[minitech]

The shallowest feature of NoScript – content blocking – is the only useful thing it provides. The rest of it, like the XSS filter, is poorly-written misfeatures, or stuff that’s available in about:config. (To be fair, µMatrix has its own misfeatures – looking at you, UA switching.)

[gorhill]

> looking at you, UA switching

Agreed, I plan to remove this. See: https://github.com/gorhill/uMatrix/issues/771#issuecomment-2...

[wtallis]

> The rest of it, like the XSS filter, is poorly-written misfeatures, or stuff that’s available in about:config.

NoScript classic has a lot of functionality that helps you keep sites usable when scripts are blocked, or to help you stay secure when you have to allow some scripts. Some of the latter features are protections that will occasionally get in the way of sites that are fucked up in non-malicious ways, but that doesn't make them misfeatures. In my experience, the only XSS filter false positive has been Wolfram Alpha, and I've only encountered the clickjacking protection with advertisements that are getting in the way of the content I'm trying to interact with.

[minitech]

> NoScript classic has a lot of functionality that helps you keep sites usable when scripts are blocked

Sounds good, but have you looked at the code behind this? The XSS filter is the same way – a giant mess that only protects against the most trivial of XSS anyway.

I forgot about its clickjacking feature, though. You’re right, that one is valuable.