InformAction Forums

therube wrote:And that was 3.6, far different (in that 3.6 was supported till just recently) from the 3.0 that you are running.

Good point.

Tom T. wrote:

azrael wrote:As FF3 is still listed as being supported ....

Fx 3 ended support on April 24, 2012. Here is an official announcement, although the date is missing. Where are you seeing it being listed as "supported"?

I can't really see how Mozilla's support cycle plays into this when the bugs are in NoScript and it still says "Supported browsers: Firefox 3.0 and above, SeaMonkey 2.0 and above, IceWeasel, Minefield" on the NoScript download page. As it stands FF3 is (barely) supported by NoScript 2.3.2, yet I still get an update notification whenever a newer build of NoScript is released. None of which of course solve these issues, which include crashing the browser.

I wondered that too. Should Giorgio have some sort of automated or semi-automated testing infrastructure in place then I guess this could mean that he is running it on Firefox 3 too. But maybe it simply just means that he might fix bugs for this platform.

Mozilla support comes into play if you want to have a secure browser, NoScript is only of limited help against some of the open holes the browser version you are running has.

Clarification on what "supported" means on the site would be great IMHO, as well as maybe mentioning that NoScript isn't a guaranteed protection against browser vulnerabilities.

azrael wrote:I can't really see how Mozilla's support cycle plays into this when the bugs are in NoScript

I'm not totally convinced that the bugs are in NS, and not in Firefox, or Flash ....

and it still says "Supported browsers: Firefox 3.0 and above, SeaMonkey 2.0 and above, IceWeasel, Minefield" on the NoScript download page. As it stands FF3 is (barely) supported by NoScript 2.3.2, yet I still get an update notification whenever a newer build of NoScript is released.

I still have Fx 3.6.28 (in addition to F12), and the update notifications occur properly. There was a recent glitch in d/l updates from AMO, which still hasn't been confirmed by anyone else. But going directly to NS site, or in my case, latest development build, and clicking the direct link to Giorgio's secure server of the .xpi worked flawlessly. As does NS itself, on 3.6.

I don't have a copy of 3.0, and 2.0 supports NS only up to v1.10.

I don't remember -- have you tried with a clean install of Fx 3.6.28 (since you want to avoid the 4+ series), a clean profile, and only NS (2.4.3), with the latest version of Flash. which is 11.2.202.235, which will indeed run on Fx 3.6?

With that exact setup, I went to ppradio.dk just now, temp-allowed the site and googleapis, and TA'd in RequestPolicy googleapis and dana7.dk.
Then shows the blocked Flash object, with both a placeholder and in Blocked Objects menu. TA either way, and the site appears to run perfectly, including the Flash banner of featured products at the top.

I don't use Hotmail, so can't test that. Could you please try, duplicating my setup as above?

dhouwn wrote:I wondered that too. Should Giorgio have some sort of automated or semi-automated testing infrastructure in place then I guess this could mean that he is running it on Firefox 3 too. But maybe it simply just means that he might fix bugs for this platform.

AFAIK, it means that all NS features and functions will work correctly on the F3 branch, to the extent that they are applicable. (E. g., certain about:config not present; no HTML5 support, etc.)

Mozilla support comes into play if you want to have a secure browser, NoScript is only of limited help against some of the open holes the browser version you are running has.

Clarification on what "supported" means on the site would be great IMHO, as well as maybe mentioning that NoScript isn't a guaranteed protection against browser vulnerabilities.

"Support" means what's said above, AFAIK, which is all that anyone can ask for.
There is already warning of using unsupported browsers: latest development build

Users of Firefox 2.0 and below are urged to upgrade their very unsafe browser. For those few who can't, latest legacy-compatible NoScript version is 1.10.

That clearly implies that NS cannot protect against unpatched Fx vulns in 2.0.
Perhaps when NS support for 3.x is discontinued, the statement will be amended to include the last legacy version of NS that supports 3.x, with the same warning.

In the meantime, the advice to use the latest stable release of *any* sw is seen and heard so frequently that it should be apparent that unsupported sw may contain unpatched vulns. OP seems to be aware of this. (And yes, *I* am. )