Important: NoScript users and our support

Add-ons for Pale Moon and other applications
General discussion, compatibility, contributed extensions, themes, plugins, and more.

Moderators: FranklinDM, Lootyhoof

Phantom

Re: Important: NoScript users and our support

Unread post by Phantom » 2018-05-11, 06:34

I used to swear by NoScript and even donated to it. But over time it just got too cumbersome. So my main line of defense is running the browser in Sandboxie.

Fedor2
Banned user
Banned user
Posts: 704
Joined: 2016-04-11, 01:26

Re: Important: NoScript users and our support

Unread post by Fedor2 » 2018-05-11, 07:17

Well, if its show only the warning, and do not block the extension itself, then nothing is bad, so i had wrong idea about the blocklist.

CdeMills

Re: Important: NoScript users and our support

Unread post by CdeMills » 2018-05-11, 07:53

Hello,
In my opinion, more and more sites fails with NoScript not because of the use of NoScript, but because there is a growing tendency to use third-party content. There are indeed legitimate uses like caching, but the rest is behavioral analysis, web beacons, single-pixel tracking images, advertizing, and so on.

So failures in NoScript are only a symptom. This makes NoScript more and more a necessity today.

From the browser maintainer perspective, I understand this is a nuisance to get lot of bug reports which in reality do not originate from the core functionalities. May I suggest to document it on the support page ?
"If you think a bug occurred, and if NoScript is active, try to enable all javascript on the site first" ?

For the user, NoScript requires some knowledge to fine-tune. And if I get only 80 % of a site working, and the main content displayed, this is enough for me. Ads ? Beurk.

Regards

Pascal

Mehlua

Re: Important: NoScript users and our support

Unread post by Mehlua » 2018-05-11, 09:03

Having read all the pros and cons, can I issue a feature request?

I can totally understand that supporting NoScript is too much for the developers.

I can also understand that the freedom to install NoScript is essential for a free, safe and usable web.

The issue that remains is that users read the blocking as if NoScript is malware. I think that the message is a standard message when an extension is blocked. It would be nice if the block list could have a message per blockage, or a blocking reason, so the developers can explain WHY a certain extension is blocked. This could explain to the "non-power" user that this extension comes with a configuration that must actively be maintained, and that message may actually end up where it belongs: with the "non-power" users that asked for the support.

That the many web sites fail with NoScript activated is not the fault of the extension. As someone in a usenet forum once said:

It is only 99.99% of the web developers that make the rest look bad!

User avatar
hitokage
Fanatic
Fanatic
Posts: 101
Joined: 2014-05-03, 02:19
Location: Frederick, MD

Re: Important: NoScript users and our support

Unread post by hitokage » 2018-05-11, 09:52

To everyone who missed it - this topic was started five months ago (December 2017) by Moonchild, so this is nothing new.
Last edited by hitokage on 2018-05-11, 09:53, edited 1 time in total.

Archer

Re: Important: NoScript users and our support

Unread post by Archer » 2018-05-11, 09:59

Except that, as of today, Pale Moon has now added NoScript to the blacklist and attempted to disable it without my requesting it do so.

To give me a warning that NoScript is known to cause stability issues? Fine, I was aware of that anyways. But to try and automatically disable the extension? Yeah, you bet I have an issue with that.

fillerup

Re: Important: NoScript users and our support

Unread post by fillerup » 2018-05-11, 10:18

Archer wrote:Except that, as of today, Pale Moon has now added NoScript to the blacklist and attempted to disable it without my requesting it do so.

To give me a warning that NoScript is known to cause stability issues? Fine, I was aware of that anyways. But to try and automatically disable the extension? Yeah, you bet I have an issue with that.
precisely, along with the malware warning as well. seems like nothing was learned from the AdNauseum debacle. major blow to my trust in the PM team

User avatar
hitokage
Fanatic
Fanatic
Posts: 101
Joined: 2014-05-03, 02:19
Location: Frederick, MD

Re: Important: NoScript users and our support

Unread post by hitokage » 2018-05-11, 10:28

It only recommends you don't use it, it doesn't remove your ability to use it. The dialog box says "known to cause stability or security problems" - not that it is a security problem. For some users NoScript can be a pain in the rear with the way websites are these days.
Last edited by hitokage on 2018-05-11, 10:34, edited 4 times in total.

Archer

Re: Important: NoScript users and our support

Unread post by Archer » 2018-05-11, 10:44

Except it didn't just recommend I not use it. Pale Moon actively tried to disable NoScript without me initiating that process, even after I unchecked the disable box and hit Restart Later.

