Comments on: Block scripts in Firefox

The NoScript add-on will give you some extra control and protection against malicious scripts and ads.

Add a Comment (Log in or register) (27 Comments)
  • prev
  • 1
  • next
by cvaldes1831 June 24, 2009 5:27 PM PDT
As you mentioned, the Internet is a far more dangerous place than it was ten years ago. That's why add-ons like NoScript or AdBlock Plus are really important these days.

It's a safety issue, above all. There's really no way to tell if any given advertiser is doing something unsavory with the data they're collecting (the current adblocking tools do not help with this triage), so it's far more wise to block all ads.
Reply to this comment
by theown3r June 24, 2009 6:30 PM PDT
cnet derives revenue from sponsored ads and banners and this script will block that! ....oh the irony.....interesting, eh?
Reply to this comment
by aMUSICsite June 25, 2009 2:39 AM PDT
Nope, I run NoScript and it does not block (by default) any of the adverts on sites like cnet.

Anyway, if all the adverts get blocked then the advertisers will turn to the text. Every article will be trying to sell you something. (if it's not like that already.)
by fgfgVCV June 24, 2009 6:41 PM PDT
Personally I love NoScript and wouldn't surf without it. I've been less than successful though in encouraging people in my sphere to use it. They get frustrated with having to periodically enable scripts for critical websites.

I'm also a big fan of Adblock Plus. The Web seems incredibly noisy and distracting whenever I use a machine where it's not available.
Reply to this comment
by kmaru100 June 24, 2009 6:49 PM PDT
You might want to point out that NoScript plug-in gets updated almost every day.
That means almost every day when you open FireFox it asks you to update it. It gets annoying.
In addition, every time you do an update, it opens their homepage wich has full of advertising.
Do they want to make the product better every day? or want more exposure to their site? (More $$$)
I don't know.
Reply to this comment
by IsaacEiland-Hall June 24, 2009 7:08 PM PDT
It's not *quite* every day... just seems like it sometimes. However, there's an option in its preferences that -- if you turn off *once*, those will never appear again.. And can you fault them for wanting to monetize their hard work? Especially when the offer a simple way out. A one-time option change. :)
by sethum1 June 24, 2009 7:37 PM PDT
Mozilla ought to offer the exact same functionality as part of Firefox itself, mirroring the way the browser handles pop-ups. Recently, the author of NoScript has used some underhanded programming into his add-on to circumvent other safety add-ons (i.e., Adblock Plus) to push his revenue-generating adds on the hapless user. He may have recanted after the community backlash, but it's still poor form.
Reply to this comment
by Hunnter2k3 June 25, 2009 3:25 AM PDT
It was them that started it first.
One of the adblocking list sites completely buckled the NoScript site to try block the ads, making it unusable.
by sharmajunior June 24, 2009 7:51 PM PDT
WOW...cnet is sooo slow these days. This plugin has been out for over 4 years. I have been using it since it came out.
Reply to this comment
by thelemurking June 25, 2009 7:04 AM PDT
My thoughts exactly! I was wondering if the author might have been living in a cave for the last few years and just stepped outside to find NoScript and AdBlock Plus! These have been in the most popular addons for years.
by saintseminole June 24, 2009 8:14 PM PDT
Just about every site anyone uses these days employs loads of scripts (including this CNET page). This might make sense a few years ago, when much of the script was bad. But now most of the script you see is actually functional for the page.

(By the way, AdBlock Plus also blocks scripts, if you set it to do so... You can pick specific scripts to block. So it kind of makes it useless to have both.)
Reply to this comment
by El_Segfaulto June 25, 2009 10:36 PM PDT
Scripts are still bad. You can whitelist permanently or temporarily on a site or page basis. Adblock for all of its uses does not let me explicitly block certain 3rd party cookies. I do not want people looking over my shoulder as I browse.
by patyork June 26, 2009 9:52 PM PDT
@El_segfaulto

If you don't like people staring over your shoulder, stand with your back to a wall.

