Update on NoScript's WebExtensions migration
The author of the Firefox security add-on NoScript, Giorgio Maone, answered questions about the WebExtensions migration of the NoScript add-on recently.
NoScript is my number one must have add-on for the Firefox web browser; in fact, it is one of the few things that keeps me from switching my main web browser as it cannot be realized in other browsers (non-Firefox based that is).
Like any other legacy Firefox ad-on author, Giorgio is affected by the looming WebExtensions exclusivity deadline. Mozilla plans to switch off the legacy add-on system in Firefox 57 Stable and Beta. The current version of NoScript would stop working for the majority of Firefox users at that time.
Giorgi is a high profile developer considering that NoScript is one of the top add-ons for the Firefox browser. Mozilla asked him to work with them on the required WebExtensions APIs to realize NoScript as a WebExtension, and Giorgio did.
While Mozilla wants feature parity in regards to WebExtensions with Google Chrome, the organizations plans to create APIs that are Firefox exclusive to provide add-on developers with better options to create add-ons for the browser.
In fact, NoScript is not realizable on Google Chrome, while it can be realized on Firefox once the required APIs land.
Check out these NoScript articles and guides:
- NoScript Beginner's guide
- The Firefox NoScript guide you have all been waiting for
- How to use NoScript efficiently
- Top 6 NoScript features you may not know about
Giorgio wants to release the WebExtension version of NoScript when Firefox 57 gets released so that Firefox Stable and Beta users can continue using it.
The interview with Giorgio revealed a couple of interesting tidbits about the migration.
- The WebExtensions version of NoScript will be leaner than the legacy add-on version thanks to backwards compatibility code being removed from the add-on.
- Giorgio will maintain the legacy add-on version for another year as Firefox ESR and Tor Browser users cannot use the WebExtensions version until the next major ESR version is released. This means support until June 2018 is guaranteed.
- Some WebExtensions APIs won't land until Firefox 57. This means that NoScript will be offered as an Embedded WebExtension.
- User configuration data will be migrated to the WebExtension.
- Some features of NoScript perform better as a WebExtension. This is true for the XSS filter which benefits from the asynchronous nature of WebExtensions.
Closing Words
NoScript will be published as a WebExtension so that Firefox Stable and Beta users can migrate to the new version of the popular security add-on once Firefox 57 gets released. The interview highlights Mozilla's ambitious deadline as well.
Now You: Which of your favorite add-ons have not yet been migrated?
> … Which of your favorite add-ons have not yet been migrated?
Session Manager
Showcase
Tab Groups
… plus the twenty-something listed at https://discourse.mozilla.org/t/-/13310/35?u=grahamperrin
> … I accept that some of these will be irreplaceable. … I’ll enjoy them for the next few months.
Their is many addons I would love to see in firefox 57, too the Point I am think about not use fire fox and change browser, fire fox change its policy and ever since I have been very mad over it. If I had the skills I could come up with ways to improve the browsers and make them better, Yes I understand the need for people ideas and how they need to have imput, Firefox kind of took that right away when they changed support and formats, I hope people see that, and I also hope the best for people and their ideas. One of the best ideas I have seen it Fox web security, and I don’t think it is going to being imputted into fire fox 57 and it is really need more than about 90% of the other addons, THis one sure makes me mad as hell. when people were to try it you would see why it is really needed.
The one addon I haven’t found a replacement for yet is Download Status Bar. I’m extremely relieved that NoScript will be updating soon. Already have the updated Tree Style Tab, and was able to implement the following code in UserChrome.css to replace Roomy Bookmarks:
/* Recreates the basic functionality of the popular Roomy Bookmarks Toolbar add-on:
Hide bookamrks bar items label text, show on hover. */
.bookmark-item > .toolbarbutton-text {
margin-top: -1px !important;
}
.bookmark-item:not(:hover):not([open=”true”]) > .toolbarbutton-text {
display: none !important;
}
#PlacesToolbarItems > .bookmark-item:not(:hover):not([open=”true”]) > .toolbarbutton-icon[label]:not([label=””]) {
margin-inline-end: 0px !important;
}
Also, if you use Tree STyle Tab and want to hide the tabs at the top, put this in UserChrome.css:
#TabsToolbar{
visibility: collapse !important;
}
NoScript *definitely* comes to my mind when I worry about what extensions I’d miss if I upgraded to Firefox 57. In fact, it comes to mind first by a huge margin. My view on NoScript quickly went from “huh, that’s a nice idea” to “good heavens, it would be completely unreasonable and crazy to ever consider browsing the web again without something like it.”
