Replacing Request Policy?

[Mircea Ionescu]

I have discovered that I have way too many extensions. And I would like to reduce their numbers. I'm not sure, but Request Policy seems to reproduce the functionality of NoScript ABE. I have read the documentation for ABE and doesn't look too complicated. But how can I see the cross site requests? In Request Policy I just have a list and that's all.

Also, how can I add temporary rules to ABE? Ones that resist one session, not more.

[Thrawn]

I have discovered that I have way too many extensions. And I would like to reduce their numbers.

OK, but is this just because your list feels cluttered? Or is it impacting your browser usage in some way? If those addons are useful, then it may be worth keeping them (but if not, then by all means, drop them).

I'm not sure, but Request Policy seems to reproduce the functionality of NoScript ABE.

Yes, sort of. It is less flexible/powerful, but much easier to use. For example, ABE can anonymize or sandbox requests, match using regular expressions or private IP addresses, and even block chrome:// requests (although that's usually a bad idea).

However, ABE has no graphical interface and limited feedback. You write rules using the built-in editor, and when they fire, a message is silently logged to the Messages tab of the Error Console (changing in Firefox 24 to the Browser Console, I believe). You sometimes get an alert bar at the top of the page, usually if the top-level site is the one affected by the rule, but otherwise you just have to check the console. So unfortunately it's quite difficult to replace RP with ABE.

Also, how can I add temporary rules to ABE? Ones that resist one session, not more.

Sorry, but this isn't possible - and that's by design. ABE was not originally written as a general-purpose tool like RP, even though it is actually more powerful. It was written to prevent attacks like Cross-Site Request Forgery. And when defending against such attacks, you don't need temporary permissions. Either it is normal for a site to interact with your bank, or it is not.

[Mircea Ionescu]

Sorry, but this isn't possible - and that's by design. ABE was not originally written as a general-purpose tool like RP, even though it is actually more powerful. It was written to prevent attacks like Cross-Site Request Forgery. And when defending against such attacks, you don't need temporary permissions. Either it is normal for a site to interact with your bank, or it is not.

Thank you Thrawn!

Looks like I'm stuck with duplicate addon functionality. Sometimes I need to give access to some of the Google sites in order to make the two bit design work. But just commenting in and out a section or another can be quite a pain. Today it's whole sites living off Google with some extra data thrown in. A decade or so ago was reliance on Microsoft Office. And so on. Ten years from now it is going to be something else. In the end that is what one would get from cheap programmers. But that is another issue.

Also thank you Mr. Maone for doing NoScript.

[Thrawn]

Well, I'm still working on a graphical interface for ABE, and making some progress, but it's a long way from replacing RP .