PM x64 33.x crash with noscript

[cartel]

both 33 versions do it. 32.5.2 doesnt
been using noscript over 10 years and never had issues before
PM will not crash when noscript is disabled

https://9xbuddy.in/process?url=https%3A ... 1456915718

this link I click

2024176.jpg

windows 7

Faulting application name: palemoon.exe, version: 6.6.0.8791, time stamp: 0x65b36ab8
Faulting module name: xul.dll, version: 6.6.0.8791, time stamp: 0x65b36c84
Exception code: 0xc0000005
Fault offset: 0x0000000000849dff
Faulting process id: 0xf28
Faulting application start time: 0x01da6cb65d63a83c
Faulting application path: C:\Program Files\Pale Moon\palemoon.exe
Faulting module path: C:\Program Files\Pale Moon\xul.dll

2024175.jpg

then to top it off I get these popovers without noscript and when I try to inspect element it redirects the developer tools to debugger.

2024177.jpg

[cartel]

expected behavior:

the tiktok link is blocked

2024178.jpg

I allow it the video plays:

2024179.jpg

the popover spam is blocked by noscript and I am protected

2024180.jpg

[andyprough]

Use eMatrix instead, it works well and is actively maintained: https://addons.palemoon.org/addon/ematrix/
Takes about a day of using it to get used to it in my experience, but I like the interface and the experience better than noscript.

Noscript legacy add-on has been known for years to cause crashes and profile corruption with Pale Moon: viewtopic.php?f=46&t=17619

[Moonchild]

Cartel you've been around here for a very long time now with almost 500 posts to your name.
Why on earth are you still not understanding we... do... not... support... installations... with... NoScript?
It is well-known it causes stability issues, not in the least because it can block browser-internal scripts literally breaking the application. Yes that includes appcrashes. Undefined behaviour with blocked components or components having been yanked out from under a running script driving the UI can also lead to exploitable security issues.

[andikay]

I just stumbled across the same issue, PM 33.0.1 x64 (can't say anything about 33.0.0 since I only used it for a few hours because of crashes before reverting to 32.5.2) with NoScript crashes as soon as you want to load a video file in the URL bar. I know you guys don't support NoScript, yet it's been one of the main addons for quite a number of people for a lot of time.

I will look at ηMatrix when I have time, but for now it's back to 32.5.2 again.

[therube]

with NoScript crashes as soon as you want to load a video file in the URL bar

Confirmed.


That said, whether a particular extension is supported or not, I'd think the correct action would be that an extension should not be able to crash a browser. (And granted, extensions have full ability to do anything, but still...) And if not NoScript, then what (next) extension will it be (to cause the same)? IMO.

[Moonchild]

That said, whether a particular extension is supported or not, I'd think the correct action would be that an extension should not be able to crash a browser.

Now you're thinking Web Extensions.

I totally disagree. Browser extensions that get broad powers to change and manipulate the browser's inner workings (like our extensions do) can and regularly have crashed it -- that is simply the trade-off of letting extensions extend the browser with custom code. This is why we have a good number of them on our extension blocklist (usually for specific versions). If NoScript in its current state readily and reproducibly crashes the browser with basic use (which directly opening of a media URL is) then the solution is to hard-block it until someone updates it to avoid these crashes.

EDIT: the blocklist has been updated for v33
If someone updates NoScript to solve this issue, please let me know the new version number from which it no longer crashes and I'll update the blocklist accordingly.

[oinkoink]

Hasn't this issue been gone over again and again? Users do not want NoScript to be hard-blocked with no possibility of override. Users especially do not want NoScript to suddenly be hard-blocked with zero notice.

The last time NoScript caused a crash in handling mp4 files, you fixed it in the browser code. I appreciate that you do not want to keep doing it, but please do not hard-block extensions that a large number of users rely on, especially with no notice. If the policy is that NoScript will be permanently disabled and users must find an alternative, I would think a major version upgrade would be the place to do it, with a release note. The existing policy has been to just allow it to crash, so this is a fairly big change for people who have a track record of preferring NoScript to stability.

[andyprough]

Users do not want NoScript to be hard-blocked with no possibility of override.

Good thing for you then that you can over-ride the blocklist. Tools-Preferences-Security, set the Add-on security level to "Off: No add-ons will be blocked (dangerous)".

Screenshot from 2024-03-04 17-52-24.png

However, you should still switch to eMatrix. It's in active development and it's just simply better than this 7-year-old abandoned version of noscript.

