension.

[Another Guest]

Then I visited noscript.net, added it to the whitelist, and found something I did not expect.
ghostery was not working like it should. It was red, but no display. So i looked around an found this :

#__ghosteryfirefox {
display: none !important;
}

in file http://software.informaction.com/data/oss.css.

And that's where my question comes in.
directly @ Giorgio
Why do you block ghostery's display ?

A comment on this one would be welcome.

[Unamused]

The comment on ghostery is.. viewtopic.php?p=3133#p3133

[Tester]

Then I visited noscript.net, added it to the whitelist, and found something I did not expect.
ghostery was not working like it should. It was red, but no display. So i looked around an found this :

#__ghosteryfirefox {
display: none !important;
}

in file http://software.informaction.com/data/oss.css.

And that's where my question comes in.
directly @ Giorgio
Why do you block ghostery's display ?

A comment on this one would be welcome.

He commented that already:
viewtopic.php?p=3133#p3133

If I got it right he pointed out that displaying the spy-bugs would not look beautiful on his site.

Of course it has NOTHING AT ALL to do with that he would not want (forced) visitors to realize what nice little (unwelcomed) gifts they get from the noscript-website... As they could bother to block those "gifts". What would instantly lead to less $$$-gain for noscript. But no no, that was OF COURSE not the reason.

BTW: I'm a 70kg 38yr old male from Germany who cares about this topic.

[Alan Baxter]

I appreciate Giorgio's reluctance to go on the attack in this situation, but
he has fallen on his sword, and the other side appears to merit some attention?

Absolutely. Giorgio behaved badly with his surreptitious alterations in NS 1.9.2 and 1.9.2.2, and with the automatic whitelisting mod in 1.9.2.3. He needs to fall on his sword, as you say, for his own good, as well as the good of NoScript, its users, and the rest of the Mozilla community. He can't do that effectively if he emphasizes the bad behavior of others.

If there is more, I believe it should come out.

I haven't discussed it with him, but I wouldn't be surprised if Giorgio wished I would let the bad behavior by Wladimir and Ares2 drop. I just can't. I was using Adblock before Adblock Plus came on the scene, and started using NoScript in August 2005. I couldn't use it before then because of a bug in Firefox which caused it to crash when NoScript was used. Giorgio had to fix the bug in Firefox himself. I provided feedback to the original filterset G list and participated in the NoScript discussion ever since I installed it.

I hated seeing Adblock Plus and EasyList used as a bludgeon on a small site like Giorgio's. I was in on the plan to use EasyList to target Giorgio's web sites since Wladimir suggested it a year ago to EasyList's owner, Rick752. Rick initially resisted explicitly targeting such a small site with EasyList, and myself and a few others argued against it too. Wladimir finally prevailed, and the explicit targeting of Giorgio's sites started then.

The whole business makes me sick. Frankly, I never expected any better from Wladimir, since he's been publicly denouncing NoScript and Giorgio for years. I didn't know much about Ares2 until now. And I'm so disappointed that Giorgio screwed everything up so royally. Maybe I'm just venting, but what's been going on the past nine days has scared the hell out of me.

I also think he still should add a nag, ask for permission to whitelist his pages.
OSS need not be a vow of poverty.

I agree, but not a nag which interferes in any way with NoScript's use. Just a more prominent request for donations or checking out any of the ads which interest the user.

[BigMKnows]

The bad: Loss of trust in the developers of NoScript.
The good: The NoScript code will be peer-reviewed like nothing else.

I think you nailed it. I've been watching this whole "debacle" as an outsider. I use ABP, and I used NoScript for about a month back in 2006, although I eventually uninstalled it because I thought it was overkill. After 4 years on Linux, I've had no security issues anyway.

But the "loss of trust" argument is mitigated by the fact that Maone's code will be vetted like never before. It will be the best vetted code on AMO. As far as I can see, he still puts more effort into identifying security threats and providing timely updates than anyone else. If you are a Windows user, what are your options? Potential security breaches through 4 of Maone's sites (which are gone now), or potential security breaches through EVERY site on the internet?

[BigMKnows]

The false positives were provoked by the noscript-author himself through his attempts to fight adblock at any cost. That's what you get. That's what every other site would get. That is the reason why other sites don't even bother to start to play this foolish game, that they can only lose

Actually, that's not true. If you read the EasyList forum, they take (or DID take) a conservative approach. For example, Hulu changed their policies and forced a 30 second wait time when you block their ads. Without ad blocking, some of the ads are only 10 or 15 seconds long, so blocking the ads ends up being more troublesome than allowing them. So the EasyList folks removed filters for Hulu, because they'd rather not "break" the site for their users. You can always add Hulu filters on your own, but they are not standard. Of course, that was Rick752's decision. Now there's a new maintainer.

So I think Ares2 DID overreact by breaking Maone's site.