Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NoScript Not Available for Latest Firefox

noscript.net

Post reply on HN
Print view View original

61–70 of 84 posts

Re: NoScript Not Available for Latest Firefox

#61

Post by sp332 »

shock wrote: post #49
0xcde4c3db wrote: post #12

It's probably better to go straight to the blog post about the migration: https://hackademix.net/2017/11/14/double-noscript/ Basically, the work to adapt NoScript and correspondingly expand the WebExtensions API has been going on for years, the original plan was to have a smooth transition when Firefox 57 came out, but there were some delays in the final days leading up to the release. Not recommended to stay on Fire…

Moving to Firefox 52 isn't really an option for me because it's a pig compared to 55/56 (it consumes almost 5GBs of RAM compared to 1GB for 56).

I think you can switch to an unbranded build of 57, and enable legacy addons. https://wiki.mozilla.org/Add-ons/Extension_Signing#Latest_Bu... You could also install the Developer Edition or a Nightly build. They're slightly less stable (usually pretty good for me) but they have the same option. https://www.mozilla.org/en-US/firefox/channel/desktop/

Re: NoScript Not Available for Latest Firefox

#62

Post by eadmund »

jchw wrote: post #40
amenod wrote: post #34

I upgraded to Firefox 57 only to find all 4 of my extensions missing... I can live without others, but being without NoScript felt like walking on streets naked. So the first thing I did was downgrade to Firefox ESR, then I started looking for alternatives. Turns out that uMatrix fills this role perfectly (for me of course). Not only can I block/allow JS, CSS and similar resources, but I can do it based on domain / 3…

Killing the old extension API is a painful, but important, step. From a security standpoint, WebExtensions are a lot better, since they are sandboxed and require explicit permissions to be granted for many things. From a developer standpoint, they are easier to deal with, being JavaScript, and since Chrome and Edge support similar APIs, developers will no longer need multiple codebases to support their extensions on…

> From a security standpoint, WebExtensions are a lot better, since they are sandboxed

In a sandbox even I, as the owner of the computer, can't let them out of. That's not cool.

> From a developer standpoint, they are easier to deal with, being JavaScript, and since Chrome and Edge support similar APIs, developers will no longer need multiple codebases to support their extensions on multiple browsers.

In the sense that it's no longer possible to do the things one could do with a Firefox codebase.

I own my computer, and my browser; Mozilla have taken away the ability for me to extend my computing environment (without reïmplementing it all myself).

Re: NoScript Not Available for Latest Firefox

#63

Post by eadmund »

ynezz wrote: post #51
amenod wrote: post #34

I upgraded to Firefox 57 only to find all 4 of my extensions missing... I can live without others, but being without NoScript felt like walking on streets naked. So the first thing I did was downgrade to Firefox ESR, then I started looking for alternatives. Turns out that uMatrix fills this role perfectly (for me of course). Not only can I block/allow JS, CSS and similar resources, but I can do it based on domain / 3…

> felt like walking on streets naked So browsing on the phone is not evoking similar feeling? :-)

Firefox runs fine on my phone. In fact, I've now got the newest Firefox running there, and it's awesome.

Re: NoScript Not Available for Latest Firefox

#64

Post by eadmund »

forapurpose wrote: post #58
pbhjpbhj wrote: post #9

Earlier quoted context omitted.

I'd value a resource with a simple explanation of the changes that prevent a compatibility layer from enabling all the old plugins?

AFAIK, the old add-ons could interface with Firefox in any way they wanted; they had carte blanche. You can imagine the dependency hell and security risks; it's not desirable to duplicate that.

> You can imagine the dependency hell and security risks; it's not desirable to duplicate that.

I really disagree with the 'security risk' angle: it's my browser, and I've chosen to install the extension. That extension executes with my authority. Crippling what extensions can do because one doesn't trust me to run software on my machine is just crazy.

Re: NoScript Not Available for Latest Firefox

#65

Post by detaro »

eadmund wrote: post #64
forapurpose wrote: post #58

Earlier quoted context omitted.

