InformAction Forums

Hello,

I've a website generated by Drupal. There is a module Drupal installed, that allows to add the JS tracking code for Googly Analytics depending on the Do-Not-Track setting of the browser.

For some reason NoScript seems to have / cause a problem here. I've two instances (a virtual machine and a live-webserver) with the exact the same setup (browser, add-ons, ...). I've turned off the Do-Not-Track setting on both in order to checkt the functionality. While it works in the VM, the live-site is being generated without the JS code. It looks as if NoScript is responsible for this. Once I deactivate NoScript and then activate it again straight afterwards (or do an re-insatll), the Google Analytics code is being generated. Once I change the Do-Not-Track setting of the browser once or twice, the JS code isn't being generated anymore until I re-active / re-install NoScript.

Never had such a problem before... Also it's not correct, that NoScript prevents the code from being generated, instead of just to block it, if it is supposed to do so.

Hope you can take a look into it...

A small additions regarding

Once I deactivate NoScript and then activate it again straight afterwards (or do an re-insatll), the Google Analytics code is being generated. Once I change the Do-Not-Track setting of the browser once or twice, the JS code isn't being generated anymore until I re-active / re-install NoScript.

This seems to be not 100% correct. It's rather a matter of luck, whether the JS code gets generated after re-activation or not. Just now it did not appear. If NoScript is deactivated, the code is there all the time.

shad wrote:I've a website generated by Drupal. There is a module Drupal installed, that allows to add the JS tracking code for Googly Analytics depending on the Do-Not-Track setting of the browser.

Well NoScript does send DNT header by default.. you need to go into about:config and add your site(s) to noscript.doNotTrack.exceptions .

Well, in my opinion, if the browser DNT setting is turned off, then NoScript and other extensions should respect this setting and at least generate the appropriate JS code und then block it, if that's how the user set NoScript up. It was like that before and Google Analytics was showed in the list of available / blocked scripts on a site. In the behavior I described above NoScripts "kills" the JS code completely, regardless the brwoser setting, which is wrong in my eyes. It can't be expected that users define the DNT behavior per extension with browser setting - the most intuitive setting - being ignored.

shad wrote:Well, in my opinion, if the browser DNT setting is turned off, then NoScript and other extensions should respect this setting

I disagree, I think it's better as a separate setting because defense-in-depth. If something goes wrong with the browser setting and I don't notice, then I still have NoScript protecting me with DNT; and vice versa.

shad wrote:NoScript and other extensions should respect this setting and at least generate the appropriate JS code und then block it,

Meaning what? Run some JS from a site when JS from that site is blocked, or send a second request to the page but without DNT header? No, no, no, no, no.
If you don't mean either of those please explain more, please explain how NoScript is supposed to magically know the code to run and how this is always GUARANTEED to be safe for all users and considered safe by all users no matter what.

shad wrote:It was like that before

With which NoScript version? Are you saying this is a recent regression?

Please actually try disabling NoScript's DNT setting (either as I said above, or about:config > set noscript.doNotTrack.enabled to false ) and let us know what happens.

shad wrote:In the behavior I described above NoScripts "kills" the JS code completely, regardless the brwoser setting, which is wrong in my eyes.

And this is "wrong" how? You do realize that NoScript blocks Google Analytics by default anyway, and the only way to unblock it is (Temporarily) Allowing it, right?

shad wrote:It can't be expected that users define the DNT behavior per extension with browser setting - the most intuitive setting - being ignored.

Some reading material for you: viewtopic.php?f=7&t=20460

barbaz wrote:

shad wrote:NoScript and other extensions should respect this setting and at least generate the appropriate JS code und then block it,

Meaning what? Run some JS from a site when JS from that site is blocked, or send a second request to the page but without DNT header? No, no, no, no, no.
If you don't mean either of those please explain more, please explain how NoScript is supposed to magically know the code to run and how this is always GUARANTEED to be safe for all users and considered safe by all users no matter what.

I'm saying that it's not a task of NoScript to modify the output code of a web page in the way that it prevents some parts of the code from being generated. A web master set up a page in one way and this code should arrive at the users end in exactly the same original stance. What the task of NoScript is, in my opinion, is to block this code, if the user has set it up like that.

barbaz wrote:

shad wrote:It was like that before

With which NoScript version? Are you saying this is a recent regression?

No idea which version it was. I'm quite sure I've never noticed a problem like this before and always have seen NoScript telling me, that Google Analytics is used on a page, but blocked due to my settings (or the default blocking, as you say). Right now it just tells me, that they Google Analytics code just isn't there, although it should be.

barbaz wrote:Please actually try disabling NoScript's DNT setting (either as I said above, or about:config > set noscript.doNotTrack.enabled to false ) and let us know what happens.

