turning off Javascript

On Sun, 13 Sep 2015 22:58:11 +0200
"s|b" wrote:

On Sun, 13 Sep 2015 11:55:00 -0700, none wrote:

I second that, but it can be confusing sometimes. When it
"breaks" a site, what do you allow and what not?

I agree but I haven't found anything better, have you?

I'm still using it, but sometimes it's frustrating if you want to
watch a video for instance, and you click on a link, but the video
isn't playing and NoScript is showing like 20 sites.


What type of video, HTML5 or Flash?

I have been using NoScript for a long time, and I might be able to
help, if I knew which site and which video.

On Sun, 13 Sep 2015 22:12:22 +0200, FredW wrote:

On Sun, 13 Sep 2015 20:22:02 +0200, "s|b" wrote:

On Sun, 13 Sep 2015 09:18:14 -0700, none wrote:

NoScript is the way to go.

https://noscript.net/

I second that, but it can be confusing sometimes. When it "breaks" a
site, what do you allow and what not?

Trial and error (one by one).
Over time you get used to it and can select fairly easily what to allow
and what not.
(I never allow googgle, facebook,etc.)

Are you using this in IE v11? If so, what happens on google and facebook when
you use it - do they still work properly, but with the hang ups?

Thanks
charliec

On Sun, 13 Sep 2015 11:49:01 -0700, Mike Easter wrote:

If you are interesting in having good control of your browser, it is
better to not use IE except for some very specific worthwhile site which
requires IE and then only use it for that site and not as your general
browser.

Agreed.

For example, if you need to use Java for something in IE, IE should be
the only browser capable of Java and not used for anything else.

If you are only using Ffx and Chrome generally, you can eliminate their
use of Java. If you stop all javascript, you are going to be
'inconvenienced', perhaps unnecessarily, but it can be done selectively.

I think you're aware and simply typo'd above, but there's no relationship
between Java and javascript, other than the unfortunate similarity in their
names. This thread seems to be mostly about javascript, rather than Java.

--

Char Jackson

| I get the same capability merely by having multiple profiles.
|

How does that work? I've never noticed anything
about profiles. I don't see it in the settings or menus.

On 9/13/2015 2:58 PM, Mayayana wrote:
| I get the same capability merely by having multiple profiles.
|

How does that work? I've never noticed anything
about profiles. I don't see it in the settings or menus.



For firefox, the developers think only developers should have multiple
profiles; so they are eliminating the user interface to create and
switch between them.

In SeaMonkey, profiles are alive and well.

You might inquire about how to create and switch between profiles at the
mozilla.support.firefox newsgroup on the news.mozilla.org server.
Newsgroup accounts on news.mozilla.org are free and no signup or
registration is required.

--
David E. Ross

Why do we tolerate political leaders who
spend more time belittling hungry children
than they do trying to fix the problem of
hunger? http://mazon.org/

On Sun, 13 Sep 2015 11:14:05 -0500, Jo-Anne wrote:
Given what I've been reading about Javascript, I suspect it's worthwhile
to keep it turned off most of the time. Is there a particular add-on in
Firefox that works well?

To turn it off, you don't need an add-in. Just type
about:config
in the URL window, find
javascript.enabled
and set it to false.

But to turn it on and off conveniently, when e.g. you visit your
bank's site (since banks, stupidly, all seem to require use of this
insecure technology), something like Prefbar is quite handy.

--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA
http://BrownMath.com/
http://OakRoadSystems.com/
Shikata ga nai...

On Sun, 13 Sep 2015 11:33:18 -0500, Jo-Anne wrote:
Thank you, everyone! I installed NoScript in Firefox. Any suggestions
for dealing with Javascript in IE?


Dealing with Javascript in IE, unless you do something about ActiveX,
is like rearranging deck chairs on the Titanic.

--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA
http://BrownMath.com/
http://OakRoadSystems.com/
Shikata ga nai...

On Sun, 13 Sep 2015 11:49:01 -0700, Mike Easter wrote:
For example, if you need to use Java for something in IE, IE should be
the only browser capable of Java and not used for anything else.


And there's no reason even to have Java installed any more. I don't
mean in IE, I mean on your computer.

http://www.howtogeek.com/122934/java...wful-its-time-
to-disable-it-and-heres-how/?PageSpeed=noscript

--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA
http://BrownMath.com/
http://OakRoadSystems.com/
Shikata ga nai...

Char Jackson wrote:
Mike Easter wrote:

If you are only using Ffx and Chrome generally, you can eliminate their
use of Java. If you stop all javascript, you are going to be
'inconvenienced', perhaps unnecessarily, but it can be done selectively.

I think you're aware and simply typo'd above, but there's no relationship
between Java and javascript, other than the unfortunate similarity in their
names. This thread seems to be mostly about javascript, rather than Java.

I was addressing both in the same par. I was suggesting the 'broad'
elimination of Java; completely by system if possible. I was also
'suggesting' that the OP's idea of eliminating javascript was a little
bit over-the-top. That idea was in the OP, but I don't think that is
going to work out, so she is going to be 'recklessly' enabling
javascript and thus being no more secure but more inconvenienced.
Depending on how she does it of course.



