turning off Javascript

| Note that at least two of the 17 extensions I have installed for my
| browser require JavaScript to be enabled.
|
What are those? They all use javascript as
their "programming" language. But that's not the
same as javascript allowed on webpages.

I actually came across a topical article yeasterday
related to this thread:

http://arstechnica.com/security/2015...fect-visitors/

Thousands of infected sites. Growing in number.
Usin a combination of 0-day exploits. Mostly
Flash, IE bugs, Acrobat Reader, Java and Quicktime.

More on that he

https://heimdalsecurity.com/blog/nuc...-flash-player/

But the vast majority of such bugs depend on
script, and the current crop mostly depend on
iframes.

On 9/21/2015 8:18 AM, Mayayana wrote [in part]:
| Note that at least two of the 17 extensions I have installed for my
| browser require JavaScript to be enabled.
|
What are those? They all use javascript as
their "programming" language. But that's not the
same as javascript allowed on webpages.


Oops! I have 24 browser extensions. The number 17 applies to my wife's
PC.

The Web sites for both Chatzilla and ShowIP extensions for SeaMonkey
indicate they use JavaScript. The same extensions most likely use
JavaScript with Firefox. I did not dig into the other 22 of my browser
extensions.

--
David E. Ross

Why do we tolerate political leaders who
spend more time belittling hungry children
than they do trying to fix the problem of
hunger? http://mazon.org/

David E. Ross wrote:

The Web sites for both Chatzilla and ShowIP extensions for SeaMonkey
indicate they use JavaScript. The same extensions most likely use
JavaScript with Firefox.

Most mozilla add-ons are written in javascript (they can be compiled
C/C++) and run within the browser itself, this is different from
allowing webpages to run javascript.

If you disable javascript for webpages, add-ons still work fine.

Steve Hayes wrote:

VanguardLH wrote:

Steve Hayes wrote:

NoScript has stopped working, and Firefox will not allow me to
install it.

Don't know what "not allow me to install" means. One guess is that
Firefox is complaining the extension is not signed.

I went to noscript.net and clicked on the install button.

Got the message "Firefox prevented this site from asking you to
install software on on your computer."

Yeah, that's a security option in Firefox (you can enable/disable). In
that dialog should be a button to let you install the add-on. Just
click on the Allow button.

I'm using Firefox 41.0

If I click on Add-ons it tels me that NoScript is incompatible with
Firefox 41.0 and shows it as disabled.

The latest released version of Firefox is 40.0.0.3, not 41.0. So you
are using a nightly build. That means you have to get a version of
NoScript that is compatible with the nightly build.

You do know how to edit .xpi files to alter the version range checking
that some may have, right? Many add-ons will check for a minimal
version of Firefox because they require something only available in
that version, or later. They can also check on a maximum version so
users don't try using a version of Firefox under which the add-on was
never tested.

Unless you edit the .xpi file to alter the version range the add-ons
allows for Firefox, you'll need to get the dev build of NoScript to use
it in non-released versions of Firefox.

Or, you could stop using nightly builds of Firefox and stick with its
released builds.

On Mon, 21 Sep 2015 21:02:13 -0500, VanguardLH wrote:

Steve Hayes wrote:

VanguardLH wrote:

Steve Hayes wrote:

NoScript has stopped working, and Firefox will not allow me to
install it.

Don't know what "not allow me to install" means. One guess is that
Firefox is complaining the extension is not signed.

I went to noscript.net and clicked on the install button.

Got the message "Firefox prevented this site from asking you to
install software on on your computer."

Yeah, that's a security option in Firefox (you can enable/disable). In
that dialog should be a button to let you install the add-on. Just
click on the Allow button.

I'm using Firefox 41.0

If I click on Add-ons it tels me that NoScript is incompatible with
Firefox 41.0 and shows it as disabled.

The latest released version of Firefox is 40.0.0.3, not 41.0. So you
are using a nightly build. That means you have to get a version of
NoScript that is compatible with the nightly build.

You do know how to edit .xpi files to alter the version range checking
that some may have, right? Many add-ons will check for a minimal
version of Firefox because they require something only available in
that version, or later. They can also check on a maximum version so
users don't try using a version of Firefox under which the add-on was
never tested.

