NoScript add-on

Six days after Mozilla launched Firefox 57, a revamped version of the Firefox browser, Giorgio Maone, the developer of the NoScript add-on, has updated NoScript to work with Firefox's new WebExtensions add-ons API.

Last week, on November 14, when Mozilla released Firefox 57, NoScript was one of the many popular Firefox add-ons that were not updated to work with the browser's new version, which dropped support for legacy addons (built on the XUL-based Add-ons SDK).

NoScript was just one of the many other insanely popular add-ons that did not work with the new Firefox, a list that also included Tab Groups, Classic Theme Restorer, FireGestures, MinimizeToTray revived, QuickNote, Session Manager, DownThemAll!, Tab Mix Plus, and FlashGot Mass Downloader.

NoScript's WebExtensions update was never in danger

While many developers had publicly stated they intended to abandon their add-ons following Firefox 57, Maone was one of the few that promised to put out a WebExtensions version.

Delays during NoScript's development meant he missed Mozilla's grand unveiling of Firefox 57. This caused some panic among Firefox users, as NoScript had become a must-use for many Internauts after the add-on received praises from Edward Snowden and was included as a default add-on with the Tor Browser.

The add-on is so popular because it allows users to blacklist scripts (JavaScript files) and active content (Java, Flash, Silverlight) based on a per-domain basis. It can also block JS-based clickjacking and cross-site scripting (XSS) attacks.

The new WebExtensions version of the NoScript add-on (v10.x) still supports all these basic features. The differences compared to the old NoScript version (5.x) is in the add-on's settings and visual interface.

NoScript settings page

The new NoScript add-on uses a new UI and users might need a few days to get used to using the new version, which relies on buttons instead of the familiar text-based drop-down menu.

Development ongoing

Development is ongoing on the new version and most of the old features will be ported to the new version in time.

It's well-known that the new WebExtensions API is inferior to the old Add-ons SDK when it comes to supported features, and it will remain so, as Mozilla engineers want to limit the core browser functions add-ons can access on purpose, for security reasons.

Nonetheless, NoScript doesn't seem to be particularly impacted by the new API in a severe way, as it's still able to do its job just fine.

"NoScript 10 is very different from 5.x: some things are simpler, some things are improved, some are still missing and need to wait for WebExtensions APIs not available yet in Firefox 57," Maone said without elaborating on what NoScript features are impacted directly by the new and limited API.

Maone: Update to Firefox 57 or Firefox ESR

Despite putting out a NoScript version that is without a doubt inferior to the old 5.x branch, Maone does not recommend users to remain on old Firefox versions so that they could use the old NoScript version.

Instead, he recommends that users migrate to Firefox ESR and wait until NoScript 10.x catches up with the old branch. The security benefits included with Firefox ESR and/or 57 as a whole far outweigh NoScript's meager protection features, so users should avoid remaining on Firefox 56 or older just because of NoScript.

"NoScript 10 is worth the migration: active content blocking (now more configurable than ever) and XSS protection (now with a huge performance boost) are already there," Maone added.

At the time of writing, the extension is installed on over 1.72 million Firefox browsers.