Safety settings and javascript status

Question

Tor Browser allows three safety settings. The highest level safety setting is designated Safest. When one clicks on that setting, a display box appears which says:

Safest: Only allows website features required for static sites and basic services. These changes affect images, media, and scripts. JavaScript is disabled by default on all sites. Some fonts, icons, math symbols, and images are disabled. Audio and video (HTML5 media), and WebGL are click-to-play.

However, if I set the safety level to Safest and then look at the javascript.enabled entry in about:config, the entry shows that javascript is enabled ... which appears to be contrary to the statement that Javascript is disabled by default on all sites.

What is going on? And is there a reliable way (e.g., a test website) of seeing what features are, and are not, enabled?

Answer 1

Tor Browser uses NoScript for this. Rather than disabling it in the browser settings, NoScript controls it.

For example, safer mode relies on a program to only block Javascript on HTTP (websites). How could you automate this with browser settings? Switching it on and off constantly is a pain to code, and i'm not even sure if changing about:config would even work on the fly.

So instead, NoScript is used. My previous paragraph is simply an educated guess as to why NoScript is used. It's common practice to use other tools by developers to make things easier. I'd recommend you don't tamper by trying to change or delete NoScript. It could make things more finger printable. Remember that what you block simply gets dummy information. It doesn't stop it from finding that only one browser in the world sends the exact dummy information. Tor tries to make all of the browsers send the same dummy, but changing that is a recipe for disaster.