Now that there is greater understanding all around, may I try a suggestion to our new friend?
iDrugoy wrote:I won't manually create rules for every site I visit.
You don't need to, and I think that is part of the misunderstanding here.
NoScript, in its default setting, provides protection against XSS, Clickjack, and all scripts except those in the default whitelist. See
FAQ 1.5. The default list enables use of the most common web services "right out of the box": GMail and other Google services; Microsoft webmail and services; Yahoo! mail service; PayPal; and YouTube. Everything else is blocked.
If you don't use any of the above, just delete them from Whitelist. For example, I use Yahoo, but not Gmail, MS, or PayPal, so I deleted those. Easy.
For all other sites, please review the
NoScript Quick Start Guide. Once you allow the necessary and trusted scripts for, let's say, MyBank.com, then you never have to think about it again. Every visit to MyBank works (until they change it, grr), and any third-party scripts (ads, data-miners) stay blocked. Since allowing is a matter of one click (or two if you choose not to open NS menu on mouse hover), there really isn't any "rule writing" required, nor do you need to store them elsewhere.
"Untrusted" is
not actually necessary. *All* scripts are untrusted by default. The purpose of marking privacyinvader.com as Untrusted is mere convenience: It will never again show in the menu of scripts offered, thereby not annoying you, and it shortens the menu of scripts, so you can focus on unfamiliar ones. And you can always remove it from Untrusted by pointing to Untrusted in the menu where this script appears, then temporarily or permanently allowing it. But the default zone (the entire universe that you haven't chosen to allow) is blocked exactly the same as the Untrusted list. Is this more clear?
There is a principle that dates back to the very early decades of computer science, called "The Priniciple Of Least Privilege". In short: if the site will work for you without a certan script, then don't allow the script. Even if it's harmless, you save a bit of bandwidth, resources, etc. But it's good practice. Allow the minimum necesary to make the site work -- and please remember, this is *one time only*. A few clicks. No rules to write.
As for what is a trusted site, please see
FAQ 1.11.
Please note the experimental feature that many users like very much:
NoScript offers a "Site Info" page which can help you to assess the trustworthyness of the web sites shown in your NoScript menu. You can access this service by middle-clicking or shift-clicking the relevant menu item.
This offers you several sources where others report their experiences with web sites and their scripts.
Other ways to check sites for yourself are in my post
here. And please let me know your opinion of it, as some version of it may be worth posting permanently as a guide.
I know that it sounds easier to let someone else make these decisions. But there really aren't very many. The list of advertisers at Yahoo that I linked there is an easy save to a text document. When you see one, mark it Untrusted. You'll never see it again. Unless you want to support goodsite.com with ad revenue, but not allow the ads at other sites. Then just leave it in the default-block zone -- that is, do nothing -- and temporarily allow it at goodsite.com only. Simple?
Incidentally, this is one (of many) reasons why subscriptions are not desirable. You might want to allow some advertisers at sites you would like to help support, whereas the subscription list is a one-size-fits-all (does that idiom translate well into Russian?) that would probably make them all Untrusted.
Another feature, though you don't need to read the article just now: Some pages got "smart", and started to demand that you allow, say, google-analytics.com, a data-mining script, or the page won't load for you. So Signore Maone created a
Surrogate Script that satisfies the page, while returning a bunch of
nothing to Google. The page now works for you, but your privacy is protected. Many such surrogates exist. The list is in
about:config noscript.surrogate. If you don't recognize the name in the Name field, look in the Value field.
You don't need to write rules or do *anything* for this protection, either -- these run automatically, so long as you leave the script in either default (deny) or Untrusted.
Are you starting to see new value in NoScript that you did not know of before?
Lastly (for now): Embeddings page in Options. Safest is to check *everything*. Then if you visit, say, YouTube, all videos are blocked by default; no annoyance of one running as soon as you arrive. Choose the one you want, click on the NoScript logo in the screen, confirm OK to temporarily allow this Flash object. Two clicks, no more.
Coming soon in NS 3.x for Desktop, it will be easy to do this per-site: To allow, say, Flash at goodsite.com, friend.com, and comrade.ru, but nowhere else. (But you can temporary-allow it anywhere else, as always.)
If you have any further questions that are not made clear in the FAQ, or answered by searching this forum, plese feel free to post them here.
And yes, the language barrier caused me to perceive your saying as offensive. Thank you for explaining it to me. We don't need another Cold War.
I also misguessed your level of technical knowledge, such as of XSS, because you knew immediately that about:config stores in prefs.js, and some other things that made it clear that you were not a technical novice. Perhaps I should have referred you to Wikipedia's
article on XSS, especially the
Mitigation section on disabling scripts, which makes it very plain that NoScript is the best defense for the user side.
You have kindly listened to me. Now it is my turn to listen to you. The
NoScript Quick Start Guide was an attempt to make learning the basics of NoScript easier for new users. If you haven't read it, please do so when you have a chance, and give your feedback. Of course it was a team effort, even though my name is on it. I wrote the first draft, and then there were many fine suggestions, revisions, etc. from all team members. Revised, more feedback, etc. until the final draft was approved by Giorgio. And it has been edited a few times since. So it was very much a group effort, of course. But my name is still on it as principal author. If you think it could be improved to make the new user's experience better, please suggest how. You may do so by private message (PM) if you don't wish to do so publicly, though of course public discussion invites other opinions.
In summary, the blacklist is only a convenience, not a necessity, and no rule-writing is required, only a few clicks the first time you visit a given site. The protections are all automatic.
The vodka is on me. Cheers!
(I was going to toast in Russian, but then I remembered that we had to ban Cyrillic here, because of a certain evil group of spammers using it on an English-language page. Sorry!)
