[RESOLVED] Is the "Allow ....." for the current site only?

[noscriptfan111]

I am very sorry if this has been asked, and answered many times but I have been researching this and have not been able to figure it out....

As an example, say I am at example.com, and in noscript I allow google.com.

Since noscript says "Allow google.com" and not "Allow google.com for this site" my understanding is this:

Google script is allowed on ALL sites I visit from then on
Google script is not just restricted to example.com
Since I have selected "Allow google.com", and not "Temporarily allow google.com" google will always be allowed, on all sites, even when I shutdown and restart my browser.

I have been under this impression for years, and so I have NEVER selected "Allow google.com", and have ALWAYS selected "Temporarily allow google.com" to prevent google script being allowed to run on all sites I visit when I restart the browser. This has meant years of doing "Temporarily allow google.com" over and over each day.

Could you please clarify?

Thank you.

[Tom T.]

I am very sorry if this has been asked, and answered many times but I have been researching this and have not been able to figure it out....

As an example, say I am at example.com, and in noscript I allow google.com.

Since noscript says "Allow google.com" and not "Allow google.com for this site" my understanding is this:

Google script is allowed on ALL sites I visit from then on

Correct. You have "whitelisted" it globally (to every site on the planet).

Google script is not just restricted to example.com

Correct.

Since I have selected "Allow google.com", and not "Temporarily allow google.com" google will always be allowed, on all sites, even when I shutdown and restart my browser.

Correct.

I have been under this impression for years, and so I have NEVER selected "Allow google.com", and have ALWAYS selected "Temporarily allow google.com" to prevent google script being allowed to run on all sites I visit when I restart the browser.

Correct.

This has meant years of doing "Temporarily allow google.com" over and over each day.

Correct, but not necessary. (to be continued).

Could you please clarify?

Most of the original questions were answered in the NoScript Quick Start Guide. If they were not made clear there, please give me your suggestions for improvement, and they will indeed be considered.

The way to allow google.com only at sites you select, and nowhere else, *permanently*, with a *one-time setting*, is in the Sticky Post,
Site-Specific-Permission Questions? PLEASE READ THIS FIRST!.

If that post, and the linked FAQ, are not clear, again, feedback is always welcome, and we'll help as needed.

- Tom

[noscriptfan111]

Hi Tom

Original poster here

Thank you very much for your clear and quick response. In terms of the quick start guide, as a professional engineer who teaches technology at the professor level, I would like to suggest the following rewrite, you are welcome to take it or leave it of course as you see fit:

Using NoScript

NoScript is ready to use as soon as you install it.
All JavaScripting, Flash, Silverlight, Java, and other potentially-harmful commands to your browser are blocked by default.
No configuration is required.

Allowing certain javascripts to run

Many websites need javascript to function properly. The scripts may be provided by the website itself, or by 3rd party websites. Hence you may need to allow javascript to run from the website you are currently visiting, or from other websites as well. NoScript will show you the websites that are providing javascript.

When you visit a site and it seems not to work properly, you have the following methods to use NoScript:

1) Open the NoScript menu by clicking on the logo in the top bar
2) Hover the mouse pointer over the logo
3) Right-click on the web page you are visiting

You can choose your preferred method of opening the menu by opening it and clicking Options, then General tab. Halfway down is a checkbox, "Open permissions menu when mouse hovers over NoScript's icon." Check it for "hover"; uncheck it for "click the icon".

Read from the menu the list of scripts and other commands ("executable content"). Note that the NoScript logo is red, or partly red, instead of all blue, indicating some blocked content. See the site address from where these items originate.

NoScript commands

Allow (domain name)

If you select this command, then all javascript from this domain name will be allowed to run on all sites you visit from then on. This is a permanent setting. It will always be allowed, on all sites, even when you shutdown and restart your browser.

Temporarily allow (domain name)

All javascript from this domain name will be allowed to run on all sites you visit from then on. This is a temporary setting. It will be allowed only in the current session of your browser. Once you restart your browser, this setting no longer be in effect.

If you trust that site (especially the site you are on), click "temporarily allow". (For more information on "What is a trusted site?", see this FAQ.) It may require several scripts to be allowed for the function you need to work.

Third party content

Be very wary of content coming from third parties. However, please note that many respectable sites use a company called Akamai to help store and provide some of their content (e. g., Github.com), so this is one third-party site that frequently must be allowed. (For further information about Akamai or about how to fine-tune its permissions if you wish to do so, please see this FAQ.) When you have determined what you need to allow, you may open the menu and click "Make page permissions permanent" if you wish; then you will never again notice NoScript at work while you are at that site. Soon, your most frequently-visited sites will become permanently configured for you. (You could also open the menu, click "Revoke temporary permissions", then re-allow the needed items, using the "Allow" command instead of "Temporarily allow". This too places those sources in your permanent whitelist.)

