Comment Re:Oh Java... (Score 3, Informative) 193
I don't know why it isn't enabled by default, but Firefox has a click-to-play plugins option that should dramatically reduce the exposure to exploits like this. So NoScript isn't required.
about:config
plugins.click_to_play = true