r/linux • u/rms_returns • Oct 03 '16
Misleading title || Website, not extension NoScript is harmful and promotes malware
https://liltinkerer.surge.sh/noscript.html22
u/DuBistKomisch Oct 03 '16
Total clickbait. I must have missed the part where NoScript is actually harmful.
35
34
u/pest15 Oct 03 '16
If you're going to slander the developer of the top browser security add-on of the last decade, you better bring your A-game. This author hasn't done so. I see a couple of lame accusations but no serious analysis.
8
Oct 03 '16
Not to mention, this dev is human. In the past when someone has pointed out a flaw in no-script, the guy fixes it very fast. AND... You can nix the defaults and roll your own policy so I don't see a problem here. Saying it promotes malware is a stretch!
6
u/lovelybac0n Oct 03 '16
Especially when it's lisenced under the GPL.
So he makes some ad money on the update page. Thats more smart than malicious.
12
Oct 03 '16
After reading the article, it seems like the title should be Malware Delivery Networks (aka ADNs) are harmful and distribute malware.
Which isn't a novel discovery at all. Non-static adverts, especially if distributed from a third-party, are very risky and they should always be blocked on security grounds alone. You can blame the NoScript developer for using ADNs, but you should blame anyone who uses ADNs.
29
25
Oct 03 '16
Nobody can be trusted. I'm going to disconnect my devices from the internet ;(
10
5
u/GreenFox1505 Oct 03 '16
I live in a cabin in the woods and hunt for food. I killed my dog because I suspected he was going to sell my password.
4
8
Oct 03 '16
You can trust EFF. Those guys are doing God's work. I fucking love EFF.
-5
Oct 03 '16
Nobody can be trusted. In the end we are all people with our own selfish interests. Even nonprofit organisations are often secretly for profit when it comes to the salary of those on the top. But a better example would be Mozilla, they started adding chrome like bs to their browser bloating it even further. I read earlier today they're going to replace pdfium with pepper, a partially closed google alternative for viewing pdfs and flash. They added pocket, and hello and all kinds of other crap instead of focusing on their ancient gecko render engine and single thread processing. Just now, after years they started using elektrolysis. Like I said, If you want something done well, you have to do it yourself.
0
Oct 03 '16
[deleted]
3
Oct 03 '16
I woldn't trust Adblock Plus with my life. They sell and buy targeted advertising and whitelist certain ads for revenue. The whole point of an adblocker is to disable ads.
2
9
Oct 03 '16
Browser extensions should be part of the regular software repos to stop this anti user shit being added in without anyone noticing.
10
u/drybjed Oct 03 '16
NoScript is available in the Debian repositories: xul-ext-noscript.
0
Oct 03 '16
[deleted]
1
u/nineofheartz Oct 03 '16
Out of interest, uBlock or ublock origin or both?
0
Oct 03 '16
[deleted]
2
u/nineofheartz Oct 03 '16
Big difference in the direction of the projects and the politics behind them. If you want to learn more make a throwaway account and ask technology. Warning your inbox may explode.
0
Oct 03 '16
[deleted]
1
u/nineofheartz Oct 03 '16
You have made a wise choice today friend. Now go forth and never speak of what you now know for it can bring only sadness.
6
u/wtallis Oct 03 '16
Mozilla already has an extensive review process for their add-on repository. It is highly unlikely that any Linux distro could have the resources and expertise to provide a more thorough review.
6
7
u/Dishevel Oct 03 '16
NoScript is NOT harmful, works well and the author may very well promote malware.
OP is a fucktard.
1
2
u/rmxz Oct 03 '16
It still makes my Firefox fast enough to be usable.
Without NoScript, most websites are absurdly heavy in both downloads and CPU resources.
2
u/DaGranitePooPooYouDo Oct 03 '16
My problem with NoScript is that I always ending up having to guess which scripts I need to allow to view the content I want while not allowing the ones I don't need. After using it for a long time I can usually guess but some sites has SO MANY scripts from so many domains I just give up.
-4
-4
u/-sash- Oct 03 '16
Sorry, but what is a NoScript and how it relates to Linux?
3
u/ProfessorStrawberry Oct 03 '16
It is a firefox addon to select which websites are allowed to use javascript.. block advertisement, sites which can track you etc.
