Enable/Disable Contact Menu on Tray Icon

[DJwa163]

Request:
Please add an "Enable/Disable Context Menu" item on tha NoScript Tray Icon (inside Firefox Window)
Alternatively, tap on the icon to toggle between enabale and disable NoScript, (as in case of GreaseMonkey)

Screen:


Details:
With NoScript tray icon, we are having similar menus on both: left click and right click (i.e. Context Menu) [also, the same menus appear with 'Mouse-over"], which is unnecessary. They might have different set of options, to enhance its efficiency.

My proposal is to retain existing "Mouse-over" and "Left-click" options;
And replace existing Right-click/context--menu items with the following options:
* Disable/Enable NoScripts (whichever is not the current state)
* Disable/Enable on the Current Page only
* Disable/Enable on the Current Website (i.e. Domain/IP)



Enable NoScript is the same as "Normal Mode"
But, Disable NoScript is not the same as "Enable Scripts Globally", rather it means temporary/user-specified suspension of all NoScript Functionalities (All sorts of Script-blocking) without disabling it from firefox addons-list (which needs a restart)...
Again, with the Enable options, all functionalities can be reverted back to the previous (last-used) state...

Tap-to-toggle (like in greasemonkey) is a nice alternative too..

Thanks...

[Tom T.]

Request:
Please add an "Enable/Disable Context Menu" item on tha NoScript Tray Icon (inside Firefox Window)

If you're speaking of right-clicking on a page, and seeing NS in the context menu along with all of the other items there, can't you just ignore it?
Is it really that obtrusive?

If so, NoScript Options > Appearance > uncheck (Show) Contextual Menu. Four clicks. Presumably, forever. No restart required.
But reversible just as easily.

Enable NoScript is the same as "Normal Mode"
But, Disable NoScript is not the same as "Enable Scripts Globally", rather it means temporary/user-specified suspension of all NoScript Functionalities (All sorts of Script-blocking)

I'm afraid that you are gravely mistaken.

Disabling "all NoScript Functionalities" is FAR more that "All sorts of script-blocking".
It disables many vital security functions that still exist in "Scripts Globally Allowed" mode. Read the NoScript FAQ, but to name a few:

Selective blocking of plug-ins (Java, Silverlight, Flash, and many others).
Cross-site scripting protection. XSS FAQ
Clickjacking protection. ClearClick FAQ
ABE prevention of access to your local resources by nasty web sites.
Etc.

If someone chooses to disable all of this, then IMHO it should be by a *very* conscious decision, requiring affirmative user action such as a restart.
(But why would you want to do this, even if you choose to allow scripts globally?)

My fear is that there may be many others with the same misconception as yours, who might casually click or tap on something, not realizing that they have just given up many other priceless protections beyond mere script-blocking.

I stand opposed to this request.

[Thrawn]

Request:
Please add an "Enable/Disable Context Menu" item on tha NoScript Tray Icon (inside Firefox Window)

If you're speaking of right-clicking on a page, and seeing NS in the context menu along with all of the other items there, can't you just ignore it?
Is it really that obtrusive?

I think he meant right-clicking on the NoScript icon on the add-on bar.

My proposal is to retain existing "Mouse-over" and "Left-click" options;
And replace existing Right-click/context--menu items with the following options:
* Disable/Enable NoScripts (whichever is not the current state)
* Disable/Enable on the Current Page only
* Disable/Enable on the Current Website (i.e. Domain/IP)

<snip>

Tap-to-toggle (like in greasemonkey) is a nice alternative too..

OK, NoScript already has a tap-to-toggle to temporarily allow scripts from the current top-level site. I think that this is enabled by default, too. I'm pretty sure it would suffice for most use cases. Go to Options-General-'Left-clicking on NoScript toolbar button toggles permissions for current top-level site'.

