InformAction Forums

Posted: **Tue Nov 15, 2011 1:32 am**

For the past few weeks, I've noticed a minor annoyance that I've finally traced to NoScript.

Some Google search results, when I click on them, do nothing. For example, if I search for "Facebook", the first result, to facebook.com, doesn't do anything when I click on it. The next one, to Wikipedia, does work.

A site I enjoy visiting, Google Sightseeing, posts interesting street views. The problem is, the streetviews, who used to work, no longer do. Here's a link that doesn't display the streetview in my browser with NoScript: http://googlesightseeing.com/maps?tw=13 ... ,-43.49338 (none of them seem to work for me in Firefox, they work in Chrome and IE).

Google Streetview, on Google's site, does work.

When I disable NoScript, everything works properly. I've tried uninstalling NoScript (everything works) and re-installing it (those two things stop working).

I have version 2.1.9 with Firefox 8.0.

I've tried resetting NoScript to go back to default settings and Google Sightseeing still doesn't work.

Oh! And the Captcha when I entered this post is not displaying in Firefox even though all the scripts have been temporarily allowed on this page. I'm stuck using Chrome to post this!

Posted: **Tue Nov 15, 2011 7:09 am**

claudemarcotte wrote:For the past few weeks, I've noticed a minor annoyance that I've finally traced to NoScript.

Some Google search results, when I click on them, do nothing. For example, if I search for "Facebook", the first result, to facebook.com, doesn't do anything when I click on it. The next one, to Wikipedia, does work.

On Firefox 3.6.24, the first Facebook link works fine once I (temporarily) allow the Facebook scripting. Also, if you have the RequestPolicy add-on for Firefox, requests from Facebook to fbcdn (Facebook Content Delivery Network) must be allowed or temp-allowed.

A site I enjoy visiting, Google Sightseeing, posts interesting street views. The problem is, the streetviews, who used to work, no longer do. Here's a link that doesn't display the streetview in my browser with NoScript: http://googlesightseeing.com/maps?tw=13 ... ,-43.49338 (none of them seem to work for me in Firefox, they work in Chrome and IE).

The link you provided worked fine, once I (temporarily) allowed a lot of scripting, from googlesightseeing, googleapis, maps.google, maps.gstatic.
And in RequestPolicy, allowing requests from googlesightseeing to google, googleapis, and gstatic.

I can re-check this on Firefox 8.0 in a few minutes, but if you see this first, please ensure that all of the above are allowed or temporarily allowed.

I've tried resetting NoScript to go back to default settings and Google Sightseeing still doesn't work.

From FAQ 1.5, the default whitelist includes the scripting for basic Google services, but googlesightseeing is not among them. So no, one would not expect the defaults to work here.

Oh! And the Captcha when I entered this post is not displaying in Firefox even though all the scripts have been temporarily allowed on this page. I'm stuck using Chrome to post this!

Did you allow scripting from recaptcha.net as well as from this site? And if you have ReqPol, must allow requests to recaptcha.net. You may or may not see a "blocked object" from recaptcha.net, but if so, temporarily allow it. Then the recaptcha will appear.

Sorry for all the trouble, and for forcing you to use an inferior browser.

It might actually be faster to register than to do all that, but we do get our share of spammers. NoScript is doing you a service by not allowing these potentially-harmful types of executable content to load without your permission, even though these particular ones may be OK. And Chrome did *not* protect you from executable content.

Cheers.

Posted: **Tue Nov 15, 2011 7:52 am**

Same results on Firefox 8.0: Both the Facebook link and the car-parking view work fine when the above list of scripts is allowed or temp-allowed.
If you have RequestPolicy, same permissions must be given, temporary or otherwise.

I could move the car picture around with the mouse as desired.

Please let us know whether this solves your problem, so that we can mark the topic as resolved.
If it does not, please advise what other extensions you have.
Also, please copy any red error messages, and any blue NoScript messages, from the Firefox Tools > Web Developer > Error Console and paste them here.

Thank you.

