SLUniverse Forums

WarKirby Magojiro

Lately, I'm getting annoyed with malicious links like this one:

YOU GOT RICK ROLL'D

I suggest not clicking that. It makes your browser bounce around the screen and such, not fun. Thankfully, firefox has a setting in the advanced javascript options to disallow scripts from moving or resizing windows. But there's another problem

If you try to close the tab on that site, it gives a popup message, which blocks the close. Clicking anything on the popup causes another one, and another, etc. It goes on for about 50.

Frankly, I tthink this is a pretty shameful security vulnerability. I want it fixed. The only way I can find to stop it though, is to disable javascript entirely, which unfortunately also breaks half the internet.

Does anyone know of a firefox plugin or setting I can use to fix this? Something like a limit on how many boxes can be opened in a row before the script gets blocked. ?

__________________

Sean Gorham

WarKirby Magojiro

ok, im using that now. Seems to do the job, a bit too well, though..

I was kind of hoping for more fine grained control over preventing javascript from doing specific things, (like opening popups). This seems to just block everything completely, and will require me to constantly turn scripts on again for most sites.

Maybe I'm missing something, but it just seems like the block javascript button with more convenience.

Anya Ristow

That advanced Javascript dialog also has an entry for "raise and lower windows". Is it un-checked? Mine is un-checked. How about the "block pup-up windows" box on the "content" tab? Is it checked? Mine is. I've used these settings since I installed firefox and it's never stopped me from doing anything.

Using no-script you can allow sites that have javascript functionality that you need, and block everything else. Once you set a site as an exception you don't have to do it again. Click the S-icon in the lower right corner for quick access to exceptions. Use temporary permissions for sites you don't expect to re-visit, to avoid filling your exception list with tons of crap.

If you want all the features of every site to just work without any thought, you aren't going to like no-script.

ETA: With JS disabled for all sites and no exception set for that site, when I visit your link I can see the video by clicking on it. Is that what you want from that site? No-script shows a whole list of stuff that was blocked. Did you really need to see any of it?

WarKirby Magojiro

Anya, I thought you left :O
welcome back?

I tried turning off all those advanced settings, and using the popup blocker. It seems to block new browser windows created, but it doesn't block javascript windows

No script is proving an annoyace thus far. It's like swatting a fly with a strategic nuclear missile. I have to turn it off to use hotmail, jira, and almost every other site I've visited. Oh, and even when allowing scripts, the anti xss controls block posting on 4chan, and the interface to specifically allow certain sites on that requires regex. it's about as user unfriendly as you could get.

All I really wanted was to just block excessive poups, not kill every cript dead..

Sean Gorham

You're right, NoScript can be overkill at times. I'm so used to it I don't think about it much anymore. Unfortunately I've never looked into alternatives because NoScript did the job for me.

Midi Reifsnider

I got totally fed up with NoScript, it does what it says it will, but to the point of annoyance. No suggestions for alternatives I'm afraid though.

__________________
www.twitter.com/MidiReifsnider

Fmeh

On NoScript, as long as you don't just say "temporarily allow" and you just flat-out allow a server, you generally don't have to allow it again. NoScript has saved me SO many times.

__________________

Midi Reifsnider

I know, but I get eaten up with the "temporarily vs permanently" discussion in my head, i'm so indecisive. It's a weakness in me rather than NoScript.

Sean Gorham

If it's a site I visit more than two or three times, I permanently allow scripts. Otherwise I just temp-allow them.