[CAN'T CONFIRM] NoScript conflict with flash plugin

[Guest]

Hi,

I've noticed what I think is a conflict between NoScript and controls (play/pause, volume controls, forward/back, etc) in flash plugins.
I am running:
firefox 10.0.1
NoScript 2.3.4
flash-plugin 11.1.102.63
...all on Fedora 15 (not that I suspect that makes a difference).

I noticed this with the recent update to the flash plugin. It seems to be related to ClearClick protection.

Steps to reproduce the problem (it is easy to reproduce):
1) Make sure that ClearClick protection is enabled for both trusted and untrusted pages
2) Find a flash video. For example, here is a recent talk from a conference:
http://vimeo.com/36579366
3) Allow javascript for this site (and the related cdn site)
4) Click the "Play" button.

Expected behavior: normal video/audio
Observed behavior: the flash video blanks out (no controls, video or audio present).

Same thing happens on other flash movies, there is nothing special about the one shown above.
I've found that if I disable ClearClick protection on trusted pages, it works properly. I don't know how big a risk I would be taking to run in that configuration all the time.

I have not found any other reports of this problem, but I have also reproduced it on two different computers (albeit with the same software configuration on both).

thanks for any help,
Rich

[Tom T.]

Steps to reproduce the problem (it is easy to reproduce):
1) Make sure that ClearClick protection is enabled for both trusted and untrusted pages
2) Find a flash video. For example, here is a recent talk from a conference:
http://vimeo.com/36579366
3) Allow javascript for this site (and the related cdn site)
4) Click the "Play" button.

Expected behavior: normal video/audio
Observed behavior: the flash video blanks out (no controls, video or audio present).

Same thing happens on other flash movies, there is nothing special about the one shown above.

I have a different result. (NS 2.3.5rc1)

Reproduced your steps and symptom at that video, on Fx 3.6.27. Toggling ClearClick on trusted pages does indeed toggle the symptom.
Which is strange, because no ClearClick warning pops up. Nothing in Error Console except "player is not defined".
Tried on Fx 10.0.2, but the page is taking forever to load. (57-minute video).

But I went to YouTube and played some flash videos with CC protection enabled on all, and they played fine, on both F3 and F10.

I noticed this with the recent update to the flash plugin.

Note: I have an earlier version of Flash, because of being on Win XP (x86).

Can someone please try to reproduce this on an x64 platform, preferably both *nix and Win/Mac?

I've found that if I disable ClearClick protection on trusted pages, it works properly. I don't know how big a risk I would be taking to run in that configuration all the time.

Well, it's there for a good reason... ClearClick FAQ

There's some risk, unless you want to vet the page source code with a packet-sniffer or something every time. (since a compromise could occur at any time.)

I suspect a site-design issue, as those have come up before. GµårÐïåñ, who does professional web site design as well as other programming, perhaps could look at that if he gets to it before Giorgio does. But one hates to rely on that until confirmed.

I have not found any other reports of this problem, but I have also reproduced it on two different computers (albeit with the same software configuration on both).

Which may indicate a problem in Fedora, since no one else has reported. Have you checked with their support for any possible issues?
... which is why reproducing on Win or Mac would help to confirm or isolate.

[therube]

Note: I have an earlier version of Flash, because of being on Win XP (x86).

AFAIK, & not that I should know, that does not hold water.
Update to 11.1.102.63.
Any old version is just too vulnerable.

http://get.adobe.com/flashplayer/otherversions/

XP 32-bit does show version 11 available.

Better to download direct (IMO) rather then using their "stub" installer, http://www.dslreports.com/forum/r26971063-.

[therube]

Firefox/10.0.1 has libpng integer overflow vulnerability.

10.0.2 has been out. 11.0 is out now.

[therube]

No issues on vimeo for me, though it was quit slow to load (the clip) initially.

As a test, do your issues persist in a new Profile with only NoScript installed?

Now there are other unresolved ClearClick issues, up to & included the latest #dev version, [ClearClick] Amazon Music Feels <is> Heavy!

[GµårÐïåñ]

1. If you are using Fx 10.x then update to 11 to resolve a small bug that was causing issue with Flash that has been resolved.

2. If you are not using at least Flash version 11.1.102.63, then you need to update NOW and what version of windows you are on is irrelevant but you being on Linux, you might have issues finding a solid latest build, but look for it, some issues have been resolved.

3. If you are not using at least NoScript version 2.3.4 where I discovered and Giorgio fixed an issue with the Flash/ClearClick combo that causes a loop, then make that update now, preferably to latest development build.

If you do all these and still have an issue, I'd be happy to take a more in depth look.

[Tom T.]

Note: I have an earlier version of Flash, because of being on Win XP (x86).

Better to download direct (IMO) rather then using their "stub" installer, http://www.dslreports.com/forum/r26971063-.

THANK YOU! -- for the link @ your post at dslreports.
It actually *worked*, and both Windows Add/Remove and Firefox about:plugins confirm it's installed.
(so did looking in %windir%\system32\macromed)

As said before, every time I went to Adobe through "normal" channels with F3.6.x, they offered *only* Flash 10.
And if I went with F4+, they offered only Flash 11.