--
Mike Easter

Jo-Anne wrote:

Any suggestions for dealing with Javascript in IE?

Internet Explorer has no add-on or toolbar button to quickly and easily
enable/disable Javascript. You can go into a security zone's setting to
disable scripting but Javascript will remained disabled until you again
wade through the config wizard to reenable scripting.

Scripting control is back in the registry. When you change the
scripting option in IE, a registry value gets changed. Took me using a
registry monitor to find out where in the registry the scripting value
was tracked. Then I wrote a batch file called by a shortcut that
changes the scripting value (to disabled), runs IE, and after exiting IE
will restore the scripting value (enabled) so scripting is enabled by
default when I later run IE but not when using that shortcut.

However, if I'm going to disable scripting in IE then I might as well
also enable IE's Private Mode along with disabling meta-refresh. Sites
can redirect you do a different page by using meta-refresh: they use a
timer that lets you see the interstitial page but too often they set it
to zero so you don't notice you wanted to one place but they pushed you
to elsewhere. As I recall, Firefox has an option or setting where you
can disable meta-refresh. Firefox will warn you about the redirection;
however, and as stupid as it sounds, Mozilla figured users that wanted
to know meta-refresh was used did not want to know to where the
meta-refresh pointed. Oh yes, warn about a meta-refresh redirect but
don't tell users what is the covert target site. So, in my examples
below, I not only disable scripting in the batch file but I also disable
meta-refresh while enabling Private Mode. Since I have CCleaner
installed, I also have it run after exiting IE to ensure cleanup
afterward (although IE has some cleanup settings, I've seen some times
when they didn't work).

Disabling scripting and meta-refresh are accomplished via registry
settings. PrivateMode and startpage are accomplished using command-line
arguments for the .bat program that get passed to IE's executable (the
%* argument means all shell variables specified in the caller's shell
which come from the command line you used to run the caller program).

Create a shortcut to run the following batch (.bat) file. In the
properties of the shortcut, set its window to minimized. Then you don't
have to see the DOS shell windows (it shows minimized in the taskbar).
Assuming you store batch files in C:\Batch and you name the batch file
noscriptIE.bat, the shortcut would run:

C:\Batch\noscriptIE.bat -private about:blank

The command-line arguments private and about:blank get passed to the
iexplorer.exe program. private means PrivateMode and about:blank is the
web page you want IE to load on startup. about:blank doesn't load a web
page so IE is ready sooner. If you don't specify a web page then the
one specified as the Home Page in IE's config will get loaded.
Disabling of scripting and meta-refresh are done via reg.exe to make
registry changes. Upon exit of that instance of IE, the rest of the
batch script gets executed which re-enabled scripting and meta-refresh
and does the CCleaner cleanup.

Note that when you run the batch file, you are changing registry
settings that will affect ALL instances of Windows currently loaded or
loaded thereafter. There is no way to make these registry settings
apply only to one instance of IE. These are HKCU (HKEY_CURRENT_USER)
registry settings that apply to all instances of IE started under the
current user (the currently loaded Windows session). It does not affect
other Windows accounts, just yours. If you want the same control under
other Windows accounts, you have to log into each one to make its HKCU
registry edits. That's why a batch to flip them off and on is easier,
plus most users don't want scripting disabled all the time.

__________ start of batch file __________

@echo off
cls

REM - Path to Internet Explorer 32-bit executable file:
set iepath=C:\Program Files\Internet Explorer\iexplore.exe

rem - Disable script & meta-refresh support in Internet security zone.
echo __________________________________________________ ________________
echo.
echo DISABLE script and meta-refresh support in Internet Explorer ...
reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\In ternet Settings\Zones\3" /v 1400 /t reg_dword /d 3 /f
reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\In ternet Settings\Zones\3" /v 1608 /t reg_dword /d 3 /f


rem - Run IE and include command-line parameters.
echo.
echo __________________________________________________ ________________
echo.
echo Load Internet Explorer without script and meta-refresh support ...
echo.
echo *** Do NOT terminate this batch file.
echo *** Exit the web browser to complete this batch file and
echo resume script support.
echo.
echo WARNING: ALL instances of the web browser will have scripting disabled
echo until this batch file completes execution.
echo.
echo Command = "%iepath%" %*
"%iepath%" %*
echo.
echo __________________________________________________ ________________
echo.


rem - Enable script & meta-refresh support in Internet security zone.
echo.
echo ENABLE script support in Internet Explorer ...
reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\In ternet
Settings\Zones\3" /v 1400 /t reg_dword /d 0 /f
reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\In ternet
Settings\Zones\3" /v 1608 /t reg_dword /d 0 /f

rem - Cleanup history, cookies, TIF cache, etc.
echo.
echo Cleaning up ...
"C:\Program Files\CCleaner\CCleaner.exe" /auto

__________ end of batch file __________

So while it is a bit of effort to setup (well, all you have to do is
create a .bat file with the above and then create a shortcut pointing to
the .bat file), it's pretty easy to toggle off/on scripting and meta-
refresh. To make it even easier, and instead of putting the shortcut on
the desktop or in the Start menu, add the shortcut to a toolbar you add
to the taskbar. Then the shortcut is always available. Just remember
to use the shortcut when you want a neutered IE.

