Why won't videos play when I click the Noscript icon?

[barbaz]

Does enabling <AUDIO>/<VIDEO> element do more security wise than just prevent autoplay? on Firefox for click-to-play.

From a security standpoint I really don't know which one is better...

From a security standpoint NoScript outright prevents the <AUDIO> / <VIDEO> from even loading until you unblock it, which is a LOT more than simply preventing autoplay. There is probably a potential exploit scenario where a media element merely loads to causes problems but I would have no idea, I'm not expert in that stuff.

[tarjk]

Finally, I have also a very restrictive (masochistic?) A.B.E. rule: I accept youtube, ytimg and googlevideo only from others google sites.

I have this ABE rule for Youtube

Code: Select all

Site .youtube.com
Accept from .youtube.com https://duckduckgo.com
Deny

How did you specify your rule to catch "other google sites"?

[Rollo]

From a security standpoint NoScript outright prevents the <AUDIO> / <VIDEO> from even loading until you unblock it, which is a LOT more than simply preventing autoplay. There is probably a potential exploit scenario where a media element merely loads to causes problems but I would have no idea, I'm not expert in that stuff.

Good to know, I was right trusting noscript

How did you specify your rule to catch "other google sites"?

Something like this:

Code: Select all

Site .youtube.com
Accept from duckduckgo.com .youtube.com .blogger.com .blogspot.com .blogspot.it .blogspot.jp .ytimg.com .googlegroups.com .google.com .google.it
Deny

I put in .blogspot.it because I'm in Italy, and .blogspot.jp because... because yes , but in the end is up to you to decide.
My criteria is: if I'm already on a google site, it is more or less pointless to forbid other google content.
Since I allowed .googlevideo.com in "noscript.allowedMimeRegExp" I have also a rule like this:

Code: Select all

Site .googlevideo.com .ytimg.com
Accept from .youtube.com .googlevideo.com .ytimg.com
Deny

"ytimg.com" stands for youtube images, not to be confused with "yimg.com" which stands for yahoo images!

Duckduckgo, I prefer to force https with noscript under advanced -> https
See here: https://i.imgur.com/CY2edZB.png

[tarjk]

Duckduckgo, I prefer to force https with noscript under advanced -> https
See here: https://i.imgur.com/CY2edZB.png

I had no idea openstreetmap was available over HTTPS. I saw your image and promptly set it into NoScript. Thanks