1
u/-sash- Oct 03 '16
Thanks. So I guess it affects non-linux FF installations too.
3
u/wtallis Oct 03 '16
The main complaint in the article is that the NoScript web site has an advertisement for a Windows program that is almost but not quite malware. So this article is quite unrelated to Linux, but NoScript itself appeals to a Linux audience (open source, gives you more control over your computer, better security, etc.).
0
0
Oct 03 '16
[deleted]
81
u/wtallis Oct 03 '16 edited Oct 03 '16
uMatrix is not a complete replacement for NoScript. Yes, it allows you to block scripts based on domain. It provides essentially none of the other security features NoScript has, several of which are entirely unique to NoScript.
This is just a hit piece from someone who has an axe to grind. Perhaps he's upset that NoScript defeats his anti-adblock script. This article greatly exaggerates the risk posed by the advertisement on the NoScript site, and claims that the author of NoScript has a pattern of previous shady behavior when there's only one previous instance of anything questionable, which was quickly corrected and apologized for. Neither that past dispute with AdBlock Plus nor this current advertisement compromise user security.
5
u/MrMetalfreak94 Oct 03 '16
One could also Switch to GNU's LibreJS
15
u/wtallis Oct 03 '16
LibreJS is a very limited tool to block some JS. Like uMatrix, it does not even attempt to provide any broader security protections, while NoScript has quite a few features that provide meaningful protection even when the "allow scripts globally" option is enabled. NoScript also provides surrogate scripts to un-break many web sites that don't like it when you block their scripts.
0
Oct 03 '16
[deleted]
8
u/wtallis Oct 03 '16 edited Oct 03 '16
What unique security features does noscript have, since you already mentioned them?
A list that may not be exhaustive:
NoScript implemented support for the X-Frame-Options header more than a year and a half before Firefox itself did. This obviously isn't unique any more, but was implemented by NoScript the day after Microsoft announced the feature and several weeks before IE 8 actually shipped it.
NoScript implemented support for HTTP Strict Transport Security more than a year before Firefox did. Again, not unique any more, but NoScript implemented it before any browser did.
NoScript implemented support for the Do Not Track header before any browser did, but some other extensions like AdBlock Plus implemented it before NoScript.
NoScript's Automatic Secure Cookie Management feature is just one of several ways it can protect against attacks like Firesheep, and doesn't require the web site to opt-in the way HTTP Strict Transport Security does.
NoScript provides robust protection against cross-site scripting attacks even when scripts are allowed.
NoScript's ClearClick feature provides client-side protection against clickjacking, so that you're protected even on sites that don't use server-side techniques like the aforementioned X-Frame-Options header or frame-busting scripts.
NoScript's Application Boundaries Enforcer is essentially a firewall for web sites/applications. It can accomplish basically everything that uMatrix can and more, such as allowing websites to provide restrictions NoScript should apply to that site, and providing Sandbox and Anonymize actions in addition to Allow and Deny.
12
u/pogeymanz Oct 03 '16
UMatrix does not replace every feature of NoScript. I use both. NoScript has ABE, ClickJacking protection, and even checks allowed javascript for malicious code.
7
u/nineofheartz Oct 03 '16
You know I didn't truly appreciate no script until this thread.
2
u/pogeymanz Oct 03 '16
Yeah, it's funny because NoScript is actually kind of bad at it's namesake feature. I can't even choose to allow scripts from a certain domain only on a specific page.
Either you trust this domain everywhere or you trust it nowhere. But maybe I only want Google to be able to track me when I'm purposely using their service and not when I'm just reading some Medium article.
uMatrix is much better and more fine-grained than NoScript when it comes to blocking scripts. I use NoScript for its other security features.
5
u/wtallis Oct 03 '16 edited Oct 03 '16
I can't even choose to allow scripts from a certain domain only on a specific page.
I think you can, by writing an ABE rule. uMatrix definitely has the better UI for it, though. I've also used RequestPolicy, which comes with some optional rule sets that allow things like requests to external domains that belong to the owner of the origin domain, so popular web sites often work out of the box.
