What are NoScript surrogates and should one disable them for more privacy in browsing?

Question

NoScript has a feature of supplying its own "surrogate" scripts instead of well-known tracking/ad scripts (Google Analytics, for one).

Does it matter for my privacy if I do not change the factory setting of noscript.surrogates.enabled to false (let's assume I'm using the latest Firefox; let's also assume I have already blocked all and sundry trackers through AdBlock Edge filters)?

GA replacement script:

(function() {
    var _0 = function() _0,
        _u = function() {};
    _0.__noSuchMethod__ = _0;
    ('ga' in window) || (ga = _u);
    with(window) urchinTracker = _u, _gaq = {
        __noSuchMethod__: _0,
        push: function(f) {
            if (typeof f == 'function') f();
            else if (f && f.shift && f[0] in this) this[f.shift()].apply(this, f)
        },
        _set: function(a, b) {
            if (typeof b == 'function') b()
        },
        _link: function(h) {
            if (h) location.href = h
        },
        _linkByPost: function(f) {
            if (f && f.submit) f.submit();
            return true
        },
        _getLinkerUrl: function(u) {
            return u
        },
        _trackEvent: _0
    }, _gat = {
        __noSuchMethod__: function() {
            return _gaq
        }
    }
})()

References:

• List of sites with surrogates
• Surrogate Scripts vs Google Analytics

Answer 1

Assuming that you have already totally blocked access to the trackers then it doesn't matter to your privacy.

However, it may matter to your usability of some web sites. The scripts are there to allow sites to work that otherwise rely on the scripts being blocked. If all your sites work, you don't need them.

Answer 2

As explained here:

Script Surrogates replace a blocked script or complements existing scripts which would not work as expected because of NoScript.

This means they provide just replacements for functionality some applications want to call, so that these function calls do not result in errors. These hooks only provide the minimal necessary functionality, that is they are mainly dummy functions which are no risk to your privacy. Of course, if you block all scripts everywhere then no surrogate functionality is needed.

Answer 3

Finally busting the NoScript Scam. Or as it were.

It's long been time your question was raised on the 'net.

To start off getting into answers, let's just take one of these surrogates allegedly meant to keep sites working the way "you" want and see what it does. I'm picking one at random - "noscript.surrogate.adriver.sources" (of course, that's "Ad River", not "A Driver") - points to "ad.adriver.ru/cgi-bin/erle.cgi". Looks harmless, don't it? That's not even a script.

Reality Check: Enter "ad.adriver.ru/cgi-bin/erle.cgi" into your browser (might use wget to do this more thoroughly but I'm being lazy) and you get... forwarded to "http://content.adriver.ru/1x1.gif/cgi-bin/erle.cgi&tuid=<32-bit signed int or something removed>". So your browser has in fact retrieved a classical tracking GIF and assigned you a tracking number to take you the way "somebody else" wants. Which, of course, will no way mean that this tracking ID will be used anywhere subsequently, because as we all know the 'net is an all nice players place.

I'm of course not accusing Giorgio (Maone, the pleasantly talking guy behind NoScript - and the explanation cited above, for what it's worth, because hackademix is that guy's own sock site on Noscript) - of collecting money from companies to make him integrate this kind of stuff into the plugin's settings (which, still, have been an ever more interesting read at every other update), and of course he's not doing it behind gullible users' backs either because they've all been closely watching their about:config and particularly some settings made user unchangeable, haven't they? It's all by chance and feel-like that things happen, so much for sure.

Adblock recently earned a reputation for being owned by a company that earned €30m in compensation for whatever favor from the advertising industry (I'm being brief).

So, whether a combination of two tools being such will help you steer clear of issues for your privacy as to your likes, seems to be a question that can't be answered to the affirmative lightly.

On a final note, I had to disable NoScript AND RequestPolicy on my browser COMPLETELY (and this instance is not even using Adblock*) in order to be able to have this post accepted by the machinery. Make of it what you like (or not).