2nd everything Corolinth said. This is precisely the issue for me. I'm perfectly happy to enable javascript for (almost) all of the sites that I use with any regularity -- but
only the scripts that originate on the site itself. In the last 12 months, I have twice encountered remote-execution vulns (at least one was aided and abetted by Acrobat...) that were "boot-strapped" by javascript injected into a trusted site by way of a rogue advertiser in otherwise trust-worthy ad server (AdSense). On one of those occasions, the attack succeeded without any user invention while using Chrome. This was shortly after I started "test-piloting" it in place of Firefox, so the filtering may have improved since then, but nothing beats a manual whitelist system. No matter how hard they try, Google (or anyone else) can't be as vigilant as I can.
SuiNeko wrote:
Also, many many very useful javascript libraries are hosted offsite - google and yahoo both publish good ones.
This is true, but the solution is simply to allow javascript for the domains that host the Google Maps API, YouTube, jQuery, etc. Big, well-trusted javascript libraries like that are easy to carve out exceptions for.
Noscript is really just a javascript firewall that makes it easy to create exemptions on the fly. NoScript doesn't support the idea that "all Javascript is bad" any more than a conventional firewall would support the idea that "all TCP/IP is bad". I would suspect that very few NoScript users are blocking all Javascript -- there really wouldn't be much point. In that case, you could just turn of Javascript entirely without the need for a 3rd-party add-on.