uBlock Origin can block JavaScript by default now
A recent update to the cross-browser content blocker uBlock Origin introduced an option to block JavaScript by default for all visited sites or individual sites.
The new option of uBlock Origin 1.17.0 gives users even better control when it comes to blocking content from running automatically on sites that they visit in any of the supported browsers.
Side note: you can read my journey to getting uBlock Origin to update to the new version in Chrome here.
The first thing that you need to do is make sure that you run at least uBlock Origin 1.17.0. Click on the extension's icon in the address bar of the browser that you are using and in the interface that opens on the settings icon. Switch to the about tab on the dashboard; the version of the extension is listed there.
Configure uBlock Origin to disable JavaScript
Users of uBlock Origin have several options when it comes to the new JavaScript blocking functionality:
- Enable it for individual sites.
- Enable it for all sites.
A click on the uBlock Origin icon displays the main interface that you use to control content. You find the new option to disable JavaScript for the site in the bottom-right corner. The new icon looks like a closed tag </>.
A click disables JavaScript on the site and adds a red cross to the icon to indicate that JavaScript is turned off on the site. Note that this is temporary unless you make the change permanent using icons that uBlock Origin displays after you activate the option.
Advanced users may add individual sites to the "my rules" section of the dashboard. Use the no-scripting: [hostname] true template and replace [hostname] with the domain that you want to disable JavaScript on.
The second option that users have is to block JavaScript on all sites by default similarly to what NoScript does for Firefox.
- Open the uBlock Origin settings.
- Make sure that the Settings tab is selected.
- Check the "Disable JavaScript" box there.
What happens when you disable JavaScript?
One core difference between using the new JavaScript switch and using uBlock Origin without it is that noscript tags are executed when the former is used to disable JavaScript. The latter blocks individual script resources instead only.
The master switch takes precedence over "dynamic filtering rules and static filters related to script resources".
Closing Words
The option to disable JavaScript for all visited sites or on a per-site basis adds another powerful tool to the already-great arsenal that uBlock Origin offers. Users who disable JavaScript globally will run into sites that break as some may require JavaScript for some or even all functionality.
If you want to make 99% of websites completely unusable, disabling javascript is a great way to do it! This isn’t 1995 anymore.
I’ll play Devils advocate here. I noticed G Hacks is begging for money at the bottom of each page because ad revenue is drying up. But clearly AdBlockers like Ublock are doing nothing but hurt revenue for sites as well. We all know most people even if they like something won’t pay for it if its offered for free. Personally I think ad blockers only speed up the process where web sites will simply become paywalls or worse just go away. Ad blocker users, be careful what you wish for because this could backfire on you.
You can have a backup of your allowed sites. Is that possible in Chrome/Chromium?
Is there some advantage to using this extension for this particular function vs the browser’s own ability to do this per-site (at least in Chrome/Chromium, though apparently not in Firefox)?
The last version of NoScript will not work for me. I have W7 pro. 32bit with Firefox ESR 52.9.0.
I had to restore back to the previous version.
I am happy to learn that uBlock Org. will block and control Javascript, which was the main reason for me to use NoScript.
I wish to change from the Firefox ESR Channel version 52.9.0 back to the current Release Channel version. I want to start with a new clean version of Firefox, but I want to save and restore my bookmarks and other options if I can. I have made many About:Config changes that may not be good for the new Firefox Release Channel.
Question: will this new version of uBlock work for me on this w7 settings, or will I need to wait until I am able to change Firefox back to the Release Channel version?
Martin thank you for the information you always give us!
Nice addition. However with Pale Moon I will continue with uMatrix 1.1.4 until someone in “The PM Community” will fork it (so much pain with the forks of Adblock + they have made).
This is an excellent change. The lack of this ability is what made uBO a nonstarter for me.
Awesome. Now I don’t need to use umatrix anymore.
Very useful feature imho! :)
It’s done in Chrome and FF. Thks !
Nice because it avoids using a dedicated extension to disable javascript
But I have the 1.16.18 and it doesn’t want to update it
“Note that this is temporary unless you make the change permanent using icons that uBlock Origin displays after you activate the option.”
No new icons displayed after I activated the option, Firefox browser, Windows 10 version 1709: disabled JS on Huffington Post website, closed website, restarted Firefox, loaded HP, JS was still disabled. I was glad to see this, and very glad to have individual site site option.
“No new icons displayed after I activated the option”
In the top left hand corner of the uBlock Origin popup screen, there is an “eraser” and a “lock” icon.
Lock makes the change permanent…eraser reverses it.
https://github.com/gorhill/uBlock/wiki/Quick-guide:-popup-user-interface#the-overview-panel
https://github.com/gorhill/uBlock/wiki/Per-site-switches
New in beta 1.16.21:
Changes to the state of per-site switches will be deemed temporary if and only if the overview panel is visible.
When the overview panel is not visible, toggling a per-site switch will cause the change to be permanent (i.e. same behavior as before).
However, when the overview panel is visible, toggling a per-site switch will cause the change to be temporary. In such case, there will be an eraser and a padlock icon in the overview pane, which can be used to revert or persist the current state of all the per-site switches.
Thanks for the help in making it easy to play with the new power of this essential Chrome extension. I wish Chrome would use Notify when it updates an extension automatically.
If I understand you correctly, you are looking for this Chrome extension: “Extensions Update Notifier” from https://github.com/beaufortfrancois/extensions-update-notifier-chrome-extension
Thanks for notifier tip for Chrome. I installed it and wait for its output the next time.
