NoScript and Youtube

Lowell · Post by **Lowell** » Fri Mar 30, 2012 2:28 am

I can't seem to get YouTube to work with either embedded videos or the actual site while NoScript is enabled. I don't have anything from YouTube blocked by NoScript and I've tried unchecking things one by one in the options already but no success. I even tried to load the pages with scripts enabled globally. The only way I found to bring back the videos was to completely disable NoScript in addons. I am running the latest version of Nightly as of 3-29. Any suggestions please?

DJ-Leith · Post by **DJ-Leith** » Fri Mar 30, 2012 11:54 pm

Firefox 3.6.28 Youtube is OK
Aurora 13.0a2 (2012-03-30) Youtube is NOT OK.

Both profiles are similar. NoScript 2.3.7rc1

In NoScript Options, Embeddings
Forbid <AUDIO> / <VIDEO> is 'ticked'.
"Apply these restrictions to whitelisted sites too" is also 'ticked'.

No Google domains (including gstatic) allowed.
youtube and ytimg also NOT on whitelist.

Test
Use the "-no-remote" shortcut switch to have both browsers running simultaneously.
See Firefox links: help yourself

On each browser:
1. Use a search engine (e.g. google) to do the SAME search for the video.

2. Right click the same 'search result' and "Open Link in New Tab"

3. Now TA youtube .com and ytimg .com

Result
On Firefox 3.6.28 - all is OK
On Aurora 13.0a2 (2012-03-30) - the Video will not play.

Repeat, but this time start RequestPolicy log, "Show Request Log", just before 2.

RequestPolicy log (on both) are similar
BUT the Aurora 13.0a2 shows

Destination

Code: Select all

http://s.ytimg.com/yt/jsbin/html5player-vflAeGaHZ.js

This "... html5player ..." might be a clue.

Another observation:

On Firefox 3.6.28 the 'click the flash placeholder' has

Temporarily allow http://s.ytimg. com/yt/swfbin/ ... ... ... ... loudness=-19.1000003815
(application/x-shockwave-flash <EMBED> / http://www. youtube .com)

Look at the last line. This has MUCH more 'text' than the Aurora.

On Aurora 13.0a2 the 'click the flash placeholder' has

Temporarily allow http: //o-o.preferred.lhr14s07.v9. lscach ... ... ... ... 69d0dc63a
(video/ogg <VIDEO> / http://www. youtube .com)

Look at the last line. Also much less text.

RequestPolicy on Aurora also wants to connect to gstatic and googlesyndication.
Using TA in RequestPolicy still does NOT allow one to see the Video.

Before posting, I then used CCleaner to clear browser cache etc before repeating all of the above.

DJ-Leith

Edited to break links in quotes

Post by **Tom T.** » Sat Mar 31, 2012 5:18 am

Thanks to DJ-Leith for investigation and information.

in Fx 3.6.28, YouTube could be run with no cookies and no scripting at all, and requests allowed only from youtube.com to ytimg.com, because (IIRC) it did a graceful fallback to HTML4 and "standard" Flash. Click the Flash placeholder, and it plays.

In Fx 11.0, one must allow or TA youtube.com and ytimg.com, but clicking the placeholder still isn't enough. I had to TA from Blocked Objects Menu also:

Code: Select all

video-ogg@http:o-o.preferred.mia05s03.v7.lscache.3.c.youtube.com

Still, no Google scripting or requests allowed, not even to gstatic, and no cookies. Perhaps the above will make F13 and 14 work?

[continued rant] And people still wonder why I'm sorry to see Fx 3.6.x leave soon. "Slower, but works", is better than "Faster, but doesn't work, at least not without a lot of scripting and additional objects loaded"-- which eats up any "speed gains" in the New! Improved! Fx. IMHO. YMMV. [/rant]

ETA: I always check *everything* on NS Embeddings tab, including "Apply to whitelisted sites". This was true of the above.

