entwash wrote:I have tried that but when I relaunch Firefox it is no longer in the Untrusted list - it is blocked as an unknown domain but not as an Untrusted. Basically I have site xyz marked as Untrusted so visits to other sites that pull scripts from xyz are blocked, but if I visit the site directly and need the scripts to run I want to be able to temporarily allow it, with it remaining in the Untrusted list when I relaunch Firefox or clear temporary permissions. Running Firefox 7.0.1 with NoScript 2.1.5.
Hmm... you're right.
I mark scripts as Untrusted because I truly *never* want to see them again: they're evil in some way, usually privacy-invasive (data-miners and such).
If I think one might be needed once in a great while, it's left in the default zone, which of course is "block". (default-deny). And is the same level of protection as Untrusted. The only purpose of Untrusted is to shorten the menu when you open it, really -- so you don't keep seeing the same unwanted scripts every time.
(Or to prevent your novice spouse/parent/child/significant other/etc. from allowing it out of ignorance or accident.)
Which is why I didn't even realize that they'd be returned to default zone -- I've almost never gone down that path. Sorry.
However, other than shortening the menu, you are still fully protected in your scenario:
Basically I have site xyz marked as Untrusted so visits to other sites that pull scripts from xyz are blocked, but if I visit the site directly and need the scripts to run I want to be able to temporarily allow it, with it remaining in the Untrusted list....
It goes back to the default-deny list, but they're every bit as much blocked as if marked Untrusted. Launching Firefox anew, or revoking the temp permissions, will definitely prevent other sites from pulling scripts from xyz.
Is this good enough, knowing that you are in fact protected under the current system? If not, we'll see what Giorgio says, but please be assured that anything that isn't specifically allowed, or temp-allowed (and not revoked), is most surely blocked.
p. s.: Are you aware that for pages that *require* that you run certain common scripts that many people regard as undesirable -- google-analytics.com being the very first example -- NoScript *by default* runs a
Surrogate Script that makes the page happy, so it works, but doesn't send any of your personal info to the data-miner? Just leave them blocked, and the surrogate will run automatically - and safely.