[oinkoink]

Users do not want NoScript to be hard-blocked with no possibility of override.

Good thing for you then that you can over-ride the blocklist. Tools-Preferences-Security, set the Add-on security level to "Off: No add-ons will be blocked (dangerous)".

I wasn't aware of this, thanks!

[andikay]

In the end it always takes two to Tango and neither the extension alone nor the browser alone causes the crash. Like stated, when this occured previously you fixed the issue with an update and that is certainly one of the reasons why many people use this browser - the option to use the older FF extensions and that you guys listen to the users.

[athenian200]

In the end it always takes two to Tango and neither the extension alone nor the browser alone causes the crash. Like stated, when this occured previously you fixed the issue with an update and that is certainly one of the reasons why many people use this browser - the option to use the older FF extensions and that you guys listen to the users.

Well, in that case the fix was really obvious and easy. In this case, it's not as clear what is causing the NoScript crash... and we don't want to put a lot of development time into fixing NoScript crashes. If you or anyone else using NoScript wants to look over the source code and provide a fix, well... that might be a different story.

I will say, and it's rare I ever say this to users... but if you care that much about NoScript, you should, indeed, just use your ancient version of Pale Moon 32.5.2 forever. I'm afraid it is the right solution... it's the job of extensions to adapt themselves to the browser, and if NoScript isn't doing that, that means it is only adapted well enough to the old version of Pale Moon, and if you want NoScript over Pale Moon, then you'll have to make a choice.

Just say no to NoScript.

[moonbat]

Hasn't this issue been gone over again and again?

Oh indeed it has. And we are sick of telling people that the older version of NoScript that's compatible with Pale Moon (as in can be installed due to not being a Web Extension) has long been abandoned by its own developer(s) in addition to irreversibly fucking up your Pale Moon profile. Go and try pleading with them to get it to work with Pale Moon, or get cracking on fixing it yourself.

Or choose the far easier and supported path of moving to eMatrix.

In the end it always takes two to Tango and neither the extension alone nor the browser alone causes the crash.

Never let NoScript anywhere near my profile, never had any crashes. And as has been pointed out millions of times already - extensions have to keep up with the browser and not vice versa.

And if after all this you still insist on using a broken extension - stay away from these forums for any sort of technical support and deal with all your problems by yourself. Our time (especially that of Moonchild and others who work on the browser codebase) is precious and better spent on assisting other people who can follow instructions instead of grimly sticking onto an older browser version for the sake of a broken old extension until the heat death of the universe .

[oinkoink]

Hasn't this issue been gone over again and again?

Oh indeed it has. And we are sick of telling people that the older version of NoScript that's compatible with Pale Moon (as in can be installed due to not being a Web Extension) has long been abandoned by its own developer(s) in addition to irreversibly fucking up your Pale Moon profile. Go and try pleading with them to get it to work with Pale Moon, or get cracking on fixing it yourself.

That's fine. What's not fine is it suddenly, randomly disabling itself in the middle of my day with no evident way to get it back.

Or choose the far easier and supported path of moving to eMatrix.

Let's be real, there hasn't been a meaningful commit to eMatrix's repo in 2 years and its upstream project is officially abandoned. It is far from "actively developed." Please understand that for people who use NoScript, it's critical security software -- by far the best thing you can do for your computer's security in toto is to have scripting off in your browser. Switching out such a key component is not generally done lightly, and its sudden absence is an emergency.

[moonbat]

Let's be real, there hasn't been a meaningful commit to eMatrix's repo in 2 years and its upstream project is officially abandoned.

And? What does it lack that you expect the sort of demented rabid release that Chrome and Firefox mandate by breaking things with every update? This browser isn't like those retarded ones; it offers a stable and mature platform for extensions. The upstream project was abandoned for this very reason, given the upcoming manifest changes Google has proposed; it is by the same developer as uBlock Origin and presumably he has his hands full with that extension alone.

And eMatrix is very much alive and maintained by forum user vannilla - the fact that he doesn't update it every week doesn't mean it's abandoned.

Please understand that for people who use NoScript, it's critical security software -- by far the best thing you can do for your computer's security in toto is to have scripting off in your browser.

This bit is comedy gold. You have a problem with eMatrix not being maintained (which is patently incorrect), but you would rather use a cRiTiCaL sEcUriTy sOftWaRe that has actually and officially been abandoned for use on this browser?