Post by **Tom T.** » Sat Mar 31, 2012 9:59 am

UPDATE: Just got latest Flash update. 11.2.202.228 (XP x86).

Test video: http://www.youtube.com/watch?v=e7-QBw862zk (I like the violins and piano)

NS Embeddings *all* checked.

Fx 2.0.0.20 (doesn't meet System Requirements): No scripting, no cookies. (Doesn't have RequestPolicy.) Click placeholder > OK > Plays. System Requirements lie.

Fx 3.6.28 (doesn't meet SysReq for Flash 11; manual d/l still offers Flash 10):
No cookies, Seems to need script *only* from youtube.com; didn't need ytimg. (Probably need script from ytimg for advanced features.)
RP: Allow requests from youtube to ytimg *only*. (No Google.) Click placeholder > OK > Plays.

Fx 11.0 > Reproduced above requirements for secondary blocked object, video-ogg etc.

Possible conclusion: F11 supports ogg, so must allow that object. No way to disable it and go back to the old way.

Anyone who knows a way to allow Flash with a single OK on Placeholder, while still keeping all plug-ins default-blocked, and applied to whitelisted sites, please enlighten us.

I haven't tested Aurora or Nightly (and don't care to), but from what DJ-Leith said, they sound like a regression.

Post by **therube** » Sat Mar 31, 2012 2:37 pm

> On Firefox 3.6.28 the 'click the flash placeholder' has

> On Aurora 13.0a2 the 'click the flash placeholder' has

3.6 cannot play html5 video.
13.0 can.

So Youtube serves the latter for 13 & the former for 3.

Your links are broken so we don't know what specific clips you were looking at.
Though Tom's links work in SeaMonkey 10 aka FF 13.

As it does here, Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20120326 Firefox/14.0a1.

DJ-Leith · Post by **DJ-Leith** » Sat Mar 31, 2012 8:51 pm

I am finding it difficult to reproduce the issues (on my 5 year old Vista Laptop with just 1GB RAM). I have several profiles.

I suspect that what is going on, in general terms, is Youtube try and 'detect your capabilities' and serve the video. I also suspect that this 'method of detection' may be changing.

[color=#00BF00]therube[/color] wrote:3.6 cannot play html5 video.
13.0 can.

So Youtube serves the latter for 13 & the former for 3.

I agree. I also expect 11 will work now (I can't prove this - I don't have it) and I guess that there is NO regression between 13 and 11.

Today, I have had Youtube consistently serve my Aurora a Flash video: NOT a html5 video. These all work OK.

It has been hard to get it to be served a "... (video/ogg <VIDEO> ...)".
However, if I do - I also have to TA ytimg and use the Blocked Objects Menu
to unblock "video-ogg@http:o-o.preferred ..." as Tom T. documented (above).

I'll now add 3 more posts.

DJ-Leith

DJ-Leith · Post by **DJ-Leith** » Sat Mar 31, 2012 9:05 pm

Background to tests

In my tests on Fri Mar 30, 2012 and today my Flash Player is 11.2.202.228 (x86).

In both 3.6.28 and Aurora 13.0a2 (2012-03-30)
My RequestPolicy "Origins-to-Destinations" are similar to the 'RP Default whitelist'.

Has
Origin >> Destination
youtube .com >> google .com
youtube .com >> googlevideo .com
youtube .com >> ytimg .com

Origin >> Destination
google .com >> blogger .com
google .com >> ggpht .com
google .com >> googlehosted .com
google .com >> gstatic .com
google .com >> gvt0 .com
google .com >> youtube .com

The main difference is that I have BetterPrivacy (to remove all LSOs [except settings.sol]) whenever I close Firefox. BetterPrivacy is not availabe for Aurora. However, if I start and then exit ANY Firefox with BetterPrivacy I can remove the LSOs.