To acknowledge Pale Moon's warning to indicate that I still wanted to use NoScript, and then get a warning from NoScript about it being turned off regardless, is wrong. If I wanted a browser to nanny me, I would have stuck with Firefox instead of switching to Pale Moon.
Last edited by Archer on 2018-05-11, 10:48, edited 1 time in total.

Fedor2
Banned user
Banned user
Posts: 704
Joined: 2016-04-11, 01:26

Re: Important: NoScript users and our support

Unread post by Fedor2 » 2018-05-11, 10:46

On the vanilla latest pm for testing, i get successfully installed noscript 5.1.8.5, confirmed noscript entry inside its blocklist as well <emItem blockID="pm112" id="{73a6fe31-595d-460b-a920-fcc0f8843232}"> which was not there before. But its do nothing, no even the warning. So what is this selective blocking?

BugRepor42

Re: Important: NoScript users and our support

Unread post by BugRepor42 » 2018-05-11, 11:00

Like others, the main reason I use Pal Moon is due to NoScript. People who install it fully understand what it does, and are perfectly fine with loss of usability due to tremendous gain in security.

Now you try to nuke NoScript, well I am gone. I use Pale Moon BECAUSE it supports NoScript, not other way around.

BugRepor42

Re: Important: NoScript users and our support

Unread post by BugRepor42 » 2018-05-11, 11:04

Archer wrote:Except that, as of today, Pale Moon has now added NoScript to the blacklist and attempted to disable it without my requesting it do so.
Same thing. Opting out out of this disable didn't work for me.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35402
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Re: Important: NoScript users and our support

Unread post by Moonchild » 2018-05-11, 11:21

It's level 1, meaning you get warned. You can re-enable it, and that's that.

The fact that we leverage the blocklist for an extension that is known to cause stability issues (READ the warning in the add-on manager, please, it clearly says "security or stability") is nothing new; the fact that the browser can no longer do its core job and gets plagued by all sorts of unrelated issues when the extension is installed clearly makes this a stability issue that people must be made aware of beyond this one thread on the forum.

Now, you can go an get on your high horse and start complaining that our 12 custom blocks out of the 24.7k extensions out there are unacceptable, or you can save everyone (including yourself) nerves and time by simply confirming in the add-on manager that yes, you really DO want to use NoScript.
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

Weasel
Apollo supporter
Apollo supporter
Posts: 35
Joined: 2016-10-10, 15:59

Re: Important: NoScript users and our support

Unread post by Weasel » 2018-05-11, 11:45

How do I disable Palemoon from blocking NoScript or popping up the message? (manual setting please). Someone said "extensions.blocklist.enabled;false", does this suffice? This should be mentioned in the first post, IMO.

My opinion: I don't care if NoScript breaks websites, or disabling JS. I'd rather have a few sites broken than JS enabled behind my back, simple as that. Don't worry though, I will make sure before I report a bug to completely remove NoScript in a testing profile, just in case. In fact, that's what you should have done instead of suggesting to disable an essential extension (this is not about convenience it's about SECURITY). You should have added a HUGE WARNING sign when posting bugs on forum that they should completely remove NoScript before submitting a bug. This is what many projects do, which allow 3rd party plugins or extensions. Disabling the extension is just bad practice, but whatever, as long as i can disable that stupid popup, it's fine.

Would be really cool if you guys added selective-JS-disabling directly into the browser (and blocked by default, which is the only sane security practice, everywhere), but I know it's not gonna happen. Then we wouldn't have to worry about essential extensions "breaking stability". I mean, the fact so many people use it is because people are sick of Javascript and bloated websites and want a simple solution, whether that's uMatrix or NoScript.
Last edited by Weasel on 2018-05-11, 11:46, edited 1 time in total.

Fedor2
Banned user
Banned user
Posts: 704
Joined: 2016-04-11, 01:26

Re: Important: NoScript users and our support

Unread post by Fedor2 » 2018-05-11, 12:01

Finally i got my warning too, why it is that late is another question, so if this is one time jog thing click to clear disable and forget.

Set extensions.blocklist.enabled;false to disable that totally.

User avatar
tlaloc77
Moon lover
Moon lover
Posts: 76
Joined: 2015-11-30, 20:15
Location: Germany

Re: Important: NoScript users and our support

Unread post by tlaloc77 » 2018-05-11, 12:05

fillerup wrote:
Archer wrote:Except that, as of today, Pale Moon has now added NoScript to the blacklist and attempted to disable it without my requesting it do so.

