Page 1 of 1

[Enhancement] Option to ALWAYS block embedded content

Posted: Sun Feb 05, 2012 2:13 am
by an_addon_user
FlashBlock always blocks flash, even if you allow a specific flash and reload the page (or view another page including the same flash), it would remain (or again be) blocked.
NoScript can be configured to block embeds; however, if you allow a specific embed, it remains allowed -- see features.
Granted, with NoScript, you could revoke temporary permissions; however, this is not desirable to do after every embed view.

Had been using both NoScript and FlashBlock -- the latter just to keep flash blocked across reloads and different pages of a site that included the same flash.
However, recent changes in the latest nightlies prevent FlashBlock from restoring a blocked flash.
As such, need an alternative to keeping embedded content blocked across pages and reloads (even if it was allowed previously).

Enhancement Request: Option to ALWAYS block embeds on every load, regardless if permitted previously.

Note that this is likely the primary use case for those with both NoScript and FlashBlock installed.
This enhancement would allow such users to remove FlashBlock entirely.

Thanks!

Re: [Enhancement] Option to ALWAYS block embedded content

Posted: Sun Feb 05, 2012 2:02 pm
by therube

Re: [Enhancement] Option to ALWAYS block embedded content

Posted: Tue Feb 07, 2012 7:34 am
by GµårÐïåñ
First off, Flashblock, EASILY defeatable, watch for my POC on it soon or look for a leaked version. Second, you can already do that in NS, simply check all the embedded you want blocked, check that it should apply to trust as well and it will always block. You can click on them to temp allow them but they won't stay allowed after you switch to another content. Let me know if anything else.

Re: [Enhancement] Option to ALWAYS block embedded content

Posted: Tue Feb 07, 2012 7:35 am
by GµårÐïåñ

Re: [Enhancement] Option to ALWAYS block embedded content

Posted: Tue Feb 07, 2012 7:40 am
by therube
(Oops. You're right. I was getting my FF #'s confused. Not applicable to 10, but rather 13.)

Re: [Enhancement] Option to ALWAYS block embedded content

Posted: Tue Feb 07, 2012 10:32 pm
by GµårÐïåñ
therube wrote:(Oops. You're right. I was getting my FF #'s confused. Not applicable to 10, but rather 13.)
Not a problem, no harm no foul. Just trying to make sure you were on the same page.

Re: [Enhancement] Option to ALWAYS block embedded content

Posted: Thu Feb 09, 2012 8:48 pm
by an_addon_user
GµårÐïåñ wrote:First off, Flashblock, EASILY defeatable, watch for my POC on it soon or look for a leaked version.
FlashBlock defeatable? In what regard? If true, this would seem to further the case to implement this RFE so users can drop FlashBlock...
GµårÐïåñ wrote:Second, you can already do that in NS, simply check all the embedded you want blocked, check that it should apply to trust as well and it will always block. You can click on them to temp allow them but they won't stay allowed after you switch to another content. Let me know if anything else.
Are you using a patched version of NoScript ... or perhaps did you misunderstand the RFE?

Even with all embeddings blocked AND blocking on trusted sites as well, NoScript does not ALWAYS block the embed. Yes, it will block the embed by default, but it will cease to block the embed if you have allowed the blocked embed previously (eg clicked the placeholder to get the original content to load). Then embed remains ALLOWED (not blocked on page load) until the end of the session or until you clear temporary permissions. See the NoScript features page (link in OP), which states (emphasis added):
NoScript Features wrote:The [embed] will stay enabled until the end of the session or until you Revoke Temporary Permissions.
Try it:
  1. Load a page with a embed, eg a flash video
  2. See NoScript block the embed (expected behavior)
  3. Hit reload
  4. See the embed loads and is not re-blocked by NoScript (not desired, hence this RFE)
IIRC, this can also occur (perhaps in limited circumstances) if NoScript blocks a flash, you allow it, then you browse to another page (perhaps it must be on the same domain), and that new page includes the same flash from the old page. Regardless, this RFE is for an option to *ALWAYS* block and re-block embeds, even if manually allowed previously.

Note that it is the continued blocking after allowing an embed (eg clicking on the placeholder), that is requested by this RFE.

Re: [Enhancement] Option to ALWAYS block embedded content

Posted: Fri Feb 10, 2012 5:36 pm
by GµårÐïåñ
an_addon_user wrote:FlashBlock defeatable? In what regard? If true, this would seem to further the case to implement this RFE so users can drop FlashBlock...
Very easily so and with NS, FlashBlock is neither necessary nor any more particularly effective as when they were told how easily their addon can be defeated they outright expressed, they don't care to fix it as their tool is not a privacy tool and therefore does not need to account for every variation.