So between EACH test run I have started with no cookies or LSOs.
I have had only one browser running at any one time.
I close the browser after each run.
If the browser is Aurora I then 'open and close' a Firefox (to remove the LSOs).
It is 'normal' to have 2 LSOs deleted if I have played a Youtube video.

EACH time I land on Youtube there is an attempt to detect

Welcome to YouTube!

Suggested Language (we have set your preference to this): English (UK)

Suggested Location Filter (we have set your preference to this): United Kingdom

The location filter shows you popular videos from the selected country or region on lists ...

So to reproduce Tom T.'s test

Tom T. wrote:UPDATE: Just got latest Flash update. 11.2.202.228 (XP x86).

Test video: http://www.youtube.com/watch?v=e7-QBw862zk (I like the violins and piano)

NS Embeddings *all* checked.

Fx 2.0.0.20 (doesn't meet System Requirements): No scripting, no cookies. (Doesn't have RequestPolicy.) Click placeholder > OK > Plays. System Requirements lie.

Fx 3.6.28 (doesn't meet SysReq for Flash 11; manual d/l still offers Flash 10):
No cookies, Seems to need script *only* from youtube.com; didn't need ytimg. (Probably need script from ytimg for advanced features.)
RP: Allow requests from youtube to ytimg *only*. (No Google.) Click placeholder > OK > Plays.

Fx 11.0 > Reproduced above requirements for secondary blocked object, video-ogg etc.

Possible conclusion: F11 supports ogg, so must allow that object. No way to disable it and go back to the old way.

Anyone who knows a way to allow Flash with a single OK on Placeholder, while still keeping all plug-ins default-blocked, and applied to whitelisted sites, please enlighten us.

I haven't tested Aurora or Nightly (and don't care to), but from what DJ-Leith said, they sound like a regression.

I followed all of the above. I used the same Yotube link as Tom T.

"You're My World" Cilla Black
http://www.youtube.com/watch?v=e7-QBw862zk

I only TAed youtube.

Today ALL my 3.6.28 tests worked: played using the flash fall back.
Today ALL my Aurora tests, were presented with the flash fall back.
So they all worked OK BUT I wanted to verify Tom T.s work around:
to TA ytimg and use the Blocked Objects Menu to unblock "video-ogg@http:o-o.preferred ..."

So I tried to see if I could get Aurora to 'get stuck'.
I tried another video.

Flash Mob, Hallelujah Chorus, by a Canadian Choir (well executed, filmed and good sound recording)
http://www.youtube.com/watch?v=SXh7JR9oKVE

Again, in each attempt I was presented with the flash fall back (when using Aurora).

I tried another one

Me worship for the "me" church
http://www.youtube.com/watch?v=t9dvVp0Nxjo

This time if I did the following I was able to 'get stuck in Aurora' AND use Tom T.'s work around.

Getting 'stuck' is not consistent.
I found that if I pasted the URL and then immediately TAed both youtube and ytimg
then I could 'get stuck'. See the next post.

DJ-Leith

DJ-Leith · Post by **DJ-Leith** » Sat Mar 31, 2012 11:17 pm

Some example tests

The anti spam has blocked several attempts. So I'm splitting this up into smaller chunks.

A-D all use
"You're My World" Cilla Black (URL is above)

A.
3.6.28
NS Embeddings Forbid <FRAME> NOT checked.

TA youtube
Placeholder, fills over the whole 'black video window': flash logo in centre.
Click then produces this: (I'm adding spaces as even putting it in code - triggers the anti spam)

Code: Select all

Temporarily allow http: //s. ytimg. com/yt/swfbin/watch_as3-vflqrJwOA. swf#!flashvars#

Then about another 2,000 characters. The last part is (adding more spaces):

Code: Select all

(application/x-shockwave-flash <EMBED> / http: //www. youtube. com)

This is the 'start and end' of a 'click the flash placeholder' that I referred to above (Fri Mar 30, 2012 11:54 pm).
It is the end that is easiest to check: flash in this case.
I captured this by clicking on the placeholder, and then before I pressed "OK" I right clicked and
did "select all" and copied.

therube wrote:Your links are broken so ...

