New Update JShelter - JavaScript Restrictor

Add-on/Extension Page
https://jshelter.org/

simmerskool

Level 43
Verified
Top Poster
Well-known
Apr 16, 2017
3,213
I tried JShelter in firefox on linux and liked its insights, but even after modifying for some websites that loaded funky, it was "problematic" so I disabled it for now. It was unclear to me after I had modified the settings for a specific URL that did not fixed the page loading issues. Will try again on updated versions.
 

oldschool

Level 85
Verified
Top Poster
Well-known
Mar 29, 2018
8,084
I tried JShelter in firefox on linux and liked its insights, but even after modifying for some websites that loaded funky, it was "problematic" so I disabled it for now. It was unclear to me after I had modified the settings for a specific URL that did not fixed the page loading issues. Will try again on updated versions.
Can you give an example?
 

simmerskool

Level 43
Verified
Top Poster
Well-known
Apr 16, 2017
3,213
Can you give an example?
I am using chatGPT to help me as I re-familiarize myself with linux. chatGPT would not / could log me in, so I turned off fingerprinting and javascript and page still balked, and this happened more than once. After disabling jshelter completely, chatGPT was ok. I saw something similar on a few other sites that I don't specifically recall.
 
  • Like
Reactions: oldschool

oldschool

Level 85
Verified
Top Poster
Well-known
Mar 29, 2018
8,084
I turned off fingerprinting and javascript and page still balked, and this happened more than once. After disabling jshelter completely, chatGPT was ok.
Indeed, I've run into this myself on several occasions, at least. This may due to this being the initial MV3 version. I'm considering this to be an experimental extension, so I'm using it mainly for testing purposes, to see how many sites I encounter with the problem you describe. In any case, make sure you leave the global settings at default, or in the alternative, disable the javascript protection globally, and leave the fingerprinting detection feature enabled. This will allow you to see which sites you visit are attempting fingerprinting.
 
Last edited:

simmerskool

Level 43
Verified
Top Poster
Well-known
Apr 16, 2017
3,213
Indeed, I've run into this myself on several occasions, at least. This may due to this being the initial MV3 version. I'm considering this to be an experimental extension, so I'm using it mainly as testing, to see how many sites I encounter with the problem you describe. In any case, make sure you leave the global settings at default, or in the alternative, disable the javascript protection globally, and leave the fingerprinting detection feature enabled. This will allow you to see which sites you visit are attempting fingerprinting.
yes, I opened global and saw warning about DON'T TOUCH THIS! so I didn't :rolleyes:
 

oldschool

Level 85
Verified
Top Poster
Well-known
Mar 29, 2018
8,084
JShelter: Release history
0.20

More robust SyncMessage implementation
Prevent patchWindow from throwing on SOP violations.
Chromium-based: Fix bug that wrappers were sometimes not timely applied (MV3 bug of 0.19)
Firefox: Work around issue that could have prevented XML documents from being parsed/loaded by the browser (see also 1899786 - Synchronous XMLHttpRequest prevents XML documents from being parsed/loaded when OMT decompression is enabled)
Firefox: minimal requirements increased to 115
 

oldschool

Level 85
Verified
Top Poster
Well-known
Mar 29, 2018
8,084

0.20.2

  • Avoid web accessible resources in Chrome-based browsers to prevent simple and precise JShelter detection by page scripts at the cost of slight performance decrease, see the commit message for details
  • Update NSCL (code refactoring and removal of debug statements from non-debug runs)
  • Change messages about failures in WASM code to warnings as these might be useful to users
  • Small update of Czech and English user-facing strings
JShelter: Release history
 

simmerskool

Level 43
Verified
Top Poster
Well-known
Apr 16, 2017
3,213
@oldschool question (comment) - so I am running jshelter again, and likeing it, chatgpt says it is a good compliment to NoScript. So the only change to my firefox is adding jshelter and this morning the MalwareTips page displays with irregular window "your browser is out of date" then wemt to load chatgpt and got the same message, so I went to add-on page and disabled jshelter and pages are loading normally. Unclear (to me) or difficult to know when jshelter is ON, exactly what to tweak to allow normal MT page... jshelter is set default recommended settings. It is clear that MT runs "High" finderprinting per jshelter. Insight welcome.
 

oldschool

Level 85
Verified
Top Poster
Well-known
Mar 29, 2018
8,084
@oldschool question (comment) - so I am running jshelter again, and likeing it, chatgpt says it is a good compliment to NoScript.
ChatGPT is pure BS. These extensions have different purposes, but do overlap to some extent. JShelter is primarily for fingerprinting protection. NoScript is for javascript control generally, which can achieve different goals, in total or in part. Using both of these extensions at the same time is going to complicate usage and lead to problems in web surfing.
Unclear (to me) or difficult to know when jshelter is ON, exactly what to tweak to allow normal MT page
Have you explored the JShelter GUI? 🤔 Instead of disabling the whole extension, you can toggle one of the GUI switches to see which is the offending feature.

