Quantcast
Channel: InformAction Forums
Viewing all articles
Browse latest Browse all 17374

Re: Easier solution for site-specific whitelisting?

$
0
0
Thrawn wrote:So, NS is relying on ABE's presence.

I stand corrected in my expression. Of course some NS functions now have to rely on the ABE firewall being open for them.

But
Giorgio wrote:ABE's main purpose is providing anti-CSRF protection
as in the ABE FAQs
http://noscript.net/faq#qa8_10


But
Giorgio wrote:Living inside the browser, the ABE component can take advantage of its privileged placement for enforcing web application boundaries, because it always knows the real origin of each HTTP request, rather than a possibly missing or forged (even for privacy reasons) HTTP Referer header, and can learn from user’s feedback (my emphasis).

from the ABE docs
http://noscript.net/abe/


Thrawn wrote:ABE can operate independently (in theory; don't know if anyone has done this in practice).

Not yet, although Giorgio does have this in his product description as a possbile dev goal.
Giorgio wrote:As soon as browser support for the Origin HTTP header becomes widespread and reliable, an external version of ABE might be developed as a filtering proxy.

from the ABE docs
http://noscript.net/abe/


My point was that the user has to decide at each NS change, what filtering (of course with some exceptions for common cases) they want ABE to undertake.
So I'm guessing that the OP possibly is asking for a GUI with pre-written rule templates or something similar.

Doesn't look as though the OP is going to return so I'll dip out now.

Viewing all articles
Browse latest Browse all 17374

Trending Articles