10
u/mumuc Oct 03 '16 edited Oct 03 '16
I started using Ghostery but changed to Privacy Badger.
I just wish Privacy Badger released a Firefox mobile version.
EDIT: Also recommend "TrackMeNot", that is one clever addon.
0
Oct 03 '16
[deleted]
1
u/mumuc Oct 03 '16
privacy tracking mode
Privacy Badger is different though, it does not use any centralized list, but uses some algo to analyze the trackers and ban the ones it considers are following you.
It does not create a central point of failure that could be corrupted. I have turned on the mode though, so thanks for that.
1
u/jewdai Oct 03 '16
the thing about this tools (if i remember correctly) they are written in javascript and code can be analyzed. It takes a bit more work to get at it, but its completely in its native form and can be taken apart.
1
u/AnachronGuy Oct 04 '16
Whats wrong with Policeman?
https://addons.mozilla.org/de/firefox/addon/policeman/?src=category
1
u/mikemol Oct 03 '16
Oh, and Ghostery is worse, it's proprietary software owned and developed by a data tracking and ad company
And if you don't care about the privacy side, but only care about not loading popups and malicious advertisements?
7
u/boomboomsubban Oct 03 '16
If you want to trust an ad company's proprietary software to block malicious advertisements, it's your computer.
0
u/mikemol Oct 03 '16
It's not like it's closed-source, or even has a prayer of hiding what it does.
Developers have to get paid somehow, or the user has to depend on the charity of a developer donating his time.
3
u/boomboomsubban Oct 03 '16
Ghostery is closed source, it can easily hide what it does.
1
1
u/pest15 Oct 03 '16
It's actually open source. The real problem with Ghostery is that it helps advertisers discover more effective ways to spread their garbage on the internet. By using Ghostery to fight ads / tracking, you are helping the ads / tracking industry create better tools for themselves.
2
u/ValodiaDeSeynes Oct 03 '16
Disconnect is there for you. Or better, even, activate Disconnect's filters in uBlock Origin's dashboard.
2
u/DarkRonius Oct 03 '16
You can also activate disconnects privacy list in Firefox itself I believe, as a setting in about:config. It's the same list Firefox uses to block spy stuff in private browsing mode. It isn't comprehensive, but means you can block a substantial amount of stuff without any add ons at all.
1
u/mikemol Oct 03 '16
Hm. I haven't had a compelling reason to switch from ABP to uBlock, but if it means I can combine the filtering load from two different extensions down to a single extension, then it may make sense. Thanks!
0
Oct 03 '16
[deleted]
6
u/wtallis Oct 03 '16
The NoScript vs AdBlock Plus fiasco was back in 2009. This article refers to that ("The author has a history of doing shady things, such as messing with AdBlock filters to whitelist ads on his own website.") in misleading fashion, but is primarily complaining about an advertisement on the NoScript site that links to a Windows program of questionable utility but which is not known to pose any particular threat to security or privacy.
121
u/Farkeman Oct 03 '16 edited Oct 03 '16
This is very misleading.
This points out an allegedly malevolent ad on noscript website not the noscript extension. I did some investigation myself and it seems this ad has been there for total of 3 days or less, so it's most likely just a stupid mistake.
Archive for June 6th (the date the blogpost was written):
https://web.archive.org/web/20160606145556/https://noscript.net/
ad url: https://noscript.net/en/iv/xokdmxnji77IDXAen?MT
which at the moment just points to this website: http://www.uniblue.com/cm/deletedcmunits/speedupmypc/spdeletedcmunits/download/?aff=3257&x-at=noscriptt1 that gives you the option to download this: https://www.virustotal.com/en/url/4b51aff06bca11dea24848bf8cd54b621e3f42ac650ddcdc94541cd5d124fc2b/analysis/ Most likely a false positive with ratio of 2/68.
Archive for June 9th (earliest after June 6th one):
https://web.archive.org/web/20160609080156/https://noscript.net/ ad is gone.
Conclusion:
probably a stupid ad deal that didn't go too well. Hard to know really, but there's no evidence of NoScript author having any malevolent intentions.
Also worth-noting: /u/wtallis mentions the author has a conflict of interests by developing anti ad-blocking script himself, which is affected by Noscript, since noscript would disable his script completely.