Slashdot Mirror
NoScript Adds Subscriptions To Adblock Plus
hahiss writes "Apparently, NoScript has taken to adding its own whitelist updates to Adblock Plus — so that the ads on the NoScript page show up — without notifying users. (It is described on the NoScript addon page, however.) This was a part of the last update to NoScript. Wladimir Palant, the main developer of Adblock Plus, describes the situation in an informative blog post."
Update — 5/02 at 12:30 GMT by SS: Reader spyrochaete notes that "InformAction, makers of the NoScript extension for Firefox, have removed the recently introduced AdBlock exceptions which unblocked the revenue-producing ads on the NoScript homepage with little or no warning to the user. According to the changelog, InformAction pushed out an update specifically addressing this controversial decision 'permanently and with no questions asked.'"
When the Easylist filter was made for Adblock Plus, it generically blocked ads for many websites, with some specific rules for other sites. Giorgio Maone (creator of NoScript) relies to a certain extent on ad revenue on his websites, without which he may spend less time working on the extension. He made a workaround on the ad blocking, and though the filter could have been updated to counter this, no attempt was made to update it.
When Rick Petnel died, they needed a new maintainer for the filter. Ares2 continued where Rick left off. He decided to fix the workaround made on Giorgio's sites.
What then followed was a game of cat-and-mouse. Giorgio would attempt a new workariound, and Ares2 would attempt to block the ads. It reached the stage where large parts of Giorgio's sites weren't working due to false positives.
Here, it seems clear that Ares2 has gone too far, and a compromise should have been reached. ABP and NoScript are a good pair when working together, though the people behind them have different philosophies. Unfortunately, things start to take a turn for the worse.
In an attempt to defend his site and ad revenue, he makes an update of NoScript to version 1.9.2. This version contains a file called MRD.js, which adds a CSS stylesheet rule to his websites that overrides the filter, by adding -moz-binding: none after the filter has loaded, which the filter depends upon. Furthermore, the file is obfuscated to hide what it does. No warning is given to Firefox users of what the extension has added in this tit-for-tat battle.
When this addition started breaking users ABP installations, version 1.9.2.3 instead adds his websites to the ABP whitelist, calling it a "NoScript development support filterset". The user isn't informed of what this is, and isn't given a choice on whether to accept it.
At present, the filter has removed its false positives, though leaves the ad blocking in place. The NoScript behaviour still remains in the latest version.
Ares2 was overzealous in attempting to block ads, and shouldn't have made Giorgio have to make excessive changes to his site. But the larger concern is that while Easylist is a filterset, which can be removed and updated by the user, NoScript went further and started to modify existing extensions, executing code without user's consent or awareness, and acting in a way that resembled malware, to display ads on his websites.
Extensions can be great for giving people freedom to control how they view the web. But creators of extensions need to be careful in what they do with them, especially with those with a large user-base like Adblock Plus and NoScript. If not handled correctly, Firefox extensions could become the next vector of malware, and that would be a shame for all.
First, noscript added code that disabled adblock plus if EasyList was used. Then, noscript auto-adds (no user prompting) an abp subscription whitelisting his sites. You cannot delete it (it readds upon FF restart), only disable it.
It's a stupid trick, but the whitelist can be disabled easily. Go to Adblock preferences and disable the "NoScript Development Support" filter. It doesn't seem to re-enable the whitelist on restart. It may when it updates.
NoScript is not primarily an ad blocker. It manipulates AdBlock to allow ads on NoScript domains.
What happened: NoScript blocks scripts (which also catches some typical ad delivery scripts). NoScript exempts the domain of the NoScript authors from script blocking (bad). An AdBlock subscription list recently added entries to block ads on the NoScript domain. NoScript tried to evade that measure by manipulating the way AdBlock works. Now NoScript has changed again and only ads a visible exception subscription to the list of AdBlock subscriptions. This exception can not be removed, only deactivated, as it's added back in whenever Firefox starts.
As an extension author, I can sympathize with the NoScript authors: Firefox users are really stingy. Unless an extension is inherently intertwined with a business opportunity and not just a convenient stand-alone feature, working on a Firefox extension is a losing proposition, at least financially. However, an author should either accept that and find other motivations for continuing the work, try a transparent commercial approach or cut the extension loose. The dark side is big enough without Firefox extension authors joining it.
Currently you can't actually delete the list, only disable it. If you delete the list, it will come back the next time you load firefox. I have actually tried this myself and it is very obnoxious.
I was looking on the noscript forums, and I did find this:
While I don't know if I believe this or not, it's at least the way it should have been from the start.
Find Nearby Indie Events
(which is btw. the most obnoxious plug-in I currently have installed; re: updates...)
Set noscript.firstRunRedirection to False and it won't open the homepage after every update.
Why is this even a nontrivial software project?
