All I know is that in the last few weeks,

Firefox has been unstable as heck for me. There's one site in particular (work-related open-source project) that, about 10-20% of the time I visit it, Firefox crashes -- and this started after I upgraded a bunch of plugins. Mere correlation? or cause?

So yes, effing well cut this crap out. Software's buggy enough without this added nonsense.

Nerd Fight! After School Behind The Gym!

Disgusting turn of events, hopefully some oversight @ AMO will keep this chit from happening again. Read G's apology, I'll accept that. Where's Wlad's apology? I trust(ed) both for my Intertubes security, will be losing the ABP if it turns out he's just another prima donna programmer who can "do no wrong".

Mine's the one w/ the bulls-eye on the back.

A solution

Uninstall both, try RequestPolicy instead.

It won't protect you against malicious scripts on a website, but it blocks ads and 3rd party scripts.

Better security and far less annoying than NoScript.

Firefox addons....security nightmare

This is something I've never understood with FF addons. The hardcore FF fan bois bleat on about how secure their beloved browser is, yet to enhance it (and this is apparently what makes FF so great) you get to install 3rd party addons that you have absolutely no idea what they are doing. Sure it says it's going to block some flash adverts and make you a hit with the girls but what's it really doing.....? Opening up some lovely big security holes? Skimming your contact list for juicy email addresses? Who knows.....?

But that could never happen because it's all been vetted by some Mozilla flunkey's who approve addons and they never let anything get past them......oh hang on..... No wait they've got that covered now "..... each add-on would have to explicitly spell out all changes it makes to any other add-ons." A malicious code writer whould never lie would they!

Or how about just host your crummy 3rd party addon away from Mozilla. Whose going to check it's been certified by Mozilla? A large majority of users, who FF are trying to aim at, will go "Oh wow! This addon changes every occurence of the letter "P" on a webpage into an animated GIF of an ejaculating penis! I must have this addon!" Great they now have penile websites and a whole truck load of malware too. Hooray the great security of FF

facepalm.jpg

Ego wars? In my Browser?

Oh well...

I'm sorry, but This Story Must Be Wrong (tm)

Everyone knows that open-source software authors never ever do anything bad or mean or stupid, unlike icky old profit-driven Microsoft. Therefore This Story Must Be Wrong (tm).

Taking responsibility

Well, good for Georgio to change his attitude and understand just how egregious and untrustworthy his actions were. As of last Friday he wasn't so willing to admit that anything he had done was wrong, and I'm glad to see he's now putting personal responsibility before his ego.

Here's hoping NoScript users and the Mozilla community give Georgio another chance. We all make mistakes, and I give him full credit for publicly admitting what he did was wrong.

Geoff

@andy

>"Oh wow! This addon changes every occurence of the letter "P" on a webpage

> into an animated GIF of an ejaculating penis! I must have this addon!"

You could charge money for that. It'd sell.

@Mike Powers

Its true alright, but all this story demonstrates is that developers are human.

Oh, and if the source code is available others can find out any nasty little surprises an application might have.

Bollocks

>Palant has yet to admit that it was probably a bad idea for Adblock Plus to disrupt NoScript updates.

No one should down load extensions from a web site direct, they should be downloaded from AMO direct, cause anything else wouldn't be *secure*.

As another user on a different forum has said:

"1. NoScript quietly added a whitelist subscription to AdBlockPlus to enable supporting ads on the NoScript site. That was sneaky, underhanded and despicable. 2. NoScript _patched the AdBlockPlus code_ to enable supporting ads on the NoScript site. This goes _way_ beyond the pale. One plugin modifying the code of another."

AdBlock was blocking Advertising D'oh.

NoScript was hacking AdBlock!!!

The good guys and the bad guys are easy to see if advertising doesn't pay your wage.

Can't blame the guy...

Can't blame the guy for being pissed that someone else's plugin is preventing his from working properly. Petty bullshit though. think I'll stick to my NoScript/Proxomitron combination. It blocks 99% of the garbage on most sites.

*bleat-bleat* *whine-whine*

<rant>

What's that? Oh...it's just Paul Barnfather, Andy and Mike Powers chirping out of their butts about what they can't fill a postage stamp with regarding browser security *yawn*

Yes of course this is a stupid little spat between OSS developers, but who the fuck are you lot to judge? Both NoScript and AdBlock have a long record of producing quality (as judged by the community, not some bean counter in Redmond) plug-ins that make a mass-market browser even more superior in comparison to its main (proprietory and standards-busting) competitor. In other words they've actually done something worthwhile for the rest of us. So: STFU.

</rant>

To the matter in hand...I'm not really interested much in who did what when - nobody's perfect - the fact is that as one of the biggest (and fastest growing) on-line threats is legitimate websites that have been compromised, NoScript is important while AdBlock is just nice (yes I know - ad streams can be poisoned before some pedant points it out - but that's a less significant threat). So let's hope these two patch things up, but if they don't AdBlock is on a loser as it's just not as important as NoScript.

