Why won't videos play when I click the Noscript icon?

[tarjk]

Can someone please help me figure out how to get videos to play? Aren't they supposed to be Click-to-Play when I enable the Apply These Restrictions To Whitelisted Sites Too?

Here is a screencast of my experience trying to get a video to play off Youtube.
https://vid.me/Cv1R

Does anyone have any insight into what I am doing wrong, why the video won't play?

[Giorgio Maone]

Unfortunately this happen because Youtube is using the new mediasource: scheme.
I'm looking for a friendlier / more specific way to handle this, but in the meanwhile you need to open the "Blockable objects" submenu and explicitly temporarily allow mediasource: (https://www.youtube.com).

[barbaz]

Isn't mediasource: in the "mandatory" whitelist?

[Giorgio Maone]

Isn't mediasource: in the "mandatory" whitelist?

Yes, but

[...] I enable the Apply These Restrictions To Whitelisted Sites Too

[barbaz]

oh... heh, I've never tried using that setting with mediasource: stuff... sorry

[tarjk]

Unfortunately this happen because Youtube is using the new mediasource: scheme.
I'm looking for a friendlier / more specific way to handle this, but in the meanwhile you need to open the "Blockable objects" submenu and explicitly temporarily allow mediasource: (https://www.youtube.com).

Hey, thanks for responding. I don't understand what you mean when you say mediasource: scheme though. I've discovered if I open the Blocked Objects menu and select the last entry (as shown in this screenshot https://i.imgur.com/bkokghq.jpg) that the videos play. (But often I have to select the same Blocked Objects entry two times before a video will play). I'm assuming this has something to do with what you are talking about with mediasource: scheme.

If it's not too much trouble, could you help me understand a little better the difference between the 5 entries that are appearing in the Blocked Objects menu, and why I am having to select the same entry twice to get the video to play? If it's too much trouble or too technical, that's okay. But I'm trying to understand better how to use NoScript. Thanks

[barbaz]

viewtopic.php?f=7&t=19674

You could need to pick the same entry twice because YouTube is changing the domain from which it's serving you the chunks of the video, after you reload the page to change the permission?

[tarjk]

viewtopic.php?f=7&t=19674

You could need to pick the same entry twice because YouTube is changing the domain from which it's serving you the chunks of the video, after you reload the page to change the permission?

Hey, barbaz. I didn't forget about that older thread. I just find myself still struggling to make sense of the entries. So thought I'd mention it again in this topic on the off chance someone chimes in who didn't see the last thread, explaining it in a way that finally allows my slow brain to make intuitive sense of it.

[Rollo]

I have "Apply These Restrictions To Whitelisted Sites Too", and since a couple of days
sometimes I have to allow "mediasource:" in order to see a video.
Adding "noscript.allowedMimeRegExp;video/ogg@mediasource:" in about:config solved for me.

But am I wrong, or youtube is still deploying this new mediasource: scheme?
I mean: this morning without adding "noscript.allowedMimeRegExp;video/ogg@mediasource:" the
same video (this: https://www.youtube.com/watch?v=z64HCi2rQkE) in iceweasel require mediasource being allowed, while in seamonkey no.
See here: https://i.imgur.com/WGnsj37.png

Same noscript configuration, no flash plugin.
Maybe its related to the browser string? I'm confused.

Not really a big issue for me, because usually for youtube I use mpv + youtube-dl, but still...

[therube]

I don't think SeaMonkey is up to speed regarding "mediasource:" (yet) so that is why it is not being seen there.

[tarjk]

same video (this: https://www.youtube.com/watch?v=z64HCi2rQkE) in iceweasel require mediasource being allowed, while in seamonkey no.
See here: https://i.imgur.com/WGnsj37.png

Oh, now I see what mediasource is. But notice how my screenshot above does not say "mediasource" anywhere? Here's my screenshot again for reference (notice how there is not mention of mediasource): https://i.imgur.com/bkokghq.jpg

[Rollo]

I don't think SeaMonkey is up to speed regarding "mediasource:" (yet) so that is why it is not being seen there.

Which is fine, for me...

same video (this: https://www.youtube.com/watch?v=z64HCi2rQkE) in iceweasel require mediasource being allowed, while in seamonkey no.
See here: https://i.imgur.com/WGnsj37.png

Oh, now I see what mediasource is. But notice how my screenshot above does not say "mediasource" anywhere? Here's my screenshot again for reference (notice how there is not mention of mediasource): https://i.imgur.com/bkokghq.jpg

These are the others youtube related entries I have in noscript.allowedMimeRegExp:
video/ogg@https?://[^/]+\.(?:youtube|ytimg|googlevideo)\.com
video/webm@https?://[^/]+\.(?:youtube|ytimg|googlevideo)\.com
Hope this help.

[tarjk]

These are the others youtube related entries I have in noscript.allowedMimeRegExp:
video/ogg@https?://[^/]+\.(?:youtube|ytimg|googlevideo)\.com
video/webm@https?://[^/]+\.(?:youtube|ytimg|googlevideo)\.com
Hope this help.

So if I set these patterns in about:config, I am in effect making the Temporary entries that appear in Blocked Objects permanent Allows? I was kinda hoping for a click-to-play. Then it's always Temporary but easier to activate than having to go to NoScript > Blocked Objects > bottom of the list

My understanding is that this Firefox bugfix will give us click-to-play on Audio/Video elements: https://bugzilla.mozilla.org/show_bug.cgi?id=659285

If true, will there still be advantages to keeping NoScript's <AUDIO>/<VIDEO> setting enabled?
Does enabling <AUDIO>/<VIDEO> element do more security wise than just prevent autoplay? I was wondering if I might disable NoScript's <AUDIO>/<VIDEO> and rely on Firefox for click-to-play. But I don't want to do this if enabling <AUDIO>/<VIDEO> is doing other things to improve security.

[barbaz]

I don't think SeaMonkey is up to speed regarding "mediasource:" (yet) so that is why it is not being seen there.

SeaMonkey has not enabled it by default (AFAIK) but Iceweasel may have given that it's basically just Firefox rebranded. If you want it enabled in SeaMonkey you have to actually go to about:config and set media.mediasource pref(s) to true.

[Rollo]

So if I set these patterns in about:config, I am in effect making the Temporary entries that appear in Blocked Objects permanent Allows?

Yes.
I have those entries in about:config because when I watch videos directly on youtube I don't like having to allow everytime a different googlevideo entry.
The embedded stuff is a different story, though: I forbid everything: <AUDIO>/<VIDEO>, <IFRAME> and <FRAME>, so I always get a place holder and I don't have the autoplay "problem".
But I agree with you when you say

Then it's always Temporary but easier to activate than having to go to NoScript > Blocked Objects > bottom of the list

Actually, I do the same for almost all other media sites less widespread than youtube.

Finally, I have also a very restrictive (masochistic?) A.B.E. rule: I accept youtube, ytimg and googlevideo only from others google sites.

Does enabling <AUDIO>/<VIDEO> element do more security wise than just prevent autoplay? on Firefox for click-to-play.

From a security standpoint I really don't know which one is better...