InformAction Forums

Tumblr videos on Tumblr are not working with noscript turned on.

URLs?

therube wrote:URLs?

The spam filter prevented me from posting more

http://weloveshortvideos.com/post/83718 ... -by-chrish

http://troyesivan.tumblr.com/post/83009 ... ion-tumblr

http://alice-suicidal.tumblr.com/post/8 ... th-his-mom

http://ruinedchildhood.com/post/8275928 ... -a-teacher

etc.. etc...

EDIT: I also have HTTPS Everywhere https://eff.org/https-everywhere and ABP https://adblockplus.org installed

The third video didn't work for me even with NoScript completely disabled...
I also tried disabling both ABP and NS there at the same time. Still didn't work.

As a test, go
Tools -> Add-ons Manager -> NoScript -> Disable -> Yes, remove ALL protections
Restart your browser, then try again to access those videos. Do they work then?

Do you have Options | Embedding -> Apply these restrictions to whitelisted sites too, enabled?

If so, disable it & refresh the page.
Does it then work?

Actually that probably isn't necessary.

What domains do you have allowed?

Third does not work, in Mozilla nor IE.

Last needs:

+d31qbv1cthcecs.cloudfront.net
+yimg.com (possibly not, but it was already enabled)
+tumblr.com
+ruinedchildhood.com

All but the third are working here.

After the HTTPS EVERYWHERE update today (to 3.5.1, Changelog https://www.eff.org/files/Changelog.txt) Tumblr videos are working again without any modifications to NoScript. So I guess it's HTTPS's fault.
I do apply restrictions to the whitelist to which I applied no changes ever since I installed NoScript. The reason I restricted the whitelist is because porn sites are not restricted even though none is listed in the whitelist. Can anyone tell me why?

Fransisco_B wrote:After the HTTPS EVERYWHERE update today (to 3.5.1, Changelog https://www.eff.org/files/Changelog.txt) Tumblr videos are working again without any modifications to NoScript. So I guess it's HTTPS's fault.

(Could NoScript Options -> Advanced -> HTTPS maybe take the place of HTTPS Everywhere? I haven't played with it, but if it's an AddressMatcher...)

Fransisco_B wrote:The reason I restricted the whitelist is because porn sites are not restricted even though none is listed in the whitelist.

Can we have more details on what you mean by "not restricted"?
(please, *don't* post URLs)

barbaz wrote:Could NoScript Options -> Advanced -> HTTPS maybe take the place of HTTPS Everywhere? I haven't played with it, but if it's an AddressMatcher...)

True, but you have to fill in the addresses yourself, in HTTPS EVERYWHERE the addresses (which are hundreds) are prebundled

Can we have more details on what you mean by "not restricted"?

Flash isn't blocked on porn sites when the "Apply these restrictions to white..." is unchecked

so, go to one those sites and check the blocked objects menu... you should see that the flash is coming from a whitelisted site
maybe it's not blocked without "apply these restrictions..." option because:
1) it's running in an (i)frame from a whitelisted or temp-allowed site (you can check this by looking at the noscript icon and noscript menu -> blocked objects -> )
2) the site is (temp-)allowed, possibly automatically by noscript depending on your config
3) you've somehow got about:config -> noscript.forbidActiveContentParentTrustCheck set to false

(just guessing... please let us know, thanx)

1) checked the object's link, not from a whitelisted site
2) I do have scripts globally allowed
3) noscript.forbidActiveContentParentTrustCheck is set to True

Fransisco_B wrote:2) I do have scripts globally allowed

OK that would do it because you're effectively temp-allowing both the site originating the Flash and the site embedding the Flash, and NoScript treats temp-allowed sites like whitelisted sites when it comes to plugin content.
So yes, in your case to forbid plugins it's expected that you check "Apply these restrictions to whitelisted sites too" and use about:config -> noscript.allowedMimeRegExp if you want to whitelist plugin content on a per-site basis.

Fransisco_B wrote:

barbaz wrote:Could NoScript Options -> Advanced -> HTTPS maybe take the place of HTTPS Everywhere? I haven't played with it, but if it's an AddressMatcher...)

True, but you have to fill in the addresses yourself, in HTTPS EVERYWHERE the addresses (which are hundreds) are prebundled

Giorgio mentioned a while ago that he could easily bundle their list with NoScript, since they originally used his code...hasn't happened as yet though.

barbaz wrote:[o yes, in your case to forbid plugins it's expected that you check "Apply these restrictions to whitelisted sites too" and use about:config -> noscript.allowedMimeRegExp if you want to whitelist plugin content on a per-site basis.

The noscript.allowedMimeRegExp is empty, what should I write in it to forbid plugins form non-whitelisted sites while keeping scripts globally allowed?

And btw, where can I find the complete list of benefits and changes that noscript adds to FF? Thanks alot for helping me, you, Thrawn and Therube

Fransisco_B wrote:The noscript.allowedMimeRegExp is empty, what should I write in it to forbid plugins form non-whitelisted sites while keeping scripts globally allowed?

You're already forbidding plugins with "Apply these restrictions to whitelisted sites too".
You use that pref to permanently allow plugin content from selected sites. Documentation here.

Fransisco_B wrote:And btw, where can I find the complete list of benefits and changes that noscript adds to FF?

Unfortunately there isn't one. This page, this forum topic, and the changelog are a start, though.

There was a forum topic requesting such documentation, but it seems no one has had any time to write it yet