Flashload.net and NoScript

[kukla]

Flashload is allowed, but I'm getting the message on the home page to enable JS. I've never seen this before, but the last time I used Flashload was many NoScript updates ago and with Leopard, not Snow (10.6.4.) The only other scripts on that page are from google-analytics and googlesyndication and they are blocked, but I wouldn't think that would produce this message. Is there some setting in NS options that is making the site think that JS is not enabled?

Don't know if this is the reason, but the site isn't downloading YouTube; it times out with an error. Firefox 3.6.4

[Giorgio Maone]

JavaScript is actually enabled, but the message is shown because the <NOSCRIPT> element containing it is placed immediately after the googlesyndication (Google Ads) import, therefore the NoScript Options|Advanced|Trusted|Show the <NOSCRIPT> element following a blocked <SCRIPT> element option causes this.

So, this is probably not the reason. I notice they're using a wrongly signed Java applet which tries to obtain system privileges: that's probably the culprit (it's not even sure it is compatible with Mac OS' Java).

[kukla]

Thanks Giorgio,

I notice they're using a wrongly signed Java applet which tries to obtain system privileges: that's probably the culprit (it's not even sure it is compatible with Mac OS' Java).

I didn't have Java enabled in FF at the time* but I played with temporarily allowing that Java applet when attempting a YT download (it still failed.) Do you think I may have let something bad in by allowing that Java applet that tries to obtain system privileges? Is that only for PC/Windows? This is OSX. Would I have gotten any warning? How could I check if it was some kind of malware? Don't like the sound of "tries to obtain system privileges."

*EDIT at least, I don't think so -- afterward, tried loading the YT with Java enabled, but don't think I allowed the applet when Java was enabled.

(Wrote this from my 10.4.)

[Giorgio Maone]

Does the site work if you disable NoScript from Tools|Add-ons?
(notice that the applet should ask you before obtaining system privileges)

[kukla]

Does the site work if you disable NoScript from Tools|Add-ons?
(notice that the applet should ask you before obtaining system privileges)

I may try that, but after what you said about the applet trying to obtain system privileges (with a big question mark on "...should ask you before..."), I don't know how secure I feel about continuing to try to use Flashload. But are you thinking that "allowing all," or disabling NS, on this site is not a security risk? Can I assume your recommendation to try Flashload without NS means you think the site is safe and that I haven't allowed, or won't allow, something in to be concerned about?

[Giorgio Maone]

I would never allow the applet to obtain system privileges, if this is your question (I wouldn't do that for most organizations around, even if they properly signed the applet -- which is not the case here).
Since they offer it for a seemingly legitimate use, though, I doubt they're trying other stunts from the sites like exploit unknown vulnerabilities.
However, as always goes with security, if you don't think the service they offer is worth the risk, modulo their reputation, then leave the site alone.

[kukla]

I have the feeling the problem with downloading may be nothing related to NS, or that applet, and that it simply won't work with the way YouTube is now configured. Whats probably going on is that it needs to be updated. It used to work simply by allowing the main site URL. But this was, maybe, four or five months ago. I think I'll just let it go for now, anyway. Thanks for the help.