How to set all url's untrusted and forbidden as default?

[pacarz69]

Hi, how to instruct NoScript to treats all the sites not present in whitelist as 'untrsusted/forbidden?' I found this track: 'about:config' and then 'noscript.untrusted', but once there, I don't know what string/value/jolly characters/boolean operators to insert. My best regards, Paolo

Ps: a comprehensive manual that explains the options of keys such 'noscript.untrusted', should be very useful imho.

[therube]

> how to treat all sites not present in white list as 'untrusted/forbidden/denied

Do nothing .

NoScript works on a default deny principle, at lease for JavaScript, so by doing nothing, you've denied everything.
(There are a few defaulted allowed domains.)
Anything not Allowed is Forbidden.
Untrusted only signals to NoScript that the so marked Untrusted domains do not display on context menus & such.

[pacarz69]

[CUT]

<<NoScript works on a default deny principle, at lease for JavaScript, so by doing nothing, you've denied everything.
(There are a few defaulted allowed domains***.)>>
<<Anything not Allowed is Forbidden>>

[My replay] Not really if just a line up you confirm that 'few' domains are allowed or blank listed. Can I get the full control on wich domains are for me friendly and which one to forbid as untrusted? I imagine that by 'jolly characters', or boolean operators into 'about:config', maybe into 'noscript.untrusted' and 'noscript.untrustedGranularity', should change the behavior as I'm looking for. Unfortunaltelly I can't do nothingh alone, I need to get instructions from the programmer/s seen that a detailed manual that treats this topics still unavailable over Internet, or maybe I'm unable to localize it. Thanks in advance, Paolo

Ps: Make a software/product to preserve security and privacy of others people it's a great and generous idea. Instead, make a software that lets open/trusted certain domain and not others, make users to think about it, for instance, are the programmers a censorship? Or worst, is the programmers using this 'false sense of security' as a way to get sponsorships or donations to be included in white list? So, in my opinion, the programmers of a software/extension such NoScript, should offer the ability to set it as globally untrusted, withe list allowed and programmers default setting.

Ps2: Taking time to create a fully detailed manual, should decrease the time to answer in forum from programmers, and it will give to users a way to understand and manage all program/extension features quickly and efficiently letting time to programmers to improve, modify, update etc the extension

*** Who decides which domains are blank listed for all users around the world (more than 2 milions) and why url1 has to be friendly for all 'NoScript' users in the world and the url2 with the same privacy/security risk is banned? If I don't get a serious and intellectually honest answer, I'll have to believe in this AdBlock Plus article adblockplus DOT org/blog/attention-noscript-users

Best regards, Paolo

[Thrawn]

Ps2: Taking time to create a fully detailed manual, should decrease the time to answer in forum from programmers, and it will give to users a way to understand and manage all program/extension features quickly and efficiently letting time to programmers to improve, modify, update etc the extension

The documentation at http://noscript.net/features and http://noscript.net/faq is quite good. You can also find more information on hackademix.net (Giorgio's blog), and for specific issues you can search these forums. If, after all of that reading, you still can't find out what you want to know, just post your question and the forum support team is quite responsive.

As for allowing others to improve NoScript, however: the code is GPL, so you can do what you like with it, but official NoScript development is a one-man show. Whatever your personal feelings about that, if you seriously examine Giorgio's track record, you'll find that he does a phenomenal job of keeping on the bleeding edge of security.

*** Who decides which domains are blank listed for all users around the world (more than 2 milions) and why url1 has to be friendly for all 'NoScript' users in the world and the url2 with the same privacy/security risk is banned?

This is answered in the abovementioned FAQ. The sites are some of Giorgio's own - if you don't trust those, then you shouldn't have installed his software! - plus the Mozilla addons site, and some of the big webmail providers so that you can email Giorgio for support if you're lost.

As for who decides - Giorgio decides everything about NoScript .

It's true that there isn't a comprehensive manual, as such, for NoScript. On the other hand, NoScript is so frequently updated that maintaining such a manual would be as much work as maintaining NoScript itself. And hardly anyone - yourself included, it seems - has read the documentation that already exists...

If I don't get a serious and intellectually honest answer, I'll have to believe in this AdBlock Plus article adblockplus DOT org/blog/attention-noscript-users

<sigh>Giorgio already answered this on his blog (hackademix . net) long ago...

[pacarz69]

Thank You for answering Thrawn, before to start a useless polemic about the points treated in ours previous posts, I wish to go straightly to the point that has fundamental importance to me: 'Can I set NoScript to treat all WAN url's as untrusted/forbidden by default?' I mean, can I block all kinds of script, objects etc (exept static images and text, obviously) as default behavior for all WAN url's except for the url's present inside my white list?'

Best regards, Paolo

Ps: I also would like to answer the points that we started in previous post, but unfortunately I have to leave. Maybe I'll do it in the next days. Have a nice afternoon

[Thrawn]

'Can I set NoScript to treat all WAN url's as untrusted/forbidden by default?' I mean, can I block all kinds of script, objects etc (exept static images and text, obviously) as default behavior for all WAN url's except for the url's present inside my white list?'

therube already answered this. You don't have to do anything at all. What you're describing is NoScript's default behavior: block everything.

Unless you mean that you want to allow LAN resources, while blocking WAN resources? If so, you'll need ABE.

[pacarz69]

'Can I set NoScript to treat all WAN url's as untrusted/forbidden by default?' I mean, can I block all kinds of script, objects etc (exept static images and text, obviously) as default behavior for all WAN url's except for the url's present inside my white list?'

therube already answered this. You don't have to do anything at all. What you're describing is NoScript's default behavior: block everything.

I'm looking for a way to block all because I discovered that NoScript load 'google analytics' on some sites. As soon as possible, I'll try to list them here. Thanks for reading, Paolo

[therube]

Some defaulted items, found in: noscript.xpi\defaults\preferences\noscript.js

pref("noscript.mandatory", "chrome: blob: about: about:addons about:blocked about:crashes about:home about:config about:neterror about:certerror about:memory about:plugins about:privatebrowsing about:sessionrestore about:support resource:");

pref("noscript.default", "about:blank addons.mozilla.org persona.org mozilla.net flashgot.net google.com gstatic.com googleapis.com paypal.com paypalobjects.com securecode.com securesuite.net firstdata.com firstdata.lv informaction.com yahoo.com yimg.com yahooapis.com youtube.com ytimg.com maone.net noscript.net hotmail.com msn.com passport.com passport.net passportimages.com live.com wlxrs.com");


On a new install, other then something from defaults, nothing else should be there.