GUI Suggestions

[Identities Infinite]

Ever since the WebGL embedding was implemented I always thought the check box was misplaced. I think it should follow the @font-face check box instead of where it is now. Am I missing something or is my logic correct?

Also, I was thinking how useful tooltips are and if there are any they are not being conveyed to me. On the same tab there are Trusted and Untrusted check boxes. These could use some verbosity because I still have no idea what they do although I keep them checked. The Anti-XSS Protection Exceptions edit field on the XSS sub-tab has a tooltip and more of those things all around would be really nice. The Pattern Matching Sample edit field does not have one either. I am not sure how or if anything would be visually effected but some developers implemented tooltips in their extensions upon providing them with feedback and I just hoped I could help to improve overall accessibility of the Options panel. Saved Password Editor makes really good use of them and the Compress File extension for Thunderbird now uses them as a result of my feedback. Does anybody notice the fine details?

[Tom T.]

Ever since the WebGL embedding was implemented I always thought the check box was misplaced. I think it should follow the @font-face check box instead of where it is now. Am I missing something or is my logic correct?

From the point of view of lumping together all of the "Forbids", I see your point. Since WebGL is fairly recent, I assume that Giorgio just used some unused space in the Embeddings tab, rather than shuffling everything around. Much less work for him. Is this truly an accessibility issue for you?

Also, I was thinking how useful tooltips are and if there are any they are not being conveyed to me.

Not in the GUI. They are used in about:config, where you can hover the mouse over, say, the Value field of the setting noscript.untrusted, and a tooltip opens with your entire untrusted list. It will remain for as long as the mouse pointer stays on that Value field.

There are other examples as well. In what parts of the GUI would you like tooltips? Perhaps about:config will provide them. Is about:config easily accessible for you?

On the same tab there are Trusted and Untrusted check boxes. These could use some verbosity because I still have no idea what they do although I keep them checked.

Does JAWS not read the descriptions of these on the Embeddings tab, or will it read only a tooltip?
I don't know the details of making dialog boxes available to screen readers, but if you can provide some details, perhaps Giorgio can make simple changes that would accomplish that.

To answer your question, the top part of the page is "Additional Restrictions for Untrusted Sites" -- all of which you now know should be checked.
Then there is a boldface entry, "Apply these restrictions to trusted sites too". Again, best safety is to do so.

"Block every object coming from a site marked as untrusted" -- that's a no-brainer. If you don't trust the site, why would you allow code objects from it?

"No placeholder for objects coming from sites marked as Untrusted" -- again, you're never going to allow such things, so why even show a placeholder that might accidentally be clicked?

Then a boldface heading: "ClearClick protection on pages..." and this is where you see "untrusted" and "trusted". Of course we want clickjacking protection everywhere, because even reputable sites have been hacked at times. All of the big ones -- Google, Yahoo, you name it, no one is immune.

The Anti-XSS Protection Exceptions edit field on the XSS sub-tab has a tooltip

I don't see one. There is a link to XSS FAQ, which of course turns the mouse pointer into a hand when you put it there, indicating a clickable link.

The Pattern Matching Sample edit field does not have one either.

I delete the default XSS exceptions because I haven't needed any. We can certainly help you create one for a specific site, but usually, we can find a better work-around, or advise the webmaster that his site is triggering XSS warnings.

I am not sure how or if anything would be visually effected but some developers implemented tooltips in their extensions upon providing them with feedback and I just hoped I could help to improve overall accessibility of the Options panel. Saved Password Editor makes really good use of them and the Compress File extension for Thunderbird now uses them as a result of my feedback. Does anybody notice the fine details?

I will ask NoScript developer Giorgio Maone about the feasibility of providing tooltips as an accessibility improvement, but as noted, is there any easy way to make the dialog box itself readable by JAWS?