Surrogates. The arms race is going on more than one front. From what I understand, on sites that use returns from ad-tracking scripts like google-analytics or yieldmanager to block access, NoScript has the ability to run surrogate scripts that give the appropriate return without the ad-tracking. This seems non-trivial.
However, now knowing how embroiled the author of NoScript is in getting his own ads viewed, users may lose their trust in his surrogate scripts.
In the Firefox address bar, type : about:config
Scroll down to: noscript.firstRunRedirection
Right click this value, and 'toggle' it to false.
Due credit goes to posts at http://adblockplus.org/blog/attention-noscript-users
Since NoScript recently put up a forum I figured I would go over to see what people on there had to say. Here's a thread which starts with a discussion of noscript breaking adblock and then turns into a discussion of the specific issue: http://forums.informaction.com/viewtopic.php?f=7&t=877
Here's a post where the NoScript guy asserts his reasoning for it: http://forums.informaction.com/viewtopic.php?p=2777#p2777 basically he says that the update to the filterset broke noscript.net making things like the menus unusable.
In this post http://forums.informaction.com/viewtopic.php?f=7&t=877&start=90#p3162 he claims that the inability to remove the noscript filterset is a bug and that the next update to noscript will fix that and prompt users beforehand.
http://www.popularculturegaming.com -- my blog about the culture of videogame players
about:config
set noscript.firstRunRedirection to false
There is is. I do not find it sufficient:
v 1.9.2.3
======
+ A "NoScript development support filterset" gets added to AdBlock
Plus, whitelisting the noscript.net, flashgot.net, informaction.com
and hackademix.net web sites recently broken by an aggressive
EasyList campaign against sites sponsoring NoScript development.
ABP users are informed both on the install and on the release notes
pages, so they can easily disable the filterset if they whish to.
Those are my principles. If you don't like them I have others. -Groucho Marx
First, I'm not an anonymous coward, I'm Tom T., a Moderator at the NoScript Support forum. Just didn't need one more U/P login as probably a
one-time poster here. Having read only the top pages, just wanted to make sure that these points were covered:
1) Giorgio Maone himself has pointed out repeatedly, including at the thread in question, that anyone can disable his pages' ads with NoScript just by blocking the Google-Syndication scripts. NoScript itself cannot be circumvented in this blocking, even by NoScript. :)
2) For those who think the updates are a revenue-(ad-viewing)-generator, aside from the fact that the NS FAQ includes simple instructions for turning off the home-page redirect for each update (try reading the FAQ before criticizing), please look at the complete history and at how many times some new attack, e. g., XSS etc., has surfaced, and Giorgio has dropped everything -- wife, new baby -- and rushed to protect NS users with an update. Some of these updates turned out to prevent future attacks that weren't even known at the time of the update. Go to the Changelog, see the number of feature requests/bug reports, and tell us which ones were unnecessary. Go to the blog of world-class hakker Sirdarckhat, http://sirdarckcat.blogspot.com/2008/06/hacking-noscript.html, who has responsibly and privately reported his discovered vulnerabilities, and note his comment on Giorgio's response to such reports:
"Is important to say, that Giorgio fixes stuff in "hours", (or minutes in some cases), and he has done some crazy stuff, just so NoScript users can be safe, so if you dont use it, go get it."
Straight from the hakker's mouth there, peeps.
3) As a personal opinion only, and not speaking for Mr. Maone, NoScript, or the NS Support Forum, I have repeatedly recommended AdBlock Original, in which only I can set blocks or permissions, no one else, and with which I can affect or hose only my own machine, not anyone's else, nor can I affect anyone's web site. That is why NS does not offer "blacklists", despite repeated requests from users who don't want to be bothered with making their own decisions (the whole point of NS), and why, despite my great respect for Wladimir Palant and his product, I don't use ABPlus. True, I don't "have" to subscribe; I just don't want to open that door. The only exception would be the Hosts file, offered by http://www.mvps.org/winhelp2002/hosts.htm ,which has *specific criteria*: a site must drop tracking cookies or drive-by adware, spyware, or other malware; and the file is plain-text readable and editable by any user to remove any block-entry that they feel is unnecessary. I never have. They're all there for a good reason and are sites I don't want to allow my browser to connect to.
4) Anyone who thinks that scripting or other web executables are without danger and require no user attention probably shouldn't be using a computer, or is already pwned. Do some research. "If you aren't worried, you just don't understand the situation." Cheers!
If you haven't been following web security (or reading the changelog) these guys are extremely cutting edge when it comes to blocking various XSS based exploitation techniques.
Clickjacking, cross domain keyloggers, and javascript connect-back proxies, etc are all out there now. Even if you have a given site whitelisted, noscript will still filter out known attack methods. It will even detect heap spray attempts etc if someone is trying to break out of a browser plugin.
Giorgio released version 1.9.2.6 which disables the filter. I quote from http://noscript.net/?ver=1.9.2.6&prev=1.9.2.5
It seems that he eventually got it right.