[ATTN: VISTA TEAM] Blocks youtube JS Flash Video

[needyt]

Vista Ultimate SP1 run as admin using shortcut to firefox with runas /user:blahuser
note that this is common for developers etc browsing to increase security

Firefox 3.5.3 Add block Plus off
BetterPrivacy
options content check Enable JS, LoadImages auto
uncheck Enable java

NoScript 1.9.9.11 whitelist ytimg.com youtube.com
unchecked Forbid Flash, other pugins, Audio Videp
checked Forbid Java, Silverlight, font-face

Appearance all checked Temp allow ....
Notif unchecked ABE, check show messages

General checked Auto reload when (fails does not reload)

TIA


http://www.youtube.com/watch?v=nAQZ8JKnDTk Haunted Mansion Organ rest I tried, Lone Ranger
Hello, you either have JavaScript turned off or an old version of Adobe's Flash Player. Get the latest Flash player.

acts like youtube on some blacklist and some kind of permission on noscript file; only works to uninstall NoScript
disable NoScript still can not run video
works on some Metcafe which loads from youtube.com

right click -> NoScript -> (forbidden scripts) Allow http://www.youtube.com different font seemsinactive
no temporay allow choices, except temp allow all this page which red gone but page same, reload btn then red again
(allowed scripts) forbid ytimg.com

[Tom T.]

Vista Ultimate SP1 run as admin using shortcut to firefox with runas /user:blahuser
note that this is common for developers etc browsing to increase security

Have you tried running as Admin, to see if it makes a difference?
Does Flash run at sites other than YouTube, or not?

I'm still on XP and not totally familiar with Vista's UAC, but are non-admin users allowed to run executable content such as Flash videos? (Seems that would be defeating the purpose of limiting user privileges, but I'm not Microsoft, so...)

For the record, I use Sandboxie to prevent the browser from writing to the drive or installing exectuables, etc. Link provided as a courtesy only; this site is not responsible for that product. Support, etc., is provided at that site.

Firefox 3.5.3 Add block Plus off
BetterPrivacy

One of the chief functions of Better Privacy is to delete "Flash cookies", a type of "permanently identifying element" (PIE, instead of cookie) installed whenever you play a Flash video. Is BP configured to *prevent* Flash cookies from loading, or from loading at YouTube? It must allow the Flash cookie, then it can delete it when you leave the site, close the browser, or whatever.

options content check Enable JS, LoadImages auto
uncheck Enable java

NoScript 1.9.9.11 whitelist ytimg.com youtube.com
unchecked Forbid Flash, other pugins, Audio Videp
checked Forbid Java, Silverlight, font-face

You may have other reasons for allowing "other plugins", "audio", "video" by default (I wouldn't, but only on an as-needed basis, but that's just MHO. YMMV.), but none of those are necessary for YouTube. Only Flash and JavaScript. (audio and video were very recent enhancements for the new HTML 5 standard.)

General checked Auto reload when (fails does not reload)

That failure to reload automatically is a separate issue that should be fixed, but let's work on the one at hand first.

http://www.youtube.com/watch?v=nAQZ8JKnDTk Haunted Mansion Organ rest I tried, Lone Ranger
Hello, you either have JavaScript turned off or an old version of Adobe's Flash Player. Get the latest Flash player.

acts like youtube on some blacklist and some kind of permission on noscript file; only works to uninstall NoScript
disable NoScript still can not run video
works on some Metcafe which loads from youtube.com

I have *everything* blocked by default on Embeddings page (formerly "Plug-ins" page). YouTube is whitelisted.
I can play any video. Since Flash is blocked, a red NoScript block-logo appears where the video would be. I click it, receive a confirmation request, "OK", and it plays fine.

right click -> NoScript -> (forbidden scripts) Allow http://www.youtube.com different font seemsinactive
no temporay allow choices, except temp allow all this page which red gone but page same, reload btn then red again

I'm not understanding this. When I removed YouTube from the whitelist, then went there, right-clicking the NoScript logo offered the choice of allowing or temporarily allowing YouTube.