Updated 25 Jan 2012: A current Web trend is the use of "content delivery networks", typically showing in the NoScript Menu with the letters "cdn" in the script name. The number of sites using Akamai, as described above, has been declining since this Guide was first posted. So you may see, for example, facebook.com, followed by fbcdn.net (fbcdn = FaceBook Content Delivery Network). Allowing script from facebook.com may not be enough for all images to display properly on all pages. So you may have to allow fbcdn.net also.

Another way of delivering images and other content is by a separate source with "img" or "static" in the name. For example, let us say that you visit maps.google.com, with google.com allowed, either temporarily (TA, as we call it here), or permanently. (It's in the Default Whitelist anyway.) The main map may show, but the "Get directions" and "My Places" buttons won't work unless you TA or allow gstatic.com. "Static" may also come before or after the site name: static-somesite.com, somesite-static.com, or similar variations.

An example with "img" in the name: YouTube. Some basic services may work without any scripts allowed at all, but for all services to function, permission is required not only for youtube.com, but also for ytimg.com. Same with yahoo.com and yimg.com -- Yahoo Mail needs these to function fully. These two sites, along with their "helper" image sites, are also in the default whitelist when you install NoScript. So they're good examples of the kinds of name patterns you might see at other sites with "img" scripts: YouTube = ytimg, Yahoo = yimg.

Generally, if something isn't working -- especially if images aren't displaying -- look for a script that has some similarity in name or initials to the original site, plus "cdn", "img", or "static", as in the above examples. If you make the decision to trust the main site, then presumably its secondary content server would get the same trust, and is probably necessary for the site to work. NOTE: None of this affects the general advice to be wary of third-party sites that don't reasonably appear to be related to your trusted site.

Update 22 November 2011: This post identifies *some* (not all) companies who are principally in the business of advertising or gathering data such as page views. This may help you to decide what is "necessary" to allow in order to make the page work, and what is not necessary. Please note the disclaimer there that this is not necessarily a reflection on the companies listed, and that many free sites and products are supported by advertising.

By default, you receive an audible warning and/or a pop-up warning when scripts or other content are being blocked. If you would like to modify or disable either or both notifications, click the NoScript menu as above, click "Options", then click the "Notifications" tab. You can uncheck "Show message about blocked scripts" to disable the messages completely, or choose to move them to the bottom, and for how long to display them. You can also uncheck "Audio feedback when scripts are blocked", if you prefer. Even without audio or pop-up notification, you will always have the NoScript logo showing partly or completely red (instead of all blue) when some content is being blocked. Also, a site that worked properly without NoScript, but does not seem to work properly with NoScript enabled, is a likely sign that some content is blocked. The logo confirms this for you.

NoScript is customizable in many other ways. As you become familiar with it, you might like to read more about its many features and configurability, in the NoScript FAQ. But this is all you need to do to have NoScript start protecting you now!

I hope you find this guide useful as you begin to browse with much greater safety than ever before.

[noscriptfan111]

OP again, a few more changes:


Using NoScript

NoScript is ready to use as soon as you install it.
All JavaScripting, Flash, Silverlight, Java, and other potentially-harmful commands to your browser are blocked by default.
No configuration is required.

Allowing certain javascripts to run

Many websites need javascript to function properly. The scripts may be provided by the website itself, or by 3rd party websites. Hence you may need to allow javascript to run from the website you are currently visiting, or from other websites as well. NoScript will show you the websites that are providing javascript.

When you visit a site and it seems not to work properly, you have the following methods to use NoScript:

1) Open the NoScript menu by clicking on the logo in the top bar
2) Hover the mouse pointer over the logo
3) Right-click on the web page you are visiting

You can choose your preferred method of opening the menu by opening it and clicking Options, then General tab. Halfway down is a checkbox, "Open permissions menu when mouse hovers over NoScript's icon." Check it for "hover"; uncheck it for "click the icon".

Read from the menu the list of scripts and other commands ("executable content"). Note that the NoScript logo is red, or partly red, instead of all blue, indicating some blocked content. See the site address from where these items originate.

NoScript commands

Allow (domain name)

If you select this command, then all javascript from this domain name will be allowed to run on all sites you visit from then on. This is a permanent setting. It will always be allowed, on all sites, even when you shutdown and restart your browser.

Temporarily allow (domain name)

All javascript from this domain name will be allowed to run on all sites you visit from then on. This is a temporary setting. It will be allowed only in the current session of your browser. Once you restart your browser, this setting no longer be in effect.

If you trust that site (especially the site you are on), click "temporarily allow". (For more information on "What is a trusted site?", see this FAQ.) It may require several scripts to be allowed for the function you need to work.

Make page permissions permanent

When you have determined what you need to allow, you may open the menu and click "Make page permissions permanent" if you wish; then you will never again notice NoScript at work while you are at that site. Soon, your most frequently-visited sites will become permanently configured for you.

Revoke temporary permissions

You can also click "Revoke temporary permissions", then re-allow the needed items, using the "Allow" command instead of "Temporarily allow". This too places those sources in your permanent whitelist.

