A Toggle to Completely Disable All Protections

Bug reports and enhancement requests
skkukuk
Junior Member
Posts: 28
Joined: Sun Dec 12, 2010 5:17 pm

Re: A Toggle to Completely Disable All Protections

Post by skkukuk » Tue May 12, 2015 1:49 pm

barbaz wrote:If this will be implemented I'd vote for an about:config-only toggle of "disable everything but ABE", with a warning when it's used - then:
- your clients won't do that willy-nilly, but you can recommend them to do it if they are in a hurry and want to troubleshoot more later
- if the user toggles that and it doesn't work, they know to look in the Browser Console (Ctrl-Shift-J) and if they don't know what to do next, they know to ask for ABE help; and OTOH, they still have _some_ protection left
- user can then just un-check NoScript Options > Advanced > ABE > Enable ABE to fully disable everything. The toggle should remind to enable ABE again if ABE is disabled at the time this toggle is used to turn NoScript on.


If this is implemented, I second the above. There needs to be protection against accidentally disabling any part of noscript, especially for anyone that has the "Automatically reload affected pages" option set. If the disable everything is an about:config option (I like this, cuz it would be hard to accidentally do this!), then some indication that it is in effect in the NS icon would probably be enough of a reminder that it was done. If the disable everything option is put in the NS Options GUI, then I think at least a prompt to confirm the disabling of NS should be issued, with the default button set to No or Cancel (don't disable), and an indication in the NS icon that everything is disabled. I also agree that making this a session only option (reset the next time FF starts) makes sense.

Again, I say the above only if this "disable everything" option is implemented. I do not need it and would not ever use it - that is what a separate Clean FF profile is for - but for the OP's case of having less technical users, a separate FF profile would probably not be a good alternative.
Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

barbaz
Senior Member
Posts: 9518
Joined: Sat Aug 03, 2013 5:45 pm

Re: A Toggle to Completely Disable All Protections

Post by barbaz » Tue May 12, 2015 5:26 pm

skkukuk wrote:There needs to be protection against accidentally disabling any part of noscript, especially for anyone that has the "Automatically reload affected pages" option set.

I do not think any pages should be automatically reloaded when this toggle is used, regardless of the user's auto-reload settings.
*Always* check the changelogs BEFORE updating that important software!
-

ReporterX
Senior Member
Posts: 74
Joined: Mon Sep 15, 2014 11:46 pm

Re: A Toggle to Completely Disable All Protections

Post by ReporterX » Thu May 14, 2015 5:46 am

barbaz wrote:
ReporterX wrote:Alternatively I think it can be set as a session-only toggle. That means the "disable everything but ABE" will be unchecked again once you restart Firefox (another session starts). In this way, we may put this option in GUI.

Good idea, this mode is probably useful only within a single session anyway, and a restart of the browser is a good emergency exit for those users who don't know what they did.
Where in the GUI do you think this should go?


I think we can re-group the context menu (when you click the NoScript icon). ;)

Options...
_______________________________
Disable NoScript > Allow Scripts Globally (except untrusted, dangerous)
................... > Disable all but ABE
Firefox 37.0.2, NoScript 2.6.9.22
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0

barbaz
Senior Member
Posts: 9518
Joined: Sat Aug 03, 2013 5:45 pm

Re: A Toggle to Completely Disable All Protections

Post by barbaz » Thu May 14, 2015 6:27 am

Sounds good. I would also suggest that the "Allow Scripts Globally" menu item not be placed in the submenu unless "Disable all but ABE" is selected to be shown, but the "Disable all but ABE" is always shown in the suggested submenu.

And if it's going to be a menu item, there should definitely be a confirmation dialog like suggested by skkukuk that users must manually click through every time, but in order to make it harder to accidentally disabling all protections other than ABE in just a few careless click(s), it should *not* be possible for users to disable that confirmation dialog as is possible with other confirmation dialogs in NS.
*Always* check the changelogs BEFORE updating that important software!
-

ReporterX
Senior Member
Posts: 74
Joined: Mon Sep 15, 2014 11:46 pm

Re: A Toggle to Completely Disable All Protections

Post by ReporterX » Thu May 14, 2015 6:38 am

barbaz wrote:Sounds good. I would also suggest that the "Allow Scripts Globally" menu item not be placed in the submenu unless "Disable all but ABE" is selected to be shown, but the "Disable all but ABE" is always shown in the suggested submenu.

And if it's going to be a menu item, there should definitely be a confirmation dialog like suggested by skkukuk that users must manually click through every time, but in order to make it harder to accidentally disabling all protections other than ABE in just a few careless click(s), it should *not* be possible for users to disable that confirmation dialog as is possible with other confirmation dialogs in NS.


Yes it should have a confirmation popup like "Allow Scripts Globally".
And as I suggested above, it can be a session-only toggle.
Firefox 37.0.2, NoScript 2.6.9.22
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0

barbaz
Senior Member
Posts: 9518
Joined: Sat Aug 03, 2013 5:45 pm

Re: A Toggle to Completely Disable All Protections

Post by barbaz » Fri Oct 13, 2017 5:47 pm

ReporterX wrote:
barbaz wrote:Moving to NoScript Development because it's an RFE.

So why isn't "Tools > Add-ons Manager > NoScript > Disable > Yes, remove ALL protections" good enough here?
I have to restart Firefox which sometimes I don't want to.
This is also some of my clients told me.
Since they have to restart every time they find a site gets broken by Noscript and they don't have time to troubleshoot at that moment, some finally decided to remove NoScript. How sad.
Since NoScript is now restartless, does that make this moot and thus WONTFIX?
*Always* check the changelogs BEFORE updating that important software!
-

Post Reply