(allowed scripts) forbid ytimg.com

Correct. Every script that is allowed will allow you the option to forbid it.

It seems like the first place to start is the Vista Access Control. Other Support Team members are Vista-knowledgeable, but until one is available, could you try running as Admin, perhaps first installing a trial of Sandboxie for your comfort, if you like what you see at their site? If it runs OK then, then there's the issue.

Next would be Better Privacy. Try disabling it completely. Does YouTube work now? If so, then it's a configuration issue.

Also possible are extension conflicts. What other extensions do you have? Try disabling all except NoScript. If that doesn't work, please try the
General Troubleshooting Instructions.

Let us know. Thanks.

[needyt]

I left this out:
runing firefox with a regular shortcut, runs Firefox as admin user. install NoScript, without ytimg or youtube in whitelist.
NoScript menu comes as normal with choices to temporarly allow thes two, select these two to temp allow them,
It reloads page and JS flash mesage goes away and video works.
TIA
The idea is to run anything dangerous as a real user to limit possible attach from dangerous holes ( jpeg, PDF reader, video player)

[Tom T.]

... runs Firefox as admin user....
It reloads page and JS flash mesage goes away and video works.
TIA
The idea is to run anything dangerous as a real user to limit possible attach from dangerous holes ( jpeg, PDF reader, video player)

If I understand you correctly, when Firefox is run with Admin privileges, the issue disappears.
This seems to confirm my suspicion that Vista's User Access Control is interfering.

I understand and agree with your concern about allowing any executable content to run in a browser with admin privileges.

As mentioned, I use Sandboxie 100% of the time. Especially during tech support, we are often asked to visit questionable sites, disable NS for testing purposes, or allow questionable scripts and objects. I would not be comfortable doing this without some method of virtualizing the browser in an environment that cannot affect the rest of the machine.

Many solutions are available -- VMware, Parallels, and others. Support team fellow member Alan Baxter and I have found Sandboxie to be a lightweight, easy-to-install-and-configure, easy-to-use method of isolating the browser. You should investigate it, and the alternatives, thoroughly for yourself before choosing one, as we cannot offer any warranties or support here, only a referral as a courtesy.

A support team member using Vista may know of another way to achieve your goal of allowing the executable content with limited user privileges. I'll mark this for the attention of a Vista-friendly team member. In the meantime, please consider the alternatives mentioned. Thank you.

[Giorgio Maone]

I'm investigating, thanks.
Are there other extensions misbehaving in your limited account setup (especially not saving their preferences persistently across restarts)?
Does the Youtube page actually work if you disable NoScript from Tools|Add-ons? (if not, it may hint at a Flash player permission issue)?

[Giorgio Maone]

My investigation On a Vista 32 system:

1. Installed Firefox 3.5.3 as an administrative user
2. Created a new "standard user" (non-admin) account called "Limited"
3. Logged in as "Limited"
4. Started Firefox 3.5.3 (a fresh profile was automatically created)
5. Installed NoScript 1.9.9.11 from AMO and restarted Firefox
6. Browsed http://www.youtube.com/watch?v=nAQZ8JKnDTk
7. Allowed youtube.com and ytimg.com
8. Watched the movie

Everything looks fine, i.e. I couldn't reproduce your issue.
Please let me know if I missed something something in my reproduction attempt.

[GµårÐïåñ]

I checked and could not reproduce your case either. However, I could suggest a solution but it would require somewhat advanced knowledge of how to modify/move files within windows. If you have admin access on this machine and willing to try something, I think I can combine and consolidate your profile in a way that will no longer get hit with the permission issue.

Currently for whatever reason, such as running Fx as admin, will cause your permissions to segregate and puts half if not all of your modifications when not as admin into VirtualStore, which is not accessible across the permission barrier. If we can consolidate this into the program files folder, we can resolve this permission issue by have it run from the program files directly rather than having it two places.