Re: I'm sorry, but This Story Must Be Wrong (tm)

I can see that you are confused here. But I can help. Open Source is perfect. However, some coders do lose their way and become unfaithful to The Revolution. A little re-education is all that is needed in this case. But I remind you that your criticism of The Revolution is even more dangerous and will be dealt with promptly.

@Firefox addons....security nightmare

Andy i think I speak for everyone here when I say this.

Granted you havent stated if you hate macs and Jobs as well. But you put together a nicely worded rant against FF and OSS. You could feel the agression level rising with each sentence. Also I have no idea if he is still here, personally I don't think so seeing as I havent read anything from him in a long time. But I nominate you for the tital of Webster Phreaky the Second :)

But I do agree with you 100%

This explains a few things

Recently FF3 got very unstable for me to the point of being unusable and it caused me to spend many hours trying to resolve the problem. In the end I had to vape my system and restore entirely from a disk image I made some while back.

The problem was extension settings were being continually lost, preferences were being forgotten and my password database was being deleted.

I was unable to specifically pinpoiint the cause of the problem and it continued to afflict my sysem even with all extensions removed, but I had a feeling that it had something to do with NoScript or Adblock Plus. Sadly, I was unable to prove it and therefore was unable to mention this at the MozillaZine forums where I was getting a lot of help.

In the end a system rebuild was required which, I could ill afford the time for.

I suspect that somehow my system integrity, and more specificallly that of FF3 had been compromised.

It's a very very poor situation for Mozilla to find themselves in and the individual extension author ought to be ashamed of himself. I won't be using his add-on any longer despite the benefits it presents.

@ Michael

I use AdBlock and:

1) I am not a freetard.

2) I take showers.

3) I am not a hippie.

So, to summarise: 'Work it up your dirtbox, Michael'.

Hosts

Clearly NoScript is in the wrong. The Adblock guys were just making their extension do what it's supposed to do, but he was making his extension directly attack theirs. It is concerning -- and bad publicity for Mozilla, since it demonstrates that extensions are not sandboxed in any way and *can* interact with each other, even if they usually don't, because most developers have ethics.

But you don't need an "extension" for blocking unwanted content. Get a list of the real low-lifes and put them in your Hosts file. Then you won't have to look at their trash in *any* browser.

And Safari users should try this nice little Flash-blocker:

http://github.com/rentzsch/clicktoflash/tree/master

Divisions...

There's one detail that's kinda been glossed over, here. ABP is more or less a two-part extension - the ABP extension itself and the EasyList filter set that's typically used with it. These two parts are maintained by different people, and EasyList recently got a new maintainer after its original maintainer passed away.

The escalation was mainly between EasyList and NoScript, though I'm pretty sure ABP's maintainer was aware of what was happening on some level. It seems EasyList's maintainer got a bit ham-fisted in his attempts to block NoScript's ads, causing some non-ad parts of NoScript's websites to be blocked. AFAIK, though, these weren't active for very long - Giorgio (NoScript's dev) himself noted that EasyList was being updated around 5 times a day at one point.

Still, from a user's perspective, it was NoScript that crossed the line. Ham-fisted or not, EasyList was doing exactly what the user installed it to do - block ads. Giorgio decided to covertly sneak in and subvert other user-installed software to achieve his goals. He markets NoScript as security software, which generally implies a greater level of user trust than with more general-purpose software like ABP.

NoScript can 'fix' its code quickly. But this breach of user trust can't be fixed as easily.

Malone

I decide what goes on my screen, not you.

Ca-hee

This is one of the reasons why I distrust nerds. I fully understand why the US government had to keep all those WW2 nuclear scientists under armed guard. Nerds lie and obfuscate, and do things behind our backs. They are angry with society for spurning them, and so they set out to dominate a little part of the world from the safety of their bedrooms. They have a self-righteous rage, and an inflated sense of their own importance and worth. They are secretly plotting against us, and this little spat is further proof of that. They have to be watched and corralled.

@andy

So much anger... Or is it envy? Not to worry, IE is getting plugin support.

I'm taken by your implicit trust in commercial software vendors, considering their stellar track record in violating privacy, selling snakeoil and general ineptitude.

The reality is that zero day exploits appear for all browsers and traditional AV products are useless against them and of limited use in general. Disabling scripts is the logical action.

@BlueGreen

Well, let's see ... my computer, my money, my connection, my, my, my ad infinitum. But, that being the case, it's also my decision. And that being the case I choose to block, well, whomever I choose to block. Those sites that can't make without putting ads on my desktop just can't make it and they should be gone... let 'em die. One thing's for sure, if it's an idea worthy of existing as an internet site, some enterprising person will make it work no matter how I choose to operate my geeky possessions in my home, using my equipment, using my electricity, blah, blah, blah.

If you feel you have an obligation to keep the cyberworld afloat via your geeky possessions then more power to you. As for me, I'll do it my way. After all, I'm the boss of me.

.. end ..

