3 ms·

Thanks for the nice words, it does help the morale. Regarding javascript execution there are two cases: External javascript: won't execute because the net req

by gorhill 12y ago

Thanks for the nice words, it does help the morale. Regarding javascript execution there are two cases: External javascript: won't execute because the net request for the external resource is blocked. Inline javascript: won't execute because a Content-Security-Policy directive is injected into the main page or sub frame. This week I had to write an explanation of how this work because the idea that inline javascript can't be reliably disabled on a Chromium-based browser is still going strong. Here are the details: https://github.com/gorhill/httpswitchboard/wiki/Blocking-javascript-execution-reliably-in-Chromium-based-browsers https://github.com/gorhill/httpswitchboard/wiki/Blocking-jav... Regarding the "flash and reload", I noticed that too lately, I have to look into this to understand what is happening.

losvedir 12y ago
Very cool! Thanks for the explanation. One last question (sorry!): I just used the "Google" preset configuration to load gmail and it all just worked. I'm still trying to get the hang of interpreting the grid, but at the top left I see in blue ".google.com". Does that mean these whitelistings only apply to pages in a Google subdomain? For example: google analytics requests from some other* domain aren't whitelisted?
- gorhill 12y ago
  > Does that mean these whitelistings only apply to pages in a Google subdomain Yes, the top-most left-most box is for choosing where the rules apply, I call it the scope selector. "" = global scope ".example.com" = any web page which sits on 'example.com' or a subdomain of 'example.com' "example.com" = any web page which sits exactly on 'example.com' If multiple scopes exist for a given web page, the most narrow one is used. Also, scopes are really sandboxes, there is no inheritance of rules across scopes (trying to implement this is opening a can of worms both on usability and code-wise).
  - losvedir 12y ago
    Very cool! Been using it all morning and I'm very impressed. Thanks again for your hard work.

by gorhill 12y ago

losvedir 12y ago

Very cool! Thanks for the explanation. One last question (sorry!): I just used the "Google" preset configuration to load gmail and it all just worked. I'm still trying to get the hang of interpreting the grid, but at the top left I see in blue ".google.com". Does that mean these whitelistings only apply to pages in a Google subdomain? For example: google analytics requests from some other* domain aren't whitelisted?

gorhill 12y ago
> Does that mean these whitelistings only apply to pages in a Google subdomain Yes, the top-most left-most box is for choosing where the rules apply, I call it the scope selector. "" = global scope ".example.com" = any web page which sits on 'example.com' or a subdomain of 'example.com' "example.com" = any web page which sits exactly on 'example.com' If multiple scopes exist for a given web page, the most narrow one is used. Also, scopes are really sandboxes, there is no inheritance of rules across scopes (trying to implement this is opening a can of worms both on usability and code-wise).
- losvedir 12y ago
  Very cool! Been using it all morning and I'm very impressed. Thanks again for your hard work.