Hacker News Reader

Comment by crazypython | Hacker News Reader

I thought NoScript was a single-purpose extension for disabling scripts. Naming and messaging matters, I guess. "JSControl" would've been a better name.

View on HN

The full name as shown on addons.mozilla.org is "NoScript Security Suite", which more accurately conveys its purpose. Some of the features it provided really had nothing to do with JavaScript, such as NoScript's implementation of Strict Transport Security about 1.5 years before Firefox itself implemented that feature.

> "NoScript Security Suite", which more accurately conveys its purpose.

No, that just makes the name more confusing!

Still sounds like a JavaScript blocker, that doesn't clarify anything for me. I've never even looked at it as I've somehow associated it with "block all Javascript", seems like I missed out.

"Block all JavaScript" never required an extension. All the browsers have an option to turn JavaScript off entirely. NoScript started out as a way to provide an easy UI for selective blocking of scripts.

But it experienced the best kind of scope creep: it gained the ability to block other dangerous web features (eg. Flash and other plugin objects, web fonts, etc.), gained features to make life easier when blocking scripts (ie. the surrogate scripts feature), gained other security features for blocking evil actions by the scripts that are permitted (XSS blocking, clickjacking protection), and helped pioneer some security measures that weren't related to scripting (HSTS, ABE as a precursor to and superset of CORS).

IIRC if you turn JS off in the browser, the "noscript" blocks on sites get executed. But if you turn NoScript on, the "noscript" blocks aren't executed.

They are not "executed". They are displayed to user.

Thanks for the correction. My point remains that the "NoScript" extension doesn't do anything with those "noscript" blocks, so they're not shown to the user despite the user not executing JS on the site.

This is a bit of a PITA when one tries to make the site "work well" with JS both enabled and disabled; or provide _alternatives_ for when the user-agent isn't running JS.

Those work really well when the user-agent is blocking JS globally, but not for NoScript: broken behaviour everywhere.

IIRC the noscript extension had the option to parse <noscript> if you disable scripts.

But if you are doing progressive enhancement correctly you should not need any <noscript> so this becomes a moot issue.

NoScript evolved over time.

It's not like you downloaded a Mozilla's executable one day and expected to see a Flaming Canine instead of a web browser.

Reply on news.ycombinator.com