Unmetaphorically: Disconnect your internet and don't even risk it.
by maeckg June 25, 2009 12:04 AM PDT
It is time to run internet browsers in a virtual machine by default. Windows 7 taunts users with the virtual XP mode which might be a useful start, but it only runs on the few processors with hardware VT. VMware has some browser appliances, but they are not very current versions and one must iinstall and configure the vm. A lot better security would be available if Windows and Linux would automatically install a virtual machine for the internet; one would still need further controls for scripts and viruses, but it would create a mote around the browser to protect the host.

As more and more web apps, such as Firefox Prism, Adobe Air, Google Apps and MS Silverlight, begin leveraging local resources, it will become really necessary. It could actually make development of web apps faster as well as more secure. I think MS is missing a great chance to provide a desktop hook into the cloud applications.
Reply to this comment
by Hunnter2k3 June 25, 2009 3:28 AM PDT
Luckily for you, browsers are slowly going down that route.

It took awhile, but thanks to browser vendors actually listening to W3C and not caring much for JavaScript, we are left in the current mess we are with having to use manual sandboxing and script-blockers.
Oh, and Microsoft Microsoft Microsoft, can't forget Microsoft trying to kill off JavaScript because it was a threat to the desktop.
by lordmorgul June 25, 2009 12:48 AM PDT
Bravo for the article. Personally I use NoScript and ABP and have for years, but I try to unblock ads from 'reputable' ad sources (google I consider reputable for one example) so that sites I like and visit frequently still get advertising revenue from my page hits.

It is a good idea to have things blocked and stay safe unless you do trust the site though.
Reply to this comment
by lordmorgul June 25, 2009 12:48 AM PDT
Bravo for the article. Personally I use NoScript and ABP and have for years, but I try to unblock ads from 'reputable' ad sources (google I consider reputable for one example) so that sites I like and visit frequently still get advertising revenue from my page hits.

It is a good idea to have things blocked and stay safe unless you do trust the site though.
Reply to this comment
by hutchike June 25, 2009 2:50 AM PDT
This kind of article gives general readers the impression that XSS is a big problem and that they should use plug-ins like NoScript otherwise they'll be at risk. We both know that's not true - that XSS is so uncommon that it almost always becomes a news item on CNET news.com or another site if it ever happens. There are many other risks you might want to tell your readers about, such as using the same password on untrustworthy sites, or clicking links in emails that appear to come from their bank. This "NoScript" plug-in would be better renamed RedHerring or ParanoidSurfer.
Reply to this comment
by umbrae June 25, 2009 7:12 AM PDT
Most exploits could be considered uncommon. This tool does not just protect against XSS. There is plenty that can be done with Javascript even by honest sites. As a developer, I don't want JS to run at all. Call me paranoid by I know what can be done by nothing more than an untrained developer, and those are coming out of colleges by the droves.
by umbrae June 25, 2009 7:05 AM PDT
It is worth mentioning that the author of this plug-in has done some shady stuff himself. His product is supported by Ads on the page that loads after you install or update the tool. He, without notice to users, altered other ad blocking plug ins to allow his ads. Once this was discovered, he came clean and removed this from NoScript. However, everyone should be aware of this historic event.

I use and love NoScript, and continued to use it after the event. However, this shows you cannot trust anyone and you should be aware the author has done things to this product to make it be considered Mal-Ware. He may have learned his lesson and may not do it again, but he did it once so everyone should be cautious.
Reply to this comment
by Issaland June 25, 2009 11:12 AM PDT
Absolutely excellent and must have add on!
Blocked scripts on cnet.com: sphere.com, revsci.net, questionmarket.com. Check this websites on WOT, if you don't know what they are. This sites are all red and dangerous. That's why when you use browser without NoScript and Ad Block you see all ads and pop ups, advertising sometimes rogue software!
You should allow scripts from yimg.com and com.com if you want to see images on the website.
Reply to this comment
by lockerridge June 25, 2009 1:02 PM PDT
Okay, this is all well and good for you people who understand what this is all about.. but I am not nor will I ever be as knowledgable about all this as I need to be. I am so tired of this mess. If it is not spies, it is viruses, and now it is malicous scripts!

I have McAfee Security Suite and it has the ability to stop my machine from running a bad script. It logs all of the bad and harmful scripts it blocks and I have yet to have one on this machine and I have been on the internet for several years now.

