Noscript uses a sledgehammer to do a scalpel's job. It would be much more widely used if it was a little more subtle, and less noticeable as most browser extensions are. Scorched Earth-like blocking is safe, but it very strongly degrades the web surfing experience. I would much rather they use a heuristics-based approach to warn users when potentially malicious scripts were trying to run, than simply block all scripts. I used it for a couple years, but stopped when I realized how annoying it made my browsing experience.
You do realize that NoScript is not "block all scripts", right?
I see so many people criticizing it with no apparent experience or use of it, and this is the primary misconception I see. It is not block all scripts. Why would anyone need an extension for that? You just turn off Javascript in the preferences for that. What it is is a domain-by-domain whitelister.
I can't use Chrome because it doesn't have NoScript, and I end up routinely visiting domains that I didn't even realize have some foreign-loaded script that pops up some crappy survey over the page ("please give us your private info under the guise of providing site feedback we intend to ignore!"), or pops up a flash ad, or who knows what. The web is too irritating to use anymore without it. (And Flashblock.)
Also, NoScripts does have heuristics, but they can't catch already-in-the-page XSS without firing too many false positives. They do have some decent protection against hostile links that have XSS-inducing strings in a query string or something. You can in fact download NoScript and configure it just for that. Personally, I've never had anything but a false positive from that check, but I don't cruise fora where such links are common.
It isn't anywhere near as hard to use as the critics say it is. I know this because I use it on three systems and I don't even bother trying to synchronize the settings somehow; it's more work to synchronize the settings that just use it in all three places.
> I can't use Chrome because it doesn't have NoScript, and I end up routinely visiting domains that I didn't even realize have some foreign-loaded script that pops up some crappy survey over the page ("please give us your private info under the guise of providing site feedback we intend to ignore!"), or pops up a flash ad, or who knows what. The web is too irritating to use anymore without it. (And Flashblock.)
> You do realize that NoScript is not "block all scripts", right?
Actually, I didn't. You do realize that the name "NoScript" implies NO SCRIPTS, right? It shouldn't be surprising that many people think it makes your browser execute "no scripts".
noscript + flashblock + adblock give me a faster browsing experience too. I do disable adblock on nytimes, reddit, google and any other site which provides good content so that it keeps on getting revenue from ads.
Comments
Noscript uses a sledgehammer to do a scalpel's job. It would be much more widely used if it was a little more subtle, and less noticeable as most browser extensions are. Scorched Earth-like blocking is safe, but it very strongly degrades the web surfing experience. I would much rather they use a heuristics-based approach to warn users when potentially malicious scripts were trying to run, than simply block all scripts. I used it for a couple years, but stopped when I realized how annoying it made my browsing experience.
You do realize that NoScript is not "block all scripts", right?
I see so many people criticizing it with no apparent experience or use of it, and this is the primary misconception I see. It is not block all scripts. Why would anyone need an extension for that? You just turn off Javascript in the preferences for that. What it is is a domain-by-domain whitelister.
I can't use Chrome because it doesn't have NoScript, and I end up routinely visiting domains that I didn't even realize have some foreign-loaded script that pops up some crappy survey over the page ("please give us your private info under the guise of providing site feedback we intend to ignore!"), or pops up a flash ad, or who knows what. The web is too irritating to use anymore without it. (And Flashblock.)
Also, NoScripts does have heuristics, but they can't catch already-in-the-page XSS without firing too many false positives. They do have some decent protection against hostile links that have XSS-inducing strings in a query string or something. You can in fact download NoScript and configure it just for that. Personally, I've never had anything but a false positive from that check, but I don't cruise fora where such links are common.
It isn't anywhere near as hard to use as the critics say it is. I know this because I use it on three systems and I don't even bother trying to synchronize the settings somehow; it's more work to synchronize the settings that just use it in all three places.
> What it is is a domain-by-domain whitelister.
Domain whitelisting is useless in situations like this, as sites like Github are likely to be in a frequent visitor's trusted sites list.
> I can't use Chrome because it doesn't have NoScript, and I end up routinely visiting domains that I didn't even realize have some foreign-loaded script that pops up some crappy survey over the page ("please give us your private info under the guise of providing site feedback we intend to ignore!"), or pops up a flash ad, or who knows what. The web is too irritating to use anymore without it. (And Flashblock.)
Have a look at https://chrome.google.com/extensions/detail/odjhifogjcknibka... its basically noscript with some restrictions
This is unrelated, but how did Google manage to produce such awful URLs? Is this just a base-26 encoded GUID? If so, they could've saved a few characters: http://www.wolframalpha.com/input/?i=0xED11C880FA5611DDA6040...
Not that this is something you'd want to do in the first place, because it's hideous.
> You do realize that NoScript is not "block all scripts", right?
Actually, I didn't. You do realize that the name "NoScript" implies NO SCRIPTS, right? It shouldn't be surprising that many people think it makes your browser execute "no scripts".
I suppose. In the same way that GitHub implies an Internet hub for gits.
> In the same way that GitHub implies an Internet hub for gits.
well, isn't it? Kidding, kidding.
It's so much faster though, especially when browsing over a slow satellite link on a netbook.
Mostly I browse to read, and NoScript eliminates a ton of pointless HTTP requests and CPU cycles.
noscript + flashblock + adblock give me a faster browsing experience too. I do disable adblock on nytimes, reddit, google and any other site which provides good content so that it keeps on getting revenue from ads.
Agreed, although I use NoScript + apply-confirmations-to-whitelisted-sites setting and ditched Flashblock.
That's a fair point, but a very limited usage case.
Netbook over 3G would probably show significant gains, and I use it on broadband too, and I still feel a noticeable speed improvement.