wxman1 wrote:Given your answer, I'm actually stupider now than when I first showed up.
Don't worry about it, you're not alone thinking that way.
wxman1 wrote:IF I temp allow s.ytimg.com it plays.
Congratulations, it works as expected for you, that's how it should be and how it's always been.
wxman1 wrote:Therefore the ABE rule - and by extension ABE itself - is worthless; in either case, either s.ytimg.com being temp allowed - which defeats ABE entirely because the site is now whitelisted and vulnerable ANYWHERE on the interwebs
No. ABE will still block it from loading if anyone other than https;//www,youtube,com call it.
ABE is case-sensitive, maybe it's the lowercase d in Deny? (But I'd have thought it would reject the ruleset if it couldn't handle it.)
wxman1 wrote:or untrusted by NoScript thereby allowing ABE ruleset to come into scope in which case that plain don't work.
If you're about to eat a chicken sandwich, would you instinctively decide to use a freight train for that?
Or would you prefer to simply eat the chicken sandwich like any other food, while driving the train at the same time?
ABE is not part of the script blocking. The script blocking is not part of ABE. They are not related. ABE doesn't care about script blocking permissions. Script blocking doesn't care about ABE rules.
It's two totally independent things.
Imagine if what you're saying were really a requirement, then CSRF protection would require you to already know and untrust the site doing the CSRF. But by the time you do that, your bank account is already drained and your router is already compromised.
With it being independent, bad sites get blocked by ABE even if you don't know and untrust the bad sites ahead of time. And you can more easily do what you seem to be trying to do here.
So, win-win all the way.
