Why about:blank if is allowed?

[turson]

Hi forumers, yes that question, Why about:blank is enabled in the NoScript's default settings??

PD: For test, I returned to its default settings, after a long time. Is this unwise?

[Giorgio Maone]

Because from time to time a few compatibility issues (mostly if not exclusively with extensions) have surfaced involving about:blank being forbidden, and because there's no security risk associated to having it allowed.

[turson]

Well Maone, but what do you think about this?:
http://news.softpedia.com/news/Firefox- ... 6661.shtml
http://www.securityfocus.com/archive/1/460369
http://lcamtuf.coredump.cx/ffblank/

[Giorgio Maone]

Well Maone, but what do you think about this?:
http://news.softpedia.com/news/Firefox- ... 6661.shtml
http://www.securityfocus.com/archive/1/460369
http://lcamtuf.coredump.cx/ffblank/

Irrelevant: for this (and other about:blank-related exploits), JavaScript needs to be enabled on the web page launching the attack (which of course is different than about:blank, an empty page by definition).

[turson]

Concerning default options: ¿Why gstatic.com and googlesyndication.com are allowed?
Thanks .

[Giorgio Maone]

http://noscript.net/faq#qa1_5