NoScript now defaults for most stuff ON!!! :(

Ask for help about NoScript, no registration needed to post
FrustratedNS
Posts: 3
Joined: Fri Dec 01, 2017 11:59 pm

NoScript now defaults for most stuff ON!!! :(

Post by FrustratedNS » Sat Dec 02, 2017 12:29 am

Over time I had set my old NS preferences more or less like I liked them.

With the conversion to FF 57, all my old NS preferences were lost.

Since the FF 57 upgrade, I've been hit with gobs of popups, annoying video ads, and fake ransomware and fake password harvesters (or at least pages I closed as quickly as I could get around their locks). And my computer has crashed a few times, as well as FF needing re-installed. Overall a very poor experience with both FF and NS.

When I click on the (S), it shows sites are mostly set as "Default". Initially it appears as if the offsite scripts are being blocked with a big red (S)

However, it turns out that one has to click on each line to see what is actually "Default", which seems to mostly be enabled by default.
  • Please DISABLE everything by default as with the old system. Possibly make known "content media" sites obvious to re-enable if desired. Or, list known sites by content, ads, tracking, etc.
  • Make it obvious what is enabled/disabled (by default). Perhaps even show the new feature of script types. All disabled, All enabled, Partially enabled.
  • Perhaps add an option for User (beginner/normal/expert) or security defaults. Thus an expert user can block EVERYTHING and re-enable as needed, while an amateur user could have the defaults set for a reasonably safe and easy browsing experience out of the box.
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0

barbaz
Senior Member
Posts: 9664
Joined: Sat Aug 03, 2013 5:45 pm

Re: NoScript now defaults for most stuff ON!!! :(

Post by barbaz » Sat Dec 02, 2017 12:38 am

FrustratedNS wrote:However, it turns out that one has to click on each line to see what is actually "Default", which seems to mostly be enabled by default.
Gak. That would make a very poor experience indeed. It is certainly not supposed to be that way by default!

Here are default settings of NoScript 10.1.5.1, for reference:

Default: only "frame", "fetch", and "other" are enabled. Everything else disabled.

Trusted: all enabled

Untrusted: all disabled

These three are global settings, you can set them once and they will apply to all sites with the same permission.

Hope this helps.
*Always* check the changelogs BEFORE updating that important software!
-

Pansa
Senior Member
Posts: 318
Joined: Fri Nov 24, 2017 10:30 pm

Re: NoScript now defaults for most stuff ON!!! :(

Post by Pansa » Sat Dec 02, 2017 1:00 am

FrustratedNS wrote:Over time I had set my old NS preferences more or less like I liked them.

With the conversion to FF 57, all my old NS preferences were lost.

Since the FF 57 upgrade, I've been hit with gobs of popups, annoying video ads, and fake ransomware and fake password harvesters (or at least pages I closed as quickly as I could get around their locks). And my computer has crashed a few times, as well as FF needing re-installed. Overall a very poor experience with both FF and NS.

When I click on the (S), it shows sites are mostly set as "Default". Initially it appears as if the offsite scripts are being blocked with a big red (S)

However, it turns out that one has to click on each line to see what is actually "Default", which seems to mostly be enabled by default.
  • Please DISABLE everything by default as with the old system. Possibly make known "content media" sites obvious to re-enable if desired. Or, list known sites by content, ads, tracking, etc.
  • Make it obvious what is enabled/disabled (by default). Perhaps even show the new feature of script types. All disabled, All enabled, Partially enabled.
  • Perhaps add an option for User (beginner/normal/expert) or security defaults. Thus an expert user can block EVERYTHING and re-enable as needed, while an amateur user could have the defaults set for a reasonably safe and easy browsing experience out of the box.
As barbaz pointed out: These rules are configurable, and I personally run with what I consider NS5 settings : Nothing allowed in default.
There is only ONE default as well as one trusted and one untrusted. You just can change them from any line. Hence the "custom" button, which is custom for each line separately.

The problem is that there were several bugs in several versions, in an earlier version of NS 10 changing settings of custom changed default. SOme of these bugs changes settings without people noticing.
The actual default is surely not "everything allowed".

"Make it obvious what is enabled"
Well it kind of is. You click on it, and it shows you.

You might want to give the "basic guide" a read.
https://forums.informaction.com/viewtop ... =7&t=23974
But it is advised to check the settings after every update to make sure the check-marks are where you set them before.
Last edited by barbaz on Sat Dec 02, 2017 2:06 am, edited 1 time in total.
Reason: Made link to basic guide clickable
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0

FrustratedNS
Posts: 3
Joined: Fri Dec 01, 2017 11:59 pm

Re: NoScript now defaults for most stuff ON!!! :(

Post by FrustratedNS » Sat Dec 02, 2017 3:59 am

Ok,
I've browsed that info page.
u
But, nowhere does it seem obvious where I can set what "Default" is for novel websites/scripts that I encounter. It is easy enough to disable a site, but a big pain since one expects them to be blocked when one opens the site (for security), and often there are dozens of junk scripts.

