<commit_before>---
title: A guide on using NoScript 10.x
tags: [firefox, noscript, privacy, security]
---

When Firefox 57 arrived, NoScript 5 users were left with the unsettling reality
of not being able to selectively filter JavaScript with NoScript until the next
version was released, a week or so later. Its release was poorly received, due
to bugs and a brand new UI. Now that the dust has settled, and the bugs have
been vanquished, NoScript users are still presented with the brand new UI and
little to no official documentation. This post will serve as a guide for both
old and new NoScript 10 users to get up to speed.

### The trust levels
Each domain in NoScript 10 has a trust level. By default, each domain is under
the **Default** trust level, but you may find your old NoScript domains already
under the **Trusted** level. These are both familiar to previous NoScript users:
the default is not to allow anything, but domains can be explicitly trusted.
NoScript 10 also adds two more levels though: **Untrusted** and **Custom**.

TODO: image

Though the UI makes this a bit less clear, these trust levels are columns. For
each domain, one column is selected, meaning one trust level.

TODO: column image

### Editing trust levels
Each trust level can be edited to describe what happens when you set a domain to
that level. For **Default**, **Trusted**, and **Untrusted**, that configuration
is global. That is, you you say that the **Default** trust level should trust
fonts (by checking the *fonts* checkbox), but nothing else, then *every domain
in that trust level will have that setting.* When you modify the **Custom**
trust level, it's per-domain.

This is the misleading part, due to the UI. To edit a trust level, you need to
set a domain to that trust level and then click on the trust level again, once
it expands. Even though you clicked on a specific domain to set the **Default**,
**Trusted**, or **Untrusted** configuration, note that it applies to any domain
with that trust level.

TODO: images for editing trust level

### Safe defaults
NoScript 10 allows for more control over what's filtered. Scripts, objects,
media, frames, fonts, WebGL, fetch, and other things can all be filtered. Since
you're using NoScript for privacy, I recommend changing your **Default** trust
level to uncheck all items. If you trust a domain completely, add it to the
**Trusted** level. If you only want some items from it, like fonts and WebGL,
then use a **Custom** trust level for that domain.

* Columns: default, trusted, untrusted, custom
* Columns can be edited from any of the domains (link to forum bit)
* Default should be to allow nothing
* Root-level domains show up and also each used sub-domain
* To trust something, click the trusted column
* To make the trusting permanent, click the clock
* Trusting for HTTPS only (go to the options and enable this for all trusted)
* Revoke temporary permission
* Trust all temporarily<commit_msg>Describe top-level domains<commit_after>---
title: A guide on using NoScript 10.x
tags: [firefox, noscript, privacy, security]
---

When Firefox 57 arrived, NoScript 5 users were left with the unsettling reality
of not being able to selectively filter JavaScript with NoScript until the next
version was released, a week or so later. Its release was poorly received, due
to bugs and a brand new UI. Now that the dust has settled, and the bugs have
been vanquished, NoScript users are still presented with the brand new UI and
little to no official documentation. This post will serve as a guide for both
old and new NoScript 10 users to get up to speed.

### The trust levels
Each domain in NoScript 10 has a trust level. By default, each domain is under
the **Default** trust level, but you may find your old NoScript domains already
under the **Trusted** level. These are both familiar to previous NoScript users:
the default is not to allow anything, but domains can be explicitly trusted.
NoScript 10 also adds two more levels though: **Untrusted** and **Custom**.

TODO: image

Though the UI makes this a bit less clear, these trust levels are columns. For
each domain, one column is selected, meaning one trust level.

TODO: column image

### Editing trust levels
Each trust level can be edited to describe what happens when you set a domain to
that level. For **Default**, **Trusted**, and **Untrusted**, that configuration
is global. That is, you you say that the **Default** trust level should trust
fonts (by checking the *fonts* checkbox), but nothing else, then *every domain
in that trust level will have that setting.* When you modify the **Custom**
trust level, it's per-domain.

This is the misleading part, due to the UI. To edit a trust level, you need to
set a domain to that trust level and then click on the trust level again, once
it expands. Even though you clicked on a specific domain to set the **Default**,
**Trusted**, or **Untrusted** configuration, note that it applies to any domain
with that trust level.

TODO: images for editing trust level

### Safe defaults
NoScript 10 allows for more control over what's filtered. Scripts, objects,
media, frames, fonts, WebGL, fetch, and other things can all be filtered. Since
you're using NoScript for privacy, I recommend changing your **Default** trust
level to uncheck all items. If you trust a domain completely, add it to the
**Trusted** level. If you only want some items from it, like fonts and WebGL,
then use a **Custom** trust level for that domain.

TODO: image of safe defaults

### Top-level domain configuration
When browsing sites and using NoScript 10, you'll likely notice that a domain
will show up multiple times within the NoScript menu. This is because NoScript
10 allows you to modify the trust level of the specific domain used (such as
`blog.jeaye.com`), as well as the entire top-level domain (such as `jeaye.com`).
If you set a top-level domain to a specific trust level, that trust level will
apply to all sub-domains as well. This is very handy for marking entire
ad/tracking domains as **Untrusted**.

TODO: image of top-level untrusted

* Columns: default, trusted, untrusted, custom
* Columns can be edited from any of the domains (link to forum bit)
* Default should be to allow nothing
* Root-level domains show up and also each used sub-domain
* To trust something, click the trusted column
* To make the trusting permanent, click the clock
* Trusting for HTTPS only (go to the options and enable this for all trusted)
* Revoke temporary permission
* Trust all temporarily
{'fraction_non_alphanumeric': 0.06008255618406971, 'fraction_numerical': 0.004586454670539673, 'mean_word_length': 4.451666666666667, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1052776', 'n_tokens_mistral': 1684, 'n_tokens_neox': 1614, 'n_words': 1072}