Hacker News new | ask | show | jobs
by wtallis 3134 days ago
> I also recommend µMatrix – it’s pretty much a better version of NoScript.

No, it isn't. uMatrix is a replacement only for the shallowest feature of NoScript. There's a ton of stuff that classic NoScript does that nothing else provides (including the new WebExtensions NoScript, so far).
1 comments
minitech 3133 days ago
The shallowest feature of NoScript – content blocking – is the only useful thing it provides. The rest of it, like the XSS filter, is poorly-written misfeatures, or stuff that’s available in about:config. (To be fair, µMatrix has its own misfeatures – looking at you, UA switching.)
link
gorhill 3133 days ago
> looking at you, UA switching

Agreed, I plan to remove this. See: https://github.com/gorhill/uMatrix/issues/771#issuecomment-2...

link
wtallis 3133 days ago
> The rest of it, like the XSS filter, is poorly-written misfeatures, or stuff that’s available in about:config.

NoScript classic has a lot of functionality that helps you keep sites usable when scripts are blocked, or to help you stay secure when you have to allow some scripts. Some of the latter features are protections that will occasionally get in the way of sites that are fucked up in non-malicious ways, but that doesn't make them misfeatures. In my experience, the only XSS filter false positive has been Wolfram Alpha, and I've only encountered the clickjacking protection with advertisements that are getting in the way of the content I'm trying to interact with.

link
minitech 3133 days ago
> NoScript classic has a lot of functionality that helps you keep sites usable when scripts are blocked

Sounds good, but have you looked at the code behind this? The XSS filter is the same way – a giant mess that only protects against the most trivial of XSS anyway.

I forgot about its clickjacking feature, though. You’re right, that one is valuable.

link