Page 2 of 2
Re: Why won't videos play when I click the Noscript icon?
Posted: Sat Jul 04, 2015 5:33 pm
by barbaz
Rollo wrote:tarjk wrote:
Does enabling <AUDIO>/<VIDEO> element do more security wise than just prevent autoplay? on Firefox for click-to-play.
From a security standpoint I really don't know which one is better...
From a security standpoint NoScript outright prevents the <AUDIO> / <VIDEO> from even loading until you unblock it, which is a LOT more than simply preventing autoplay. There is probably a potential exploit scenario where a media element merely loads to causes problems but I would have no idea, I'm not expert in that stuff.
Re: Why won't videos play when I click the Noscript icon?
Posted: Sat Jul 04, 2015 6:06 pm
by tarjk
Rollo wrote:
Finally, I have also a very restrictive (masochistic?) A.B.E. rule: I accept youtube, ytimg and googlevideo only from others google sites.
I have this ABE rule for Youtube
Code: Select all
Site .youtube.com
Accept from .youtube.com https://duckduckgo.com
Deny
How did you specify your rule to catch "other google sites"?
Re: Why won't videos play when I click the Noscript icon?
Posted: Sat Jul 04, 2015 7:25 pm
by Rollo
barbaz wrote:
From a security standpoint NoScript outright prevents the <AUDIO> / <VIDEO> from even loading until you unblock it, which is a LOT more than simply preventing autoplay. There is probably a potential exploit scenario where a media element merely loads to causes problems but I would have no idea, I'm not expert in that stuff.
Good to know, I was right trusting noscript
tarjk wrote:
How did you specify your rule to catch "other google sites"?
Something like this:
Code: Select all
Site .youtube.com
Accept from duckduckgo.com .youtube.com .blogger.com .blogspot.com .blogspot.it .blogspot.jp .ytimg.com .googlegroups.com .google.com .google.it
Deny
I put in .blogspot.it because I'm in Italy, and .blogspot.jp because... because yes
, but in the end is up to you to decide.
My criteria is: if I'm already on a google site, it is more or less pointless to forbid other google content.
Since I allowed .googlevideo.com in "noscript.allowedMimeRegExp" I have also a rule like this:
Code: Select all
Site .googlevideo.com .ytimg.com
Accept from .youtube.com .googlevideo.com .ytimg.com
Deny
"ytimg.com" stands for youtube images, not to be confused with "yimg.com" which stands for yahoo images!
Duckduckgo, I prefer to force https with noscript under advanced -> https
See here:
https://i.imgur.com/CY2edZB.png
Re: Why won't videos play when I click the Noscript icon?
Posted: Sat Jul 04, 2015 8:08 pm
by tarjk
I had no idea openstreetmap was available over HTTPS. I saw your image and promptly set it into NoScript. Thanks
