NoScripters and WebSec nerds of all lands, unite!
https://forums.informaction.com/
References are very sparse, but CAPS for property access control is already dead, even though its corpse may still contract sometimes, see https://bugzilla.mozilla.org/show_bug.cgi?id=453928#c0 for instanceal_9x wrote: You mentioned that CAPS is scheduled for removal, could you point to some Mozilla info about that, Bugzilla, wiki, whatever exists?
Domain-wide script execution control. Notice that NoScript 3 currently does not use CAPS at all, though.al_9x wrote: How much of it will be left for the sake of NS?
Nothing of declarative and user-facing, I'm afraid. A combination of page-level surrogates (or pagemods, or whatever can run user scripts before anything else) and Proxies, maybe.al_9x wrote:Is there going to be any replacement functionality?
It's a CAPS design flaw: even though CAPS does support multiple policies, if the same site is listed in two different policies the results are unpredictable. Therefore, you can use multiple policies as long as their site lists have no intersection (making NoScript generally incompatible with any other site-level policy).al_9x wrote:Is it currently possible to add additional policies with NS installed? What's the trick, it doesn't seem to work?
[*] If not possible, I am curious as to why, since CAPS supports multiple policies.
Does that mean that to apply a different CAPS policy to a site, you would need to leave it untouched (default-denied) in NoScript?Giorgio Maone wrote:It's a CAPS design flaw: even though CAPS does support multiple policies, if the same site is listed in two different policies the results are unpredictable. Therefore, you can use multiple policies as long as their site lists have no intersection (making NoScript generally incompatible with any other site-level policy).al_9x wrote:[*] If not possible, I am curious as to why, since CAPS supports multiple policies.
Exactly, otherwise it would be automatically added to NoScript's "maonoscript" policy.Thrawn wrote: Does that mean that to apply a different CAPS policy to a site, you would need to leave it untouched (default-denied) in NoScript?
Code: Select all
user_pref("capability.policy.mycustompolicy.javascript.enabled", "allAccess");
Yes, but it requires extreme care for the reasons explained above.Thrawn wrote: And is it possible for users to tweak the 'trusted'/'untrusted' policies by adding entries to prefs.js?