This change in uBlock Origin, allowing parsing of tags, is making the NoScript extension even less useful now.
It looks like development of the firefox-legacy branch of uBO (for e.g. Pale Moon) has ended. The most recent version is 1.16.4.4 (July 18, 2018). That’s a pity.
Support for classic uBO had officially stopped long before, but then the dev partly changed his mind and said he was ready to do unfrequent trivial fixes for the classic version too :
https://github.com/gorhill/uBlock/issues/3666#issuecomment-38494482
That’s not necessarily the case. As far as I understand, firefox-legacy only gets bug fixes, not feature updates… and there may not be (m)any bugs found since July.
to disable js _per default_ is imho madness.
the js – web – of – trust – bubble (with other words self-isolation) will grow and grow over time. always. the (normal) user gets tired of eternal clicking. the (normal) user gets tired of broken websites. the js – use on the web will continue to grow and grow. the js – web – of – trust – bubble (with other words self-isolation) will grow and grow over time. always. the (normal) user gets tired of eternal clicking. the (normal) user gets tired of broken websites .. .. .
yes, future-oriented solutions look different.
but I’m at least glad about the per site switch (sometimes useful) and i’m glad the “disable javascript” setting is generally opt out. this shows understanding but still gives the user the choice (to madness). but the main thing is a choice.
@noemata: “to disable js _per default_ is imho madness”
I’ve been doing this for years, and I’ve found it to be a very helpful habit (or I would have stopped doing it!). You talk about “web of trust”, but the reality is that websites cannot be trusted by default, and allowing them to run Javascript by default is a huge security issue. Personally, I’d call allowing Javascript by default “madness”.
@john, you are a real techie and that’s what we need. but i’m a normal user. the majority as well. maybe you enjoy building a “js – web – of – trust” ( = you disable javascript per default and only allow javascript on certain pages = you build a “js – web – of – trust”), but i’m not (anymore). this is not a _solution_, this is _mad behaviour_ (over time – as described above and right after). it’s especially mad behaviour with a view to the future of the web.
if it were up to me, i would completely forbid the use of javascript. but that won’t happen. the use of javascript will grow and it will become more and more difficult to finally be able to use a page unrestricted and uninterrupted and so on .. if javascript is disabled. to disable js per default in order to escape its dangers is just like a crude hammer blow.
the js – web – of – trust – bubble (or with other words self-isolation) will grow and grow over time. always. but the (normal) user gets tired of eternal clicking. the (normal) user gets tired of broken websites. the (normal) user gets tired of restricted websites. the js – use on the web will continue to grow and grow. the js – web – of – trust – bubble (or with other words self-isolation) will grow and grow over time. always. but the (normal) user gets tired of eternal clicking. the (normal) user gets tired of broken websites. the (normal) user gets tired of restricted websites .. .. .
consequence = madness. yes, future-oriented solutions look different. this approach is outdated. this bubble will burst soon. hopefully, because then techies will find better solutions – outside the burst bubble.
@noemata
“maybe you enjoy building a “js – web – of – trust—
No, I don’t enjoy it at all. It’s a royal pain in the butt. However, if you want to be secure, it’s a mandatory pain in the butt whether you’re a techie or not.
Truthfully, I do very little whitelisting for Javascript. 99% of the time, I don’t allow any Javascript to run. Most websites that I go to are just fine without it (they usually use JS in order to implement eye-candy stuff that isn’t actually necessary). The major exception is websites that engage in commerce.
Unless a website is actually indispensible to me (and almost none are), if it doesn’t work without Javascript then I simply don’t use that site anymore. This is what I recommend to everyone for two reasons — first, it’s the safest approach in terms of personal security, and second, it’s good for the web generally, as it continues to encourage website designers to keep their sites functional for users who don’t allow Javascript.
@john “…as it continues to encourage website designers to keep their sites functional for users who don’t allow Javascript”
i believed that once. not any more. that’s already too idealistic in times like these.
well, you’re hardcore. i know that. but – that’s a little bubble. that’s a pain in the ass. this is not a general solution for the majority. this is not a general solution for the future of the web.
this is my problem with this approach. furthermore, it leads to the absurd behaviour described above for the majority of users of this approach.
you do very little whitelisting and you can keep this up (for now), so maybe not for you, but you’re an exception here (for now).
@noemata: “this is not a general solution for the majority”
Yes, I know that, and that’s why I’m speaking about my own use, not others. If other don’t care as much about their personal security and privacy, that’s their business.
I’m trying to retain as much of the usefulness of the web as I can, and so far, it’s worth the effort. If the effort required becomes too much (or it becomes impossible to achieve even a minimal amount of protection), the only other alternative is to stop using the web entirely.
The only absurd thing about this is that the egregious misbehavior of the major web and internet-related companies make this stance necessary.
What does it say just above “Disable JavaScript” and has been there for ages?
Wow, this is excellent.
It adds another layer of control, and in this case a new level of functionality because it tells website that JS is not supported.
It’s not really helpful to have it on by default.
But I started to use it for some websites to make them load faster.
For example, I was wondering why startpage is so slow and it turns out some ad related JS are were the culprit.
So it’s a very nice function to make some websites, especially those that support noscript tags load faster and leaner.
Nice addition to a great addon.Maybe gorhill could consider inserting the same setting for all the other functions like pop-ups and remote fonts etc.