Posted: **Tue Nov 15, 2011 11:02 pm**

I'm sorry, but the "You Got Stallown3D!1" is not only scary, but it's completely unhelpful.

I spent the day scanning my PC for malware.

Thankfully I had saved what I wanted to post:

Thank you for answering, Tom!

I don't have the Request Policy addon and I use Facebook without any problems. It's not just Facebook links that don't work from Google, it was the first example I could come up with. I found another one: I searched for "twitter about" (without the quotes). The second result, going to twitter.com/about, doesn't work. The NoScript icon shows nothing blocked.

I didn't have maps.google, maps.gstatic allowed on the page, but they're not on the list from NoScript. I did add them to the whitelist but it had no effect.

From the error console:

Error: _gat is not defined
Source File: (long URL from Googlesightseeing I can't post without seeing the ridiculous (and not funny) Stallone image)

Line: 218

recaptcha.net is allowed. I do have AdBlock and I checked to make sure the image wasn't being blocked, but no...

Okay, as to the add-ons I have:

Adblock Plus 1.3.10
Add-on Compatibility Reporter 0.9.3
Disconnect 1.0.1
DownloadHelper 4.9.7
DownThemAll! 2.0.8
Echofon 2.3.3
Element Properties 6
F.B. Purity - Cleans Up Facebook 5.5.0
Farkode(TM) 3.0.7
Garmin Communicator 3.0.1
Greasemonkey 0.9.13
Media Converter 1.0.3
New Tab Homepage 0.4.3
NoScript 2.1.9
Page Info Button 0.2.0.1
Permit Cookies 0.6.2

All are up-to-date, except for a couple I've fudged the max version of Firefox (like Farkode, which I find extremely useful and is no longer being updated).

No worries about the trouble, I totally understand about Spammers. I've noticed that Chrome sucks with streetview, it's all jerky!

Claude

Posted: **Wed Nov 16, 2011 2:42 am**

claudemarcotte wrote:I'm sorry, but the "You Got Stallown3D!1" is not only scary, but it's completely unhelpful.

I spent the day scanning my PC for malware.

Sorry for the scare. You'll have to take that up with Giorgio.

Thankfully I had saved what I wanted to post:

Side note: I've often found it useful to compose in a text editor (Wordpad being a common choice for moi), or to periodically save long posts to such a document, for just that reason. I hate losing a message that's 3/4 complete because something crashed or I hit a wrong button. Glad you did.

I don't have the Request Policy addon and I use Facebook without any problems. It's not just Facebook links that don't work from Google, it was the first example I could come up with. I found another one: I searched for "twitter about" (without the quotes). The second result, going to twitter.com/about, doesn't work. The NoScript icon shows nothing blocked.

I have a hunch, but for now, let's just say that I tried exactly what you did, and it immediately took me to twitter.com/about. Of course, the page did not display correctly until I allowed twitter's scripts, but the point is that it took me to that URL immediately. I see no reason to try on 8.0. Moving on...

I didn't have maps.google, maps.gstatic allowed on the page, but they're not on the list from NoScript.

This is a nasty web trend, in which you allow the scripts that show up when you first visit the page, but they then call scripts from other sources. Which don't show until you look again at the NS menu. Sometimes, this happens through three or four iterations.

So you need to keep an eye on the NS logo after each allow and page reload. If it turns from blue (all allowed) to any portion of red, something new is being blocked. Annoying, but common.

I did add them to the whitelist but it had no effect.

Please don't take this the wrong way, but it's risky to assume anything. You knew that I was abbreviating (my posts are too long already, lol), and that the whitelist entries should have the .com or whatever, correct?
maps.google.com
maps.gstatic.com etc.