AFAIK, the old add-ons could interface with Firefox in any way they wanted; they had carte blanche. You can imagine the dependency hell and security risks; it's not desirable to duplicate that.

> You can imagine the dependency hell and security risks; it's not desirable to duplicate that. I really disagree with the 'security risk' angle: it's my browser, and I've chosen to install the extension. That extension executes with my authority. Crippling what extensions can do because one doesn't trust me to run software on my machine is just crazy.

It's not crazy, it's what you do when you make software that's intended for lay users and is a big target for criminal activity. Us "power users" are not the people that are the primary concern.

Re: NoScript Not Available for Latest Firefox

#66

Post by Tharkun »

Amezarak wrote: post #47
jchw wrote: post #40

Earlier quoted context omitted.

Killing the old extension API is a painful, but important, step. From a security standpoint, WebExtensions are a lot better, since they are sandboxed and require explicit permissions to be granted for many things. From a developer standpoint, they are easier to deal with, being JavaScript, and since Chrome and Edge support similar APIs, developers will no longer need multiple codebases to support their extensions on…

> There's so much to be gained from getting rid of the old extension system for concurrency, extension compatibility, and the health of the ecosystem and individual browser installations. I personally think that while it's clearly great for security and possibly good for Firefox in general, it's also terrible for the extension ecosystem. The set of possible extensions is being reduced from "literally anything computa…

After reading these comments, I basically don't want to upgrade. I've been running Classic Theme Restorer for years to get rid of whatever the latest craze in GUI design is. I like my address bar for addresses and my search bar for searches. I love my tree style tabs. I like having a fair amount of control over my browser.

For a few years now, I've had the feeling that Firefox was actively trying to get rid of me as a user. With every new version, the user is less and less in control. It claims to be privacy-conscious, but runs Google Analytics. It tries to gather data behind my back. It's missing so many switches and toggles that I had to install a Privacy Settings extension simply to make the thing behave.

Re: NoScript Not Available for Latest Firefox

#67

Post by jchw »

eadmund wrote: post #62
jchw wrote: post #40

Earlier quoted context omitted.

Killing the old extension API is a painful, but important, step. From a security standpoint, WebExtensions are a lot better, since they are sandboxed and require explicit permissions to be granted for many things. From a developer standpoint, they are easier to deal with, being JavaScript, and since Chrome and Edge support similar APIs, developers will no longer need multiple codebases to support their extensions on…

> From a security standpoint, WebExtensions are a lot better, since they are sandboxed In a sandbox even I, as the owner of the computer, can't let them out of. That's not cool. > From a developer standpoint, they are easier to deal with, being JavaScript, and since Chrome and Edge support similar APIs, developers will no longer need multiple codebases to support their extensions on multiple browsers. In the sense th…

>In a sandbox even I, as the owner of the computer, can't let them out of. That's not cool.

Good software doesn't easily let you shoot yourself in the foot. It turns out if you allow it, people will do it. There exists software that does let you shoot yourself in the foot, but Firefox is designed for the mass market, not a specific niche. It's the only serious competitor to Chrome.

NPAPI is also gone. Not behind a flag, the code to support it is gone. It was broken, and so was the old extension API. It's about time for the majority of users to move on.

>In the sense that it's no longer possible to do the things one could do with a Firefox codebase.

This doesn't make any sense. You can do the same things you could do with the Firefox codebase before: download it, modify it, redistribute it. The runtime is what you're thinking of, and you were never guaranteed any abilities with regards to the runtime; you just got used to them, then they changed. This happened a few times with Firefox before, so it's not really clear how this update is much different.

>I own my computer, and my browser; Mozilla have taken away the ability for me to extend my computing environment (without reïmplementing it all myself).

Firefox is not your "computing environment." You're free to remove Firefox from your computing environment, or use an ESR release of Firefox and still get security updates with your old extensions, or use a fork of Firefox, of which there are a few to choose from.

