Re: Confusion about TorButton, Noscript, etc.

[Ringo Kamens <2600denver@xxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Scott Bennett wrote:
>      On Mon, 18 Aug 2008 14:57:42 +0200 sigi <dugongs@xxxxxx> wrote:
>> On Mon, Aug 18, 2008 at 11:17:57AM +0200, Karsten N. wrote:
>>> Ringo Kamens schrieb:
>>>> I'm working on a presentation where I teach people how to install Tor. I
>>>> have always heard it is best practice to use NoScript and TorButton, but
>>>> TorButton automatically hooks "dangerous javascript". Is there any
>>>> reason to have noscript installed after that?
>>> NoScript blocks other "dangerous content" like Java applets, flash,
>>> siverlight... too. And it discover cross site scripting. So I prefer
>>> NoScript and FoxyProxy.
>>>
>>> FoxyProxy offers the possibility to configure some sites to be used
>>> with a preselected proxy, may be switch to "tor" for all http://*.onion*
>> In the faq <https://www.torproject.org/torbutton/faq.html>
>> they warn you about foxyproxy. 
>>
>> What about other plugins like QuickJava? I think I don't need it 
>> anymore with Torbutton installed, but do they confuse each other? 
>>
>      NoScript handles everything indisdcriminately, IIRC.  QuickJava allows
> one to disable Java, while enabling JavaScript.  NoScript then allows one
> to disable JavaScript on a site-by-site basis, while Java is disabled for
> all sites by QuickJava.  QuickJava puts two small buttons at the bottom of
> a Firefox window, one for Java and one for JavaScript.  Clicking on a
> QuickJava button toggles the enabled/disabled status of whichever feature
> it controls, so if you need to override it momentarily, it's trivial to do
> so and then toggle it back as soon as you've gotten what you need.
>      I'm currently using old software:  Firefox 1.5.0.8, TorButton 1.4.0.01,
> and SwitchProxy 1.4.  My NoScript is 1.7.8 and should be reasonably current
> because it's still getting updated frequently.  I'm not at all happy about
> the ancient Firefox, but I'm kind of stuck with this setup until I next
> install a new FreeBSD release.  Looks like the FreeBSD team has begun talking
> about 7.1 lately, so it might even happen before the end of the year.  (I
> generally avoid x.0 releases, so have sat with 6.3 quite a while.  However,
> my ports tree is stuck at over a year ago, so no Firefox or TorButton
> updates. :-< )
>      Anyway, QuickJava is a nice complement to NoScript.
> 
> 
>                                   Scott Bennett, Comm. ASMELG, CFIAG
> **********************************************************************
> * Internet:       bennett at cs.niu.edu                              *
> *--------------------------------------------------------------------*
> * "A well regulated and disciplined militia, is at all times a good  *
> * objection to the introduction of that bane of all free governments *
> * -- a standing army."                                               *
> *    -- Gov. John Hancock, New York Journal, 28 January 1790         *
> **********************************************************************
> 
So just to confirm, if I install TorButton, that's all the protection I
need and I don't need to worry about NoScript?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIqdD4mBTzXUpNYqQRAgqaAKCPSjpkeNyyh+u9QuDkzH4h6pVlXgCdH8lS
utv7jUvOWDFepQZ1wT/mL/w=
=Zxju
-----END PGP SIGNATURE-----