From the error console:

Source File: (long URL from Googlesightseeing I can't post without seeing the ridiculous (and not funny) Stallone image)

If you wrap it in "code" tags, it should post with no trouble. They're non-clickable, non-search-engine, etc., and so can't be spam or malice, unless someone copies and pastes it from there to their browser address bar. E. g.:

Code: Select all

http://googlesightseeing.com/maps?tw=1359&layer=c&spn=0.001104,0.001703&hl=pt-BR&t=h&ll=-20.3849,-43.493272&z=19&cbp=13,312.08,,1,14.89&cbll=-20.38495,-43.49338

Just select the whole URL in your "compose" box, and click "Code" in the toolbar above. Or manually:

Code: Select all

[code]URL

[/code].
(Note that I had to wrap the "code" raw elements in code tags to display them as written, rather than being parsed by the browser as actual code.)

recaptcha.net is allowed. I do have AdBlock and I checked to make sure the image wasn't being blocked, but no...

Also Firefox Tools > Content > "Load images automatically" is checked, and there is nothing in the Exceptions box about recaptcha? Long shot, but might as well rule it out.

Okay, as to the add-ons I have:

Adblock Plus 1.3.10
Add-on Compatibility Reporter 0.9.3
Disconnect 1.0.1
DownloadHelper 4.9.7
DownThemAll! 2.0.8
Echofon 2.3.3
Element Properties 6
F.B. Purity - Cleans Up Facebook 5.5.0
Farkode(TM) 3.0.7
Garmin Communicator 3.0.1
Greasemonkey 0.9.13
Media Converter 1.0.3
New Tab Homepage 0.4.3
NoScript 2.1.9
Page Info Button 0.2.0.1
Permit Cookies 0.6.2

An extension conflict is possible. Could you please perform the Standard Diagnostic, and advise of the results? Thanks.

Tom

Posted: **Wed Nov 16, 2011 3:24 am**

This is a nasty web trend, in which you allow the scripts that show up when you first visit the page, but they then call scripts from other sources.

Yep, I noticed that happening on some pages. On the Google Sightseeing (and the Google search) pages, the NoScript icon is white and there are no scripts blocked.

Please don't take this the wrong way, but it's risky to assume anything. You knew that I was abbreviating (my posts are too long already, lol), and that the whitelist entries should have the .com or whatever, correct?
maps.google.com
maps.gstatic.com etc.

LOL! Actually, I felt pretty dumb when I checked and realized that's exactly what I had done. Doh! However, when I was done laughing at myself and tried entering the .com versions, it didn't work because I already had google.com and gstatic.com whitelisted.

Thanks about the code tag tip. I didn't know about that one. I tried using the URL code but it didn't work either.

Also Firefox Tools > Content > "Load images automatically" is checked, and there is nothing in the Exceptions box about recaptcha? Long shot, but might as well rule it out.

"Load images automatically" is checked. The Exceptions box is empty.

An extension conflict is possible. Could you please perform the Standard Diagnostic, and advise of the results? Thanks.

Okay. I did start Firefox in safe mode before posting here yesterday, and I didn't have any problems with Google Sightseeing. I also started disabling extensions one by one but I didn't get very far before I narrowed down the problem to NoScript (I tried AdBock, and then NoScript). Perhaps what's left for me to do, unless you tell me that hunch of yours

is to disable the other extensions while keeping NoScript running and testing both Google Sightseeing and Google search.

Thank you, Tom.

Claude

Posted: **Wed Nov 16, 2011 4:07 am**

claudemarcotte wrote:
Tom T. wrote:An extension conflict is possible. Could you please perform the Standard Diagnostic, and advise of the results? Thanks.
Okay. I did start Firefox in safe mode before posting here yesterday, and I didn't have any problems with Google Sightseeing. I also started disabling extensions one by one but I didn't get very far before I narrowed down the problem to NoScript (I tried AdBock, and then NoScript). Perhaps what's left for me to do, unless you tell me that hunch of yours is to disable the other extensions while keeping NoScript running and testing both Google Sightseeing and Google search.