NoScript

I stopped using noscript when I found that even when I turn it off, it still breaks sites. I distrust software which doesn't have a working "off" button, strikes me the developer thinks he knows what's best for me, more than I do.

Regards ad block plus apologising, I don't see why they should, they're just following their remit to block advertising. Noscript's site was allegedly carrying the famous "You have a virus, install fake-av-which-asks-for-money" style adverts, which included pop ups.

At first...

... I thought 'Oh shit, this give ammunition to "open source is open to abuse" brigade' and then I thought what actually happened is that somebody tried to use a hidden function to gain market advantage, he was caught, lost credibility (the currency of open source work), and the code was quickly removed.

This happens all the time in the proprietary closed source software industry - except for the getting caught and fixing it part.

@Ian McNee

Whoa, chill out man.

NoScript and AdBlock are pretty wonderful. A little criticism and/or competition isn't going to do them any harm.

My problem with NoScript is that once I've enabled scripts on a page, I don't seem to have much control over what they actually do (and what sites they connect to). RequestPolicy gives me some of that control, which is the reason it is worth a mention. It also works fine with NoScript, if that's important to you.

ABP already inserts its own whitelists

This spat has prompted me to take a closer look at the ruleset actually installed by EasyList (the default ABP subscription). Hello, there's a reasonably large section devoted to whitelisting sites, some where blocking ads would presumably break the content, but others just seem to enable ads for the sake of it. I wonder what it takes to get on the EasyList whitelist? I have no doubt that there are some larger sites who'd pay good money to know that their ads won't get blocked.

Maone did some naughty things, but he's confessed and apologised. Palant and Ares2 seem to be playing a game that's a bit more sinister though.

@Andy

Well, duh!

You have merely re-stated the essence of the software problem.

The ultimate question is: whom do you trust with your data?

It has been a problem since Adam was a lad (or in IT terms since Ada was a lang...)

Yes, yes, the one with the wiring patches in the pocket, please...

@AC

"the vast majority of people using firefox or anything else have no clue whatsoever about programming, nor should they need to."

Actually I think you are completely missing the point. Joe Public maybe can't look into the guts of software that he uses, but the people that can, do. That sort of thing is called peer-review in other disciplines and it goes some way to freeing software from having fatal flaws suppressed for marketing reasons. Binary-only software is Thalidomide.

Ads? I think not.

Sorry to disappoint everyone, but I will cheerfully continue to block ads from websites, skip them in television, throw out the circulars I get in the mail, and hang up on any and all telemarketing calls. I too practice good hygiene and pay for (at least most of) the things in life worth having.

I wouldn't be so adverse (no pun intended) to viewing ads if there were some standards and/or rules to delivering them. I don't want to see an idiotic blinking ad stealing my attention from what I'm trying to read or watch. Do the marketing fools that generate these think they make their product stand out? Any product that advertises in an annoying fashion immediately loses points and most of its desirability to me by being displayed in this fashion. This goes quadruple for TV ads that have twice the audio volume of the program I'm watching, and anyone telemarketing anything.

If there were rules that advertisers were forced to follow, I could and would tolerate ads, but by being as annoying and intrusive as possible you guarantee that I'll go to the same lengths to block your idiocy. Most of us wouldn't hang around with people that are like this, why would we subject ourselves to it in any other portion of life if there's an alternative?

Eh?

"Regards ad block plus apologising, I don't see why they should, they're just following their remit to block advertising. Noscript's site was allegedly carrying the famous "You have a virus, install fake-av-which-asks-for-money" style adverts, which included pop ups."

Um, no, he had three Adsense ads. If what you say was on there actually was, then Google is to blame or someone/thing has redirected Adsense to something else on your machine (physician, heal thyself). Either way, Giorgio isn't responsible for the content.

I'm not defending Giorgio's actions, although I am shocked at the way he's been savaged by people who one minute thought his plugin was essential (it is. There are so many holes in Fx - all software sucks - that you have to mitigate at least the simple to implement attacks between updates) and the next thought that whitelisting his domains so the install and changelog links worked made him the antichrist. Ares2 has admitted, on NoScipt's own forum, that Easylist was, perhaps, a little too zealous and that those problems existed with the links. No, the hyperbole and exaggeration coming from the detractors is getting a little ridiculous and fail-worthy now.

And you can bet your Moon Macrosystem (still giggling, you bastards!) that Giorgio's code is going to be audited by many, many eyes for the foreseeable. Accepted, most users aren't code-monkeys [1], but there are a fair number (what's 0.01% of a metric arseload?) who are. NoScript may even have its trusted status removed and have to sit in the sandbox for approval in future. AMO has already noted this SNAFU (how could they not with all the torches and pitchforks?) and made some policy changes.

[1] Saw some really clever folks talking about forking NoScript, a very ambitious project that I wouldn't contemplate taking on, and asking all and sundry where the code repo is. There must be one to comply with the GPL, apparently, but the code was nowhere in sight. Christ on a bike, these people are so smart! I was so impressed...