"Firefox prevented this site from asking you to install sw"

[JwT]

When I went to install 2.6.8.23 (as I was "strongly encouraged to" at the startup page http://noscript.net/?ver=2.6.8.22&prev=2.6.8.21) I got warned

• Firefox prevented this site (noscript.net) from asking you to install software on your computer.
  [ Allow ] ... [ Not Now ]

This didn't happen the last time I updated NoScript, and I'm not aware of any Firefox settings I've changed recently (but there would have been a FF update or two.) Should I change or fix some Firefox or NoScript setting? Just shrug it off and "Allow"? Or flee and report an issue to someone?

[barbaz]

Probably because you've always installed NoScript from AMO one way or the other, and noscript.net isn't a default "official" site from which you can install add-ons.
You're probably OK to go ahead and allow the installation, but as noscript.net isn't served over https and I install dev builds directly from noscript.net frequently, I personally use the following (overly paranoid?) ABE rule to make it relatively safe (would go in USER if you don't have any custom ABE rules)

Code: Select all

# Protect noscript.net from being abused
Site .noscript.net
Accept from noscript.net .informaction.com
Deny INCLUSION
# just in case...
Sandbox

[JwT]

Well, I'm a very casual user of NS, and don't know how to make an ABE. Following your other clue, I went to addons.mozilla.org where I installed 2.6.8.23 (probably all-over-again) without incident. So thanks for that!

I've certainly never done that before, though - at least not since initial installation - and I'm puzzled why NoScript's own update advisory would link to a non-"official" site that FF forbids, rather than to one that would work.

[barbaz]

Well, I'm a very casual user of NS, and don't know how to make an ABE.

NoScript Options -> Advanced -> ABE -> USER, then paste in my rule
But as I said, that might be too paranoid, and I install directly from noscript.net a lot more than you would likely need to.

I'm puzzled why NoScript's own update advisory would link to a non-"official" site that FF forbids, rather than to one that would work.

First off, (at least in SeaMonkey) that's configurable, but I don't know how to do it in Firefox.
Also, if the latest stable version of NS hasn't been fully reviewed by AMO, then it's not readily available from AMO: you would have to dig through the old versions page (if it's even there) and click on a big yellow warning-striped button.

[Thrawn]

I'm puzzled why NoScript's own update advisory would link to a non-"official" site that FF forbids, rather than to one that would work.

Firefox forbids everywhere by default except for addons.mozilla.org.

I don't think that there is a process for getting sites included in that. And I don't think that Mozilla would do it for an addon author anyway.

So the only way to get the latest NoScript faster than Mozilla's review process is to use noscript.net and accept the warning. It's up to you whether you want to trust Giorgio more and get his latest improvements/defences, or trust AMO more and wait for their review.

[barbaz]

I don't think that there is a process for getting sites included in that.

OK, had to update NS on my Pale Moon, and apparently I must have copied over the permission from my SeaMonkey profile allowing noscript.net to install add-ons, because I didn't get the warning described by the OP.
Anyway, looks like this is the relevant setting:
Fx (Pale Moon) Options -> Security -> Warn me when sites try to install add-ons -> Exceptions... , allow "noscript.net"

So the only way to get the latest NoScript faster than Mozilla's review process is to use noscript.net and accept the warning. It's up to you whether you want to trust Giorgio more and get his latest improvements/defences, or trust AMO more and wait for their review.

Sometimes I've been able to get yet-to-be-fully-reviewed versions of addons from AMO on the addon's version history page...