InformAction Forums

I have some issues to report.

First a minor issue regarding the UI, where domains hosting scripts are listed, either via the status bar or context menu. When I visit a site, say http://sg.yfittopostblog.com/2010/10/26 ... bruce-lee/, it hosts several scripts from other sites, one is from wp.com. The issue with the UI is that some subdomains belonging to wp.com is not being properly grouped in the list. For example, in the status bar menu, the list shows like this:

----------------------------------
Allow s1.wp.com
Temporarily allow s1.wp.com
----------------------------------
Allow wp.com
Temporarily allow wp.com
Allow s0.wp.com
Temporarily allow s0.wp.com
----------------------------------

I have seen similar behavior on other sites where multiple subdomains host scripts. By intuition, s1.wp.com should have been placed and grouped under the Allow wp.com group list. This is only a minor issue, and no function is broken. However, it would be nice if groupings are consistently done throughout the UI as is the behavior of NS. Or perhaps this issue is preceded by something else -- a limitation maybe?

The second issue concerns ABE with stylesheets (I believe). I have tried emulating CsFire behavior with NS, as previously posted around here, with this User ABE rule as the only rule:

Site *
Accept from SELF++
Anon

The problem is that having this rule active seems to break some stylesheet functions. One good example is by visiting ph.yahoo.com, at the left side of the page contains a menu for quickly accessing various parts of the site. That menu features submenus, which I believe is done thru CSS, and this is broken with the ABE rule enabled, such that hovering over a particular menu no longer shows a submenu.

This is also happens when logging into mail.yahoo.com and having a classic interface, where the mail listing stylesheet is not loading properly. Visiting the spam folder have this line %40B%40Bulk showing, a sign which means ABE is interfering with something. Having the User ABE rule disabled and refreshing the page fix the issues.

So far I have only seen the User ABE rule affecting the sites I visit in yahoo.

I'd be glad to provide further information on this.

Some further reading on XSRF and ABE has revealed that the above ruleset is very generic in nature--that it doesn't take into account the complex cross-domain relationships some sites have. It breaks to a certain extent some pages when the rule enforces same-origin requests, and that it modifies the requests that does not fall into this policy.

Some sites that get resources, like stylesheets or javascript, from remote servers like content delivery networks (CDN) or imaged (mirrored) servers are setup to require that the proper cookies or authentication be sent along with the unmodified requests in order to process the same. Because of the generic rule, it doesn't take this into account, thus modifying the request and stripping the necessary authentication, thereby breaking the page because those resources cannot be processed.

Of course making exceptions for sites that are affected may be too cumbersome because one needs to study the page elements being requested by the site to some remote servers, and determine, at the bare minimum, the required cross-domain requests that need to pass through to provide bare functionality for the site.

On to the other issue with the UI, I guess nobody finds that odd to share their opinion, so I will pass over that minor, non-breaking issue.

Thank you Mr. Maone for you're great add-on. And looking forward to your enhancement on ABE's frontend, bringing it on the same usability for the average joe like Request Policy, now that I appreaciate how granular and flexible your implementation can be.