[RESOLVED] smart.fm Learning app stopped working with NS

[MDG]

Hi NoScript group,

Recently (I suspec the fixes from 4th December) it's impossible to run the new learning apps from smart.fm with NoScript active.

How to reproduce:
- Go to any learning goal (after simple signup), e.g. http://smart.fm/goals/164180-vocabulary-550
- Select "Fullscreen" at the "start" button (orange, left upper page side)
- Learning window opens, but nothing starts

Versions:
Firefox/Iceweasel 3.0.14
NoScript 1.9.9.18

Trials I did
- Allowing everything: Same fail
- Allowing scripts globally: Same fail

Only workaround is diabling the NoScript AddOn Completely, which I am (naturally) very reluctant to do

Thanks a lot for your help and Kudos to everybody involved in this project
MDG

[Tom T.]

I'm a little suspicious of a site that "doesn't supply any ownership information" and "could not be verified by Yahoo" when I tried to sign in with my Yahoo ID, which they allow; has as an author a Japanese site, but has a domain of Micronesia (small S. Pacific island country).

Nonetheless, the site "worked" after temporarily allowing google-analytics.com and googleapis.com, as well as clicking "Recently blocked sites" and "Allow all from smart.fm".

But when I tried to play Brainspeed, the choices were blank squares, not words. Putting the cursor over them made reference to Adobe Flash Player, yet I saw no Flash objects (.swf, usually) anywhere on the page or in the menu. However, RequestPolicy shows requests being made to Adobe, as well as to Googleapis. Scripts are trying to run from Twitter and Facebook.

I'm not sure I want to be able to make this site "work". Are you? ... If so, try continually opening the NoScript menu and allowing "Recently blocked", "Blocked Objects", etc., as each time you do this, more will try to load. So you may have to go through the menu several times. This is why "Allow scripts globally" failed, because it's more than just scripts, it's several generations of objects loading.

I would rather find another learning site than disable NoScript, but if you wish, try this out and let us know.

[Giorgio Maone]

No sure if the BrainSpeed thing is actually a NoScript related issue.
However the only show stopper seemed to be Google Analytics, actually because they make an reflection call to pageTracker._trackEvent() (using Function.apply()) which works around __noSuchMethod__().
I'm upgrading GA surrogates in next build to include an explicit _trackEvent dummy property.

If you can't wait, you can just change the noscript.surrogate.ga.replacement about:config preference to

Code: Select all

var _0=function(){};with(window)urchinTracker=_0,_gat={_getTracker:function(){return{__noSuchMethod__:_0,_link:function(h){if(h)location.href=h;},_linkByPost:function(){return true;},_getLinkerUrl:function(u){return u;},_trackEvent:_0}}}

[Tom T.]

Thanks for getting to the heart of this messy site, Giorgio.

[MDG]

Thanks a lot for your quick help and the great project!

I am very very reluctant to allow google-analytics per default, so I will wait for the next release.

And in the meantime will also look for an alternative - this script cascading is also to my dislike ...


Ciao,
MDG

[SeanM]

I'm a little suspicious of a site that "doesn't supply any ownership information" and "could not be verified by Yahoo" when I tried to sign in with my Yahoo ID, which they allow; has as an author a Japanese site, but has a domain of Micronesia (small S. Pacific island country).

Nonetheless, the site "worked" after temporarily allowing google-analytics.com and googleapis.com, as well as clicking "Recently blocked sites" and "Allow all from smart.fm".

I have seen a few ".fm"-domain sites (such as "Last.fm", used by the fire.fm extension). My son (music teacher) has quite a few more, and it seems that Micronesia has found a "cash cow", similar to the ".tv" phenomenon. I have been told that ownership info and the rest of the domain registration supposedly is in the purview of the nation-specific domain. Perhaps they are a bit slow in the paperwork

[Tom T.]

I have seen a few ".fm"-domain sites (such as "Last.fm", used by the fire.fm extension). My son (music teacher) has quite a few more, and it seems that Micronesia has found a "cash cow", similar to the ".tv" phenomenon. I have been told that ownership info and the rest of the domain registration supposedly is in the purview of the nation-specific domain. Perhaps they are a bit slow in the paperwork

Ahh, so they are to the Internet as the Cayman Islands are to banking, and Costa Rica, or some of the other island nations, are to Internet gambling sites.

I was suspicious because they allow you to sign in with your Yahoo! ID, yet Yahoo says that they cannot verify the site. For the sake of brevity, I didn't mention that Yahoo added a warning during the redirection process, "We recommend that you not give any personal information to this site". I wasn't going to anyway, , but for a major player like Yahoo to give such a user warning was disconcerting, to say the least.

It's good to know that legitimate sites use the .fm also. Thanks for that information, SeanM.