I’m glad that Giorgio is able to do the move, and he’s the kind of guy that I trust to not pretend like it’s an equivalent replacement if it really isn’t. If he were willing to do that kind of compromise, he wouldn’t have passed up on trying to reach the Chrome user base.
What I’d miss most – and I haven’t checked for which of these there’s an equivalent WebExtensions replacement already, but I assume not many of them, if any, seeing how ridiculously limited the APIs are right now:
* Bookmark Favicon Changer for those websites that have none or an ugly one
* Keybinder, since Firefox still doesn’t allow customising keyboard shortcuts *sigh*, and specifically to make the Escape key stop any open requests again instead of just doing nothing.
* Keyword Search so you can search from the URL bar in a sensible way
* Link Visitor to mark links as visited or unvisited by manipulating the history (to keep track of where I was and where I want to go)
* Nuke Anything Enhanced to very quickly remove annoying page elements or simplify a page for printing
* Preserve Download Modification Timestamp, because why the hell is that not the default in EVERY browser
* Textarea Cache to prevent losing long text input from web pages (similar to the now-defunct Lazarus)
* URL Flipper to increase or decrease URL query parameters from toolbar buttons
* YouTube Video and Audio Downloader because you should always backup what you like :)
I have to say that all of these except the last one should really be standard issue in any browser, and if things were right, they’d be part of the mainline Firefox codebase. Still, they’re not now so I doubt they’ll suddenly be by the time Firefox 57 comes around, so I pretty much depend on those extensions.
I’m less worried about ad blockers, since they’re super slow and NoScript takes care of most things anyway; I switched from Greasemonkey to Tampermonkey a while ago so that one is fine; and I’m less worried than I probably should be about Classic Theme Restorer, because Firefox 57 will look completely different anyway, and with some luck it will include decent customisation options, at least over time.
Just in case anyone is reading and commiserating… I found WebExtension replacements for two out of the nine extensions I mentioned:
* An add-on called “Remove/Crop-to Selection” is an almost identical replacement for “Nuke Anything Enhanced”. Yay!
* The developer of the “YouTube Video and Audio Downloader” has replaced his extension with an in-development WebExtension version. The FFMPEG merging of audio and video tracks didn’t work yet when I tried it, but considering it’s by the original developer, it’ll probably get there.
Seven to go!
Although NS is certainly a high-profile addon, I don’t really care about if it works or not. There are so many other addons I’d miss if I were to switch to FF57, but NS does not come to mind first.
“User configuration date will be migrated to the WebExtension.” I think you meant “user configuration data,” Martin.
“User configuration date will be migrated to the WebExtension.”
Is that the date users were conceived or born? :)
Which of your favorite add-ons have not yet been migrated?
___
Only 1 add-on migrated to WE:
Ghostery WE
Not migrated to WE but I found WE replacement:
Tab Control => Open Tabs Next to Current WE
Add-ons that not migrated to WE:
Session Manager
Adblock Plus
Flashblock, FlashStopper
Custom Tab Width
___
(I was using NoScript in the past but not anymore due to conflict with other add-ons)
Can anyone else that is running the current Nightly and NoScript tell me if “View Page Source” works for you ? I just get a blank page and blank addressbar unless I disable NoScript, is that a config error on my part or is it an issue with the current Nightly or NoScript?
I have a nightly from July 15th and newest NS and “view page source” works fine.
In the fourth paragraph: Giorgi is a high profile developer considering that NoScript is one of the top add-ons for the Firefox browser. Mozilla asked him to work with them on the required WebExtensions APIs to realize NoScript as a WebExtension, and Giorgio did. In the name Giorgi missing a ‘o’
It’s too bad he’s not continuing support for the so-called “legacy” version.
Do you know about the replacement for Custom Tab Width addon?