I have never found an extension for IE that lets you quickly and easily
toggle scripting in IE. I had to come up with registry edits for the
scripting option in IE but that affects every instance of IE currently
or later loaded. Not until you exit the instance of IE that the batch
file loaded to run reg.exe to reset the registry settings will IE then
again support scripting and meta-refresh. This is like using the main
light switch to turn off all the lights in a room so everyone trying to
read a book in that room are affected.

Stan Brown wrote:

Jo-Anne wrote:

Any suggestions for dealing with Javascript in IE?

Dealing with Javascript in IE, unless you do something about ActiveX,
is like rearranging deck chairs on the Titanic.

Besides my reply to Jo-Anne showing how to make easy changing the
registry settings controlling scripting and meta-refresh in IE,
disabling add-ons (which includes the ActiveX controls) is pretty easy:
just add the -extoff command-line argument when loading iexplore.exe.
-extoff loads IE in its safe mode.

In the shortcut properties, just add -extoff to the command line. So
the shortcut's command line might look like:

C:\Batch\noscriptIE.bat -private -extoff about:blank

-private = Use PrivateMode (not much value if you configure IE to purge
everything on its exit)

-extoff = Don't load any add-ons.

about:blank = Loading a blank page is faster than the one specified as
the Home page (unless that is also about:blank). No point in wasting
a home page when your intent is to visit elsewhere.

reg.exe is used in the .bat file to disable scripting and meta-refresh
before loading IE and then reenable scripting and meta-refresh after
exiting IE.

There might be some extension to the same in IE. I didn't look that
hard once I found out about the command-line arguments to IE and figured
out the registry entries controlling scripting and meta-refresh.

I do know that this works. I'll visit a site that whines Flash is
needed and I must install it. No, I do not must install. I'll visit
sites that bitch scripting must be enabled. Wrong. I'll get stuck on
their first web page that they tried to hide and redirect me to
elsewhere via meta-refresh. They cannot covertly push me elsewhere. If
I've going to visit an unknown or untrusted site using IE, I use my
shortcut to run my .bat program to disable scripting, meta-refresh, use
PrivateMode, and kill all add-ons (IE's safe mode). I select when to be
protected. With NoScript, you have to figure out why a site doesn't
work and if you whitelist the site or components within it. So I don't
see either as being more effective than the other but NoScript does
offer more configurability - but the OP was asking about IE in her 2nd
inquiry, not about Firefox. In Firefox, yeah, I'd use NoScript.

On Sun, 13 Sep 2015 22:58:11 +0200, "s|b" wrote:

On Sun, 13 Sep 2015 11:55:00 -0700, none wrote:

I second that, but it can be confusing sometimes. When it "breaks" a
site, what do you allow and what not?

I agree but I haven't found anything better, have you?

I'm still using it, but sometimes it's frustrating if you want to watch
a video for instance, and you click on a link, but the video isn't
playing and NoScript is showing like 20 sites.

I click "Temporarily allow all this site".

One of the main reasons I have NoScript is to stop sites that
automatically play videos from wasting my bandwidth.

Some news sites do this, and I'm not happy to pay for some video
playing in the background while I'm trying to read an article and have
no interest in the video.


--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

On Sun, 13 Sep 2015 21:23:25 -0400, Stan Brown
wrote:

On Sun, 13 Sep 2015 11:49:01 -0700, Mike Easter wrote:
For example, if you need to use Java for something in IE, IE should be
the only browser capable of Java and not used for anything else.


And there's no reason even to have Java installed any more. I don't
mean in IE, I mean on your computer.

Unless you want to use LibreOffice.


--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

Stan Brown wrote:
On Sun, 13 Sep 2015 11:49:01 -0700, Mike Easter wrote:
For example, if you need to use Java for something in IE, IE should be
the only browser capable of Java and not used for anything else.


And there's no reason even to have Java installed any more. I don't
mean in IE, I mean on your computer.

http://www.howtogeek.com/122934/java...wful-its-time-
to-disable-it-and-heres-how/?PageSpeed=noscript

Unless you work remotely and have to VPN to the office.

On Sun, 13 Sep 2015 16:21:07 -0500, Johnny wrote:

I'm still using it, but sometimes it's frustrating if you want to
watch a video for instance, and you click on a link, but the video
isn't playing and NoScript is showing like 20 sites.

What type of video, HTML5 or Flash?

I don't have a specific video, but I remember a site using Vimeo for
their videos and it was a PITA to get it to play. Nowadays I either use
a "clean" Portable Firefox or Pale Moon Portable to watch such a video.

I have been using NoScript for a long time, and I might be able to
help, if I knew which site and which video.

I can only remember Vimeo, embedded in a site. No problems while trying
to watch videos on vimeo.com.

--
s|b