Pale Moon forum

Got a pop up this morning saying No-Script Blocked on Pale Moon and when I checked in Add-Ons sure enough it is. Now I am an elderly non tekkie person and have used No-Script and Pale Moon for years but could someone explain why suddenly it is deemed a security risk and possibly offer an alternative option?.. Thanks in advance for any help/advice offered.

^+1


Edit: Oh my God: http://blocklist.palemoon.org/info/?id=pm112
Edit: viewtopic.php?f=46&t=17619

Cross-posted from my reply to the other topic:
It only recommends you don't use it, it doesn't remove your ability to use it. The dialog box says "known to cause stability or security problems" - not that it is a security problem. For some users NoScript can be a pain in the rear with the way websites are these days.

How would I be able to install a replacement such as uMatrix in that case? Without Firefox telling me to install... Firefox.

It's not blocked, it is a rightful warning. And all it takes is NOT selecting "disable" in the dialog and it will remain enabled.
Now, calm down, make the proper selection in your add-on manager confirming you want to use it despite the warning, and carry on as normal. Thanks in advance.

I have been using PaleMoon pretty much since FireFox decided it wanted to be Google Chrome... I signed up for an account on your forum just to come and say this.

Yes I get that NoScript gives you support nightmares.. I've known many NoScript users who have gotten tired of micro managing their scripts for every site..

however, NoScript in PaleMoon is my default browser setup precisely due to the proliferation of sites out there which are malicious and/or which just dump so many ads/ third party scripts into their pages that their sites are dangerous to visit.

I expect NoScript to make any new site I visit for the first time not work right. However, I can fine tune it to allow just the actual site content while blocking all of the superfluous crap and also the downright malicious scripts/sites.. If a site refuses to work, I will make a decision as to whether I trust it enough to run without NoScript and IF I need to use the site badly enough AND I trust it enough, I'll open it in Google Chrome where I don't have NoScript set up.

This has kept me safe from viruses and malware and I understand that the security I receive comes at the cost of having to be quire proficient at figuring out which scripts are necessary and which are ads/tracking/dangerous/unneeded

I don't object to some level of warning.. but i DO object to it being disabled / blocked... If you want to say "hey do you REALLY want to continue? yes/no" fine, but to warn me and have me say no and STILL find you tried to disable it.. this is incredibly heavy handed and frankly disappointing.

You can tell people to have perspective all you want, but the way you went about this is reminiscent of the heavy handedness and tone deafness that drove me away from FireFox. You cared enough about their directly to make PaleMoon.. so I would hope you would have more understanding for your users who by definition are the type who likely get very wrapped up in their browser being "just so"

I chose PaleMoon because I hated the direction FireFox went in ... please don't be like FireFox.

Moonchild wrote:...all it takes is NOT selecting "disable" in the dialog and it will remain enabled...

No actually even after doing that, I found that PaleMoon had tried to tell NoScript to disable itself.

This is part of why people are upset.. unchecking disable doesn't actually seem to resolve the matter.. something still tried to mess with the extension.

DigitalSorceress wrote:I don't object to some level of warning.. but i DO object to it being disabled / blocked... If you want to say "hey do you REALLY want to continue? yes/no" fine, but to warn me and have me say no and STILL find you tried to disable it.. this is incredibly heavy handed and frankly disappointing.

The dialog popping up is exactly what you ask for. It is a choice presented to you to continue with it enabled or to accept the default recommendation to disable it.
Since when is giving you a choice heavy-handed? Disabling silently would be heavy-handed and that is what we decidedly DO NOT do.

So, once again. Calm down.

If there is a bug in the dialog, then please go to github and open an issue for it on the Pale Moon repo, in which you describe the exact steps to reproduce the bug, the expected results and the actual results. As far as we know, the dialog works exactly as it should, but you MUST make the proper choice when presented with it and not just dismiss it.

I too received the PM warning about NoScript today... I choose to ignore that warning and continue to use NoScript.

I've used NoScript for about a year now and will NOT stop using it.

If that means I can no longer request support from either MoonChild or Tobin, then I'll just live with that reality.

NoScript makes my browser faster because it blocks a YUGE(r) number of third party scripts on, sadly, most websites.

I really like the control to say that a particular script may NOT run on my browser.

Yes, I do consider myself competent to use the NoScript configuration tool to adjust, on a per-site basis, what it will allow or forbid. It is not a difficult skill to learn... The alternative is to blindly allow all scripts to run, from any website...