That is exactly what to do, except I'd do it the other way around: (shortcutting some of that Standard Diagnostic)

Create a clean profile from scratch.
Install *only* NoScript.
Ensure that all of the above sites are allowed. If you don't want to go through the hassle of the repetitive menu refreshes, you can whitelist them, since this profile is just for diagnostic purposes anyway.

googlesightseeing.com
googleapis.com
maps.google.com
maps.gstatic.com

and see what happens.

unless you tell me that hunch of yours is to disable the other extensions

Yes, exactly. My hunch was an extension conflict, especially with some of them having been, uh, "fudged" is how I think you put it.

Also, in the interest of covering all possibilities, all of this is on the English-language Google sites, not French?
And your computer and browser are localized for English, not French, when this happens?

Thank you, Tom.

You've very welcome.

Posted: **Thu Nov 17, 2011 12:29 am**

We have a winner!

The problem was not with a "fudged" extension (phew). I fudge them because I want to be able to keep using them after their authors have abandoned them and nobody's come up with a replacement.

Also, in the interest of covering all possibilities, all of this is on the English-language Google sites, not French?
And your computer and browser are localized for English, not French, when this happens?

Aside from a few Emails, everything on my computer, its setup, its OS and its software is in English. I hate, with a passion, coming to a site and having it assume that because I'm located in Quebec, I want the page displayed in French. So I never tested the problem with French web sites.

Okay, so the culprit was Disconnect 1.0.1 (stops major third-parties from tracking the pages you go to). No big deal, I delete all my browser's cookies when I exit Firefox with the exception of the cookies I've specified with the extension Permit Cookies. So third-parties can set their cookies, they just get deleted at the end of the day.

Since I don't visit Google Sightseeing every day, I didn't notice it had stopped working after I installed Disconnect.

I've also tested the Google search with "Facebook" and "Twitter about" and the results also work. What's odd is that Google Sightseeing and Google search are not technically related (GS is not owned by Google), and not every Google search result failed to work (then again, their links are less than straightforward!).

Thank you again, Tom! You've helped me solve my problem!

Posted: **Thu Nov 17, 2011 1:31 am**

claudemarcotte wrote:Okay, so the culprit was Disconnect 1.0.1

Another hunch pans out! ... of course, even a clock that doesn't run at all is right twice a day.

(stops major third-parties from tracking the pages you go to). No big deal, I delete all my browser's cookies when I exit Firefox with the exception of the cookies I've specified with the extension Permit Cookies. So third-parties can set their cookies, they just get deleted at the end of the day.

Better just not to permit them in the first place. I need to refresh my memory on the F8 GUI, as I prefer to browse with 3.6.x.

On F3, > Tools > Options > Privacy, I choose "Use custom settings for history", then uncheck "Private Browsing", uncheck the next three "Remember".
Then check "Accept cookies from sites", but uncheck "Accept third-party cookies". No more third-party cookies, ever!

"Keep until" = "ask me every time."
Check "Clear history when Firefox closes." (One should always close and re-open Fx before and after sensitive operations such as online banking, anyway.)
When a site asks to set cookies, "Remember this setting" is checked by default, and the choice is either "deny" or "Session only". So even "permanent" cookies are dumped at the end of the session.
(I don't care to store permanent cookies. They can make logins convenient, but anyone who gets access to your computer can be logged in as you. Or if a remote cookie-stealing attack were to succeed ... but I'm the paranoid type.

)

To me, this gives the benefits of Private Browsing mode, but with more flexibility to adapt as needed. IMHO. Everyone's mileage will vary, of course.
Will re-check on F8 in a few minutes.

Thank you again, Tom! You've helped me solve my problem!

You're very welcome!

btw, don't take "Invalid" as a personal reference or insult.

It just means that the problem was not a valid issue in NoScript.

Posted: **Thu Nov 17, 2011 1:47 am**

On Fx 8.0, I use the same settings, adding the "Do Not Track" option FWIW (not much, lol), and on "Clear History > Settings", I check all of the top ones. None of the bottom ones are allowed to be stored in the first place.
"Location bar suggest" = nothing.

Personal opinion only, but it does eliminate the need for the add-on that caused your problems.
Everyone has their own personal preferred level of privacy, so of course others will do differently. Isn't freedom of choice cool?

