Will NoScript need change how it blocks fonts on Gecko 41?

Post by **barbaz** » Tue Jul 21, 2015 1:16 pm

http://www.ghacks.net/2015/07/21/firefo ... e-browser/
Will that affect NoScript's ability to block webfonts?

Post by **Thrawn** » Thu Jul 23, 2015 12:41 am

Link is broken for me.

Post by **barbaz** » Thu Jul 23, 2015 12:51 am

Weird, it's gone. Let me see if it's actually deleted or just reposted elsewhere...
EDIT OK found another thread on mozillaZine about this, but it's not informative at all so instead I just linked the article they linked.

Post by **Thrawn** » Thu Jul 23, 2015 2:28 am

I guess the burning question is, Do icon fonts present the same security risks as regular ones?

If so, the Ghacks article mentioned that they can be disabled with some extra steps, so I'm sure NoScript can handle it. Of course, it's possible that NoScript intercepts them at a different point in the process anyway and will be unchanged.

Post by **barbaz** » Thu Jul 23, 2015 5:41 pm

Any Nightly testers around who can "just try it"? Preferably check both Fx and SeaMonkey. Thanks

(I'd check SM myself but I'm not able to test nightlies right now. Plus my build machines are kind of in need of major maintenance...

)

Post by **therube** » Thu Jul 23, 2015 8:31 pm

> "just try it"

Is there a page around, with the different types of fonts or whatever that describes what we're seeing, what should be seen, so we might know what if anything is being affected by changes in FF & or by NoScript?

Post by **barbaz** » Thu Jul 23, 2015 9:47 pm

Github uses icon font.. any page will do, say this one https://github.com/rust-lang/cargo/
Or look at Font Awesome: https://fortawesome.github.io/Font-Awesome/icons/ (<-- not a typo)

For "normal" (non-icon) webfonts, there's the Google fonts site, but I don't know if you'll need some special NoScript settings (e.g. "Apply these restrictions to whitelisted sites too") so that the fonts "would" be visible except for NoScript's font blocking...

Post by **therube** » Fri Jul 24, 2015 12:41 am

> https://www.google.com/fonts

When I didn't see anything, I knew I remembered something, Google Fonts site doesn't welcome Seamonkey.
Have to spoof your UA (removing mention of SeaMonkey).

Post by **therube** » Fri Jul 24, 2015 8:30 pm

Dated, so lets see if it stays alive or goes further, How to selectively block web fonts?

Post by **barbaz** » Fri Jul 24, 2015 8:33 pm

They lock threads that are dead for 1 year or more that get posted to after that time period... don't expect it to last long.

InformAction Forums

Will NoScript need change how it blocks fonts on Gecko 41?

Will NoScript need change how it blocks fonts on Gecko 41?

Re: Will NoScript need change how it blocks fonts on Gecko 4

Re: Will NoScript need change how it blocks fonts on Gecko 4

Re: Will NoScript need change how it blocks fonts on Gecko 4

Re: Will NoScript need change how it blocks fonts on Gecko 4

Re: Will NoScript need change how it blocks fonts on Gecko 4

Re: Will NoScript need change how it blocks fonts on Gecko 4

Re: Will NoScript need change how it blocks fonts on Gecko 4

Re: Will NoScript need change how it blocks fonts on Gecko 4

Re: Will NoScript need change how it blocks fonts on Gecko 4