Completely disable temporarily or on certain sites

[Jan Schejbal]

It seems that some features of noscript cannot be disabled. These features sometimes break sites, and can cause nasty hard-to-debug issues during web development. I would like a way to turn off noscript temporarily without restarting the browser. Additionally, I think there should be an easy way to disable even the more advanced blocking features. For example, the following web demo: http://eligrey.com/demos/FileSaver.js/ gets blocked due to incorrect mime types. I am happy that NoScript has this useful protection, but sometimes, it is a problem.

I receive no indication until I decide to check the error console. If I figure a web site might be broken due to NoScript, there is no "Turn the damn thing off" button for quick troubleshooting. Also, there seems to be no way to turn this specific check off, it is even difficult to know it exists at all. All this applies to multiple such hidden features.

For this reason, I would like to request:
[*] Some kind of indication (e.g. bright red background for the NoScript icon in the status bar) if NoScript blocks something that a regular browser would allow.
[*] A quick way to turn NoScript off - all of it, even and especially the hidden features! - without restarting the browser. If it is possible to make it site-specific, even better.

[Thrawn]

That's an interesting idea, and it's up to Giorgio to decide. However, I would suggest that in cases where NoScript silently blocks something, then the site involved is quite poorly designed, and it's actually good that you have to take some trouble to work around it, because:

• The site owner(s) should be notified, so that s/he/they can fix it;
• Giorgio should be notified, in case he wants to refine the NoScript feature;
• You should be made aware of the consequences and possible risks of disabling the feature.

But I like the idea of having something - whether on the icon, new menu item, whatever - to indicate "NoScript is blocking something non-standard, and you should go to the Error Console and then report it to the support forums." That would help a lot of people.

[Jan Schejbal]

The problem often is that I do not know if NoScript is causing the issue. Only thing I know it doesn't work in my default profile with many extensions, but it does work in a clean profile quickly opened with --no-remote. Something that absolutely, completely shuts down NoScript would be a very valuable tool for debugging such issues. Actually, in my extension-riddled profile, NoScript is the only extension that occasionaly interferes with web sites that doesn't have such an "emergency shutoff". Restarting the browser isn't an attractive option with 50+ tabs open.

Also, I agree about the poor design part, and I can accept having to work around it, but there should be a way to work around it without uninstalling NoScript. If I have the choice between uninstalling NoScript and being unable to use a poorly designed site that I really want/need to use, the end result (no NoScript) will be less secure than selective exceptions. I have already contemplated to remove it due to the hard-to-debug errors it often causes.

Especially during web development, it is easy to trigger some NoScript security measure that will not be triggered in production (e.g. ABE because the web site is served from localhost). A reminder to check the error console would be VERY useful, and also good as an indicator for attempted attacks.

Kind regards,
Jan

[Thrawn]

Just thinking aloud here...what about having a star appear on the NoScript icon when something hidden is being blocked (ABE, wrong mime type, etc)? And maybe a submenu to show the specific blocks (not necessarily allowing you to unblock them, though; that would take a fair bit of work on Giorgio's part).

[Hecuba's daughter]

nvm

[Jan Schejbal]

Just thinking aloud here...what about having a star appear on the NoScript icon when something hidden is being blocked (ABE, wrong mime type, etc)? And maybe a submenu to show the specific blocks.

Yes, that would be very useful. For the rarer warnings, please make sure it stands out, so it is noticed even in the status bar even if you don't intentionally look for it.

However, a "global disable" should still exist, and shouldn't be that much work - just put the equivalent of "if (globalDisable) allow" in front of each security module.

[qwerty017]

Please add this to Noscript. I thought this was how it worked in the first place but found out I was wrong. http://forums.informaction.com/viewtopi ... 10&t=11078