Thrawn wrote:Actually, he does. Guardian and I were working on a separate addon that would interact with NoScript. If Giorgio were to then choose to merge it in, he could. NoScript (and FlashGot) are exclusively his.
That's acceptable for me: if Giorgio ignores my feature requests & bug reports - I'd be glad to see them released as a separate add-on.
ABE subscriptions have been talked about, but I actually don't like the idea. I think the best option is to collect rules that people have found useful, and pick & choose which ones you like. People have such different usage patterns for sites that it's not feasible to just sign up to a list.
How do you imagine that? Ask every user to share his rules? That's slow and lame. It's way easier to sign-up for a subscription and disable some of it's rules if you don't like them.
Do you want to allow Facebook everywhere, just on its own site, or just block Facebook Connect?
Do you use Google at all? Just Google Maps? Gmail?
Similarly for Yahoo?
As far as I understand - you don't actually expect me to answer these questions, but just brought them as prove to your point about different users having different patterns. I've answered that above.
I can see some legitimate uses for a subscription list for bank-related sites, since their usage patterns are much more consistent, and you definitely want to restrict them to their own sites. But you probably only use a very small number of banks, so signing up to a list of rules for hundreds or thousands of them is overkill. As Giorgio mentioned, every single HTTP request you make will be filtered through every rule, which would be a big performance hit for huge ABE rulesets. Better to just have a list of potential rules, identify which ones apply to you, and copy those ones.
The golden words! Of course it would be way more awesome to just have a list you can pick good rules from, to fit your own needs. But that's what a subscription is!
I think you misinterpret what subscription is. It's not necessarily adblock-like huge list of lotsa rules for tons of sites most of which you'll never visit.
Take a look at Wind Li's
AutoPager add-on and how it's subscriptions work: the author hosts a site that contains a database, so when a user visits any site, he may click to send the query to Wind Li's database to search for rules for that site. And the user selects the one he likes more (sometimes there are different rules by different authors for the same site).
Thus, the user has only the rules for the sites he visits. Thus, no overkill/performance hit.
As for the other subscriptions - there are already predefined lists of untrusted sites (like hosts files), and HTTPS sites (HTTPS Everywhere), while XSS exceptions should only be used in rare cases where a site's normal (bad) behavior is to XSS itself. And subscription-based whitelisting is a minefield that I recommend everyone keep out of. Huge issues with who you choose to trust to set up such a list.
I don't know what you are talking about. Predefined lists? Thanks, no. I've even removed most of "whitelisted" rules that NoScript has by default.
If you want to set up a 'Subscription helper for NoScript' addon (with Giorgio's permission to use the name), which would edit the Content Security Policy settings, you may try it.
URL, please?
Or you suggest me to write that add-on? If so - then it'd be easier just to patch NoScript the way I like (without anyone's permissions).
Then they should a) put NoScript in 'Scripts Globally Allowed' mode,
that's almost equal to not install NoScript.
All those "CSRF/XSS/WUTEVAELSE" attacks are so rare, that plain users mostly never get affected. But what they get affected by - is the tracking by evilCorps (mostly, scroogle). And if all scripts are globally allowed - it's way easier to delete NoScript and have a slight performance boost.
and/or b) use Adblock Plus, preferably with the Anti-Malware subscription list. Or ask a tech-savvy friend to set it up for them.
Hmm, I forgot that ABP can block scripts. Thanks for reminding, now I'll consider removing NoScript in favor of anti-script rules for AdBlock. The only thing I'll miss then is NoScript's surrogate system.