I wasn't meaning folk to click them (the phpBB software produced the links). I was trying to show that they were "flash" or, in Aurora, "video/ogg <VIDEO>".

continued ...

DJ-Leith · Post by **DJ-Leith** » Sat Mar 31, 2012 11:30 pm

B.
3.6.28
NS Embeddings *all* checked.

TA youtube
Placeholder, just a small frame in top centre of the 'black video window' (with flash logo).
Click then produces this (again spaces added):

Code: Select all

Temporarily allow http: //s.ytimg. com/yt/swfbin/watch_as3-vflqrJwOA.swf #!flashvars#

another 2,000 characters - ends

Code: Select all

(application/x-shockwave-flash <EMBED> / http: //www. youtube. com)

C.
Aurora 13.0a2 (2012-03-30)

NS Embeddings Forbid <FRAME> NOT checked.

TA youtube
Placeholder, fills over the whole 'black video window': flash logo in centre.
Click then produces this (again spaces added):

Code: Select all

Temporarily allow http: //s.ytimg. com/yt/swfbin/watch_as3-vflqrJwOA.swf #!flashvars#

another 2,000 characters - ends

Code: Select all

(application/x-shockwave-flash <EMBED> / http: //www. youtube. com)

D.
Aurora 13.0a2 (2012-03-30)

NS Embeddings *all* checked.

TA youtube
Placeholder, just a small frame in top centre of the 'black video window' (with flash logo).
Click then produces this (again spaces added):

Code: Select all

Temporarily allow http: //s.ytimg.com/yt/swfbin/watch_as3-vflqrJwOA.swf #!flashvars#

another 2,000 characters - ends

Code: Select all

(application/x-shockwave-flash <EMBED> / http: //www. youtube. com)

A-D are ALL 'flash fallback'. All play OK.

continued...

DJ-Leith · Post by **DJ-Leith** » Sat Mar 31, 2012 11:48 pm

So, both Cilla Black and the Flash Mob (see URLs above) work OK with both 3.6.28 and Aurora.
So far, I've only 'been offered' flash. Try another video:

Me worship for the "me" church
http://www.youtube.com/watch?v=t9dvVp0Nxjo

E.
Aurora 13.0a2 (2012-03-30)

NS Embeddings Forbid <FRAME> NOT checked.

TA youtube and ytimg (in one mouse movement)

Placeholder, fills over the whole 'black video window'. NO 'flash logo' but a logo that looks
like a portrait piece of paper. This is different. This is going to 'show the issue' as reported above.

continued...

DJ-Leith · Post by **DJ-Leith** » Sat Mar 31, 2012 11:58 pm

Click then produces this (again spaces added):

Code: Select all

Temporarily allow http://o-o.preferred. lhr07s13.v9.lscache6.c. youtube. com

only about 400 characters, ends

Code: Select all

(video/ogg <VIDEO> / http://www. youtube. com)

This time "(video/ogg <VIDEO>" and will NOT play until
Blocked Objects Menu to unblock

Code: Select all

video-ogg@http:o-o.preferred ...

as Tom T. documented (above).

Once I have got E (the non flash in Aurora) I can open a new tab and still produce C (the fall back flash)
providing I use the Cilla Black or the Flash Mob URLs.

Comments
This situation is inconsistent.

I suspect that some of the observations are due to changes 'behind the scenes' at Youtube.
I have very old hardware and it is possible that the 'detection method', at Youtube,
may include 'timing tests' of the 'response from my browser' as I arrive.

DJ-Leith

DJ-Leith · Post by **DJ-Leith** » Sun Apr 01, 2012 12:03 am

It seems to me that this intermittent issue is similar to

Re: [issues?] Suddenly all google search result contain pref
http://forums.informaction.com/viewtopi ... 466#p35466

By 10:30 pm on Wed Feb 22, 2012 with NoScript 2.3.2rc1
I also could confirm that Giorgio had worked around the changes made
by Google. I was about to post this when 'Google moved the goal posts - again'!