Disabling NoScript entirely...I agree with Tom T. on this one; I'm not sure that you realise the impact of it. Are you really asking for something that gives you less protection than Scripts Globally Allowed? If so, then with all due respect, I think that you misunderstand what Scripts Globally Allowed actually does. It means that all sites are considered 'trusted' and can run scripts/plugins as per usual, unless you have deliberately configured NoScript to blacklist specific sites or forbid plugins even on trusted sites. Scripts Globally Allowed means that 99% of the time, NoScript in its default configuration will not interfere with your browsing at all. The exceptions are when it recognises a specific attack, like a clickjacking attempt, or if something trips the default ABE rule (which some sites do, but it's not exactly common). Do you really need anything more permissive than that?

• If all you're after is to be able to quickly get the current site working, then the existing tap-to-toggle should get you started, followed perhaps by 'Temporarily allow all this page.'
• If you really need to browse without interruption, then I'd first suggest trying Options-General-'Temporarily allow top-level sites by default', which allows scripts from the sites you visit, while blocking third-party scripts, giving limited protection with limited interference.
• Use Scripts Globally Allowed only if you can't handle breaking any sites by default, or if you're setting up a computer for someone else who can't handle it.
• I can't see any reason to disable NoScript altogether.

[obiwan]

I would support adding this option! Because the only other way I know to temporarily disable NoScript (which I do from time to time, usually when testing things) is through the Add-ons Manager, and it's necessary to restart Firefox.

If not a context menu option then how about a setting in about:config for those of us who know what we're doing (for example "noscript.enabled", which defaults to true but can be changed to false)? That would be less likely to get changed by accident.

[Tom T.]

I would support adding this option! Because the only other way I know to temporarily disable NoScript (which I do from time to time, usually when testing things) is through the Add-ons Manager, and it's necessary to restart Firefox.

As said, the issue for me is that most users aren't as tech-aware as you seem to be, and might not realize how much they're giving up.
Thrawn detailed excellent alternatives.

If not a context menu option then how about a setting in about:config for those of us who know what we're doing (for example "noscript.enabled", which defaults to true but can be changed to false)? That would be less likely to get changed by accident.

Agree. Not sure if it's possible -- NoScript *needs* a restart to be enabled-disabled -- but if Giorgio can find a way to make that happen (and *wants to*), then yes, an about:config preference is far less likely to be changed by an unknowing user. Still, IMHO, leaving as-is is better. It doesn't take that long to restart Fx, and you *don't* need to reboot the entire machine.

Thanks for your input. I reiterate my opposition to the original request as presented.

[Thrawn]

I would support adding this option! Because the only other way I know to temporarily disable NoScript (which I do from time to time, usually when testing things) is through the Add-ons Manager, and it's necessary to restart Firefox.

If not a context menu option then how about a setting in about:config for those of us who know what we're doing (for example "noscript.enabled", which defaults to true but can be changed to false)? That would be less likely to get changed by accident.

If this is for testing purposes, may I suggest that a much better option is an alternative profile? Ideally running inside a sandbox or virtualised environment? That way, you should be able to run simultaneous Firefox instances with & without NoScript, making your testing faster, and you still have some degree of protection.

[Tom T.]

I would support adding this option! Because the only other way I know to temporarily disable NoScript (which I do from time to time, usually when testing things) is through the Add-ons Manager, and it's necessary to restart Firefox.

If not a context menu option then how about a setting in about:config for those of us who know what we're doing (for example "noscript.enabled", which defaults to true but can be changed to false)? That would be less likely to get changed by accident.

If this is for testing purposes, may I suggest that a much better option is an alternative profile? Ideally running inside a sandbox or virtualised environment? That way, you should be able to run simultaneous Firefox instances with & without NoScript, making your testing faster, and you still have some degree of protection.

That would work, but obiwan seems to want to make this change on-the-fly while browsing. Starting a new instance with a command-line switch to the new profile is indeed faster than a restart, but then all of the tabs, etc. wouldn't be loaded from the other running instance. My perception is that this would still be more inconvenient than his wish. But if it's good enough for him...