So, for example, when I encounter "DoubleClick" for the first time, Noscript sets the permissions to "Default", which is apparently "Enable" until I specifically go in and disable it.

I've browsed the NoScript Options page, but that just lists the sites that one has chosen to blacklist/whitelist, but it is not obvious how to set the global default options. Although there were quite a few sites showing as "Trusted" by default that I ordinarily would have "Untrusted" by default (Outlook, Netflix, etc were "Trusted" when I would have defaulted them as "Untrusted", not that they need to be untrusted, just I don't use them at all).

WashintonPost, for example, gives me a BUNCH of scripts, and they all seem to default to enabled (by default).

I'm not sure if this is anything, but the following looks a bit odd, under: moz-extension://[...]/ui/options.js (linking back from the options page):

newSiteForm.addEventListener("submit", e => {
e.preventDefault();
e.stopPropagation();
let site = newSiteInput.value.trim();
let valid = Sites.isValid(site);
if (valid && canAdd(site)) {
policy.set(site, policy.TRUSTED);
newSiteInput.value = "";
sitesUI.populate(policy.sites);
sitesUI.highlight(site);
}
}, true);
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0

bo elam
Senior Member
Posts: 208
Joined: Sat Oct 14, 2017 2:25 am

Re: NoScript now defaults for most stuff ON!!! :(

Post by bo elam » Sat Dec 02, 2017 6:19 am

FrustratedNS wrote:Ok,
I've browsed that info page.
u
But, nowhere does it seem obvious where I can set what "Default" is for novel websites/scripts that I encounter. .............

WashintonPost, for example, gives me a BUNCH of scripts, and they all seem to default to enabled (by default).
FrustratedNS, to set restrictions for Default domains, click any Default domain in the Drop down menu. In the window that opens up, you ll see small boxes, you tick to allow and untick to forbid. I untick all the boxes, that gives me what appears to me to be a more restricted experience that what I had with version 5. Thats what I want for Default domains.

If you have the Washington post set as Default and you getting a bunch of scripts when you visit the site, then you probably have the box for scripts ticked under Default, so, you need to uncheck it.

Image

Bo
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:57.0) Gecko/20100101 Firefox/57.0

FrustratedNS
Posts: 3
Joined: Fri Dec 01, 2017 11:59 pm

Re: NoScript now defaults for most stuff ON!!! :(

Post by FrustratedNS » Sat Dec 02, 2017 7:01 am

Ahhh...

Now I understand.

I saw that and realized that it had Defaulted to all enabled... somehow. Perhaps something I clicked on while I was learning the new interface.

But I hadn't realized that checking or unchecking the check boxes changed it for everything. So, instead I was clicking on the Untrusted button which only affected the one site.

I do think it would be more intuitive to set the defaults on a separate menu (go to the NoScript Options page). Also, changing the default can be almost as bad as "allow scripts globally", so maybe a warning message???

At some point, once the dust settles, I'll have to test the "custom".
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0

User avatar
Giorgio Maone
Site Admin
Posts: 8934
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: NoScript now defaults for most stuff ON!!! :(

Post by Giorgio Maone » Sat Dec 02, 2017 7:12 am

FrustratedNS wrote: I do think it would be more intuitive to set the defaults on a separate menu (go to the NoScript Options page). Also, changing the default can be almost as bad as "allow scripts globally", so maybe a warning message???
That's a really good idea, and also probably moving the presets customizability (except from CUSTOM, maybe) away from the popup interface, keeping it only in the options. Maybe.
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0

oldmoz
Posts: 4
Joined: Sat Nov 25, 2017 6:12 am

Re: NoScript now defaults for most stuff ON!!! :(

Post by oldmoz » Sat Dec 02, 2017 10:17 am

Giorgio Maone wrote: moving the presets customizability (except from CUSTOM, maybe) away from the popup interface, keeping it only in the options. Maybe.
+1
It does seem that too many who use the classic NS default settings with minimal on-the-fly configuration are getting themselves into a quasi globally-allow position too easily by mistake when they first use 10.
Having a less crowded 'simple' pop-up by default, with an 'advanced' button to expand it would be a good idea. The 'advanced' in classic NS was enough of a warning to make most people take more care before fingerpoken in that 'scope'.
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0