I admire your determination and conscientiousness, not merely in the face of a physical challenge, but because that level exceeds that of many of our users who have full vision. I wish all users were so willing to devote time to learn these things. I'd like to make it easier for both of us. This may be out of line, but if you like, I can send you a phone number, in strictest confidence of course, and perhaps set a convenient time to talk live.

We don't reveal the locations of our users, but it's pretty clear to this US-based writer that your English has a British, Continental, or Indian flavor to it. If you wish to do this, I'm sure it's cheaper if you call me than if I call and reverse the charges. Unfortunately, I don't have Skype or Voice Over IP.

Otherwise, feel free to continue to ask and suggest.

[Identities Infinite]

If you read the change log for NoScript there are high-number RCs [e.g. RC8 and RC9] for a version I can not recall that dealt with accessibility. That was around the time I began to use NoScript and the first thing I did was try to make it usable for me. Now I just want to 'polish' it if possible and thought I would put my suggestions in bits and bytes for the world to read.

The WebGL check box placement is not an issue at all; I just really like organisation and from the manner in which I view things it sounds displaced. Maybe there are no tooltips in the Options panel but there are descriptions resulting from the initial e-mails between Giorgio and me predating the accessibility notes in the change log. I like those descriptions and wish about:config was that descriptive or more so. I really do not like how that entire screen is laid out. I guess it is a table of sorts but since I have no access to the use of a mouse I can not hover; consequently, all I can do is press Up and Down Arrow keys to navigate the names and press Shift+F10 [my laptop lacks an Applications key damn it] and modify things if need be. I can also filter things which I do often. Any about:config preference that can reasonably be incorporated in the GUI I welcome.

JAWS reads the labels of the controls but what good are labels if there is not additional verbosity? Some things should be common sense and some are to me but let me use trust and untrusted as examples. So what about trusted and untrusted? What do they do? Trust what? Do not trust what? What is collapsing a blocked object? They do not expand or collapse by use of the keyboard so maybe a description binded to that check box would be helpful. Do you understand how that generates questions for somebody who is interacting with controls without seeing all the visually coded niceties? There are MUCH worse examples such as the GuiConfig add-on. I told the developer exactly what needs to be improved but it still has not been updated. It has potential but the inaccessibility is beyond frustrating. Giorgio listens [and so I find people on here do too] and that is why I take the time to change one's perspective even if temporary.

I knew nothing about 'additional restrictions for untrusted sites' because that is something not binded to any specific control. JAWS does not recognise boldface [I just read it is some type of font?]. Orientation and positioning such as top and bottom is another aspect of a dialogue about which I do not know. The boldface heading is something you see and that if possible and not visually compromising should be attached to both boxes so I or anybody else knows those apply to ClearClick protection on pages.

Regarding the Anti-XSS tab I was referring to the edit fields not the '?' link. The first one says 'Exceptions matching these regular expressions will not be protected against XSS.'. I like that little bit of information and think other controls could benefit from having those. The HTTPS | Behaviour edit fields have these too . Again, these are helpful no matter what type of control.

My telephone service was discontinued on 04 January but I do have the MSN and Jabber [Google Talk] activated by use of the Miranda IM client. Other than those and e-mail I am not hip to the 21st century methodology of mechanical communication. It has not become just something I do; it has become somewhat of an advocacy thing. I must make sure or do what I can to make sure I can make full use of anything I intend to use fully. In other words, if I will continue to use something I try my best to direct my concerns to the source and I guess it was not such a bad idea registering here to make others aware of how I interact with what most people might perceive as a simple dialogue.

[Tom T.]

I did not know that you had had previous conversations with Giorgio. I'm sure he'll look at your recent suggestions when he is able to. I have already sent him a private message requesting that.

I like those descriptions and wish about:config was that descriptive or more so.

Yes, often one must look up the meaning of an about:config value in Firefox Help. Some are intuitive, but many are not.