Again as stated, NS ALREADY blocks Flash on both trusted, untrusted (aka either/or AND permanent) which also allows you to temporarily allow something to use and then on another incarnation you still have to allow again, it won't retain the permission. So I am not sure why you think what you are saying in an RFE when in fact its already a feature and has been for ages. I told you how to use it, so you either didn't try or don't get it. Let me know which so I tailor the answer better.
Are you using a patched version of NoScript ... or perhaps did you misunderstand the RFE?
No, this is a function that has been at NoScript's core for a LONG time and I didn't misunderstand what you are improperly referring to as an RFE, its describing a feature already there. If you wish to know how to actually use it, let us know and we'll walk you through it, but otherwise, its there. Read this and if you still feel you are contributing something new, we'll talk: http://noscript.net/features#contentblocking
Even with all embeddings blocked AND blocking on trusted sites as well, NoScript does not ALWAYS block the embed. Yes, it will block the embed by default, but it will cease to block the embed if you have allowed the blocked embed previously (eg clicked the placeholder to get the original content to load). Then embed remains ALLOWED (not blocked on page load) until the end of the session or until you clear temporary permissions. See the NoScript features page (link in OP), which states (emphasis added):
NoScript Features wrote:The [embed] will stay enabled until the end of the session or until you Revoke Temporary Permissions.
Try it:
  1. Load a page with a embed, eg a flash video
  2. See NoScript block the embed (expected behavior)
  3. Hit reload
  4. See the embed loads and is not re-blocked by NoScript (not desired, hence this RFE)
Yes I am aware of the post you are referring to but my experience has always been that when restrictions are applied to both trusted/untrusted sites, when temp allowing a resource by clicking on its placeholder, temporarily allows THAT particular embed and not ALL embeds for that domain by default. The one you allowed to temporarily run, YES, will remain allowed until you say to undo it, that's a logical behavior. YOU chose to temp allow it because you must have wanted to, so when you are done wanting to, then undo it or wait until it expires per session. That doesn't and shouldn't need an RFE to account for behavioral process of a user within the confines of predetermined and expected program behavior and function. NS is doing what is supposed to do and been instructed to do. Additionally, if you have the box checked that says ALWAYS ask me before temp allowing a blocked embed, then it will prompt you for permission EACH time. All the features combined are comprehensive enough that this so called RFE should not be necessary and is frankly contraindicated.
IIRC, this can also occur (perhaps in limited circumstances) if NoScript blocks a flash, you allow it, then you browse to another page (perhaps it must be on the same domain), and that new page includes the same flash from the old page. Regardless, this RFE is for an option to *ALWAYS* block and re-block embeds, even if manually allowed previously.

Note that it is the continued blocking after allowing an embed (eg clicking on the placeholder), that is requested by this RFE.
Given the options under Embeddings to block various types, applying them to trusted as well, checking to block every object from untrusted, and ask for confirmation before temp allowing has always yielded the most desired response to what you are asking. I have never personally seen a condition where having these settings you would have something wildly allow itself on the same domain or not simply because you temp allowed something. Additionally, you temp allow it, you can unallow it, you are expecting the program to somehow mind read when you are done doing whatever you temp allowed and block it again for you. How do you suggest it does that? On reload of the page, that happens when you temp allow, so that would by your logic reblock it, because you expect anything temp allowed to permanently revert back to blocked. Second reload? Closing the tab? Already sufficient implementation to allow for that. Your "RFE" makes no sense but you know what I am not the one writing the code and if Giorgio feels this is something he wants to add or can find a useful means to add it or has a practical place, so be it, his call to make. So I have put in my two cents, I will defer any further decision on your "RFE" to Giorgio.

If he hasn't read or responded on his own, I will point him via PM to take a look and post a response.

Re: [Enhancement] Option to ALWAYS block embedded content

Posted: Sat Feb 11, 2012 5:22 am
by an_addon_user
GµårÐïåñ wrote:Yes I am aware of the post you are referring to but my experience has always been that when restrictions are applied to both trusted/untrusted sites, when temp allowing a resource by clicking on its placeholder, temporarily allows THAT particular embed and not ALL embeds for that domain by default. The one you allowed to temporarily run, YES, will remain allowed until you say to undo it, that's a logical behavior. YOU chose to temp allow it because you must have wanted to, so when you are done wanting to, then undo it or wait until it expires per session.
This is exactly the RFE -- adding an option such that the one you allowed to temporarily run will *NOT* remain allowed until you say to undo it, but rather will be re-blocked on the next load.

At least in the case of flash video, many sites use a single "player" SWF and vary content through parameters. As such, if you watch even one video, the embed will load on all subsequent pages -- even if you don't want to watch the next video. A good example of this would be opening several video pages in separate tabs -- even if you want to view the videos, you might want to only load the flash one at a time -- instead of having a number of background tabs loading flash and wasting memory and other resources. It gets worse if the site links videos from multiple different hosts, each with different players. You get a few sites like this across multiple tabs, and flash can consume significant resources! Yet if the exact same tabs are open and flash is blocked, there is no memory / resource concern.

This is not so much a privacy concern (after all, you already opted-in to allow the content once), but rather the argument seems to be the same as / similar to the one raised by FlashBlock -- being able to block all embeds all the time unless you actually want to view the content.

Hence why I currently use both NoScript and FlashBlock. Are you implying that FlashBlock presents vulnerabilities even if used in tandem with NoScript?
GµårÐïåñ wrote:Given the options under Embeddings to block various types, applying them to trusted as well, checking to block every object from untrusted, and ask for confirmation before temp allowing has always yielded the most desired response to what you are asking.
This *IS* my existing configuration! I have all embedding types checked, blocking every object from sites marked untrusted, applying the restrictions to whitelisted sites as well, and showing a placeholder.

I want to be able to block embeds like FlashBlock:
  1. Load a page, flash is replaced with a placeholder
  2. Decide you want to view the flash, click the placeholder
  3. Placeholder is replaced with original flash for you to view
  4. Reload the page
  5. The flash you just viewed is blocked again -- if you want to view it again, click the placeholder again
Again, the RFE is to add an option such that the one you allowed to temporarily run (by clicking the placeholder) will *NOT* remain allowed until you say to undo it, but rather will be re-blocked on the next load. Effectively changing the authorization from "allow the embed at this URL until session expires" to "allow this specific placeholder to be replaced with the embed at this URL, but if this URL is embeded elsewhere or this page is reloaded, block it".

Re: [Enhancement] Option to ALWAYS block embedded content

Posted: Sat Feb 11, 2012 5:42 am
by GµårÐïåñ
I have referred the discussion to Giorgio and bowing out, good luck.