Khaleg
Posts: 3
Joined: Thu Nov 30, 2017 8:12 am

Re: NoScript now defaults for most stuff ON!!! :(

Post by Khaleg » Mon Dec 04, 2017 10:59 am

Giorgio Maone wrote:
FrustratedNS wrote: I do think it would be more intuitive to set the defaults on a separate menu (go to the NoScript Options page). Also, changing the default can be almost as bad as "allow scripts globally", so maybe a warning message???
That's a really good idea, and also probably moving the presets customizability (except from CUSTOM, maybe) away from the popup interface, keeping it only in the options. Maybe.
Hello,

The thing is that it is very helpful having the options for every permissions setting under the permission category itself. So it is very easy changing all settings for each situation.
This that I suggest is just showing a popup window saying that by changing any of these settings, all sites under the permission category will be affected (in case of the Default and Untrusted).

Just include a checkbox to "No show the warning anymore" :-)

I think this would instruct the users in knowing that these settings are for the entire category permissions, not just for the site for which they are configuring the permissions.

I would not have problems having in the global configuration page a "copy" of these Default and Untrusted global settings, just these settings on the configuration page should mimic those configured by the method that is used now; but I would not remove how it is working now, just add a warning popup, if possible.

Thanks a lot.

Kind regards
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0

Peter 123
Junior Member
Posts: 28
Joined: Fri Nov 24, 2017 3:27 am

Re: NoScript now defaults for most stuff ON!!! :(

Post by Peter 123 » Mon Dec 04, 2017 12:29 pm

Sorry that I did not read all the thread, but I was already worried when I read the following:
barbaz wrote: Here are default settings of NoScript 10.1.5.1, for reference:

Default: only "frame", "fetch", and "other" are enabled. Everything else disabled.
In my case it is different (and I am not aware that I have changed anything under "Default"):

Image

So enabled/allowed I see "media", "frame", "font", "webgl" and "other".
Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0

bo elam
Senior Member
Posts: 208
Joined: Sat Oct 14, 2017 2:25 am

Re: NoScript now defaults for most stuff ON!!! :(

Post by bo elam » Tue Dec 05, 2017 12:35 am

Peter 123 wrote: In my case it is different (and I am not aware that I have changed anything under "Default")

So enabled/allowed I see "media", "frame", "font", "webgl" and "other".
Hi Pete, you probably checked by mistake the boxes that didnt come pre checked. I would untick the boxes for what you want restricted.

Bo
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:57.0) Gecko/20100101 Firefox/57.0

Peter 123
Junior Member
Posts: 28
Joined: Fri Nov 24, 2017 3:27 am

Re: NoScript now defaults for most stuff ON!!! :(

Post by Peter 123 » Tue Dec 05, 2017 1:50 am

Hello Bo,

I am glad good to see that you are active here in this forum too. ;)

Usually all changes should be gone when closing my browser, as I use it almost exclusively in ... Sandboxie. ;) But yes, may be that in one of the rare cases when I were outside of the sandbox (e.g. for updating NoScript), I checked some boxes by error.

Thanks for your reply.
Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0

bo elam
Senior Member
Posts: 208
Joined: Sat Oct 14, 2017 2:25 am

Re: NoScript now defaults for most stuff ON!!! :(

Post by bo elam » Tue Dec 05, 2017 6:27 am

Peter 123 wrote:Hello Bo,

I am glad good to see that you are active here in this forum too. ;)

Usually all changes should be gone when closing my browser, as I use it almost exclusively in ... Sandboxie. ;) But yes, may be that in one of the rare cases when I were outside of the sandbox (e.g. for updating NoScript), I checked some boxes by error.

Thanks for your reply.
I am glad you are here also, Pete.

Its got to be. You were outside the sandbox, you made changes and they stuck.

You know we cant update NoScript while sandboxed and make it stick but we can make changes in settings while running sandboxed by allowing Direct file access to storage-sync.sqlite. Thats the file that NoScript 10 uses for saving settings. Personally, I dont allow access to that file in every sandbox but I set one for doing that sort of thing. You might like to set one like that. I use this sandbox for changing Firefox settings, about:config settings, NoScript, ABP definition updates when I am using it, etc. Its good to have a sandbox like that so you can make changes without leaving the sandboxed environment. Works good.

Bo
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:57.0) Gecko/20100101 Firefox/57.0

Peter 123
Junior Member
Posts: 28
Joined: Fri Nov 24, 2017 3:27 am

Re: NoScript now defaults for most stuff ON!!! :(

Post by Peter 123 » Tue Dec 05, 2017 12:13 pm

Thanks, Bo, for this advice. I will think about it.
Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0

Post Reply