Hacker News Reader

Comment by rhn_mk1 | Hacker News Reader

> NoScript Security Suite: since uMatrix will be used to block scripts, this functionality is not required from NoScript

This is a mistake. uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself. NoScript stops script execution completely.

NoScript also activates `<noscript>` tags which will allow content to render on Medium. And which break Twitter by redirecting away just after it loads...

Caveat emptor: NoScript is somewhat buggy in its WebExt form. Sometimes it needs a click on the global revoke button to render `<noscript>` again. Sometimes it pops up blank windows. I'm not aware of any alternative though.

View on HN

> NoScript Security Suite: since uMatrix will be used to block scripts, this functionality is not required from NoScript

> This is a mistake.

thanks for bringing this up - i couldn't quickly find info regarding how uM handles inline scripts, but i see that uBO does have that specific option - this has caused me to look deeper into uBO and i'm now considering revising the guide and dumping uM completely since i personally don't require all the granularity of uM (i always allow images/css globally for example)

so although there may be some caveats with not using NS, it seems that uBO can basically eliminate the need for NS, at least for those of us that just want stuff to work for the most part

> uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself

You are mistaken. You could have taken a few seconds to try for yourself before making this erroneous claim.

> NoScript also activates `<noscript>` tags which will allow content to render on Medium.

uMatrix can also "activate" the `noscript` tags, and this can be disabled/enabled on a per-site basis.

Can you explain how to enable/disable the noscript tags? I can only find a global "spoof noscript tags" option which does indeed seem to make <noscript> tags work.

I did base my comment on an observations. I wouldn't be using NoScript myself if I wasn't fairly sure it's the only way.

Seems I was wrong indeed, because there are no scripts listed in the Debug tab of the Inspector if uMatrix blocks them.

Thanks for pointing it out! removes NoScript

> Can you explain how to enable/disable the noscript tags?

It's one of the per-scope switches, see: https://github.com/gorhill/uMatrix/wiki/Per-scope-switches

Thanks!

Unfortunately, Twitter's forced redirect still takes place even after it's off :(

> NoScript also activates `<noscript>` tags

Ah, that explains why I occasionally see <noscript> on links. I use NoScript too, but only allow scripts from a select list.

Reply on news.ycombinator.com