Even so, it's depressing that every time a breaking change happens, even one like this that's 2 years in the making, the same responses happen: weird arguments about entitlement and a lot of looking toward the past.

Why not look toward the future? If you relied on an extension and now it's not possible with WebExtensions, it would help a lot of people out if bugs were filed and features were requested to bridge the gap. It's clear that there's overwhelming reasons to continue down the WebExtensions path, and whether people like it or not it's definitely going to be the only option in the browser you use in a few short years. So it's in our best interests to push for WebExtensions to meet the needs of extensions rather than make pointless arguments for decisions that were made a long time ago and have no chance of being reverted.

Re: NoScript Not Available for Latest Firefox

#68

Post by arnvidr »

Tharkun wrote: post #66
Amezarak wrote: post #47

Earlier quoted context omitted.

> There's so much to be gained from getting rid of the old extension system for concurrency, extension compatibility, and the health of the ecosystem and individual browser installations. I personally think that while it's clearly great for security and possibly good for Firefox in general, it's also terrible for the extension ecosystem. The set of possible extensions is being reduced from "literally anything computa…

After reading these comments, I basically don't want to upgrade. I've been running Classic Theme Restorer for years to get rid of whatever the latest craze in GUI design is. I like my address bar for addresses and my search bar for searches. I love my tree style tabs. I like having a fair amount of control over my browser. For a few years now, I've had the feeling that Firefox was actively trying to get rid of me as…

I also lost my window, but it was in the "recently closed windows" menu, so no big deal. Most of the (all?) changes that you got with Classic Theme Restorer can still be accomplished with userChrome.css. Check this[1] github repo for the quickest way to set it back up the way you like it.

[1] https://github.com/Aris-t2/CustomCSSforFx

Re: NoScript Not Available for Latest Firefox

#69

Post by vesinisa »

forapurpose wrote: post #55
vesinisa wrote: post #31

uMatrix is a replacement extension from the creator, and compatible with, uBlock. uMatrix migrated to Quantum leveraging the existing Chrome codebase already about a month ago: https://github.com/gorhill/uMatrix Some learning curve is required compared to NoScript since uMatrix allows even finer grained control (not just scripts, but images, cookies, iframes and XHR as well), but I personally migrated about a year ag…

To add some important points: > uMatrix is a replacement extension from the creator, and compatible with, uBlock. To avoid any confusion, I think the parent means, 'from the creator of ... uBlock'. uMatrix is not by the creator of NoScript. Also, blocking just JavaScript is quicker and easier in uMatrix (at least easier than the current NoScript; I don't know about the upcoming version). The UI is far more efficient,…

Thank you, dropped an of there indeed.

For me personally, #1 reason for using NoScript was controlling which domains can execute JS. uMatrix delivers that superbly, and more.

Sadly, ever since NoScript started pushing malware[1] to users with every update, I lost all confidence with the author for securing my browsing experience.

[1]: https://liltinkerer.surge.sh/noscript.html

Re: NoScript Not Available for Latest Firefox

#70

Post by Amezarak »

detaro wrote: post #65
eadmund wrote: post #64

Earlier quoted context omitted.

> You can imagine the dependency hell and security risks; it's not desirable to duplicate that. I really disagree with the 'security risk' angle: it's my browser, and I've chosen to install the extension. That extension executes with my authority. Crippling what extensions can do because one doesn't trust me to run software on my machine is just crazy.

It's not crazy, it's what you do when you make software that's intended for lay users and is a big target for criminal activity. Us "power users" are not the people that are the primary concern.

So what browser is made for power users now?

That did used to be Firefox - Firefox became so popular because it strongly appealed to power users, who then evangelized it to friends and family.

Over the years, Mozilla has increasingly targeted the mass market. That's well and good, though I don't know how they can compete with being the default browser (Safari, IE, Edge, Chrome) or with massive advertising and heavy pushing on Google's homepage or in auto-installers like Chrome, no matter how good they make the browser. But what happens to power users now?

Post reply on HN