I really do not like how that entire screen is laid out. I guess it is a table of sorts

It is just row upon row of entries, in alphabetical order.
The left side is the "name" field of the setting.
The next column is Status, and there are only two possibilities: Default or User Set, which seems self-explanatory.
The next column is Type. In other words, what type of values does this setting have? There are three possibilities:
1 Boolean, which is simply true or false
2 Integer, which is any integer within the range permitted by that particular setting, and may be zero in some cases
3 String, which I think you understand from your apparent knowledge of coding. Text and/or symbols. For example, noscript.untrusted would be a string of all domain names that you have marked as Untrusted.

If you can locate the Filter field, you can type a desired setting, such as noscript dot untrusted. Then that will be the first entry on the screen. If you move down until the reader again reads that name, you are on the correct line. As you move to the right, you will pass over the aforementioned columns. In this case, Status will read as User Set, unless you have no items in Untrusted. Type will be string, as said. Keep moving right, and when the reader starts reading some site names, keep the mouse right there. The tooltip isn't necessary if the reader will just keep reading the names in the screen.

You can also find most about:config information in the Firefox folder prefs dot J S. This can be opened with Wordpad. Can you use the Find tool? If not, I guess one would just keep scrolling downward until the reader reads the preference you seek.

You can also click the NoScript Export button, which is at the bottom of the NoScript GUI, third button from the left, almost in the middle. This will produce a text document in the default Save location. It may be easier for you to read the entries in such a text document, opened with Notepad or by double-clicking it.

Any about:config preference that can reasonably be incorporated in the GUI I welcome.

Agreed. And many have been incorporated. Unfortunately, sighted people will complain of too much visual clutter, confusion, and difficulty in navigating if a GUI becomes too complex. So there is some trade-off there, unfortunately.

JAWS reads the labels of the controls but what good are labels if there is not additional verbosity?

That is why there is the NoScript FAQ, which I just made a clickable link for you. Click where you previously heard "NoScript FAQ". That should provide interesting and informative reading that will greatly enhance your understanding of NoScript.

Some things should be common sense and some are to me but let me use trust and untrusted as examples. So what about trusted and untrusted? What do they do? Trust what? Do not trust what?

To trust an individual script or code object is to allow it to run. All scripts that are not in the Default Whitelist - that's another hot link -- or that you have not added to the whitelist, are denied by default. The only purpose of Untrusted is to remove them from the NoScript menu of scripts and objects, so that they don't pester any of us again. This can shorten the menu greatly, and would clearly make your navigation easier.

What is collapsing a blocked object? They do not expand or collapse by use of the keyboard so maybe a description binded to that check box would be helpful.

It frees up the screen space for something that otherwise would take up space on the screen, such as an inserted frame, or IFRAME, from an ad agency.
Surely this is better for you, correct?

Do you understand how that generates questions for somebody who is interacting with controls without seeing all the visually coded niceties?

I have an elderly relative who is legally blind, and is gradually becoming totally blind. He used a computer for a little while, using a zoom tool for what vision he had left. But in visiting him, I was certainly given immediate evidence of the difficulties faced in general -- I got quite good at leading with an arm behind my back, gentle steering motions of that arm, description of number of steps until we reach the stairs, etc. It is not at all hard to imagine the difficulty of using such a highly-visual tool as a computer without the faculty of sight. However, many of the notices you're thinking of don't exist, or are in the FAQ, the NoScript "Features" Page page -- "features" is another hot link for you at the previous mention, or elsewhere documented. Still, if everything were evident to everyone, this forum would be almost unnecessary - being mildly facetious there. Just saying that sighted users have many problems, too, because computers are complex, and NoScript is complex of necessity.

There are MUCH worse examples such as the GuiConfig add-on. I told the developer exactly what needs to be improved but it still has not been updated. It has potential but the inaccessibility is beyond frustrating.

In all fairness, many add-ons are freeware, supported only by donations, which are sparse. The most popular add-ons certainly should strive for high accessibility, but an add-on written by one person in his or her spare time, with a small user base, might not motivate that person to go to a lot of trouble to add these enhancements for a very small percentage of a very small user base. Paid software is an entirely different matter, of course.