Users need to understand the purpose of an extension and gain familiarity with its GUI and associated features, otherwise they are whistling in the wind and unable to gain relevant experience. This concept also applies to any software, be it browsers or other tools. Users need to understand the purpose of the tool, and be willing to explore, experiment and learn from experience.
 
Last edited:

Jan Willy

Level 13
Verified
Top Poster
Well-known
Jul 5, 2019
613
@simmerskool
The sites MalwareTips and chatgpt use cloudflare as CDN (Content Delivery Network). JShelter doesn't cooperate well with cloudflare, obviously because cloudflare uses browser and TLS (Transport Layer Security) fingerprinting to identify the type of client making a request, helping to distinguish between browsers and bots.
 

simmerskool

Level 43
Verified
Top Poster
Well-known
Apr 16, 2017
3,213
ChatGPT is pure BS. These extensions have different purposes, but do overlap to some extent. JShelter is primarily for fingerprinting protection. NoScript is for javascript control generally, which can achieve different goals, in total or in part. Using both of these extensions at the same time is going to complicate usage and lead to problems in web surfing.

Have you explored the JShelter GUI? 🤔 Instead of disabling the whole extension, you can toggle one of the GUI switches to see which is the offending feature.

Users need to understand the purpose of an extension and gain familiarity with its GUI and associated features, otherwise they are whistling in the wind and unable to gain relevant experience. This concept also applies to any software, be it browsers or other tools. Users need to understand the purpose of the tool, and be willing to explore, experiment and learn from experience.
Often I find chatGPT helpful -- more so when I also know something about the topic, it did say jshelter was primerly for fingerprinting so you agree on that point. ;) I looked over jshelter interface briefly at first, my impression there's a one of two windows, the first is a more general turn 3 main items ON/OFF, then there is much more detailed window with perhaps 20 switches (I did not count them, yet) -- I like the extensions that are more or less set it and forget it, eg, osprey, ublock, as user I rarely have to interact with them. You did disagree with chatGPT conclusion: Using both of these extensions at the same time is going to complicate usage. I just started using NoScript again in the past few weeks, and I see its value, understand it pretty well. So far, the past few days running jshelter too, and surprised how much fingerprinting MT does, which is my understanding so far from jshelter. Other sites where I might expect a lot of fingerprinting are not bothered by jshelter. Learning it as I use...
 
  • Like
Reactions: Jan Willy

simmerskool

Level 43
Verified
Top Poster
Well-known
Apr 16, 2017
3,213
@simmerskool
The sites MalwareTips and chatgpt use cloudflare as CDN (Content Delivery Network). JShelter doesn't cooperate well with cloudflare, obviously because cloudflare uses browser and TLS (Transport Layer Security) fingerprinting to identify the type of client making a request, helping to distinguish between browsers and bots.
thanks, I follow what you're saying, and yes, I recall seeing a reference to cloudflare when jshelter was messing with MT... I have made a modfication to jshelter and chatGPT and both seem to be working normally with both jshelter and noscript enabled.
 
  • Like
Reactions: Jan Willy

simmerskool

Level 43
Verified
Top Poster
Well-known
Apr 16, 2017
3,213
fwiw here's an update from chatGPT re jshelter: Summary
Yes, JShelter and NoScript can conflict if misconfigured, but they serve distinct roles and can be run together effectively.
Cloudflare is likely the source of fingerprinting at MalwareTips — JShelter will help limit what they see, even if it occasionally causes site friction
 
  • Like
Reactions: [correlate]

oldschool

Level 85
Verified
Top Poster
Well-known
Mar 29, 2018
8,084
I looked over jshelter interface briefly at first, my impression there's a one of two windows, the first is a more general turn 3 main items ON/OFF, then there is much more detailed window with perhaps 20 switches (I did not count them, yet) -- I like the extensions that are more or less set it and forget it
Most users should void using the Global Settings page and use only the first, the drop down flyout, where you can switch on/off three features. After any change, hit "Refresh page" and check for site breakage. Disabling all three is essentially whitelisting that site.
 

oldschool

Level 85
Verified
Top Poster
Well-known
Mar 29, 2018
8,084
surprised how much fingerprinting MT does, which is my understanding so far from jshelter. Other sites where I might expect a lot of fingerprinting are not bothered by jshelter. Learning it as I use...
You could disable Javascript Shield and Network Boundary Shield globally, and use only Fingerprint Detector, in which case you'll be notified if fingerprinting is detected. However, doing so then means no fingerprinting protection is enabled. The notifications are just that, and nothing more. Hope that clarifies things for you.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top