Firefox Quantum: Noscript now has popups?

[Malorn]

I eagerly downloaded noscript as soon as the new version was available, expecting a return to the comfortable security I've enjoyed for the past two years. I installed it confidently and then went about my browsing business. Then, suddenly, a strange thing happened...I saw a flash of a small window opening and in horror I looked upon the dreaded specter of a POPUP! For a moment I felt cold, then curious at this rare occurrence I had not seen for many a year. I looked, afraid to see what manner of horrid ad had breached my defense. Then I realized it was noscript. I read it, and thought, 'ah, what an odd thing. I suppose odd things happen every so often.'

Then it happened again, on a different site. Then again, and then again. Now each of these popups was rightfully informing me of a possible problem that was blocked on the page in question, they said "NoScript detected a potential Cross-Site Scripting attack". But these are popups...the entire purpose of noscript is to prevent unexpected popups from showing up and blocking my vision, requiring my attention to close. Where did the peaceful, happy noscript of just one month past go? The noscript with which I browsed these self-same sites, with no strange and jarring popup. With it I could open a quiet list of what it had blocked, should I find a need to, and otherwise browse unimpeded...

I can find no similar familiar list now...so I fled to the options, thinking this was a some new extra informative mode which had come enabled by default, yet I found no options to speak of. Indeed I saw no way to enable or block scripts individually on each website in real time, one of the best features of noscript.

I ask, without malice, what is this? Are these features merely delayed, due to firefox's changeover? Surely I should not be receiving popups for every small concern noscript has? Were this one unique circumstance it would be one thing, but these are constant. Youtube, Crunchyroll, Paradox forums, nearly every third site I visit. Nor are they one-time only, they return every time I visit. While I know these popups are merely to inform me, they remain disruptive. Is there some option I have failed to see, some mistake in installation I have made? Inform me, please.

[Malorn]

Humor aside, obviously I could prevent this by disabling 'Sanitize cross-site suspicious requests" but I do rather want that functionality, just not to be informed in every single case it is used. The help options would reveal an option, namely:

Can I turn off Anti-XSS activity notifications?
A: Yes, you can, just toggle the Noscript Options|Notifications|XSS preference. Of course you will still able to monitor NoScript Anti-XSS activity log in the Browser Console (Firefox) or Error Console (SeaMonkey), and you will get an extra "XSS" menu inside the NoScript contextual menu whenever an XSS attempt is detected, featuring all the actions usually accessed from the notification bar.

Sadly I can find no such notifications section, and thus cannot toggle it.

[Turing63]

Just found this thread and am hoping to get a response in regards to how to "toggle the Noscript Options|Notifications|XSS preference", which I haven't been able to find...

[Pansa]

I would venture a guess that the FAQ hasn't been updated to reflect 10.0.x fully.

I think that part of the faq is outdated. (there are other parts concerning ABE as well, which isn't currently accurate either)

[gilcu3]

It seems it has not been implemented yet Please the first person to notice that feature in a future version post here so that interested users get "notified"

[Sufficentlynotified]

Holy fuck please fix this quickly. How such a glaring issue has been overlooked is beyond me. The noscript popups are driving me insane.

[Giorgio Maone]

There's no option (yet?) in NoScript 10 to entirely suppress notifications, but there are two completely new ones on the warning window itself to either "Always allow" or "Always block" suspicious request from the origin to the destination involved, silencing that interaction for ever.
I guessed it made more sense than just breaking a website without any explanation or recurse.

[Malorn]

The issue being that it will only apply to that one interaction. Meaning that you still pick up popups constantly as you encounter new sites. With all due respect, this obviously should merely be attached to the existing list of blocked content, rather than create a separate popup window.

[Giorgio Maone]

this obviously should merely be attached to the existing list of blocked content, rather than create a separate popup window.

Not quite obvious, since it's much more nuanced that "I've just blocked this because it's a script", but that's definitely an interesting idea to be developed, thanks.

[Malorn]

It occurs to me that I have not fairly explained why the popups are so disruptive. This is especially the case for me as it overwrites all my 'recently closed windows' with popup closures. That may seem like a small thing, of course, but it is my personal reason. Others may have other reasons, of course.

PS Is it just me, or has anyone else noticed that facebook is CONSTANTLY on the popup, from just about every site. Even sites I thought had no ties to facebook at all. It seems facebook really likes it's cross-site requests.

[FranL]

Is it just me, or has anyone else noticed that facebook is CONSTANTLY on the popup, from just about every site. Even sites I thought had no ties to facebook at all. It seems facebook really likes it's cross-site requests.

I don't see the XSS popups on Facebook. It may be due to having uBlock Origin installed, which blocks lots of content (not just ads) from various sites. Or it could be due to these custom uBlock Origin rules I added:

Code: Select all

||facebook.com/$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net
||facebook.net/$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net
||fbcdn.com/$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net
||fbcdn.net/$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net

The above custom uBO rules block all requests to those four FB domains unless they originate from a page loaded from one of those four domains.

A similar effect can be achieved using NoScript's Application Boundaries Enforcer (ABE), but ABE has yet to be ported to NoScript 10.x.