Posted: **Thu Nov 17, 2011 12:18 pm**

I used to not accept third-party cookies, but a few sites refuse to work without them (grrrrrr...).

The Permit Cookies extension was a suggestion from Steve Gibson (I've been listening to his Security Now podcast since almost the beginning).

As for history and access to my computer, I'm not terribly worried. Wired connection, router, firewall.

And yes, that add-on is gone.

I love freedom of choice!

I'm not sure why "invalid" was added to the topic name. Is it because it's easier to blame "the other guy"? Maybe it's NoScript that has the bug and can't play nice with this other (although useless!) extension.

Still, NoScript is a terrific extension and I'm not ready to give THAT one up!

Thank you for all your help, Tom!

Claude

Posted: **Thu Nov 17, 2011 11:56 pm**

claudemarcotte wrote:I used to not accept third-party cookies, but a few sites refuse to work without them (grrrrrr...).

Could you name some? I'd like to try them and see if there's a work-around for that. I've never had a site fail to work with 3rd-party cookies blocked (my default setting).

The Permit Cookies extension was a suggestion from Steve Gibson (I've been listening to his Security Now podcast since almost the beginning).

I use to read it quite regularly. Great source of info. He was a bit off about NoScript at first, but then became quite a supporter, and has plugged it several times. His other info is usually very good also, and he explains things in low-tech language.
His "Shields Up!" firewall tester and his random-password generators are great free tools, although Password Safe usually generates them for me now -- configurable as to each site's parameters for acceptable passwords. Great guy.

As for history and access to my computer, I'm not terribly worried. Wired connection, router, firewall.

None of which stops history attacks. The firewall has to allow the browser. Attacks directed at the browser's history would not be stopped. Having the browser not save history helps, and NoScript stops the script-based ones, which is most of them.

I'm not sure why "invalid" was added to the topic name. Is it because it's easier to blame "the other guy"? Maybe it's NoScript that has the bug and can't play nice with this other (although useless!) extension.

Giorgio would have to analyze the code of the other, and of all the other extensions that over time have been found to have conflicts. That's a lot of time that could be better spent. Once or twice, the presence of NS has caused issues with FX, and a bug report was filed with Fx. Here is one such example, and it was marked "Closed", if the semantics make you happier.

If you wish, make another clean profile, install only Disconnect, and see if it affects anything. But regardless of the outcome, it's agreed that NS stays, as you said further down.

Giorgio tries very hard to code to Mozilla's standards and requirements. Not all add-on developers are so conscientious, especially the special-purpose or less popular ones that do not become full-time jobs for the developer, as NS has become for Giorgio. (He wrote the first small version for his own personal use, in about three hours, I think, and the rest, as they say, is history.

)

Still, NoScript is a terrific extension and I'm not ready to give THAT one up!

Kinda' like the American Western film genre: If this town isn't big enough for both of us, probably the other guy should leave. NoScript is always the first thing I install on a new browser (or urge friends to), and would be the last thing I'd ever get rid of. Safety first, then privacy, then waaay down the list are convenience, personal themes, bells, whistles, etc. ... agreed?

Thank you for all your help, Tom!

And thank you for your full and timely cooperation, which made it a pleasure to work with you on this issue.

Tom

Posted: **Fri Nov 18, 2011 2:04 am**

Could you name some?

I wish I could, but it's been over a year. I've forgotten which sites gave me trouble. Sorry!

None of which stops history attacks. The firewall has to allow the browser. Attacks directed at the browser's history would not be stopped. Having the browser not save history helps, and NoScript stops the script-based ones, which is most of them.

Hopefully it will be enough. I like keeping a history, knowing which site I went to a few days earlier.

No worries about the semantics, really, it just seems that "invalid" is a strong word. I guess I would have preferred "Solved!" because it *was* solved. It wasn't a case of me being clueless, like "doh, I didn't realize there were options in NoScript!" that would have corrected the problem. Then again, it's not technically solved as the issue still exists between NoScript and Disconnect. It's just become moot.

