InformAction Forums

When viewing web pages, NoScript shows a list, sometimes quite long, of scripts which can be blocked or allowed. Do you have any general suggestions for determining which scripts to block and which to allow? It's often not obvious from NoScript whether or not the script is essential to the proper display of the page. For example, when I go to http://stackoverflow.com/, a banner appears on the page, "Stack Overflow works best with JavaScript enabled" and yet NoScript does not show any scripts that appear to be related to JavaScript.

Is determining which scripts to block, just a matter of trial and error?

Thanks,
Don

Don wrote:Is determining which scripts to block, just a matter of trial and error?

Some of it is, and there's nothing to be done about that.

However, see viewtopic.php?p=75314#p75314 for one method that might help reduce the amount of trial-and-error.

Thanks for your response.

I going to suspend using Noscript to block scripts. As I explained above, It is just too difficult to determine on a given site which scripts can be blocked and which scripts are essential to the basic functioning of the site. I was trying to log in to my bank site, and the User Name text box had disappeared. The password box was still there and otherwise the rest of the page seemed normal, but it was impossible to tell which script was causing the problem, but allowing everything restored the page to normal.

I appreciate all the effort put in to Noscript and its goal of providing a safer browsing environment. Perhaps the script writers have won this one!

Don

Guest wrote:I going to suspend using Noscript to block scripts.

Have you considered using cascading permissions mode? This will make the top-level document's permissions extend to EVERYTHING within it, so top-level site's permissions reflect to all scripts on the site.. basically you are just deiciding whether you want JavaScript enabled when you browse <site>.

If you're interested to try it, Forbid Scripts Globally, then
NoScript Options > Advanced > Trusted, check "Cascade top document's permissions to 3rd party scripts"

No more trial-and-error, no more deciding which scripts to Allow and not to Allow, all you need to decide is whether JS is needed at all.

Even if you don't want to do that, Allow Scripts Globally is still far safer than not using NoScript at all.

Guest wrote:Perhaps the script writers have won this one!

I doubt that. If this wasn't your bank site (and thus "risky" to play with) I'd ask you to try some troubleshooting, but as it is we'll just let it go

Thanks, Barbaz, I'll try out your cascade suggestion. In the cascade mode, why are JavaScripts the exception to "all the scripts on the site"?

I'll also try to do some blocking on a few sites I visit often. I think they may load more quickly that way.

Don

(offtopic: let us know if you want your guest posts in this thread put under your account)

Don wrote:In the cascade mode, why are JavaScripts the exception to "all the scripts on the site"?

Sorry, poor choice of words on my part. Try again

In cascading permissions mode, all scripts are blocked by default, just like normal. The difference is that once you (Temporarily) allow a site, you are effectively Allowing Scripts Globally for all pages on that site. However, if you visit another site that has *not* been (Temp-)Allowed yet, scripts will be forbidden on that site.

Likewise, Forbidding a site / revoking temporary permissions is like forbid scripts globally on that site.

Is that a better explanation?

Don wrote:I'll also try to do some blocking on a few sites I visit often. I think they may load more quickly that way.

(And in cascading permissions more or Allow Scripts Globally, if you Mark a site as Untrusted it will stay Forbidden and not get automatically script-allowed.)

Thanks for the additional explanation. I"ll experiment some more with cascading.

Off topic: Yes, please move my Guest posts to my account.

Don