Tom T. wrote:I went to your site and did not allow it. (No offense, of course, just testing.
)
*Everything* is checked on the Embeddings page, including "No placeholder for objects .... untrusted". This is my default NS configuration.
None taken, that's why I have 3, two of which are on less than "trusted" sites so I can gauge the gui effect on the user. I do the same myself
(btw, agree with al-9x - your reputation is far too well established here for anyone to accuse you of posting a question merely to spam your site. Please don't ever give that another thought.)
I would think that too and if I wanted to spam something, I certainly wouldn't be using that site. But we are mods, expected to lead by example and didn't want it to appear like we were showing double standards. I know my motives, but others don't and the honorable thing was to leave it off. But thank you for everyone's show of support and respect, thank you.
Since I have never had contact with vimeo or infosniper, they are in what will be known in the future as
"Unknown". Hence there is a green marker in NS menu, and pointing to it offers me the option to allow these objects. Also, their placeholders show, for quick convenience in allowing them.
Infosniper is on that ONE only, again to gauge the interaction with gmodules and such. Not a bad service, but not something I normally use but this was simple enough for testing purposes. Now vimeo was something that happened to be a service used by another to whom I was linking, so not a choice but rather a compromise
yes they are considered the unknown, by my current definition too
Next, I mark vimeo and infosniper as "Untrusted", and reload the page. Their placeholders disappear, and they disappear from the "Blocked Objects" sub-menu.
I concur that this is a good system. If I think something is missing, I can always point to "Untrusted" and examine the untrusted/blocked objects.
Ok, so far. If no placeholder, then yeah, but with placeholder the partial suggests something got missed when a decision was actually made. I have come across other sites with untrusted status who have media in them and they do not come up partial like that, they just show untrusted. I guess that was my expectation to all, even with the place holder active.
Next, I uncheck "No placeholder for objects coming from sites marked as untrusted", and reload the page. The vimeo and infosniper placeholders reappear, and the objects reappear in the "Blocked Objects" sub-menu. This is exactly the behavior I would expect.
So far yeah, same here, my concern is mostly with the display icon as a guide.
Next, I go back to 100%-lockdown, reload, then uncheck "Block every object coming from a site marked as untrusted", and reload the page.
I've never toyed with this checkbox before. No placeholders appear, as that is still checked. *Nothing appears to change at all.* No Blocked Objects in the Blocked Objects sub-menu, only the original cholce in "Untrusted" menu to allow vimeo or infosniper.
Well I guess my confusion is that regardless of the block every or show placeholders or not, if they are marked untrusted, they are untrusted right? Until otherwise, what is the whole pending so we show partial that is driving me crazy here.
Additionally unchecking " No placeholder for objects coming from sites marked as untrusted" and reloading brings back the placeholders, but still no untrusted objects listed in "Blocked Objects" sub-menu. This checkbox seems somewhat redundant to me so far if all "Block Plugin" boxes are checked. If I uncheck "Forbid IFrame", then the infosniper IFrame appears even with "No placeholder" AND "Block every object from sites marked Untrusted".
Exactly, if I say untrusted, and have checked with objects should be untrusted, then it is a done deal no? Why consider them different and give different weight to it based on whether or not I have the redundant block every object checked or the placeholder? As a security conscious person, I want the placeholders to know where and what WITHOUT allowing it to find out, but that doesn't mean they are anything more than untrusted to me when I come across them. I feel my ability to use language to explain is failing me
I think "this* might be an issue. The "Block every object coming from a site marked as untrusted" seems to serve no purpose. Infosniper is Untrusted, yet allowing IFrames allows Iframe from infosniper, despite the "Block every...".
Whole other can of worms which I do not mind continuing as part of my original concern and will leave to Giorgio to address that for us. I am CERTAIN there is some logic for it, Giorgio is very good at not cluttering GUI unless absolutely necessary.
The other suggestion: Note the frequent mention of "Reload the page..." . I would think that changing permissions for objects is a page permission change significant enough to warrant an automatic reload. (Yes, I have always had "Automatically reload affected pages when permissions change" checked.) I would suggest that this convenience feature be added.
I have that set as well and I think that would certainly warrant it too. however, I have noticed that reloads executed by NS do not always end well, I have to often click in the URL box and hit enter to force another to make it work right.
Finally: I think the logo color and shading changes have gotten far beyond the average user's comprehension. There is no FAQ, only the Features page explanation, a page probably less read (you would have the hit stats, Giorgio), and less intuitively checked by a user with a question. FAQ is the natural choice.
Well I check it and sure you do as many else, but you are right, it is not as IN FACE your face as most of the FAQs and I resigned myself to the fact that Giorgio is busy, it is not pressingly urgent and that in the end those who care enough to notice it, will also know where to look for the information. Just thinking out loud, Giorgio did say that the documentation needs to be reworked, so I am thinking when it comes to fruition, it will be dealt with accordingly. I have offered my assistance to Giorgio but respect his methodology to go it alone. I want to renew that offer in case it was forgotten.
But in any event, it seems three are simple enough:
Solid blue: Everything on this page is allowed (or the page does not use executable content, although there aren't many of those left anymore.)
Part red: Some things are allowed and one or more are blocked. Open the menu to see.
Solid red: Everything on this page is blocked. Open the menu if you wish to allow some.
For me to this date, it has been very straightforward and a none issue. White with blue all allowed. White with gray, no script. Big red one, script but all blocked. half shaded, some allowed, some not. White with blue and little red circle (our current condition) I took as being a site with partial allowed with something pending a decision but never thought it would be a situation like this where all decisions made still give the same icon. ???
You have to open the menu anyway, so the additional, non-intuitive markings and shadings add little value, IMHO.
Correct for someone as anal as myself, the icon is NOT my only indicator but it helps for quick cursory evaluation, plus its pretty cleverly done.
The fourth, the red exclamation point for "Global Allow" is valid as an alert, but perhaps should be accompanied by a more emphatic message than just another menu choice "Forbid scripts globally (advised). Perhaps when the ! is clicked, a pop-up, "You have allowed all scripts in the universe to run. This is dangerous and contrary to the purpose of NoScript. Please see FAQ X.x for further information about why this is dangerous." Of course, users may still choose to ignore the exclamation point, as several posters to this forum have indicated is their practice.
Well thank god its not up to me, as I would have icons that are FAR more gradient (meaning different for different reasons with the smallest variations) but that's the anal part I was referring to. I think Giorgio has masterfully kept it manageable, I just wanted it to work as expected, or learn why my expectations may be wrong.
This simplification would eliminate what Guardian perceives as a bug and what I perceive as trying to be too fine-grained in a 16x16 logo. Let the fine-graining improve in the controls, and let the logo be analogous to the green/yellow/red stop-light or WOT scheme with which people are familiar: Three choices.
I must clear that unless Giorgio states otherwise, this is YES my perception of a bug, it may not be. If it is, then I am glad I was able to help detect it but if not then I am fully willing to apologize, learn and move on
I'm not recommending actually *changing* to green/yellow/red, because people would misinterpret it as "approval/caution/danger", which isn't the case. Just saying that three logos (blue; blue/red; red) plus the exclamation are enough visual cue to advise when further investigation is needed.
My two cents worth. IMHO. YMMV.
The WOT system is ok but it matches their purpose, not ours here so much. Although I see what you are saying about the universal symbolic representation of color designations.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
