Tor Browser: How and why to remove NoScript

Posting mode: Reply [Return]
Name	P0GTvq%7;kg)-R},sB~A]fLV ⚈p/Kw>U_F☕?H=⛇⚲N{⛵Q⛠MxS+\uZ8oI62e(*`m9Dc5bn1.$l!Oh\|aE&rtj
Email☶(Kw⛴&⚵'8u♝3 ☾f>6c9oRZ?Vxjbe2M[=5⚈d.@vin\|♥4<G1~X	inTvb\|<C⚙⛂_da8m'%NWqzpu$>2hB3)5E SL*[kJrMRc☓♊wy@14ZPsGU].fA7☷K+Hx☚:VO`
Subject	Spoiler Image
Comment
Captcha Tor Only
Flag
File
Embed
Password	(For file deletion.)

File: 1695969625698.jpg ( 29.81 KB , 800x592 , crushedicemachine.jpg )

Tor Browser: How and why to remove NoScript Anonymous 2023-09-29 (Fri) 06:40:26 No.12496

Backstory:
I became suspicious about the path NoScript is taking when devs decided that users are not allowed to block JS on addons.mozilla.org anymore.
I did not care much because I'm using Third-Party Request Blocker which not only lets you block JS but also incorporates the functionality of the great but sadly abandoned RequestPolicy addon, as well as some neat options like automatic redirect to archive.org in case the user encounters a CloudFlare-encumbered website.

However, I just noticed that Tor Browser doesn't allow you to disable/remove NoScript anymore.
Being a skilled conspiracy expert, this strongly rustled my jimmies.
Why the fuck are we forced to give a monopoly position to this useless piece of shit addon?

Well, maybe because addons are a great way to inject JavaScript and potentially use one of a gazillion JS engine vulnerabilities to expose the user's clearnet IP.
https://www.invicti.com/blog/web-security/noscript-vulnerability-tor-browser/

Let's not forget that TBB devs once before joined forces with the FBI and changed NoScript settings to allow all scripts by default so thousands of people using legit non-pedo services like TorMail could get hacked and identified using a JS exploit:
https://www.wired.com/2013/09/freedom-hosting-fbi/

So, what do?
Easy-peasy, I'll just find the extension and remove the file, right?
Wrong, as Tor Browser automatically reinstalls NoScript on startup. It seems (((someone))) has a strong interest to keep this addon around.

<How to actually remove NoScript:
Overwrite the file and remove write permissions:

cd tor-browser_en-US/Browser/TorBrowser/Data/Browser/profile.default/extensions
grep -R -i noscript
grep: {73a6fe31-595d-460b-a920-fcc0f8843232}.xpi: binary file matches
echo -n '' > "{73a..."
chmod ugo-rw "{73a..."

…and hope they don't change permissions back at some point -.-

<Please note that shitty NoScript is still better than shitty JavaScript, so make sure you continue to block scripts.

Anonymous 2023-09-29 (Fri) 07:09:44 No.12498

Fun fact:
I can't even complain to Tor devs about this decision because their git hosting software FUCKING REQUIRES JAVASCRIPT TO EVEN VIEW THE DISCUSSION:
https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41598

Anonymous 2023-10-14 (Sat) 20:11:49 No.12569

>>12496
>…and hope they don't change permissions back at some point -.-
After the next update NoScript was back.
Maybe chown root the extensions folder?

Anonymous 2023-10-15 (Sun) 03:25:05 No.12571

I didn't even know this happened.
Can't well tell them how gay this is? Tor is open source.

Anonymous 2023-10-15 (Sun) 18:56:24 No.12572

>>12496
I remember reading about people proposing ideas to make a java-syntax compatible replacement-script with dramatically reduced functionality but also much greater security. Something that was supposed to work for the basic stuff that most websites use.

Anybody know what happened to that, maybe that would be useful for this.

If you cared about security, you wouldn't add java-script and then add another program ontop of it to disable it.

Anonymous 2023-10-16 (Mon) 10:28:58 No.12573

>>12569
>Maybe chown root the extensions folder?
I tried chmod u-w on the extensions folder, this resulted in TBB starting up but when I tried to open a website it just kept re-downloading the page over and over but it never displayed it.

>>12571
>Tor is open source.
I tried to compile TBB once but couldn't figure out how to do it. Maybe I'll try again.

And it seems they are rewriting the Tor daemon in Rust.
https://blog.torproject.org/arti_119_released/

Compiling Rust requires tons of free disk space (like 10+GB) and half a day on a mediocre multi-core machine.
Problem, gentoo users?

>>12572
>I remember reading about people proposing ideas to make a java-syntax compatible replacement-script with dramatically reduced functionality
If it is turing-complete it is potentially vulnerable. Something to do with P=NP and the halting problem.
Anything else I think you can already do with html and css.
See https://codepen.io/mcShane/pen/zYmdrzP for example.

>If you cared about security, you wouldn't add java-script and then add another program ontop of it to disable it.
Indeed. But their focus probably lies on anonymity more than security.

Anonymous 2023-10-16 (Mon) 10:34:11 No.12574

>>12573
>If it is turing-complete it is potentially vulnerable.
A solution for websites that need JS for whatever reason would be to distribute gpg-signed browser extensions. At least that way the code can be audited.
But if your site requires JS, it might be worth considering to release it as software instead…

Anonymous 2023-11-08 (Wed) 12:32:14 No.12709

Last time my TBB updated, it didn't reinstall NoScript.
So it seems someone got through to the devs. Let's hope it stays that way.

Anonymous 2023-11-16 (Thu) 13:01:13 No.12728

>>12496
>Well, maybe because addons are a great way to inject JavaScript and potentially use one of a gazillion JS engine vulnerabilities to expose the user's clearnet IP.
If you can be deanonymized with javascript then the noscript extension is really not the problem. If you don't know how to configure a tor-only firewall then use a system like tails or whonix which does it for you.

>Let's not forget that TBB devs once before joined forces with the FBI and changed NoScript settings
<ctrl-f noscript
<Phrase not found.
If you feel the need to lie that means you can't even convince yourself with this argument.

>It seems (((someone))) has a strong interest to keep this addon around.
The whole point of tor browser is to protect non-technical users who have a tenancy to fuck things up by accident. If they were malicious they would hide backdoor code in the browser itself not an extension you can just delete.

Unique IPs: 3