Scripts question

Post Reply New Topic

To make my Web browsing safer, I use the NoScript add-on with Firefox. This blocks all scripts by default, and allows me to choose which scripts to allow. My normal procedure is to allow only the scripts that prove essential for the page to give me what I want, which iI believe is the generally-recognised procedure for keeping browsing safe and private. Unfortunately, some websites have rather a lot of scripts, and it's often hard to identify the good ones from the bad ones. Some are safe, some aren't, and some are unnecessary or plain annoying.

I've noticed that Wrong Planet has the following scripts, and I'd appreciate any comments on what they are designed to do, so that I can decide which ones to allow:

1. wrongplanet.net (presumably essential)
2. cloudflare.com (something to do with that thingy that WP uses to protect itself with these days)
3. vigilink.com
4. scorecardresearch.com (I've seen this before on many sites and it can usually be blocked without harm)
5. d1I6p2sc964Shc.cloudfront.net
6. gosquared.com
7. quantserve.com
8. googlesyndication.com (why would Google have anything to do with WP?)
9. googleadservices.com (does this facilitate unwanted advertising? It's name would suggest that it does)
10 sharethis.com (seems to allow buttons to make it easy to share WP pages on Facebook, Twitter etc.. If I wanted to share WP content, I'd do it by copying and pasting the links into an email, and I find the buttons distracting)
11. google-analytics.com (google again? What are they up to?)
12. google.com (as 11. above)

Any explanations of the purpose of these scripts would be very welcome, as finding out by trial-and-error is somewhat laborious, and I don't want to end up getting targeted ads or anything else that's in any way harmful to me or my computer.

I don't remember enabling ANY scripts on WrongPlanet within NoScript. The site seems to work without them... when I say "work" I use the word loosely.

Thanks, Tallyman. I'll try that soon. One thing that happened to me the other day was that when I tried to access WP, this Cloudfront thing jumped in between me and my goal, asking me to wait 5 seconds (at least I think it was 5). I waited and waited, but nothing else happened until I enabled the Cloudfront script, and then it let me visit WP. So I figured that one at least was probably necessary. I revoked its permission once I'd arrived at WP, with no apparent harm until I tried to submit a post, which didn't happen, though I later learned that somebody else was also unable to submit posts on that particular day, so I reckon the cause there was something other than my script-blocking. Clearly a simple matter of trying again.

I'm dying to know what these scripts are supposed to do, especially if the site works tolerably well without them.

Well, I just revoked all permissions, and you're correct, mostly WP still seems to be working. There's a few little icons that don't get drawn, but I can live without them.
Slightly more bothersome, emoticons don't appear in my post when I click them. Not the end of the world though.

In my NoScript setup I allow only wrongplanet.net, cloudflare.com and google.com

Those CloudFlare "Checking your browser" screens seem to be pretty close to the suggested five seconds, too.
I've not bothered timing one, but it seems about right.

There is some sort of intermittent problem with the forum icons, and occasionally emoticons, where they fail to display.
A page refresh usually corrects this - but not always, and not always all of the broken ones on display.

OK.......Currently I've got just wrongplanet.net and cloudflare.com enabled, and everything seems OK so far. So maybe google.com isn't necessary?


Same here. As long as I enable the Cloudflare script, that is. Otherwise it just hangs, seemingly forever. I still don't get it though. Cloudflare seems to periodically do this checking thing, and I can't understand what it's trying to check, or why it feels it has to do it more than once per session. After all, I'm logged in with username and password, and WP knows my IP address. What is there to check, that isn't already known?


OK. The emoticons here aren't broken as far as the display goes, but with all scripts forbidden, they just don't do anything when I click them. If I allow wrongplanet.net, they work properly.

It is if you want to use the site's search function.

Unfortunately, just knowing that someone is logged on doesn't diminish the possibility that something nefarious might be going on - either directly, or presumably indirectly via malware on the machine - so rather than rely on some sort of trust arrangement, everyone is checked.
I get that screen as I log on for the first time during the day, once again if I'd not been active on WP for about 30 minutes, and at a very few random intervals during my time here.

Well, it's generally a good idea to at least allow the site to which you're directly connecting.
I tend to draw the line at advertising because it's an annoying distraction, and anything related to things like Facebook and Twitter etc because I'm not in the least bit interested in them.

You mean to search Wrong Planet itself, or to search the Web?

OK. But I'm still kind of surprised that it doesn't just do that invisibly in the background, like an antivirus program. Is it because cloudfront wants to advertise itself?


Point taken, though it's surprising how much still works without it.


My sentiments exactly.

So it looks as if wrongplanet.net, google.com (if you want the search feature) and (occasionally) cloudflare.com are the only useful scripts (unless you really must have one-click Facebook sharing etc.). So the rest of them are either useless or harmful?

Let google analytics run.

This is about scripts running on WP, so it refers to the site's search function only (which happens to use Google to perform the search of posts here).

It's because CloudFlare is a service running externally to your computer (and also external to WP itself) - all access to WP is made through CloudFlare and in this instance, it's acting rather like a security guard standing at the entrance to a club.

I would hope that none of them are harmful!
My general approach is to selectively enable things until the required functionality of a site is achieved and if enabling something achieves nothing useful, it's disabled again.
For example, one news site I visit has around 22 scripts running (it depends on the page somewhat) but only 5 are required to read the articles and view embedded videos, and to allow some drop-down effects on pages (an article's header will drop down a summary as the mouse pointer is moved over it).

Why? What does it do? I've never let it run; always assumed it was part of Google's spying system to follow people from one website to the next - which I don't like.

Yes, why run that one?

Something odd just happened here. Cloudfront did its usual "just checking you out" thing when I arrived, but completed it and let me in before I had time to allow cloudflare.com. Maybe it was just a coincidence when it seemed to hang the other day? I guess I'll find out in time.

^ I don't allow cloudflare but it usually allows me in anyway after its 5 second check. On the occasions it brings up the "website is offline screen - retry for a live version" I usually have to temporarily allow it then though. As I mentioned, I don't allow ANY scripts on this site with the exception of WrongPlanet.net. The only loss of functionality is the Google powered site search feature, but I don't use that anyway as the search results are usually rubbish.

Got it. Yup, I tried it out, and it needs that script, and when the search is done, it says "powered by google."

So it's another of these external things like google, I see.

Not even googleadservices.com? By "harmful," I don't just mean malware etc., mean ads and tracking also.


Yes that's what I try to do. Just that I have trouble doing that when there are numerous scripts. I can find out by trial-and-error, although it can take rather a long time, and I always fear that once I've allowed a script, if it's not a completely benign one, then the damage is done. If I've researched this right, these things are Javascript executables, i.e. programs. I've always believed that when a user runs a program, he/she is completely at the mercy of the program's author. I probably try to be too perfectionist about it, and it's very rare that I trust anything I don't know about.

Fascinating........a script that is necessary sometimes but not every time. I guess that means cloudfront doesn't frisk me in quite the same way every time?

Google Analytics gives Alex site use information. Not Google; Alex. Google just has a reliable tool for the job.