Google Analytics code is being generated (correct in my opinion), but isn't offered to be blocked (wrong in my opinion and differently to previous versions, I think).

barbaz wrote:

shad wrote:In the behavior I described above NoScripts "kills" the JS code completely, regardless the brwoser setting, which is wrong in my eyes.

And this is "wrong" how? You do realize that NoScript blocks Google Analytics by default anyway, and the only way to unblock it is (Temporarily) Allowing it, right?

I do realize that and that's what is missing: the code is missing and the user can't determine whether it is supposed to be blocked or not, because it just isn't there.

barbaz wrote:

shad wrote:It can't be expected that users define the DNT behavior per extension with browser setting - the most intuitive setting - being ignored.

Some reading material for you: viewtopic.php?f=7&t=20460

Pretty much exactly what I'm saying.

shad wrote:No idea which version it was. I'm quite sure I've never noticed a problem like this before and always have seen NoScript telling me, that Google Analytics is used on a page, but blocked due to my settings (or the default blocking, as you say). Right now it just tells me, that they Google Analytics code just isn't there, although it should be.

Can you please check through old NoScript rc versions and find out which version it was that broke this?
Old NoScript @
https://addons.mozilla.org/addon/noscript/versions
*or*
https://noscript.net/feed?c=100&t=a

shad wrote:Google Analytics code is being generated (correct in my opinion), but isn't offered to be blocked (wrong in my opinion and differently to previous versions, I think).

Not sure. Please post the generated code here.

shad wrote: I'm saying that it's not a task of NoScript to modify the output code of a web page in the way that it prevents some parts of the code from being generated. A web master set up a page in one way and this code should arrive at the users end in exactly the same original stance. What the task of NoScript is, in my opinion, is to block this code, if the user has set it up like that.

But NoScript is not responsible for Drupal's behavior. If Drupal chooses not to send tracking scripts when the user requests privacy, and NoScript assumes (reasonably) that its users want privacy by default, then it is working exactly as designed.

barbaz wrote:

shad wrote:No idea which version it was. I'm quite sure I've never noticed a problem like this before and always have seen NoScript telling me, that Google Analytics is used on a page, but blocked due to my settings (or the default blocking, as you say). Right now it just tells me, that they Google Analytics code just isn't there, although it should be.

Can you please check through old NoScript rc versions and find out which version it was that broke this?
Old NoScript @
https://addons.mozilla.org/addon/noscript/versions
*or*
https://noscript.net/feed?c=100&t=a

A thought just came up: There might be one thing that could speak against the theory, that it was a recent change: the different behavior of the Google Analytics module for Drupal regarding the handling of the DNT setting. As I said, I've made a new website with new version of the module. If the old version on the old website didn't support the DNT setting, then this could explain why I didn't notice this behavior on my site before (wasn't paying attention to this on other sites). But I can't say for sure whether the old version had supported the DNT setting or not. So under these circumstances I might be wrong, when I say it's a recent change. However, to figure all this out is too time intensive for me currently. Also it doesn't appear that you guys agree that this behavior of NoScript is wrong, so no point to continue, I think.

barbaz wrote:

shad wrote:Google Analytics code is being generated (correct in my opinion), but isn't offered to be blocked (wrong in my opinion and differently to previous versions, I think).

Not sure. Please post the generated code here.

Apparently the code triggers the antispam filter, can't post with it inserted. Had to go via http://pastebin.com/fBP6isXu

Thrawn wrote:

shad wrote: I'm saying that it's not a task of NoScript to modify the output code of a web page in the way that it prevents some parts of the code from being generated. A web master set up a page in one way and this code should arrive at the users end in exactly the same original stance. What the task of NoScript is, in my opinion, is to block this code, if the user has set it up like that.

But NoScript is not responsible for Drupal's behavior. If Drupal chooses not to send tracking scripts when the user requests privacy, and NoScript assumes (reasonably) that its users want privacy by default, then it is working exactly as designed.

Right, NoScript is not responsible, but does exactly the opposite and iterfers with it. Drupal is being used to create the website and depending on the DNT setting of the browser to either use the Google Analytics code or not. NoScript simply says "screw the browser DNT setting, I have my own", which is not even clear through GUI or so. So no matter how the browser DNT setting looks like, NoScript just decides it's more important than the possibly turned off DNT setting of the browser.

The whole point of installing an extension is to change the behavior of the browser. If you want this particular change to be more visible, OK; that's a separate issue that has been discussed before, and will probably be implemented eventually, but has not reached the top of Giorgio's to-do list yet. E10s has been keeping him busy. If you really feel strongly about this, then feel free to contact Giorgio (by email or private message) and offer to sponsor it.