isitdownrightnow.com comments script doesn't work with NS

[ginahoy]

When http://isitdownrightnow.com reports a site is down and there are comments posted, the script that loads the comment string doesn't work with NoScript. I tried removing all script blocks that are active on this site and still no cigar. However, if I disable NoScript, the comments load. What more can I do to troubleshoot this problem?

To reproduce, you have to enter a website that has comments posted. The sites listed on the right under the red header "Down Right Now" are good candidates. The comment script doesn't load until the ping gets a response or times-out. A "View Comments" button will appear in the 'Server Status Check' section at the top of the page.

Thanks for the assist.

[barbaz]

When this issue occurs, do you see anything related in the Browser Console? (Ctrl-Shift-J)
(if you don't know what's related, turn off CSS warnings and post everything else you see)

Also, what version of NoScript are you using, and why Firefox 55?

EDIT
Actually I'm not sure if isitdownrightnow.com is working at all for me. When checking a site that is up, how long does it usually take to see the response?

[ginahoy]

Sorry, I should have pointed out that I'm able to reproduce the comment script issue for any site that has comments, not just ones that are down. For example, you can test google.com.

Here's a copy of my console. These are Security Warnings (red exclamation mark):

Code: Select all

Content Security Policy: Ignoring “'unsafe-inline'” within script-src: ‘strict-dynamic’ specified
Content Security Policy: Ignoring “https:” within script-src: ‘strict-dynamic’ specified
Content Security Policy: Ignoring “http:” within script-src: ‘strict-dynamic’ specified

[barbaz]

The "View Comments" button doesn't seem to work for me even in a completely clean profile without NoScript or any other extensions. All that happens when I click it is the page scrolls a little bit.

If disabling NoScript fixes it for you, most likely they are using Facebook comments and your NoScript is blocking something Facebook related.

As a test, does it work if you disable the XSS filter?

1) NoScript Options > Advanced > XSS, un-check both boxes

2) about:config > set noscript.xss.checkInclusions to false

[ginahoy]

The "View Comments" button doesn't seem to work for me even in a completely clean profile without NoScript or any other extensions.

Yeah, that was the first thing I noticed, and presumably has nothing to do with the comment script error since it still does that when the comments work, as you noted.

As a test, does it work if you disable the XSS filter?

I have this ABE rule:

Code: Select all

Site .facebook.net .facebook.com
Accept from .azcentral.com .facebook.net .facebook.com
Deny  INCLUSION(SCRIPT, OBJ, SUBDOC)

So this was obviously the culprit. You never said, but I'm guessing you were not able to reproduce? I don't imagine there's a way to 'fix' this. The ABE rule is doing what I intended it to do. I just need to be aware that when I encounter a site where comments don't load (this wasn't the first), to turn off XSS/ABE filtering. Too bad XSS can't be switched off and on from the context menu.

[barbaz]

You never said, but I'm guessing you were not able to reproduce?

I said I couldn't get the comments working at all, not even in a clean profile without NoScript. Sorry if it wasn't clear.

I have this ABE rule:

Code: Select all

Site .facebook.net .facebook.com
Accept from .azcentral.com .facebook.net .facebook.com
Deny  INCLUSION(SCRIPT, OBJ, SUBDOC)

So this was obviously the culprit.

Yep, that'd do it. Never mind about disabling XSS filter.

I don't imagine there's a way to 'fix' this. The ABE rule is doing what I intended it to do. I just need to be aware that when I encounter a site where comments don't load (this wasn't the first), to turn off XSS/ABE filtering.

If you really want to see the comments, you could try changing your ABE rule like this -

Code: Select all

Site .facebook.net .facebook.com
Accept from .azcentral.com .isitdownrightnow.com .facebook.net .facebook.com
Deny INCLUSION(SCRIPT, OBJ, SUBDOC)

It's safer than disabling ABE entirely.

[ginahoy]

If you really want to see the comments, you could try changing your ABE rule like this...

Of course! Thanks for the tip!

I said I couldn't get the comments working at all, not even in a clean profile without NoScript. Sorry if it wasn't clear.

When you posed the question how long the site takes, I thought you might have encountered a sever issue (I had that problem while testing as well, but I knew that was unrelated to the comment script issue). The intent of my reply (which admittedly wasn't clear) was to suggest that you try testing a site that's not down (e.g., Google), since that fires the comment script almost instantly (i.e., no built-in waiting-for-ping delay). In my testing today, the site routinely took about 20 seconds to report that a site is down. However, when checking a couple of the red-listed sites, the spinning wheel would hang.

Only as a matter of curiosity, can you get comments to load when you test google.com?

[barbaz]

When you posed the question how long the site takes,

That turned out to be my own fault, an over-reaching custom ABE rule that was silently blocking the response from isitdownrightnow. Sorry for any confusion.

Only as a matter of curiosity, can you get comments to load when you test google.com?

Nope, but my situation there isn't relevant to you. I block facebook stuff at the system level, so when I saw the comments fail even in a clean profile when checking a site that is up (e.g. google.com), I figured it's likely the site uses Facebook comments.