Third party content

Be very wary of content coming from third parties. However, please note that many respectable sites use a company called Akamai to help store and provide some of their content (e. g., Github.com), so this is one third-party site that frequently must be allowed. (For further information about Akamai or about how to fine-tune its permissions if you wish to do so, please see this FAQ.)

Updated 25 Jan 2012: A current Web trend is the use of "content delivery networks", typically showing in the NoScript Menu with the letters "cdn" in the script name. The number of sites using Akamai, as described above, has been declining since this Guide was first posted. So you may see, for example, facebook.com, followed by fbcdn.net (fbcdn = FaceBook Content Delivery Network). Allowing script from facebook.com may not be enough for all images to display properly on all pages. So you may have to allow fbcdn.net also.

Another way of delivering images and other content is by a separate source with "img" or "static" in the name. For example, let us say that you visit maps.google.com, with google.com allowed, either temporarily (TA, as we call it here), or permanently. (It's in the Default Whitelist anyway.) The main map may show, but the "Get directions" and "My Places" buttons won't work unless you TA or allow gstatic.com. "Static" may also come before or after the site name: static-somesite.com, somesite-static.com, or similar variations.

An example with "img" in the name: YouTube. Some basic services may work without any scripts allowed at all, but for all services to function, permission is required not only for youtube.com, but also for ytimg.com. Same with yahoo.com and yimg.com -- Yahoo Mail needs these to function fully. These two sites, along with their "helper" image sites, are also in the default whitelist when you install NoScript. So they're good examples of the kinds of name patterns you might see at other sites with "img" scripts: YouTube = ytimg, Yahoo = yimg.

Generally, if something isn't working -- especially if images aren't displaying -- look for a script that has some similarity in name or initials to the original site, plus "cdn", "img", or "static", as in the above examples. If you make the decision to trust the main site, then presumably its secondary content server would get the same trust, and is probably necessary for the site to work. NOTE: None of this affects the general advice to be wary of third-party sites that don't reasonably appear to be related to your trusted site.

Update 22 November 2011: This post identifies *some* (not all) companies who are principally in the business of advertising or gathering data such as page views. This may help you to decide what is "necessary" to allow in order to make the page work, and what is not necessary. Please note the disclaimer there that this is not necessarily a reflection on the companies listed, and that many free sites and products are supported by advertising.

By default, you receive an audible warning and/or a pop-up warning when scripts or other content are being blocked. If you would like to modify or disable either or both notifications, click the NoScript menu as above, click "Options", then click the "Notifications" tab. You can uncheck "Show message about blocked scripts" to disable the messages completely, or choose to move them to the bottom, and for how long to display them. You can also uncheck "Audio feedback when scripts are blocked", if you prefer. Even without audio or pop-up notification, you will always have the NoScript logo showing partly or completely red (instead of all blue) when some content is being blocked. Also, a site that worked properly without NoScript, but does not seem to work properly with NoScript enabled, is a likely sign that some content is blocked. The logo confirms this for you.

NoScript is customizable in many other ways. As you become familiar with it, you might like to read more about its many features and configurability, in the NoScript FAQ. But this is all you need to do to have NoScript start protecting you now!

I hope you find this guide useful as you begin to browse with much greater safety than ever before.

[Tom T.]

Thank you for your suggestions. I expected individual ones, but not a complete re-write. Will consider them carefully.

Much will change when NoScript 3.x for the desktop is eventually released, but it's good to have input from users at the novice level. (Do professors of technology really qualify there? )

[Tom T.]

Just wanted to add -- the "will consider them carefully" was *not* like "Let's do lunch sometime".

Such changes need input from the rest of the team, and also of course from Giorgio. Given that there are four volunteer moderators to handle the entire board, the priority for hours available to donate is usually giving immediate help on immediate issues, whereas we do have at least a working copy of the Guide.

So, it *definitely will* be considered. Just didn't want you to feel that your time and effort were wasted if nothing changes for, say, a week or two. The input is assuredly appreciated. - Tom

[Tom T.]

Update: I've reviewed both suggested rewrites, and solicited input from the rest of the team (without giving my own comments, to avoid contamination).

I look forward to team feedback as each can find the time. (This will take place in our private Admin/Mod-only forum.)

Thanks again for your interest and support of NoScript.

[Tom T.]

@ noscriptfan111:

Sorry that the "week or two" turned into six months , but if you note in the changelog the rate at which new builds of Firefox have broken things in NoScript, thus requiring code re-writes; the many additional protections added and fine-tuned; user-requested features added, etc. -- well, we at least had a working New User Guide, so it kept slipping down the list ...

Finally got there. Many of your suggestions were incorporated, or included with slight revision. Let us know what you think of the current version.
Many thanks for your interest and suggestions, of which the consensus is that it is indeed an improvement in readability and clarity.


Also, special thanks to newest team member, Thrawn, whose addition to the team eased the workload for the rest of us, and who took a great deal of interest in this project and spent much time on it.

Cheers to all.