Giorgio listens [and so I find people on here do too] and that is why I take the time to change one's perspective even if temporary.

You didn't need to change my perspective. I helped Grandpa, and will help you as much as time permits for an unpaid volunteer, and I'm sure Giorgio will do what he can. Please understand that he has quite a lot on his plate right now. NoScript may finally be ported to the Google Chrome browser; he is working on a next-generation NoScript that will have site-specific-permission capability without needing ABE for that; and every time a new web threat emerges, he drops everything to rush out a new version of NoScript that will protect its users.

I knew nothing about 'additional restrictions for untrusted sites' because that is something not binded to any specific control. JAWS does not recognise boldface [I just read it is some type of font?].

But does it at least read all of the descriptions in the GUI?

Boldface is a font that is noticeably darker than its ordinary equivalent. It is used to indicate extra emphasis, to sighted users. Why don't you suggest to the JAWS people that if a noticeable difference in font thickness and/or darkness is detected, it should read that word or words with extra emphasis - perhaps a bit more loudly?

The same is true of what is called italic font. 'This is slanted to the right instead of each character being aligned vertically. It too is used to set off or emphasize a word or section of words. Could they do that?

Orientation and positioning such as top and bottom is another aspect of a dialogue about which I do not know. The boldface heading is something you see and that if possible and not visually compromising should be attached to both boxes so I or anybody else knows those apply to ClearClick protection on pages.

Does the reader read the three dots following "ClearClick protection on pages"? Those three dots, called an ellipses, indicate that something is following. So when the reader moves to the right and stops finding anything, one would return to the beginning of the line and move down one notch, until the box labels are read.

However, it may not be too much to ask that it reads, "Apply Clearclick to trusted pages" and "Apply Clearclick to untrusted pages". Is the checkbox detectable in some way?

Also, please know that good developers try to keep their code as economical as possible in terms of both code length and space consumed on the screen. One person opened a Microsoft Word blank document, enabled every possible toolbar, and there were only two lines of space on the entire screen in which one could type. This probably doesn't affect you, as you're scrolling line-by-line anyway, but the sighted reader likes to be able to scan the entire page for various purposes. Again, an unfortunate trade-off between ease of use for the sighted and ease of use for the non-sighted.

Regarding the Anti-XSS tab I was referring to the edit fields not the '?' link. The first one says 'Exceptions matching these regular expressions will not be protected against XSS.'. I like that little bit of information and think other controls could benefit from having those.

Ahh, now I understand. There is no tooltip. It's the explanation that you want, and probably many others would want. But this raises again the question: Does JAWS read every bit of text in the GUI, or did Giorgio do something special to that legend so that it is visible to JAWS, but sighted readers see no difference?

My telephone service was discontinued on 04 January

I'm sorry to hear that.

I guess it was not such a bad idea registering here to make others aware of how I interact with what most people might perceive as a simple dialogue.

Definitely not. But as far as answering actual individual questions that don't pertain to the sighted, it seems that each answer raises more. Don't misunderstand. I don't mind. I just thought that talking live on the telephone could answer so much more, and more quickly than each of us composing these posts. Also, there is real-time feedback. A question is asked and there is an immediate answer. If it isn't clear, then one can ask for clarification without waiting for the other to return to the forum. And so forth.

If you ever get access to a telephone, the offer still stands.

[Identities Infinite]

I never thought about using the Left and Right Arrow keys in the about:config list but now I will try that.

With dialogues like these I can only use Tab and Shift+Tab to navigate. This means I can not read using the Arrow keys as I would an web page, PDF or any type of document. This is why I do not catch any of the headings but JAWS does read elipsies. If the dialogue was reformatted for more of an HTML type feel with the same checkable and editable fields I would not have any problem reading everything you see. The position you described of the Export button is one thing I miss due to the Tab and Shift+Tab confinement. I could ask Freedom Scientific about emphasising bold or italicised text but they make use of the ETI-Eloquence synthesiser so it might be a Nuance Communications question for all I know. The prefs.js file is easily navigable for me. I use Jarte Plus but for things like this I do use NotePad and every so often I do revert to prefs.js if it is faster.

