Why do recent NoScript versions prevent me from using XMLHttpRequest in the Firebug console on untrusted sites?
Firebug uses various hacks to allow JavaScript interactive execution for web developers in the “apparent” context of sites where JavaScript is otherwise disabled (e.g. by NoScript). Unfortunately one of these hacks, which allows XMLHttpRequest usage, doesn’t work if the noscript.forbidData about:config preference is set to true. Just toggle it to false and Firebug will fully work again. Notice that this change doesn’t imply any special security weakening, as long as XSS protection is kept enabled.
