Aspirant,
I did not mean to disparage or dismiss you. I sometimes use colorful analogies to make my points. I'm sorry if you took them as offensive.
However, I must point out that there is considerable evil that can be done by Javascript alone, without any other plugins. In fact, that is why Giorgio Maone sat down and wrote NoScript in the first place. The control of other plugins was added later, as NS matured and these other threats became major factors.
There are Javascript attacks other than buffer overflows. I'm not personally familiar with Comodo, but I haven't heard of any product that can truthfully guarantee protection against all buffer overflows, including those yet to be discovered. I agree on always closing/reopening the browser before and after visiting sensitive sites, assuming you have Firefox set to delete all private data upon closing (else it dilutes the value of this). But this still does not protect you from malicious JS at the next ordinary site you visit. (We'll hope that your bank site hasn't been compromised, though it's happened.)
Today, if a user globally allows JavaScript and has one important site that fails when NoScript forbids Silverlight, the user must uncheck "Forbid Microsoft Silverlight"
I don't use Silverlight, but let's take something similar, Flash. I have all plugins blocked by default. When I visit YouTube, rather than uncheck "Forbid Flash", I simply search for the video I want, see the red NS placeholder (red block-logo), click on it, get a confirmation message, "Do you wish to allow...", click OK, and the video plays. That way, I'm exposing myself to only one Flash video instead of a million, and I don't have to remember to re-check "Forbid Flash" when I leave the site.
If you are referring to being able to whitelist plugins on a site-specific basis, that is a feature that has been on the to-do list for a long time, and I believe will be in whenever NS 2.0 comes out. Unfortunately, developer Giorgio Maone is constantly busy "putting out fires" that spring up (new threats, new vulnerabilities and exploits, etc.) I think in the meantime, if you use the method I described, or else click the NS menu and look for "blocked objects", you'll find that you can allow them temporarily without messing with the configuration.
the whitelist would work for plugins when JavaScript is globally enabled.
I'm not sure I'm understanding you completely here, but if you forbid all plugins and all Javascript by default, then go to NoScript > Options > Plug-ins and uncheck "Apply these restrictions to trusted sites too", then whenever you whitelist a site for scripting, i. e., add it to your "trusted" list, or whitelist, then the plugins will automatically be allowed there, too. Yet you still are protected from Javascript and all of the plugins at the sites that you have not whitelisted. Would this accomplish what you want? ... I prefer to allow only the single plugin needed versus allowing all of them at my trusted sites, but as you said, we may have different balances in our security comfort levels, so I think this suggestion would still improve your overall security while not inconveniencing you or your wife in the manner described.
If you don't administer a PC for your spouse, you may make different choices than me.
I don't directly administer, but offer support to, users at all levels, from first-time computer users through advanced users. I have a friend who has a Master's Degree in Computer Science, 25 years' experience, first as a programmer, then at the management level, but all in industrial applications, none Internet-related. This person has used a number of programming languages, from BASIC on through ADA, C, etc,. but not Javascript, because, for some strange reason, NASA, for example, chooses not to use Javascript for command and control of the Space Shuttle. So I have had to assist this expert professional a little with NoScript, because
in that area, this person is as much a novice as your wife. Is it worth it? Let me ask you a few questions, continuing our interesting discussion, please!
When your wife (or you) sat behind the wheel of a car for the first time, did either of you immediately pop it in gear, hop on the freeway, and do 70 mph? Did you know how to parallel-park already? I'm guessing that each of you had either formal instruction, or a friend or parent help you, and probably spent some hours, if not days or weeks, driving around the parking lot before getting on the road for the first time.
I learned how to fly. It took me about 40 or 50 hours of instruction to receive my private pilot's license.
When your wife sat down in front of a computer for the first time ever, did she already know how to boot it? Shut it down safely? Put it on standby? Open, create, move, rename files and folders? Navigate the Web? Surely someone had to teach her these things, and surely it took hours, or a number of sessions over days or weeks, before she felt fully comfortable on her own sending email, downloading photos,
doing online banking, etc.
All I am trying to say is that unfortunately, the Internet is a very dangerous place, as dangerous in its own way as a crowded highway. To drive on it *safely* takes some instruction. The proof of this is that random surveys and inspections have shown that 80-90% of home PCs have some form of malware infection.
My friend mentioned above, the professional, one day saw a new toolbar appear in the browser. I quickly recognized it as spyware. S/he (trying to protect privacy, please) had no idea where it came from, and didn't remember doing anything that would have allowed it. Yet, there it was. We did a rather painful extraction, which included some significant edits to the Windows Registry, something no novice or average home user should attempt, but we got rid of it.
The bottom line here is that I think a few sessions of instruction in how to use NoScript's powerful protection to maximum advantage would pay off in the long run, and, IMHO, are just as necessary to drive the Internet superhighway as driving lessons are before driving a car on the highway, or the local streets.
We are aware that NoScript can be challenging to novices. That is why the Quick Start guide was written, the FAQ, the Common Troubleshooting sticky post, the Firefox Self-Help Links sticky post, etc. Making it more user-friendly is always a goal. Giorgio has talked about putting a more "consumer-oriented shell" around it. These things take time (a small donation doesn't hurt either, as every hour Giorgio spends on this freeware is an hour away from his paying job), but in the meantime, please consider what I have said about educating your wife to self-sufficiency in NoScript, and please let her know that
we are always here to help if she has any questions to which she can't find answers in the above resources. IMHO, the response times at this forum to critical technical or user-problem issues are faster than at any other support forum I've seen. Give her a chance, and let us know how we can help.
Thanks for your time and continued interest.
Best wishes,
Tom
)