SOLVED -- Netflix errors w/ NS enabled

[JLJ]

Windows 7 Home premium x64 / Firefox 45.0 x64 / NoScript 2.9.0.10

Since upgrading to the NoScript 2.9.x series I'm having two Netflix issues I cannot pinpoint or resolve:

• (A) Member reviews on the DVD site (dvd.netflix.com) do not show - ex: http://imgur.com/zzIlO0y
  (B) The "Add to Queue" popup window does not display correctly, though the item is added successfully - ex: http://imgur.com/5u2DzuW

I've checked that all relevant Netflix sites/domains are whitelisted; I've tried disabling ABE and/or checking "Allow sites to push their own rulesets"; I've monkeyed around with notifications and various options and nothing short of disabling NoScript completely allows normal Netflix display/functionality as noted above. (Video streaming itself works normally.) The only thing I haven't tried is creating manual exceptions to XSS or other rules because I'm not conversant in Regular Expressions.

Anyone experiencing anything similar and have info on fixes / workarounds? More tech details provided as needed and all assistance much appreciated, THX!

[barbaz]

As a test, try setting about:config > noscript.httpsDefWhitelist to false ?

[JLJ]

That seems to do the trick indeed! -- May I ask what that pref setting actually means -- esp re other sites?

[barbaz]

By default, any whitelisted sites that are in the default whitelist (which includes some netflix-related domains) get forced to HTTPS. This setting controls whether that feature is enabled.

[JLJ]

I grok. Two questions: Is that setting reachable from within the NS interface itself? and is there a way to apply it to Netflix and its subsidiaries only?

Either way, thanks!

[barbaz]

No it's not visible in NoScript Options because it's an advanced users feature & debugging feature to toggle that off.
If you want to put httpsDefWhitelist back to its default value, you can try editing about:config > noscript.default and experimenting with removing the netflix-related sites. Please let us know which site(s) you end up removing, thanks.

[JLJ]

Modifying that pref / list does not seem to work as long as the whitelist https pref defaults to true. It's an odd list of items -- some I've never knowingly had anything to do with.

Does globally disabling that https pref have significant security implications, would you say?

[barbaz]

Well I run all the time with httpsDefWhitelist set to false...

It's presumably there to make the problem of MITM attacks against default-whitelisted sites moot. NS being part of Tor Browser where things are extra susceptible to MITM-ing this type of feature is pretty important, but if you don't use a proxy of any kind...

[JLJ]

Updated reply: I was able to restore all Netflix functionality by the following method:

• 1. Uninstall Noscript
  2. Reset (del) all retained NoScript configs
  3. Close FF and wipe the cache/cookies
  4. Re-install NoScript 2.9.0.10
  5. Manually edit the noscript.default pref to remove all references to Netflix

Now the default behavior is presumably intact for all sites other than Netflix and hopefully I've got the best of both worlds.

Again: thanks!

[barbaz]

You're welcome

[barbaz]

Thank you for posting your findings and glad you got it resolved!

I only would add this: for those not working within a disposable environment, *always* backup your NoScript settings before doing a NoScript Reset!
To backup: NoScript Options > Export (the one on the very bottom, *not* the one unique to the Whitelist panel)

[Guest]

I could not search dvd.netflix.com for a DVD title with noscript 2.9.0.11 installed until I followed JLJ's recipe:

1. Uninstall Noscript
2. Reset (del) all retained NoScript configs
3. Close FF and wipe the cache/cookies
4. Re-install NoScript 2.9.0.10 (I re-installed 2.9.0.11)
5. Manually edit the noscript.default pref to remove all references to Netflix

This is the first time I've encountered a problem using noscript with Firefox (that could not be overcome by enabling a script). Something odd is going on between noscript and dvd.netflix.com . FWIW, when I searched for a DVD title (before the aforementioned fix), I was always redirected to a FF error page that stated:

"this page isn't redirecting properly"

FYI. Thanks for a very useful tool.

- Clark Morgan

[Buge]

I cannot visit the Netflix tech blog with Noscript default settings.

http://techblog.netflix.com/2016/08/bui ... stcom.html

I have to change the about:config https Def Whitelist to false. This is pretty user unfriendly and should be fixed.

Also the spam filter on the forum is messed up. It won't let me post when I have https Def Whitelist as one word.

[barbaz]

Probably Netflix should be removed from the default whitelist. Actually given all these https issues I'm surprised that hasn't happened yet.