hackademix.net

v 10.1.2
=============================================================
+ Added "Revoke temporary permissions" button
+ Added "Temporarily allow all this page" button
x Simplified popup listing, showing base domains only (full
  origin URLs can still be entered in the Options window to
  further tweak permissions)
x Fixed UI not launching in Incognito mode
x Fixed changing permissions in the CUSTOM preset affecting
  the DEFAULT permissions sometimes
x Fixed UI almost unusable in High Contrast mode
x Fixed live bookmark feeds blocked if "fetch" permissions
  were not given
x Fixed background requests from other WebExtensions being
  blocked

Update

Oh, and in case you missed it (sorry, how couldn't you, since I didn't manage to write any documentation yet?), Alt+Shift+N is the convenient keyboard shortcut to #NoScript10's permission management popup :)

Based on the immediate user feedback, here's my TODO list for what I'm doing today:

• Fixing the Private Browsing (Incognito) bug making the UI unusable on private windows (even though everything else, including the XSS filter, still works)
• Getting rid of all the "legacy" localization strings that are creating confusion on internationalized browsers, and restart fresh with just English, refining the messages for maximum clarity and adherence with the new UI paradigm
• Tweaking a bit the permissions preset system by making them customizable only on the options page, rather than in the popup, except for the CUSTOM preset.
• Figuring out ways to make more apparent that
  • temporary permissions are still there: you just need to toggle the clock button on the preset (TRUSTED or CUSTOM) you choose: the permission will go away as soon as you close the browser;
  • selecting DEFAULT as a preset really means "forget about this site", even though you keep seeing its entry until you close the UI (for convenience, in case you made a mistake or change your mind);
  • the "lock" icon is actually another toggle button, and dictates how sites are matched: if its locked/green, as suggested by the title ("Match HTTPS only"), only sites served on secured connections will be matched, even if the rule is for a (base) domain and cascades to all its subdomains. This is a convenience to, say, make just "noscript.net" TRUSTED and match also "https://www.noscript.net" and "https://static.noscript.net" but not http:www.noscript.net" neither http:noscript.net".

  OK, an updated guide/tutorial/manual with screenshots is sorely needed, to. One thing at a time. Back to work now!

v 10.1.1
=============================================================
+ First pure WebExtension release
+ CSP-based first-party script script blocking
+ Active content blocking with DEFAULT, TRUSTED, UNTRUSTED
  and CUSTOM (per site) presets
+ Extremely responsive XSS filter leveraging the asynchronous
  webRequest  API
+ On-the-fly cross-site requests whitelisting

Thanks to the Mozilla WebExtensions team, and especially to Andy, Kris and Luca, for providing the best Browser Extensions API available on any current browser, and most importantly for the awesome tools around it (like the Add-on debugger).

Thanks to the OTF and to all the users who supported and are supporting this effort financially, morally and otherwise.

Coming soon, in the next few weeks: ClearClick, ABE and a public code repository on Github.

Did I say that we've got a chance to reshape the user experience for the best after more than a dozen years of "Classic" NoScript?
Make your craziest ideas rain, please.

Long Live Firefox Quantum, long live NoScript Quantum.

Update

Just gave a cursory look at the comments before getting some hours of sleep:

• Temporary allow is still there, one click away, just toggle the clock inside the choosen preset button.
• For HTTPS sites the base domain is selected by default with cascading, while for non-secure sites the default match is the full address.
• For domain matching you can decide if only secure sites are matched by clicking on the lock icon.
• You can tweak your "on the fly" choices in the Options tab by searching and entering base domains, full domains or full addresses in the text box, then customizing the permissions of each.

Next to come (already implemented in the backend, working on the UI) contextual permissions (e.g. "Trust facebook.net on facebook.com only").
And yes, as soon as I get a proper sleep refill, I need to refresh those 12 years old instructions and screenshots. I know I've said it a lot already, but please keep being patient. Thank you so much!

Update 2

Thank for reporting the Private Browsing Window bug, I'm gonna fix it ASAP.

Update 3

Continues here...

I apologize for not providing a constant information feed about NoScript 10's impending release, but I've got no press office or social media staff working for me: when I say "we" about NoScript, I mean the great community of volunteers helping with user support (and especially the wonderful moderators of the NoScript forum).

By the way, as most but not all users know, there's no "NoScript development team" either: I'm the only developer, and yesterday I also had to temporarily suspend my NoScript 10 final rush, being forced to release two emergency 5.x versions (5.1.6 and 5.1.7) to cope with Firefox 58 compatibility breakages (yes, in case you didn't notice, "Classic" NoScript 5 still works on Firefox 58 Developer Edition with some tricks, even though Firefox 52 ESR is still the best "no surprises" option).

Anyway, here's my update: the week, at least in Italy, finishes on Sunday night, there's no "disaster recovery" going on, and NoScript 10's delay on Firefox 57's release is still going to be measured in days, not weeks.

Back to work now, and thank you again for your patience and support :)

Later today In a couple of days, if everything goes fine, and definitely by the end of this week, NoScript 10, the first "pure" WebExtension NoScript version, will be finally released for Firefox 57 and above, after years of work and months NoScript 5.x living as a hybrid one to allow for smooth user data migration.

NoScript 10 is very different from 5.x: some things are simpler, some things are improved, some are still missing and need to wait for WebExtensions APIs not available yet in Firefox 57. Anyway, whenever you decide to migrate, your old settings are kept safe, ready to be used as soon as the feature they apply to gets deployed.

If you're not bothered by change, you're ready to report bugs* and you're not super-paranoid about the whole lot of "NoScript Security Suite" most arcane features, NoScript 10 is worth the migration: active content blocking (now more configurable than ever) and XSS protection (now with a huge performance boost) are already there. And yes, Firefox 57 is truly the most awesome browser around.

If, otherwise, you really need the full-rounded, solid, old NoScript experience you're used to, and you can't bear anything different, even if just for a few weeks, dont' worry: NoScript 5.x is going to be maintained and to receive security updates until June 2018 at least, when the Tor Browser will switch to be based on Firefox 59 ESR and the "new" NoScript will be as powerful as the old one. Of course, in order to keep using NoScript 5.x outside the Tor Browser (which has it built-in), you have to stay on Firefox 52 ESR, Seamonkey, Palemoon or another pre-Quantum browser.
Or you can even install Firefox 58 Developer Edition, which allows you to keep NoScript 5 running on "Quantum" with the extensions.legacy.enabled trick. Just please don't block your updates on Firefox 56, it would be bad for your security.

Let me repeat that: your safest option for the next few days is Firefox 52 ESR, which will receive security updates until June 2018.

So, for another half-year you there will be two NoScripts: just sort your priorities and choose yours.

Update 2017-11-15

As you probably noticed, yesterday's today has gone away in most time zones and we're not ready yet (Murphy law and all) :(
But we're definitely on track for the end of this week, and in the meanwhile your awesome patience deserves a couple of preview screenshots...

Update 2017-11-18

The week is not over yet.

* in the next few weeks will move NoScript 10.x source code and bug tracking on GitHub, in the meanwhile please keep using the forum.