The expand and collapse function makes no difference to me from what I have examined. The placeholder from what I remember does not change [or does it?]. If it becomes shorter there would be reason to collapse it. I should test on more than just a few.

I totally understand Giorgio has much to do and is probably more occupied than I can comprehend. I think it would be mighty selfish of me if I expected him to prioritise my concerns above those that need expedient attention.

Your examples pertaining to the ClearClick check boxes are good; I think that would work well. The labels of each check box are read but nothing else. I guess this is because I am focused on these controls and not anything above or below like headings and descriptions that might be there. That is why I suggested a tooltip or additional explanations in place of anything to which I can not navigate but might be there. Giorgio added the explanations per suggestion from way back. They were not in existence before that. I do not know if the sighted notices them but if not my assumption is it would be visually non-compromising to add whatever is necessary. I understand there are trade-offs so I realistically can not expect everything to be tailored to or adapted specifically for me. That would be silly.

[Tom T.]

Eureka! Success! I opened the NoScript GUI, and on any given tab, I just keep hitting the Tab key. It goes from one element to another, until eventually, it gets to the bottom row. You will recognize this because the first button reads Donate. Then follow, in order, Import, Export, Reset, OK, Cancel. Just be careful not to hit Reset, as it will return NoScript to its out-of-the-box settings, losing all of your additions and configurations. This is also a good reason to export a backup regularly, in case you accidentally reset, or a crash loses some saved settings. Also, don't hit OK before ready, of course. And on the Embeddings page, the tab key makes apparent why you would like Forbid WebGL to be grouped with the other Forbids. And it skips from "Collapse blocked objects" to "Untrusted", so if it does not stop and read "ClearClick protection", I see the confusion. It seems simple to reformat that as "Clearclick protection on untrusted pages checkbox trusted pages checkbox." Would that work for you? I'm sure Giorgio will review our conversation at some time, so if that would be an improvement for you, say so, and perhaps he can do that. It would not adversely affect sighted users at all.

[Identities Infinite]

That would work. Visually, what changes when you tabulate around? For instance, how did you know it only says Trusted and Untrusted? You can install a free screen reader called NVDA which is good for being free and really hear how it all sounds.

I do export my entire configuration regularly. I have often wondered if it was possible to import and export a .ini file. They are better laid out because each line contains a setting versus the exported text file containing URLs separated by spaces which would make it difficult for me to find a specific URL without using the Find function. Any other improvement that would not adversely effect sighted users I will gladly test.

[Tom T.]

Visually, what changes when you tabulate around? For instance, how did you know it only says Trusted and Untrusted?

Clicking the tab key puts a thin little rectangle around the caption. For example, if I start at Embeddings, clicking Tab then outlines Forbid Java. Next, Forbid Adoe Flash. And so on, with the next element acquiring the thin rectangle. I would not have known that, having no need for it, so thank you for enlightening me. When it got down to Collapse blocked objects, the next click of tab outlined the untrusted box, but did not outline the caption above it, ClearClick protection on pages. So I assume JAWS does not read that caption to you? Now I see what you mean by binding the caption to the boxes. This seems like an easy change for Giorgio that would not affect sighted users at all.

I I have often wondered if it was possible to import and export a .ini file.

NoScript does not have a .ini file, as far as I know. It does not use .exe; rather, the main file is a .jar, executable JAR file. Much of the rest, ironically perhaps, is written in javascript, or Jscript if you will. I can't immediately think of a way to export a file with one untrusted entry on each line. Many users would have more than a hundred "Untrusted equals X" lines. That would have to be something special for Giorgio to do, and frankly, it may not be practical.

