3 ms·

Sorry, that sounds frustrating. I just installed your extension and it looks pretty slick so far! I had been using RequestPolicy, CookieMonster, and NoScript o

Sorry, that sounds frustrating. I just installed your extension and it looks pretty slick so far! I had been using RequestPolicy, CookieMonster, and NoScript on Firefox to do something similar, but wasn't aware of something like RequestPolicy for Chrome. Your extension fits the bill nicely. Couple questions: * Your documentation says "Efficient blacklisting ... javascript won't execute". Is this because you prevent the request altogether or do you somehow allow the Javascript to be fetched but then sandbox it or something? The latter seems brittle and prone to issues (tptacek's warnings about security/javascript in the browser come to mind). * The control panel seems to let me block scripts from the domain I'm actually on (so, not a 3rd party request). Does this include inline script tags in the HTML? Obtrusive javascript via "onclick=..."? Last I checked, I thought Chrome didn't give you hooks to be able to stop, with an extension, the evaluation of scripts. In fact, that's why I've been using Firefox w/ NoScript, since I didn't think Chrome could match it. Is that not the case? * When I search Google (but no other page), it seems to flash and reload since installing the script. What's that? Thanks for your hard work on this! I appreciate it a lot.

gorhill 13y ago
Thanks for the nice words, it does help the morale. Regarding javascript execution there are two cases: External javascript: won't execute because the net request for the external resource is blocked. Inline javascript: won't execute because a Content-Security-Policy directive is injected into the main page or sub frame. This week I had to write an explanation of how this work because the idea that inline javascript can't be reliably disabled on a Chromium-based browser is still going strong. Here are the details: https://github.com/gorhill/httpswitchboard/wiki/Blocking-javascript-execution-reliably-in-Chromium-based-browsers https://github.com/gorhill/httpswitchboard/wiki/Blocking-jav... Regarding the "flash and reload", I noticed that too lately, I have to look into this to understand what is happening.
- losvedir 13y ago
  Very cool! Thanks for the explanation. One last question (sorry!): I just used the "Google" preset configuration to load gmail and it all just worked. I'm still trying to get the hang of interpreting the grid, but at the top left I see in blue ".google.com". Does that mean these whitelistings only apply to pages in a Google subdomain? For example: google analytics requests from some other* domain aren't whitelisted?
  - gorhill 13y ago
    > Does that mean these whitelistings only apply to pages in a Google subdomain Yes, the top-most left-most box is for choosing where the rules apply, I call it the scope selector. "" = global scope ".example.com" = any web page which sits on 'example.com' or a subdomain of 'example.com' "example.com" = any web page which sits exactly on 'example.com' If multiple scopes exist for a given web page, the most narrow one is used. Also, scopes are really sandboxes, there is no inheritance of rules across scopes (trying to implement this is opening a can of worms both on usability and code-wise).
    - losvedir 13y ago
      Very cool! Been using it all morning and I'm very impressed. Thanks again for your hard work.

gorhill 13y ago

Thanks for the nice words, it does help the morale. Regarding javascript execution there are two cases: External javascript: won't execute because the net request for the external resource is blocked. Inline javascript: won't execute because a Content-Security-Policy directive is injected into the main page or sub frame. This week I had to write an explanation of how this work because the idea that inline javascript can't be reliably disabled on a Chromium-based browser is still going strong. Here are the details: https://github.com/gorhill/httpswitchboard/wiki/Blocking-javascript-execution-reliably-in-Chromium-based-browsers https://github.com/gorhill/httpswitchboard/wiki/Blocking-jav... Regarding the "flash and reload", I noticed that too lately, I have to look into this to understand what is happening.

losvedir 13y ago
Very cool! Thanks for the explanation. One last question (sorry!): I just used the "Google" preset configuration to load gmail and it all just worked. I'm still trying to get the hang of interpreting the grid, but at the top left I see in blue ".google.com". Does that mean these whitelistings only apply to pages in a Google subdomain? For example: google analytics requests from some other* domain aren't whitelisted?
- gorhill 13y ago
  > Does that mean these whitelistings only apply to pages in a Google subdomain Yes, the top-most left-most box is for choosing where the rules apply, I call it the scope selector. "" = global scope ".example.com" = any web page which sits on 'example.com' or a subdomain of 'example.com' "example.com" = any web page which sits exactly on 'example.com' If multiple scopes exist for a given web page, the most narrow one is used. Also, scopes are really sandboxes, there is no inheritance of rules across scopes (trying to implement this is opening a can of worms both on usability and code-wise).
  - losvedir 13y ago
    Very cool! Been using it all morning and I'm very impressed. Thanks again for your hard work.