Also creating userChrome.css does not help (it is not possible to close empty tabs and other problems with tabs):
https://www.ghacks.net/2011/02/02/change-firefoxs-minimum-maximum-tab-width/
> Which of your favorite add-ons have not yet been migrated?
Classic Theme Restorer, DownThemAll, BetterPrivacy, Private Tab, Self Destructing Cookies, Greasemonkey… just to name a few.
Greasemonkey: There are Tampermonkey and Violentmonkey, both are webextensions.
SDC. There is Cookie AutoDelete. So far it cannot clear loaclStorage but this will change:
https://github.com/mrdokenny/Cookie-AutoDelete/issues/44#issuecomment-321015964
“Better Privacy” is redundant these days, flash itself & flash cookies it’s pretty much a thing of the past.
Adblock Plus:
https://adblockplus.org/blog/the-plan-towards-offering-adblock-plus-for-firefox-as-a-web-extension
https://bugzilla.mozilla.org/show_bug.cgi?id=1226547
Tab Mix Plus:
https://www.ghacks.net/2017/04/06/mozilla-audited-tab-mix-plus-for-webextensions-compatibility/
Session Manager:
http://forums.mozillazine.org/viewtopic.php?p=14757231&sid=0f3c1a92537f16d96de465b83564d863#p14757231
Many extensions:
https://www.ghacks.net/2017/07/07/firefox-add-ons-webextensions-state-july-2017/
For me, the add-on that wasn’t migrated and it will never be (as far as I read) is “Mozilla Archive Format, with MHT and Faithful Save”. Also, one of the features I use from uBlock Origin – script:contains – which is increasingly useful to stop the anti-adblockers, will also not be migrated to WebExtensions.
As a result, I have no plans to switch to the new Mozilla 57. I will stay on the latest ESR that has the features I want, and see what the future will bring.
Regarding script:contains, gorhill himself writes on
https://github.com/gorhill/uBlock/wiki/Firefox-WebExtensions#differences-with-ubolegacy :
> uBO’s own filter lists have long ceased to rely on this filter syntax to solve reported filtering issues.
So if this issue doesn’t seem to be a problem for gorhill I don’t know why it is for you.
I really dont see any benefit in using this and ublock together as this seems to be counter-productive .
I find ublock origin to be a better option because it has integrated adblocking,Noscript has to be used in conjunction with a separate adblocking extension which is both resource heavier and a bit of a pain.
ScriptSafe is maybe the NoScript alternative for Chrome/Chromium based browsers, and it does it’s job good.
Giorgio Maone has long wanted to port NoScript to Chrome, but it is unfortunately not possible, far from it, and he said that he’d rather not provide a false sense of security by releasing a dumbed down NoScript with holes.
I can’t really name Chrome’s lacks but they are important enough that neither Giorgio nor Tor developers can adapt their products so they can use Chrome. (I saw a pretty detailed list they made for Tor, but Giorgio only made a post regarding ScriptSafe, NotScript and whatever)
Giorgio with his work on WebExtensions and his hint at web standards for add-ons aims to enable a future where required features can be added to Chromium-based browser so he can port NoScript.
But right now comparing things like ScriptSafe to NoScript is providing a false sense of security IMO.
Best add-on .
Interesting interview, and devoted individual.
what about flashgot?
any news
FlashGot section/category: https://forums.informaction.com/viewtopic.php?f=11&t=22907&p=88659#p88659
Putting it in my TODO list, unfortunately low priority because FlashGot still needs to go full e10s (NoScript got full priority for obvious reasons).
Yeah, very good news for NoScript, the code cleanup it gets was direly needed and in the process it gains per-site permissions, the long time weakness of NoScript being the global nature of its whitelist. (Although mitigated by XSS filtering and many features)
> Which of your favorite add-ons have not yet been migrated?
All of them will be there except one, which seems way too niche and rare and complex for me to expect survival. Yet I have some hope that it might actually be possible, the question being will the developer or someone else port it ? Possible. In time for 57 ? Doubt it.
Actually I just discovered that a similar add-on has been made recently that is already a WebExtension. So the original one I like should be technically able to exist.
Thanks, that’s really good news! :)
Agree, very good news. I’m happy to read that first Ublock Origin and now Noscript, two of my favourite add-ons, will live on past 57.