Userscripts.org

I like the groups idea. T-shirts would be neat too. :)

Great post, very interesting to read all that information.
You should make a time-line with all the great implementations you've made.

You did great job on USo last year. You have my thank.

Thank you for your dedication to the site

Thanks for everything you've done and plan to do!

I say the server rolls over and dies by March lol.

Provided you don't change the site structure dramatically, I bet the pageview count will be at 400,000 by the end of next year.

Jesse, maybe you should put a paypal "Donate" button somewhere on the site so people can chip in and help you pay for the hosting costs.

Congrats on your success through 2008 and my best hopes to you in the new year!

Wow, you've been busy! I can't believe how much this place has grown since it first started *nostalgia*. Oh, and I second Yansky's idea for a Donate button. Maybe in the form of one of those "Buy Me a Cup of Coffee" buttons you see all the kids with blogs using these days.

What about issues currently pending... (around 400 pages... with almost 20 script reports on each!!!) ???

Yes, reporting issues seems pretty useless if you're not gonna do anything with the report

Whatever happened to having scripts that contained "cookie" in them automatically unlisted. They would still be added to the "need to be reviewed" box but then it would help protect the unsuspecting user from installing all of those cookie grabbers that have popped up.

@nungryscpro
there are plenty legit scripts that contain "cookie" and there are many ways to obfuscate calls to document.cookie. so if such a system as you described were put in place only the non-malicious scripts that have no reason to hide their intentions would be unlisted, and malicious scripts would still be listed, creating a false sense of security for users. I mean, how the hell do you suggest we prevent something similar to:

var first = "c";
// Hundreds of lines of code
var steal = document[first + "ookie"];

I though the point of the reports were to use them to solve issues

hey you all peoples ...plz help me
im having problem in my orkut profile
i hav installed all de scripts but i can't found a change in my profile
tell me how torun all dis...
wat to do...??? :(

var first = "c";
// Hundreds of lines of code
var steal = document[first + "ookie"];

how to use dis/any scripts...plz tell me....

@relish: Are you asking us to tell you how to create a cookie-stealing script?

I understand there are legit scripts that contain "cookie" but that's how the sytem used to be set up. I had one of my scripts initially unlisted and had to get it listed by the staff all because I had to reference "cookie.gif"

I guess since they no longer wish to be bothered by reports, they've allowed cookie stealing script to get listed automatically. Under the old system there were 0 cookie grabbing scripts for keyword "neopets". Now there are 14 that have been uploaded within the last 6 weeks. (Half don't actually work because they were written badly.)

When a script is listed or updated, it should be easy enough to parse the code, not just reading it, but basically running it and then searching the resulting page for "document.cookie". I know there are also scripts that aren't malicious that access "document.cookie" but are there going to be that many that the staff will have to list manually? They already have it set up so that when you visit the source code, the script is parsed for syntax highlighting.

In the end, those 14 or so scripts have all been reported but all of them are still there. Even with a couple warnings in the comments the install counts rise. Someone needs to do something about the reports or set up a system that blocks them in the first place!

@nungryscpro

I understand there are legit scripts that contain "cookie" but that's how the sytem used to be set up. I had one of my scripts initially unlisted and had to get it listed by the staff all because I had to reference "cookie.gif"

First of all their is no staff. Jesse is the only active admin. This is a community driven site. It is up to those of us who understand javascript to be on the lookout and warn people in comments if a script is malicious and it is up to users to take the time to look at the comments to see if a script has been called malicious. Also the install count isn't entirely truthful. You need to install a script to raise its install count. Hell 4.66% of traffic a month is by those who have IE6.

Under the old system there were 0 cookie grabbing scripts for keyword "neopets".

How many scripts were there for neopets?

I know there are also scripts that aren't malicious that access "document.cookie" but are there going to be that many that the staff will have to list manually?

Yes there would. Jesse is just one man. He would have to sit in front of a computer all day listing scripts. There are literally thousands of legit scripts that use "document.cookie". Hell 3 out of my 16 scripts use it.

They already have it set up so that when you visit the source code, the script is parsed for syntax highlighting.

Highlighting is done on the client-side. Checking for document.cookie would have to be done on the server-side.

The bottom line is that it is just totally impractical to manually approve every script that contains document.cookie. What happens when someone uploads a new version? Do we have to wait for that to be approved before it is listed again? Let's not turn Userscripts.org into Addons.mozilla.org

--Under the old system there were 0 cookie grabbing scripts for keyword "neopets".

How many scripts were there for neopets?

There were 0 cookie grabbing scripts out of around 90.
As of right now, there are 18 out of 123. A little less than half of the scripts since the unlisted feature was removed have been cookie grabbers.

Hell 3 out of my 16 scripts use it.

You should try using GM_setValue and GM_getValue instead. If you're worried about making the scripts work in browsers besides Firefox, greasekit emulates GM functions and there is Opera Userscript for Opera users.

Highlighting is done on the client-side. Checking for document.cookie would have to be done on the server-side.

Of course. If that can be written to work client side, think of all you can do server side.

As far as manually approving unlisted scripts... whatever happened to the idea of having a real community Reviews Discussion. There's a help file for unlisted scripts unlisted scripts. It says there to email admin. There are a lot of people that care about us.o and are willing to help with the workload.

There are currently 405 pages of harmful/spam scripts. How many will still be there next week?

Please consider deleting/editing the basically useless script here:
http://userscripts.org/scripts/show/46036
It is basically spam because it shows up for every www.* site in Greasefire and makes greasefire much less useful. The review and discussion there also state this case. Thanks!

What about implementing a function in this site that enables to user to vote whether a script is malicious and to show how many users voted the script as malicious (and how many as not malicious) and to show this (somehow highlighted) just below the "Install"-link?
This would help to prevent users from downloading propably malicious scripts.
Maybe there could also be a message-box that asks you if you really want to install a script if there were enough votes (f.e. more than 20) and more than half of the votes say the script is malicious.

Great new page updates, tags and layout improvements! Keep up the good work [it's much appreciated!]