I knew I asked at the right place. Thank you.

Note: This is one of those times where it is shown that I am not really the sharpest tool in the shed, by a longshot.

I’ve attempted to figure this out, on and off, for six months, and it never occurred to me that it was a colon, and not a dot.

try about:config

(note it is a colon and not a period) Good luck!

I can’t use about.config in FF.

I type it, and my browser is directed to here:
http://guide.opendns.com/?url=about.config

Now, when I searched for days for a solution to the opendns thing, I found a hundred answers that said, "Simply type about.config, and change these particular settings."

Now you can see why I am utterly stumped. The about.config that I am supposed to use to fix the problem IS the problem.

@^http:*.imagefap.com *.moviefap.com imagefap.com moviefap.com *.grayvee.com grayvee.com *.empornium.us empornium.us

in the about:config , would this be limiting popunders to only the listed sites.
Q2: how can I allow all sites but some sites, sorta like a a whitelist?

You don’t need to change anything: now noscript.surrogate.popunder.sources’s default value is ^@http:, meaning that all URLs starting with http: matches.

1. You need either to enable both or to disable both. Recaptcha does not like its parent page to have different permissions, not sure why. However I could probably write yet another script surrogate to work-around this :)
2. Yes, that would be handy. Maybe when/if I package this as a first-class feature, rather than a script surrogate.
3. I’m constantly trying to make their lives easier (e.g. Javascript links and combos emulation), but however allowing script globally, albeit not as safe as the default mode, still provides significant protection against stuff like XSS, cross-zone CSRF (via ABE) and clickjacking.