I briefly saw your mention at your other post of a GUI Blacklist to accompany the existing Whitelist. This has been requested many times, and would surely be a convenience for all, regardless of vision. The next-generation of NoScript, 3.x, which will have the site-specific permissions capabilities from the menus and GUI, will have major architectural changes, and this may well be one of them. At this time, Giorgio is not inclined to make such major changes to Version 2.x, when it will soon be obsolete, and he could be spending the time bringing us Version 3. Please be patient. V3 will grant the wishes of literally hundreds or thousands of posters here regardless of sight capability.

Hopefully, when Giorgio reviews this conversation, he may be able to bind the ClearClick label to the boxes with a very simple change or two.

[Identities Infinite]

I knew nothing about the rectangle [I am guessing that is the rectangular focus mentioned in JAWS's settings centre]. I also did not know those text bits to which I do not have access are captions. JAWS does not read those and I guess the reason why I am restricted to the aforementioned key combinations is due to Firefox's XUL programming language. Like I said before I would have no complaint if it was more like a web page but that accounts for all these types of dialogues. There was a time when Firefox 8 was stable when the add-ons manager was actually navigable using the Arrow keys. My guess is the WAI-ARIA role was removed. I absolutely loved it! I was able to access that pop-up menu that said All Tools or whatever it was and in Thunderbird as well [that was the only way I could easily install an add-on from a file]. If you revert to Firefox 8 and use a screen reader you will know the difference between that and every other version from 4 onwards. I do not know why they broke it again but I am becoming much too sidetracked with this.

Do you know when version 3 of NoScript will be released? I am already anticipating it and will surely offer all the feedback I possibly can. I would not be surprised if one day it becomes its own executable that complements anti-virus, anti-malware and even Microsoft's Enhanced Mitigation Experience Toolkit [yes I use it faithfully]. I am patient; I have heard good things come to those who wait.

[Tom T.]

I don't know about the history of accessibility, but I still prefer to use the 3.6 branch, which will be supported at least though April of this year, possibly longer. Would that be any more accessible, since it does not support many of these newer protocols that seemed to have impaired accessibility?

Do you know when version 3 of NoScript will be released?

I don't think Giorgio knows. Early last year, the goal was before the end of 2011. But so many things have come up, and Firefox's rapid-release cycle (which I despise) doesn't help. Plus all the other things on his plate that were previously mentioned.

I would not be surprised if one day it becomes its own executable

As far as I know, it will always require a suitable browser infrastructure. A version for Chrome was first mentioned in 2009, but Chrome lacked the necessary hooks and other structure. Only in the past month or so has it seemed that the Chrome API has become suitable. I don't see it as a stand-alone app.

... that complements anti-virus, anti-malware.... (etc.)

All are part of a total "defense-in-depth" strategy, of course.

I need to log off for a long time now. Cheers.

[Identities Infinite]

I was never in favour of the rapid release cycle. I do not think the updates warrant a whole-number version change and things are being rushed because the public is not patient. Internet Explorer is developed by Microsoft who has multiple people working in the accessibility department. That is in part why I never had issues using it. The other reason being they actually take time to develop the browser instead of patching it for a month and bumping the version number.

[Identities Infinite]

After re-reading the FAQ yet again I think there is something in the GUI to which I have no access. There must be some Site Info page accessible by using the mouse but there is no keyboard equivalent. Would this be feasible to make keyboard accessible?

[therube]

SeaMonkey has "Page Info", accessed by icon, or by menu; View | Page Info, or by shortcut; Ctrl+I

Good luck finding the associated means in Firefox, though I would expect it to be there.

[Identities Infinite]

The Site Info accessed by the middle-click in NoScript is the same exact thing as the panel with General, Permissions, Security etc. tabs? If that is so I can access that easily.

[therube]

(Oops. I was talking about something totally different.)

AFAIK, (NoScript's) Site Info is only accessible via mouse.