InformAction Forums

NoScript Direction concerning Defaulted Whiltelist & Changes Thereof?


Eh, weird topic.


But similar to JavaScript CDNs to add to whitelist what should NoScript policy be pertaining to the default whitelist, changes initiated on the NoScript side, & settings made by the user?

So how it comes about...

Youtube HTML5 video all of a sudden sucks.
Takes ~10 seconds before playback starts.

Existing Profile (& so all the garbage that has accumulated, goes along with that).

And what changed?

Instead of my normal (well dated at this point) SeaMonkey 2.33.1 release, I'm now messing with SeaMonkey Aurora/Nightly, 2.38/2.39. And I click a link to some YT video & its taking forever for playback to begin. And I know that with 2.39, I'm using HTML5, where with 2.33 you're still served Flash.

2.33 Flash, fires right up.
2.39 HTML5, slow.

Simple. No other changes, just fast/slow.

So I try a different Profile I've got laying about - with 2.39 & YT fires right up - using HTML5.

Tells me its something in my original Profile.
Guessing it will turn out to be extension related.

So create a new, empty Profile, copy everything extensions related into it, so /extensions/* & extensions*.*.
Fire up 2.39, visit Youtube, pick a clip, & playback starts right away.

Tells me its something in my prefs.js.

Immediate thought (even before this point) was NoScript.
So I make all the same (NoScript) changes (particular Pref setings) I've made from my original Profile, in this new one - except I do not mess with the whitelist.

Still, YT runs fine.

I then again copy over original prefs.js & confirm that YT runs slowly. It does.

I then do a Reset of the whitelist, & with that YT runs fine.

A quick comparison between the whitelists points to googlevideo.com.
Sure enough, that's it.
HTML5 playback still works on YT, actually everything works, only it is very slow to start its playback if googlevideo.com is not allowed.

So... at some point in the past, googlevideo.com had been added to the default whitelist, probably for this very reason, but until now, its inclusion, or not, has not affected me.

So I now include it.
No big deal.


But, what should NoScripts policy be towards these whilelist changes?
Should it say, hey, not there, I'm adding such & such domain?
Should it say, hey, this existing one is wrong, so I'm removing such & such domain?
Should a user be prompted of some sort of mismatch?

Should a user know, that over time, defaults change & what worked or what was accepted yesterday, may not be today, and may yet change again tomorrow. Well that part goes without saying.

So, what should be done in this regard?


(I'm sure I have plenty of cruft in my existing Profiles & tend to start afresh every so often, but if someone has ages old Profiles, no telling what "wrong" settings are laying about, or in regard to NoScript, what may or may not be included in a defaulted whitelist, or even other specific Prefs.)

My view on it is something like this:
Removals: eh, it's likely a good thing, as long as there's an explanation somewhere out there it's fine (and probably good). I trust Giorgio to know when a domain is bad idea for me to whitelist, but even so I like to know the reasoning behind this stuff.
Replacements: to be used only if a domain moves or changes somehow (like persona.org & more recently googleapis.com)
Additions: to be used *only* if something on the default whitelist gets a new dependency, but one of the following should be possible:

• the user should be able to confirm whether to make the change, AND/OR
• the user should be able to opt out of this entirely (this one exists as about:config > noscript.allowWhitelistUpdates).

And in the edge case of the addition of maps.googleapis.com for those who had ajax.googleapis.com, it technically counts as a replacement as it's part of the replacement of the whitelist of the entire googleapis.com, that's fine. (I temporarily re-enabled allowWhitelistUpdates just to get that entry added.)

Wait... it kind of seems you're conflating two issues in one long post, and I'm confused - are you referring just retroactive changes to the whitelists of users who kept default entries (as I was above), or the default whitelist for new installations of NoScript as well?

> are you referring just retroactive changes to the whitelists of users who kept default entries (as I was above),
> or the default whitelist for new installations of NoScript as well?

The former.

allowWhitelistUpdates pref doesn't work and I ended up with unwanted entries in my whitelist again. I know it's probably a bug but this is simply unacceptable especially given that the recent changes to the whitelist don't apply to me and wouldn't even if I were using Firefox (I'm referring to NoScript whitelisting Pocket URLs for users).

Giorgio, please revert that change or make it apply only to Firefox users! Thanks!

2.6.9.30rc5 makes sure that the pocket is only whitelisted for Firefox users (and users who otherwise have Pocket in their browser)
Thanks again Giorgio for fixing that up.

barbaz wrote:My view on it is something like this:
Removals: eh, it's likely a good thing, as long as there's an explanation somewhere out there it's fine (and probably good). I trust Giorgio to know when a domain is bad idea for me to whitelist, but even so I like to know the reasoning behind this stuff.
Replacements: to be used only if a domain moves or changes somehow (like persona.org & more recently googleapis.com)
Additions: to be used *only* if something on the default whitelist gets a new dependency, but one of the following should be possible:

• the user should be able to confirm whether to make the change, AND/OR
• the user should be able to opt out of this entirely (this one exists as about:config > noscript.allowWhitelistUpdates).

And in the edge case of the addition of maps.googleapis.com for those who had ajax.googleapis.com, it technically counts as a replacement as it's part of the replacement of the whitelist of the entire googleapis.com, that's fine. (I temporarily re-enabled allowWhitelistUpdates just to get that entry added.)

I agree with all of this.

Just one small 'fly in the ointment': if your Profile
ever had 2.6.9.30rc4 you might have to manually delete
about:pocket-save from your NoScript whitelist.

More details in
NoScript 2.6.9.30rc4 added wrong item to default whitelist
viewtopic.php?f=10&t=20994

DJ-Leith