I do know that if I disable NoScript, I don't have any problems with Disconnect on those sites.

NoScript is always the first thing I install on a new browser (or urge friends to), and would be the last thing I'd ever get rid of. Safety first, then privacy, then waaay down the list are convenience, personal themes, bells, whistles, etc. ... agreed?

Agreed. I just keep a list of the extensions I need to add when I install Firefox. I like that I can just copy my Firefox profile from my desktop to my laptop (when I travel) and everything follows, including the extensions.

And thank you for your full and timely cooperation, which made it a pleasure to work with you on this issue.

You're welcome, and thank you.

I've been using computers since 1981, PCs since 1983, and when I started working as a computer operator in 1988, I only had a dumb terminal in front of me (a VT220!). People would call me for Windows 3.1 tech support, even though it wasn't my job. I would help them from memory. I don't do that job anymore, but people still come to me for tech support.

Claude

Posted: **Fri Nov 18, 2011 3:34 am**

claudemarcotte wrote:No worries about the semantics, really, it just seems that "invalid" is a strong word. I guess I would have preferred "Solved!" because it *was* solved. It wasn't a case of me being clueless, like "doh, I didn't realize there were options in NoScript!" that would have corrected the problem. Then again, it's not technically solved as the issue still exists between NoScript and Disconnect. It's just become moot.

"Moot" isn't in our approved list of topic classifiers.

"Closed" has been used for, say, RFE's that are withdrawn or denied, or for "moot", or other catch-alls meaning, "Hey, rest of team, don't spend any time on this one".
"Resolved" seems to be reserved for genuine bugs attributable to an error in NoScript that is corrected in a later build, or as you said, a user being enlightened in how to solve their issue by configuration, etc.
I've been, uh, "corrected" for *not* using "Invalid" when there proved to be no known issue in NS. I agree it may sound like an insult to the OP, which is why I added that disclaimer a few posts up. But it does let Giorgio and all other team members know at a glance that nothing has to change in NS based on that thread.
Syntax... In the coding world, everything is syntax, correct commands, variables, constants, modifiers...

I've been using computers since 1981, PCs since 1983, and when I started working as a computer operator in 1988, I only had a dumb terminal in front of me (a VT220!). People would call me for Windows 3.1 tech support, even though it wasn't my job. I would help them from memory. I don't do that job anymore, but people still come to me for tech support.

I don't know if it's still true in Vista/7, but in XP, %windir%\system (the back-compatibility folder for legacy apps) still has a file, setup.inf, which is the setup file for installing Win 3.1

.... XP came out in 2001, but I didn't get it until 2005, OEM-preloaded with SP2, and they still think that they need a setup file for 3.1?

(truth: seems they never comb through and purge the obsolete stuff. I did a major slimming of XP, and was amazed at the number of obsolete/useless/irrelevant OS files that were found.)

Posted: **Sat Nov 19, 2011 4:20 pm**

Thanks again, Tom.

InformAction Forums

[INVALID] Problems with Google search, Google Sightseeing

[INVALID] Problems with Google search, Google Sightseeing

Re: Problems with Google search, Google Sightseeing

Re: Problems with Google search, Google Sightseeing

Re: Problems with Google search, Google Sightseeing

Re: Problems with Google search, Google Sightseeing

Re: Problems with Google search, Google Sightseeing

Re: Problems with Google search, Google Sightseeing

Re: Problems with Google search, Google Sightseeing

Re: Problems with Google search, Google Sightseeing

Re: [INVALID] Problems with Google search, Google Sightseein

Re: [RESOLVED!] Problems with Google search, Google Sightsee

Re: [RESOLVED!] Problems with Google search, Google Sightsee

Re: [SOLVED!] Problems with Google search, Google Sightseein

Re: [SOLVED!] Problems with Google search, Google Sightseein

Re: [INVALID] Problems with Google search, Google Sightseein