InformAction Forums

Been reading in several places that the extensions changes that Firefox is implementing with web-extensions API will ultimately mean that Google Chrome and Firefox will be able to run the same extensions. Assuming NoScript will continue to work when Firefox is fully multi-process, does this mean NoS...

@Thrawn & barbaz:

when I first heard of that Russian exploit, I immediately thought of NoScript's built-in ABE protection (i.e., SYSTEM). Do you guys know enough about the exploit to know if the ABE setting would have provided protection?

Assuming a domain loads CSS or images independent of scripts and that domain is in the Noscript Untrusted list, are those images and CSS blocked? Or are only scripts blocked?

Is there a way to blacklist a domain so that absolutely nothing is loaded from that domain?

Seeing the same thing at http://www.wired.com/. Even with Full Addresses, there is a "wired.com" entry in the NoScript menu.

Huh, this is weird... I'm seeing that too. Somehow I don't think it's a bug though... still not sure why that's happening. Obviously NoScript is seeing *something* that can't be given permission by full address... http://res.myguardian.net/NS/_SMILEY_/thinking.gif Giorgio, do you have any insight i...

The use of remote font icons (@font-face) has taken off in the last couple years. It is now at a state where it is hard to interact with sites without displaying font icons. I apply restrictions to whitelisted sites in my NoScript settings and I want the protections that forbidding @font-face provid...

Well then it should work... # restrict docs.google.com active content to https and [0,1,2,...] subdomains only Site ^https://\d\d?\.docs\.google\.com[/:] Accept Site .docs.google.com Deny INC(SCRIPT, OBJ, FONT, XHR, MEDIA) Sandbox If that's what your ruleset looks like, try moving it to its own rul...

barbaz wrote:What version of NoScript are you using?

2.6.9.34

Why is a Base 2nd Level Domain showing in the Noscript menu? Because there are still disallowed scripts (or "some active content", if you haven't Apply these restrictions to whitelisted sites too) from somewhere on chase.com Can I get rid of it? I think so: NoScript Options > Appearance, ...

Can't get your config to work for .docs.google.com. Any idea why? No, because I'm not clear what you're trying to do with docs.google.com. Restrict it how? Allow all but certain subdomains to run active content? Allow it on per-site basis? I switched out .client-channel for .docs but left everythin...

Can't get your config to work for .docs.google.com. Any idea why? I switched out .client-channel for .docs but left everything else the same.

Yep, you have to allow the full domain (client-channel.google.com) in the script blocking and restrict it with ABE. The rule would look like this (taken directly from my ABE rules and change the domains to match what you want): # restrict client-channel.google.com active content to https and [0,1,2...

https://chaseonline.chase.com/

I have Full Addresses enabled in Appearance settings. Yet when i visit the above site there is an entry "chase.com".

Why is a Base 2nd Level Domain showing in the Noscript menu? Can I get rid of it?

When I visit Google Drive, there is a URI I want to allow with Full Domain restriction, except it is constantly changing its subdomain. Here are some examples: https://1.client-channel.google.com https://2.client-channel.google.com https://3.client-channel.google.com https://4.client-channel.google....

Rollo wrote:Duckduckgo, I prefer to force https with noscript under advanced -> https
See here: https://i.imgur.com/CY2edZB.png

I had no idea openstreetmap was available over HTTPS. I saw your image and promptly set it into NoScript. Thanks