InformAction Forums

I'm not sure if this is a bug or a RFE; it could arguably be either.
Anyway, if I temporarily allow a site's scripting, an entry for that site shows up in NoScript's Whitelist tab. However, if I temporarily allow an object on a site (e.g. a YouTube video), no entry appears in NoScript's Whitelist tab. This doesn't seem like that big a deal, but it actually is: instead of deleting an entry in the Whitelist tab to revoke the site's temp permissions, I have to use the "Revoke Temporary Permissions" menuitem to revoke all temp permissions, which causes me some trouble on sites I've temp-allowed scripting for.
Would it be possible to have an entry show in the Whitelist tab for sites with temp-allowed objects?

Thanks, and keep up the great work!

computerfreaker wrote:... if I temporarily allow an object on a site (e.g. a YouTube video), no entry appears in NoScript's Whitelist tab.

ATM, the whitelist is for scripts only, and is site-based. Look for changes in NS 2.x

computerfreaker wrote: This doesn't seem like that big a deal, but it actually is: instead of deleting an entry in the Whitelist tab to revoke the site's temp permissions, I have to use the "Revoke Temporary Permissions" menuitem to revoke all temp permissions, which causes me some trouble on sites I've temp-allowed scripting for.

Not in the method that you and I use at YouTube, and which I wholeheartedly reccomend: Not to allow Flash, but to allow only Video abcd1234.swf. Note that having done so, *none* of the other millions of videos are allowed -- you'll get the same placeholder for any other video. And the site has *not* been whitelisted for Flash in general.

So you can leave the page and go elsewhere without worry. Only the specific video that you already decided was trustworthy is still allowed. All Flash and all of YouTube Flash are still blocked, assuming those are your NS settings. Since object permissions are per-object only, except for "allow all from *@http.somesite.com", you haven't actually whitelisted anything -- only allowed the one single object to run, for the duration of that browsing session only.

Thanks for the kind words!

computerfreaker wrote:... if I temporarily allow an object on a site (e.g. a YouTube video), no entry appears in NoScript's Whitelist tab.

Tom T. wrote:ATM, the whitelist is for scripts only, and is site-based. Look for changes in NS 2.x

I had been hoping for a site-based list of allowed objects; in other words, NS would "forget" it was handling an object and add the appropriate site to the Whitelist tab. However, that's unnecessary - see below.

computerfreaker wrote: This doesn't seem like that big a deal, but it actually is: instead of deleting an entry in the Whitelist tab to revoke the site's temp permissions, I have to use the "Revoke Temporary Permissions" menuitem to revoke all temp permissions, which causes me some trouble on sites I've temp-allowed scripting for.

Tom T. wrote:Not in the method that you and I use at YouTube, and which I wholeheartedly reccomend: Not to allow Flash, but to allow only Video abcd1234.swf. Note that having done so, *none* of the other millions of videos are allowed -- you'll get the same placeholder for any other video. And the site has *not* been whitelisted for Flash in general.

So you can leave the page and go elsewhere without worry. Only the specific video that you already decided was trustworthy is still allowed. All Flash and all of YouTube Flash are still blocked, assuming those are your NS settings. Since object permissions are per-object only, except for "allow all from *@http.somesite.com", you haven't actually whitelisted anything -- only allowed the one single object to run, for the duration of that browsing session only.

Valid point, and one which I had overlooked. That renders this whole topic unnecessary, so I'm marking it as resolved... thanks for pointing that out!

Tom T. wrote:Thanks for the kind words!

I just wish I could do more.

computerfreaker wrote:I just wish I could do more.

You're doing quite a bit already with your enthusiastic participation here.
And thanks for doing *my* work! (by marking it Resolved)