Few of the popular ones, but there may be some misconception here. NoScript isn't meant to be blocking JavaScript for all sites. If you trust a site, which doesn't function without JavaScript, adding it to the whitelist is one click away. You get used to it quickly.

And, even in the mode where JavaScript is allowed by default on new sites, the other protections (Clickjacking, XSS, ABE, etc) still apply.

It's a little bit like the cookie-situation back when the internets were still young.

Many people (including myself) would swear by leaving the cookie notification on and confirming every. single. one. of. them.

That has long stopped being feasible and I assume it will be the same with NoScript in a few years.

Isn't this the fault of a bad UI mixed with bad defaults? I'm using the Cookieculler FF addon (https://addons.mozilla.org/en-US/firefox/addon/cookieculler/) to manage them. Instead of torturing me with a modal popup for every new site I visit, it keeps a list of hosts and cookies and trust status in the background. Using that list to protect important but delete/block all other cookies is quite convenient.

Most actually, depending on your interests of course.. IF you are looking for content, not games, animations or games and the like. I browse with Javascript disabled by default and rarely enable it (and mostly it is for things would work just fine without if their creator wanted).

Hacker News, for one. Anyway, NoScript isn't an extension to disable javascript (there's already a checkbox for that), the point is to selectively enable it.

Many sites work reasonably well and some are even better, as many developers use Javascript to make website perform annoying advertising routines.

Set NoScript to allow all same domain JS. This will block 3rd party tracking scripts and ads while allowing the site to work. You'll have to whitelist a few common files like jQuery on Google CDN but for the most part it works great.

I think NoScript's clickjacking protection works even if the site is whitelisted or you have javascript turned on for all sites, it still checks for XSS type behavior.

www.google.com is a good example.