And that is exactly how eMatrix works - not just scripting but cookies (reading previously set cookies on other sites, not just setting 3rd party ones), frames, CSS, images, media, and background XMLHTTPRequests - nothing is allowed on any website by default and you have to explicitly whitelist what you want the first time you visit any site after installing it.

[andikay]

Just say no to NoScript.

I have tried eMatrix last night, I am not very fond of the UI and the lack of a status bar display like the legacy NoScript has. I also could not find some options that NoScript has, such as blocking @font-face by default, etc. . Even switching gstatic to red did not help. There also seems to be a lack of documentation what certain things do.

And if after all this you still insist on using a broken extension - stay away from these forums for any sort of technical support and deal with all your problems by yourself. Our time (especially that of Moonchild and others who work on the browser codebase) is precious and better spent on assisting other people who can follow instructions instead of grimly sticking onto an older browser version for the sake of a broken old extension until the heat death of the universe .

Don't worry, it's widely known that you are not interested in being helpful. And your statement seems more like you are part of your so-hated Google Chrome consortium than anything else. But I certainly can see my error here and have fixed it now, thanks.

[Moonchild]

In v33 NoScript is causing crashes with basic operations that are not intermittent and cannot be worked around. Blocking at this point was the only option.
As said if you come up with a solution, I'll be happy to adjust the blocklist accordingly (with an extension update (greatly preferred) or possibly a core change, patches welcome in that case) but as it is now the extension is causing crashes and data loss for users with basic use of the browser, so must be blocked.

Capable alternatives exist. You can use those, or you can use v32 of the browser in the interim for as long as you're not willing to consider alternatives to NoScript. We serve separate blocklists for major milestones for a reason.

[andyprough]

I also could not find some options that NoScript has, such as blocking @font-face by default, etc. . Even switching gstatic to red did not help.

Block remote fonts with uBlock. See https://github.com/gorhill/uMatrix/issues/480

There also seems to be a lack of documentation what certain things do.

eMatrix is a fork of uMatrix, and I've found that nearly all the documentation for uMatrix applies: https://github.com/gorhill/uMatrix/wiki

I am not very fond of the UI and the lack of a status bar display like the legacy NoScript has.

I haven't used it for a long time, I don't recall what the noscript status bar display is or does unfortunately.

[therube]

An extension crashes a browser doing a basic task, block it.
I've got to agree with that.

That it wasn't known, is expected, as NoScript (specifically, extensions more generally) are not tested for their compatibility with the browser.
Crashes the browser, block it.

Yes, there was a time before where this happened, & something changed that the crashes stopped.
Will it happen now, no telling.


What if someone who knows *matrix were able to replicate some of NoScripts default whitelist domains (really an update I'd expect would be necessary) such that a NoScript user transitioning to *matrix can start with some base that they're more familiar, & some pointers how to do specific tasks that NoScript provides a GUI option for. Might help. (From some time back, if I recall, I was rather confused by the *matrix UI, so would it be as "easy"... maybe not, but maybe over time...)

[Plume]

I thought maybe I'd just bring up a reason why some users don't use eMatrix. I have tried it, I simply can't use it. I am visually impaired. I have tried it. Unlike NoScript, eMatrix does not seem to follow the browser's.. gui? Font size? I am not sure of the technical terms. What I know is that NoScripts dropdown menu has the same font size as the other menus in Pale Moon. EMatrix's dropdown menu has a smaller font size. I have gone into the settings and set the font size slider to the rightmost level "bigger" but that font is still not large enough for me to be able to read it. I have tried changing it in about:config but I guess the setting is hardcoded to not go above 96px.
Furthermore I have to run my computer in high contrast mode, which eliminates a lot of colours. Whether i set eMatrix to colourblind friendly or not in the settings makes no difference, the menu doesn't show any difference between allowed or disallowed connections.
So, I am stuck with NoScript. I realise I can't expect extensions to cater to my specific needs. I don't know if anyone here is working on eMatrix's Pale Moon version and would be able to do anything about these specific problems? I imagine it is not something that will happen.
I understand that using NoScript has risks and downsides, but I am willing to accept those because the alternative would be just allowing all scripting everywhere or no scripting anywhere, and I don't feel comfortable with that.
Just my 2 cents. So far I don't think I have had real problems with NoScript on Pale Moon. I keep a rolling backup of my profile folders, I don't mind firing up a Firefox browser now and then if something doesn't work. I don't know what I'd do without Pale Moon. There are no other browsers that come close when it comes to accessibility for me. I am thankful for the work that is being done.