Giorgio Maone

Overview

Giorgio Maone is a software developer best known as the author and long-time maintainer of NoScript, a browser extension that blocks executable web content by default and lets users grant script-execution privileges only to sites they choose to trust. First released on 13 May 2005, NoScript became one of the most widely recognised security add-ons for Mozilla Firefox and was later ported to Chromium-based browsers such as Chrome, Edge and Brave. Maone has been a member of the Mozilla Security Group since 2007.

NoScript and the whitelist model

NoScript inverted the prevailing browser security assumption of the mid-2000s. Rather than executing JavaScript, plugin content and other active elements on every page and relying on the browser sandbox to contain them, NoScript withheld those capabilities unless the user explicitly extended trust to an origin. The project described this as pre-emptive script blocking: because most drive-by exploitation depended on attacker-controlled script running at all, denying execution by default removed the precondition for entire classes of attack rather than patching them individually. Later versions replaced the original binary allow/deny list with graduated trust levels — DEFAULT, TRUSTED, temporarily TRUSTED, UNTRUSTED and CUSTOM — each controlling capabilities such as scripts, objects, media and frames separately.

Anti-XSS and cross-origin defences

Beyond script blocking, Maone added a series of defences aimed at cross-site attack classes. NoScript's XSS filter, also called the Injection Checker, inspects requests that originate from one site and target another, and neutralises attempts to inject and execute code in the destination page; the project characterises it as the first such filter shipped in a web browser. Related mechanisms include LAN Protection, which stops documents loaded from the public internet from issuing requests to local network hosts and so blocks cross-zone CSRF and XSS attacks, and the experimental TabGuard, which strips authentication headers from cross-site requests and warns the user about potential cross-tab identity leaks. Earlier releases carried additional components such as the Application Boundaries Enforcer (ABE), a policy language for constraining which origins could reach which resources; ABE was retired as a classic feature and its role was largely taken over by LAN Protection.

Recognition

NoScript accumulated a series of industry awards during its first decade. PC World chose it as one of the 100 Best Products of 2006, and in 2008 it won About.com's Best Security Add-On editorial award. It was a Reader's Choice Awards winner in 2010 and again in 2011, and in 2011 it was the winner of the first edition of the Dragon Research Group's Security Innovation Grant. The project's own site cites Edward Snowden among the security practitioners who have recommended the extension.

The 2009 Adblock Plus incident

In May 2009 Maone was criticised after it emerged that NoScript shipped code which altered Adblock Plus filter subscriptions so that advertising on several domains he controlled would not be blocked, without asking users first. Following public criticism and an indication from the administrators of Mozilla's add-ons site that its guidelines would change, Maone published an apology on 4 May 2009 in which he wrote that he had "abused the power and wasted the enormous trust capital gained by the NoScript add-on through the years to prevent Adblock Plus from blocking stuff on four internet domains of mine, without asking an explicit preemptive user consent". He removed the code in version 1.9.2.6, which deleted the relevant configuration automatically, and committed to an explicit opt-in dialog for any future equivalent behaviour and to publishing NoScript's source in a public repository. The episode is often cited in discussions of trust and transparency in browser extension ecosystems.

The WebExtensions rewrite

Mozilla's decision to retire the legacy XUL/XPCOM add-on architecture in favour of the cross-browser WebExtensions API forced a complete rebuild of NoScript. On 14 November 2017 Maone announced that NoScript 10 would be very different from earlier releases and would be built on WebExtensions for compatibility with Firefox Quantum; version 10.1.1 was released on 20 November 2017 for Firefox 57 and later. The rewrite narrowed some of the fine-grained configuration that the legacy versions had offered, a change that drew complaints from long-time users, but it also made the same codebase deployable on Chromium-based browsers.

Tor Browser and later work

NoScript is bundled with the Tor Browser, where it is wired to the browser's security slider so that a single user-facing control adjusts which classes of active content are permitted. The transition to the WebExtensions build was reflected in Tor Browser 8.0, which shipped the pure WebExtension version of NoScript 10.1.9.1 and required the Tor developers to re-implement the security slider against NoScript's new messaging protocol. Maone subsequently joined the Tor Project itself, and is listed on its people page within the Applications Development Team, described there as "Creator of NoScript, security breaker & builder, digital rights advocate & secular humanist activist, casting spells on the Tor Browser".

Legacy

NoScript remains under active development more than two decades after its first release; the Mozilla Add-ons listing records version 13.6.32 published on 19 August 2026, distributed under the GNU General Public License. Its default-deny approach anticipated ideas that later became mainstream browser and web-platform features, including Content Security Policy, per-origin permission prompts and built-in cross-site scripting mitigations. As a single-developer project that became security infrastructure for a privacy tool used by journalists, activists and researchers, NoScript is also a frequently cited example of both the reach and the concentration risk of the browser extension model.

Timeline

• 2005-05-13First release of NoScript, a Firefox extension that blocks executable web content by default.
• 2006PC World names NoScript one of the 100 Best Products of 2006.
• 2007Maone becomes a member of the Mozilla Security Group.
• 2008NoScript wins About.com's Best Security Add-On editorial award.
• 2009-05-04Maone publishes an apology for shipping NoScript code that circumvented Adblock Plus filters on domains he owned, and removes it in version 1.9.2.6.
• 2010NoScript is a Reader's Choice Awards winner.
• 2011NoScript wins the Reader's Choice Awards again and takes the first Dragon Research Group Security Innovation Grant.
• 2017-11-14Maone announces NoScript 10, a rewrite on the WebExtensions API for Firefox Quantum.
• 2017-11-20NoScript 10.1.1 is released for Firefox 57 and above.
• 2018-09Tor Browser 8.0 ships with the pure WebExtension build of NoScript, version 10.1.9.1.
• 2026-08-19NoScript 13.6.32 is published on Mozilla Add-ons.