I saw some unexpected items in the RequestPolicy log.
I even had a profile, with an older version of NoScript that 'worked without the issue'
(that was fixed in 2.3.2rc1).
I did not want to report, back in February, what I could not reproduce.
I started to copy RequestPolicy log items, make some test profiles etc.
A few days later I could not reproduce so I did not report.

DJ-Leith

Post by **Tom T.** » Mon Apr 02, 2012 7:17 am

DJ-Leith wrote: In both 3.6.28 and Aurora 13.0a2 (2012-03-30)
My RequestPolicy "Origins-to-Destinations" are similar to the 'RP Default whitelist'.

Has
Origin >> Destination
youtube .com >> google .com
youtube .com >> googlevideo .com
youtube .com >> ytimg .com

Origin >> Destination
google .com >> blogger .com
google .com >> ggpht .com
google .com >> googlehosted .com
google .com >> gstatic .com
google .com >> gvt0 .com
google .com >> youtube .com

That's the main difference between us. As said above, I allow requests from youtube ONLY to ytimg.com, NOT to any google domain, and certainly not googlevideo. See if that changes your results.

I don't use Google except when users here make me

, but I never allow requests from google to anything but gstatic. You don't need any permissions for requests FROM google TO anywhere to play YT vids. Delete them, and TA the others if you're using them at a blog or whatever.

I don't leave the default RP whitelist, just as I don't leave the default NS whitelist. Both are intended to make the tools friendly for novices OOB, not breaking the most popular sites or requiring user action. You've enough savvy to fine-tune permissions on anything, including Fx itself.

The main difference is that I have BetterPrivacy (to remove all LSOs [except settings.sol]) whenever I close Firefox. BetterPrivacy is not availabe for Aurora. However, if I start and then exit ANY Firefox with BetterPrivacy I can remove the LSOs.

I wrote a primitive, 500-byte replacement for BetterPrivacy that should work on *any* Windows, if you adjust the file paths as needed. Unsupported, no guarantees.
It was written almost three years ago in response to an unfortunate incident with BetterPrivacy.

I browse in a sandbox, in which all LSOs and other Flash settings are written to the cloned folders in the sandbox, and dumped on closure, which is frequent.

EACH time I land on Youtube there is an attempt to detect

Welcome to YouTube!

Suggested Language (we have set your preference to this): English (UK)

Suggested Location Filter (we have set your preference to this): United Kingdom

The location filter shows you popular videos from the selected country or region on lists ...

Probably because you're allowing all those requests to Google, and possibly unnecessary YouTube scripting, but surely, the requests FROM google TO youtube. Minimize all permissions. I don't get such things; just a video and a placeholder.

So I tried to see if I could get Aurora to 'get stuck'.... <snip>Getting 'stuck' is not consistent.

So use what works, instead of trying to get stuck. I can play YT vids on newer Fx with two clicks: the placeholder and the ogg. If some play with only one, cool.

Post by **Giorgio Maone** » Mon Apr 02, 2012 7:44 am

DJ-Leith wrote: This situation is inconsistent.
I suspect that some of the observations are due to changes 'behind the scenes' at Youtube.

In facts, the differences you're observing are due to Youtube slowly replacing its Flash-based content with HTML 5 video one.

Post by **Tom T.** » Mon Apr 02, 2012 8:00 am

Giorgio Maone wrote:
DJ-Leith wrote: This situation is inconsistent.
I suspect that some of the observations are due to changes 'behind the scenes' at Youtube.
In facts, the differences you're observing are due to Youtube slowly replacing its Flash-based content with HTML 5 video one.

JOOC, How would you compare the relative safety (risks) of the new approach to the old?

InformAction Forums

NoScript and Youtube

NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube

Re: NoScript and Youtube