And using their get.adobe thingy, the install would start, then stop, and the installer would disappear from the machine.
I saw numerous other replies to your post there, expressing dismay with Flash plug-in update system.

After so many times of doing that, one gives up and assumes that they don't want you to have Flash 11, whether it's because of XP or because of Fx 3.x.

Want to hear something even wilder? After the successful install of Flash 11 from your link, I dragged out the Fx 2.0.0.20 (end-of-life Dec. 2008) that I keep for just such reasons, and *it played YouTube vids just fine* with Flash 11. (despite dire warnings from YT about unsupported browser, "lite" version of site, etc.)

So .... does Adobe have any credibility left *at all*?

Now I can try again to reproduce OP's issue, with both F3 and (now) Firefox 11.0.

Thanks again, therube.

[Tom T.]

1. If you are using Fx 10.x then update to 11 to resolve a small bug that was causing issue with Flash that has been resolved.

Was notified a bit earlier, but didn't have time to install. Done, thanks.

2. If you are not using at least Flash version 11.1.102.63, then you need to update NOW

Thanks to therube, done.

And now there is no issue with the vimeo link, on either Fx 3.6.27 or Fx 11.0.

Sounds like your instruction #1 was the key, to get the Fx 11 "small Flash bug fix".
I saw that OP had 10.1 vs. 10.2, but didn't realize 11 was Flash-related, and didn't have at the time.

@ Guest: Please try Firefox 11.0. If that doesn't fix it, then perhaps it's a Fedora issue.

Removing the Confirmed tag.

[Guest]

Okay, I'll try on firefox 11... I am hoping that it's in the Fedora repositories soon (I usually take updates from the repos rather than a direct firefox update) but if it doesn't show up in the next day or so I'll download a tarball and re-test with it.

Thanks everyone for your quick responses!
-Rich

[Guest]

I've finally gotten a chance to update to Firefox 11, and the behavior is unchanged. Still have to disable ClearClick on trusted site for any flash controls to work. Interestingly enough, I see the same problem with "TED" videos but NOT on YouTube videos. I do not see the problem on Windows, so it sounds like this is either a Fedora problem or a flash-on-Fedora problem.

Is there any way to get more detailed information about what NoScript is unhappy about? Not sure what I would do about it, I'm just hoping that it gives me a clue-by-four...

thanks,
Rich

[therube]

Is this a "TED" video, TED Video, huh?
(WFM, Windows.)

[Tom T.]

I've finally gotten a chance to update to Firefox 11, and the behavior is unchanged. Still have to disable ClearClick on trusted site for any flash controls to work. Interestingly enough, I see the same problem with "TED" videos but NOT on YouTube videos. I do not see the problem on Windows, so it sounds like this is either a Fedora problem or a flash-on-Fedora problem.

Is there any way to get more detailed information about what NoScript is unhappy about? Not sure what I would do about it, I'm just hoping that it gives me a clue-by-four...

When you can reproduce the error, open Firefox Error Console (Ctrl+Shift+J or Tools > Web Developer > Error Console), click "Errors", and note any red Error messages. Also please click "Messages", and note those relating to NoScript. (including [XSS], [ABE])

@ therube:

Yes, Rich said that it worked fine on Windows, as it does for me as well.

...sounds like this is either a Fedora problem or a flash-on-Fedora problem.

[GµårÐïåñ]

I've finally gotten a chance to update to Firefox 11, and the behavior is unchanged. Still have to disable ClearClick on trusted site for any flash controls to work. Interestingly enough, I see the same problem with "TED" videos but NOT on YouTube videos. I do not see the problem on Windows, so it sounds like this is either a Fedora problem or a flash-on-Fedora problem.

Is there any way to get more detailed information about what NoScript is unhappy about? Not sure what I would do about it, I'm just hoping that it gives me a clue-by-four...

thanks,
Rich

Rich, I am not having any issues and yes @therube, that's a TED video. Cannot replicate your issue but I am familiar with things that I have seen in the past causing it. Here are a list of them, try and see which one fixes your problem.

1. Test this in a clean profile with ONLY NoScript and see if you are having an issue, my bet, you won't.
2. This brings us to the other things that interfere causing this issue, Adblock Plus's show tabs on flash will cause this issue with some embedded videos, running the quite useless FlashBlock simultaneously will often cause this issue due to their blocked image overlay, if you are running within an IFRAME and have certain configurations by addons that interact with that, it will cause this issue. So simply put, if it works in clean profile with NS only, then do standard diagnostics by enabling your addons one by one until you see which one makes it happen.
3. EDIT, forgot to add, if you are using any special themes, disable them and try with the standard theme.

All else fails come back to me and I will see what else I can find to resolve it for you.

[Tom T.]

@ GµårÐïåñ: With all due respect, Brother, is there a reason why those things would affect Rich's Fedora install, but not his Windows install ?

[GµårÐïåñ]

Actually they are likely to affect them at randomly the same statistical probability on both systems. However, given that the Flash build for Linux is slightly less native than the one on Windows and often tends to lag behind a bit, artifacts tend to extend further than in Windows. For all of its faults, Windows allows the best compatibility when it comes to stuff like this, even compared to say Mac, for the simple fact that all things are generally designed to windows specs before any other platform.