I am no longer using firefox or IE or Chrome.. They all are the slowest, most aggravating browsers there are to use. They have so many bells and whistles that I can not keep up with what is slowing it down and what is causing my machine to whine and wheeze when they have so many virtual machines running on the same page that I just went looking and I am now happily using Opera.. I have a Google home page and I am not about to start messing around with the workings of this simple lovely browser..

Thanks for the warning.. but it is just another example of trying to give the public too much control over their settings. I want a browser to drive me to the site and then let me save an image or the entire page for later viewing and that is all I need to have on my toolbar. You give us too much stuff to change when we do not know what it is we are changing.. and you get a major mess!

thanks for letting me rant.
lockerridge
Reply to this comment
by El_Segfaulto June 25, 2009 10:38 PM PDT
To be completely fair, this isn't a run-of-the-mill news site. It's geared towards technogeeks (and I say that with all affection). Would you go to a sports car forum and say that your Corolla is good enough?
by lockerridge June 25, 2009 1:02 PM PDT
Okay, this is all well and good for you people who understand what this is all about.. but I am not nor will I ever be as knowledgable about all this as I need to be. I am so tired of this mess. If it is not spies, it is viruses, and now it is malicous scripts!

I have McAfee Security Suite and it has the ability to stop my machine from running a bad script. It logs all of the bad and harmful scripts it blocks and I have yet to have one on this machine and I have been on the internet for several years now.

I am no longer using firefox or IE or Chrome.. They all are the slowest, most aggravating browsers there are to use. They have so many bells and whistles that I can not keep up with what is slowing it down and what is causing my machine to whine and wheeze when they have so many virtual machines running on the same page that I just went looking and I am now happily using Opera.. I have a Google home page and I am not about to start messing around with the workings of this simple lovely browser..

Thanks for the warning.. but it is just another example of trying to give the public too much control over their settings. I want a browser to drive me to the site and then let me save an image or the entire page for later viewing and that is all I need to have on my toolbar. You give us too much stuff to change when we do not know what it is we are changing.. and you get a major mess!

thanks for letting me rant.
lockerridge
Reply to this comment
by nrlz June 26, 2009 4:33 AM PDT
NoScript slowed down Firefox dramatically. Now I just disable JavaScript outright in the Firefox options. Trust me, it's not worth it. For the sites that require JavaScript to function, I say screw them! If they don't want my business then so be it!
Reply to this comment
by chimpypimpy June 26, 2009 8:22 PM PDT
It's ironic that I can't view this page (Cnet) without using either Noscript or Flashblock.
The scripts on the page freeze Firefox for me.
http://forums.mozillazine.org/viewtopic.php?f=38&t=1149005

Vista Home Premium 64 bit
Intel Quad 2 Q8200
8.0 GB RAM
Reply to this comment
by 0zSpit June 27, 2009 5:20 PM PDT
the add-ons for firefox is one reason i've never switched. noscript, adblock plus, a better privacy, and wot makes it one of the safest browsers. noscript is an excellent tool to block the dreaded google virus, also.
Reply to this comment
(27 Comments)
  • prev
  • 1
  • next
advertisement

About CNET TV

CNET TV is where you get your video fix on the coolest gadgets, the latest gear, and up-to-the-minute tech reviews and news. And the CNET TV blog provides you a behind-the-scenes look at our shows, personalities, and even upcoming site features.

Add this feed to your online news reader

CNET TV Twitter Feeds

CNET TV topics

CNET TV bloggers

Brian Cooley
Molly Wood
Tom Merritt
Justin Eckhouse
Brian Tong

Get the CNET TV newsletter

Would you like a wrap-up of the week's hottest CNET TV videos delivered directly to your in-box? Then sign up for the weekly CNET TV newsletter, delivered every Friday.
Subscribe now!
CNET TV
Site map
Blog
Podcast Central
CNET Live
Buzz Out Loud
The 404
Popular topics
Apple iPhone
Apple iPod
Cell phones
CES 2010
GPS
LCD TV
CNET sites
CNET Site map
CNET TV
Downloads
News
Reviews
Shopper.com
More information
Newsletters
CNET Mobile
Customer Help Center
RSS
CNET API
About CNET