Unless you edit the .xpi file to alter the version range the add-ons
allows for Firefox, you'll need to get the dev build of NoScript to use
it in non-released versions of Firefox.

Or, you could stop using nightly builds of Firefox and stick with its
released builds.

And the way to do that is to edit the .xpi file?


--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

Steve Hayes wrote:
On Mon, 21 Sep 2015 21:02:13 -0500, VanguardLH wrote:

Steve Hayes wrote:

VanguardLH wrote:

Steve Hayes wrote:

NoScript has stopped working, and Firefox will not allow me to
install it.
Don't know what "not allow me to install" means. One guess is that
Firefox is complaining the extension is not signed.
I went to noscript.net and clicked on the install button.

Got the message "Firefox prevented this site from asking you to
install software on on your computer."
Yeah, that's a security option in Firefox (you can enable/disable). In
that dialog should be a button to let you install the add-on. Just
click on the Allow button.

I'm using Firefox 41.0

If I click on Add-ons it tels me that NoScript is incompatible with
Firefox 41.0 and shows it as disabled.
The latest released version of Firefox is 40.0.0.3, not 41.0. So you
are using a nightly build. That means you have to get a version of
NoScript that is compatible with the nightly build.

You do know how to edit .xpi files to alter the version range checking
that some may have, right? Many add-ons will check for a minimal
version of Firefox because they require something only available in
that version, or later. They can also check on a maximum version so
users don't try using a version of Firefox under which the add-on was
never tested.

Unless you edit the .xpi file to alter the version range the add-ons
allows for Firefox, you'll need to get the dev build of NoScript to use
it in non-released versions of Firefox.

Or, you could stop using nightly builds of Firefox and stick with its
released builds.

And the way to do that is to edit the .xpi file?

It's probably a lot more complicated now.

I thought Mozilla was adding "signing" to plugins, and
at some point, the browser will not accept plugins that
are not signed. Which is likely intended to prevent
me from giving you a home-crafted plugin directly.

Paul

Paul wrote:

Steve Hayes wrote:

VanguardLH wrote:

Steve Hayes wrote:

I'm using Firefox 41.0

If I click on Add-ons it tels me that NoScript is incompatible with
Firefox 41.0 and shows it as disabled.

You do know how to edit .xpi files to alter the version range checking
that some may have, right?

Unless you edit the .xpi file to alter the version range the add-ons
allows for Firefox, you'll need to get the dev build of NoScript to use
it in non-released versions of Firefox.

Or, you could stop using nightly builds of Firefox and stick with its
released builds.

And the way to do that is to edit the .xpi file?

It's probably a lot more complicated now.

I thought Mozilla was adding "signing" to plugins, and
at some point, the browser will not accept plugins that
are not signed. Which is likely intended to prevent
me from giving you a home-crafted plugin directly.

And why I didn't mention how to edit. Once the content is changed, the
hash will be changed, so the digital signature on the whole file will be
invalidated. It has been a long time since I edited an .xpi file. It's
a compressed archive so just about any archive tool (WinZip, PeaZip,
7-Zip, etc) can extract the files in the archive.

See:
http://kb.mozillazine.org/Editing_an..._compatibility

From I recall reading, currently Mozilla does not mandate an add-on be
signed -- but they will eventually require it.

See:
https://wiki.mozilla.org/Addons/Extension_Signing

Since 40.0.3 is the current released version, it falls under "Firefox
40-42: Firefox warns about signatures but doesn't enforce them."

Editing an .xpi to circumvent its version range checking does NOT make
that add-on compatible with a version of Firefox outside that range.
You choose to take the risk if you try to lie in the installer as to
what versions of Firefox the add-ons was tested. Except for abandoned
add-ons where you are trying to keep an add-on alive (and will have to
test if it runs okay), you should not be trying to run an add-on on an
unsupported version of Firefox. That's why I mentioned Steve should be
using dev builds of the add-on, if available, if he is going to use dev
builds of Firefox. Might as well risk the program going haywire as well
as the add-on.