We'll see.

[Tom T.]

...Everything looks fine, i.e. I couldn't reproduce your issue....

@ Giorgio: Is there no possibility of an extension conflict, corrupt extension, corrupt extension file, etc?

Also possible are extension conflicts. What other extensions do you have? Try disabling all except NoScript. If that doesn't work, please try the
General Troubleshooting Instructions.

Was this not in order, especially disabling Better Privacy, which deals particularly with Flash LSO "cookies"? Just asking....

@ Giorgio and Guardian: Stupid question: As mentioned, I'm not Vista-familiar. But XP has *three* categories of user: Admin, Limited, and Guest. If there is some analogous choice in Vista (a quick search of MS Support gave no info), is it possible that OP is running a Guest account, or some account privileged less than the Standard User account? Sorry if these are inapplicable.

[GµårÐïåñ]

I can't speak for Giorgio but I believe that both of us assumed that basic debugging had been performed and it was absolutely a Vista UAC issue, so we focused there. Your link to general troubleshooting should have been more than sufficient to rule out any extension conflicts or corrupt profiles, unless the user didn't do it. It goes without saying that you are right, it should have been checked already, if not then it should be performed immediately before we waste any more time. Giorgio going through the whole clean process and finding no issue and my own testing suggests this step might have been skipped leading to the wrong conclusion to the actual issue.

@OP: if you have not done so, please check with 1) clean profile + noscript (ONLY) or 2) go to %appdata% and inside your profile directory in the Mozilla folder, delete the files extensions.cache, extensions.ini, extensions.rdf and then load Fx, run a check for updates, it will update a few things (internally) and then reboot Fx and see if the problem still exists.

@QUESTION: In Vista you have admin or limited, guest has even less authority and is a stripped shell account with minimal non-system authority. If the user is wasting their time inside a Guest account, this is a futile and moot point. Now using policy you can do more than just admin/not, but that is usually not within the pervu of the average user, such as (power user, support, backup operators, network admins, system admins, etc class of users that can be created using policy, generally pushed out as part of active directory but can be done using local policy too.

[Tom T.]

I can't speak for Giorgio but I believe that both of us assumed that basic debugging had been performed and it was absolutely a Vista UAC issue, so we focused there. Your link to general troubleshooting should have been more than sufficient to rule out any extension conflicts or corrupt profiles, unless the user didn't do it.

My friend, I have learned, as I know you have, *never* to assume anything that is not explicitly stated in the post.

It goes without saying that you are right, it should have been checked already, if not then it should be performed immediately before we waste any more time. Giorgio going through the whole clean process and finding no issue and my own testing suggests this step might have been skipped leading to the wrong conclusion to the actual issue.

Unless and until OP tells us otherwise, I suspect that to be the case.

@OP: if you have not done so, please check with 1) clean profile + noscript (ONLY) or 2) go to %appdata% and inside your profile directory in the Mozilla folder, delete the files extensions.cache, extensions.ini, extensions.rdf and then load Fx, run a check for updates, it will update a few things (internally) and then reboot Fx and see if the problem still exists.

Excellent advice. Thanks for reiterating it, G.

@QUESTION: In Vista you have admin or limited, guest has even less authority and is a stripped shell account with minimal non-system authority. If the user is wasting their time inside a Guest account, this is a futile and moot point. Now using policy you can do more than just admin/not, but that is usually not within the pervu of the average user, such as (power user, support, backup operators, network admins, system admins, etc class of users that can be created using policy, generally pushed out as part of active directory but can be done using local policy too.

note that this is common for developers etc browsing to increase security

While not assuming anything, this quote from the OP strongly implies that OP is an advanced user, if not actually a developer.

[GµårÐïåñ]

Well if we dare to assume advanced status, then we can hope they have done the proper etiquette of support procedure but you never know, advanced users are known to misbehave too.