Why I use NotScripts: the extension lets you enable JS temporarily or permanently for a particular website with just a mouse click. As well, at the same time, you can do the same thing for any third-party JS because it presents you with a list of them. So you can enable jsquery and disable google-tracker at the same time.
It's much easier than navigating the menu system to add an exception to the list of blocked sites for each time you just want to read a PDF, for example. That's the main use-case for me.
Happily, my bank doesn't load Javascript from anywhere else.
Not only that, but I was surprised how much paranoia-induced plugins like NoScript and RequestPolicy induce paranoia themselves. And not entirely without cause, either: sites that load 5 different analytics systems are not uncommon, and I've seen 10 different ad providers on a single page.
1. 47% of the top 1,000 web sites include google-analytics.com
2. 69% include a remotely loaded web analytics solution
3. 97% load something remotely
If you can attack any of these you get access to a very large number of web sites and can inject arbitrary code. Clearly forging the SSL certificate for SSL loaded remote JavaScript is one way in, another is an attack on the DNS of non-securely loaded remote JavaScript.
At the time techcrunch.com loaded 18 different JavaScript elements remotely. Attacking one would allow a complete site takeover using JavaScript. And those 18 elements could easily have been loading other elements so that attack could have been done through a third-party.
A quick survey in the UK shows that the banks HSBC, Lloyds TSB, Royal Bank of Scotland all load third-party JavaScript on the secure page used for online banking login. Barclays look like they are not, but in fact the domain they are using for one piece of JavaScript is a CNAME for a third-party.