To give me a warning that NoScript is known to cause stability issues? Fine, I was aware of that anyways. But to try and automatically disable the extension? Yeah, you bet I have an issue with that.
precisely, along with the malware warning as well. seems like nothing was learned from the AdNauseum debacle. major blow to my trust in the PM team
Agreed. This is the 2nd day in a row where this nag screen popped up. I came here to ask: How can I get rid of it, once and for all?
I guess this is the answer:
Fedor2 wrote:Set extensions.blocklist.enabled;false to disable that totally.
Thank you, Fedor2!
But if that's the only way, it's a bad design decision on behalf of the Palemoon team. Unless this setting would reset itself which would be an even worse design decision...

I understand that you don't want to give support if it's enabled or even there. That's fine, I have another profile without add-ons for cases when this is needed. Getting a warning ONCE is fine, too, but every day, already prepared to disable it? Not fine at all.

Palemoon is my main browser, and AS SUCH it is my intention to block scripting BY DEFAULT and AS MUCH AS POSSIBLE. I'm also fully aware that this has a high potential to break sites. As I already said, I have another profile in case I need other conditions, so trust me, I know what I'm doing - mostly.

That said: "Security issues"? What are these exactly?
I can understand that it may cause stability issues and (by working 100% as intended) break web sites, but how could it create security issues and which ones??

Also, can you suggest an alternative except "YesScript" (doesn't block scripts by default) and "uMatrix" (I tried and didn't manage to get it to do the same thing "NoScript" does)?
If not:
WHAT SECURITY ISSUES DOES IT CAUSE?
because NOT having it will cause some security issues on its own, so I'd like to have very good reasons to trade one kind of security issues against another kind of security issues.
Last edited by tlaloc77 on 2018-05-11, 12:11, edited 1 time in total.

coupdeforce
Newbie
Newbie
Posts: 6
Joined: 2016-01-19, 23:08

Re: Important: NoScript users and our support

Unread post by coupdeforce » 2018-05-11, 12:37

I agree with everyone else. If you want to make your own method for selectively disabling javascript, that would be great. If you have any suggestions for other extensions that are as good at selectively disabling javascript, that would be great. Otherwise, this recent action only serves to make us not trust your extension blocklist. I had to disable the blocklist so that I can continue to trust Pale Moon as a whole again. I'm sure that was not your intention, but you created a situation where we can either not trust Pale Moon or not trust the extention blocklist.

It's not about us being on a "high horse" as you said, because the Add-ons Manager still flags it as dangerous based on the blocklist and the notification can continue to pop up at any time. It's about us still wanting to trust Pale Moon, and disabling the blocklist now is the only way to do that. I would certainly enable it again if NoScript is removed or if there is a suitable alternative, because there is no problem with the other 11 extensions being on the blocklist. I remember when Ad Block Plus was disabled for good reason, and you told us about uBlock Origin which is a great alternative and has been working well for years since then. I hope you can rethink your treatment of NoScript without a suitable alternative, for the majority here who know how to use such tools without blaming Pale Moon.

New Tobin Paradigm

Re: Important: NoScript users and our support

Unread post by New Tobin Paradigm » 2018-05-11, 13:17

Level 1 status means it is an add-on that is known to cause security OR stability issues Which it is.

By default this will not even disable an extension. It will only put a warning in the Add-ons Manager.
Last edited by New Tobin Paradigm on 2018-05-11, 13:33, edited 2 times in total.

coupdeforce
Newbie
Newbie
Posts: 6
Joined: 2016-01-19, 23:08

Re: Important: NoScript users and our support

Unread post by coupdeforce » 2018-05-11, 13:30

New Tobin Paradigm wrote:
New Tobin Paradigm wrote:Level 1 status means it is an add-on that is known to cause security OR stability issues. Which it is.

By default this will not even disable an extension. It will only put a warning in the Add-ons Manager.
Since you presumably don't use NoScript, you weren't getting the incessant dialog pop-ups with the checkbox to disable already checked. Disabling the blocklist seems to be the only way to prevent that.

ardouronerous

Re: Important: NoScript users and our support

Unread post by ardouronerous » 2018-05-11, 13:31

Just found out about this issue after I just did my usual browser refresh, as in I delete my profile and begin anew, I do this every couple of months.

Anyway, when I tried to install NoScript, Palemoon totally blocked it, as in there is no option to install.

After reading the comments made here, it would've been nice to have the option to 'use NoScript at your own risk' instead of going 'about:config -> extensions.blocklist.enabled -> false', because while I disabled the blocklist to install NoScript, I'm a little weary of disabling the blocklist in the first place because there could be other extensions in that blocklist that could be harmful to Palemoon, so instead of disabling the blocklist as a whole, is there a way to manually edit the blocklist to remove NoScript from it?
Last edited by ardouronerous on 2018-05-11, 13:33, edited 1 time in total.

Locked