With specific reference to Javascript(r), yes, it is blocked by default and this works for me. Sure, I can (and do) enable it for selected sites, but it (Javascript) IS a dangerous tool. I could wish for a better tool for use in website design, but until the W3G decides to support an HTML native client side scripting utility, Javascript(r) will remain blocked by default.

Moonchild, thanks for the advice even it I choose to ignore it in this case.

Don't get me wrong. The idea behind NoScript is fine -- it's just incompatible with most websites, and the implementation of is causing stability issues in the browser which have been known for a while, have been reported, and have not been solved by the NoScript devs despite their hundreds of releases.

Everyone has the choice and freedom to continue using it if they so wish -- but with the warning that it will cause issues and that our support for anything with the browser will be limited or nonexistent as long as this extension is installed.

There's something not right about that warning dialog. It popped up for me, but I didn't click anything in it. I switched focus to a different program to do something, then when I switched back to PM, the dialog was gone, and NoScript had already been disabled. I looked for it, but it was nowhere to be found. I'm certain I didn't click any of the buttons nor the X in the corner.

saltyseadog wrote:Got a pop up this morning saying No-Script Blocked on Pale Moon and when I checked in Add-Ons sure enough it is. Now I am an elderly non tekkie person and have used No-Script and Pale Moon for years but could someone explain why suddenly it is deemed a security risk and possibly offer an alternative option?.. Thanks in advance for any help/advice offered.

Please be aware that this may be a security risk. It's not recommended.

Disable Plugin Blocklist:

1. Type about:config in the PM address bar. Hit Enter.
2. Go to "extensions.blocklist.enabled"
3. Double click to change the value to "false".

Once again for the love of pete. Quit suggesting that people do this because it will cause more harm than convenience.

Moonchild wrote:To not deactivate in the first place: uncheck the "disable" checkbox when the dialog pops up about it.
To reactivate if you've mistakenly deactivated it by not paying attention and just auto-clicking the button to continue, you can simply re-enable in the add-on manager.

I've had no problems when this popup showed. Simply followed recommended process for dealing with it and all went well. Think disabling the blocklist is not a good idea.

If NoScript causes problems, try YesScript. It works. The difference is that it handles only scripts, and makes a blacklist rather than a whitelist.

Hello,
For me opt-in (my temporary whitelist only policy is less annoying than the amount of bad javascipt I'm exposed to) javascript execution is essential. Javascript is misused or abused by too many sites. I assume we all agree more or less on this point, that'll be why we installed NoScript.

To cut straight to the preferred solution for me, it would be that Pale Moon offers javascript control natively, no plugin needed.

The situation is analagous to the Linux kernel team not accepting bug reports from tainted kernels, and it's for that reason I buy radeon graphics hardware (their OS support is better than nvidia). You have every right to reject support requests from tainted browsers, but to
actively discourage (I guess that wasn't the intent) users from installing "essential" functionality is not the way forward.

On the othe hand Xscreensaver dropped a time-bomb on us, please don't be like him, and yes you do have a right to push back on people like me to help with what is esentially a user education problem.

Thanks for all your work and efforts to provide better software for all.

Respectfully,
MrGiraffe.

First my apologies for my English writing if it has grammar issues, I'm from the Netherlands.

I have only one question:
If I want to install NoScript from its backed up .xpi file (NoScript{5.0.6}.xpi) is it enough to temporarely disable Internet connection to prevent Pale Moon to access its extensions blacklist?

Thanks to anyone who replies to me with an answer!

Goodydino wrote:If NoScript causes problems, try YesScript. It works. The difference is that it handles only scripts, and makes a blacklist rather than a whitelist.

Good grief what next?...maybe script?!!!
why not ublock origin which has adblocking too and is kept up to date with palemoon(for now).
I bet nearly 60% of the rendering issues found on this forum are caused by noscript,i tried it once and it was more trouble than it was worth and you find yourself fixing more sites than actually viewing them and people do not want or need this hassle.Then there is the extra riddle of knowing which scripts to allow and your casual home user will not or does not want to know.I think noscript has had its day.

I have no rendering issues with noscript v 5.1.8.4

Time is running out with umatrix and ublock.

https://www.dslreports.com/forum/r31905 ... ort-for-PM
Keep in mind I plan to drop support for Firefox/legacy once Firefox 60 ESR is released on May 7. This will remove a roadblock for simplifying uBO's code base in many areas.


drop support of Firefox-legacy
https://github.com/gorhill/uMatrix/comm ... 354a266307