I finally got around to installing and using NoScript recently. First let me say that I appreciate the functionality it provides, and the attacks that it prevents. Now that I got that out of the way, let me also say that it makes surfing the internet painful (if safer).

I would guess that in three weeks of use, 70-80% of the sites I access are trying to send me Javascript, Flash, or the other things that NoScript blocks. Virtually every major website, NoScript blocks something or other. Every PDF download, for example. And I understand that you can tune the product site by site (or even page by page) to allow some scripts by default, so it gets less intrusive over time. The thing is, even for major websites, I basically have no clue as a user which scripts might be OK. Some sites have 5-10 scripts on a page, many of which come from ad serving sites, etc..

The average internet user can't possibly cope with this- I know that I should in theory tip my friends and relatives off to use something like this, but trust me, I can't devote the time that would be required to support them using it.

It’s another example I think of application development technology (all that AJAX stuff…) and deployment racing ahead of security, causing security vulnerabilities (browsers that allow this stuff in), and threats targeting the vulnerabilities. And then the inevitable security solution response causing things to not work too well, resulting in user backlash. This action/reaction scenario has been playing out for the 24 years I’ve been in the security industry anyways.

How do we flip this paradigm, cause this just isn’t working?