2 ms·

Most NPAPI plugins are not sandboxed or auto-updated to track the plugin's latest security fixes. Adobe does have an auto-updater and sandbox for Flash. The san

Most NPAPI plugins are not sandboxed or auto-updated to track the plugin's latest security fixes. Adobe does have an auto-updater and sandbox for Flash. The sandbox (called Protected Mode) is only available for 32-bit Windows, so Mozilla has developed its own Flash sandbox for Win64 Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1185532 https://bugzilla.mozilla.org/show_bug.cgi?id=1185532 Firefox sandboxes EME "plugins", called Content Decryption Modules (CDMs), and hard codes a list of trusted and signed CDM DLLs. (Currently, this list is just Adobe's Primetime CDM.) Also, because plugins are system libraries, other applications can side-load random plugins into your browser. For example, OS X installs a plugin called "Default Browser Helper" that allows Safari to snoop on your default browser choice and know when Firefox is run: https://twitter.com/dougturner/status/650575548918296580 https://twitter.com/dougturner/status/650575548918296580

bdash 11y ago
The "Default Browser" plug-in is not responsible for the notification mentioned in that tweet. The plug-in has no opportunity to execute code when Firefox is launched, only when instantiated by a web page. Besides, there's no need for a browser plug-in to detect when Firefox is run: the LaunchServices framework responsible for launching applications on OS X can simply check whether the application it is launching appears to be a web browser.
- cpeterso 11y ago
  Thanks for the correction. The only analysis I have found is this blog post from someone at Opera (Published: 2014-04-07, Updated: 2015-08-26). Do you know when the "Default Browser Helper" plug-in is instantiated? It was shipped in OS X 10.9, so it may no longer be relevant. https://www.aeyoun.com/technote/default-browser-plugin.html https://www.aeyoun.com/technote/default-browser-plugin.html
  - bdash 11y ago
    The plug-in provides a scripting interface that's only available to pages hosted via HTTPS on apple.com. The scripting interface exposes whether Safari is the default browser, and allows for prompting the user to change their default browser. To my knowledge the only place this was used was a "Welcome to OS X Mavericks" page that was shown shortly after installation of that version of OS X. I doubt that it's been used since.

bdash 11y ago

The "Default Browser" plug-in is not responsible for the notification mentioned in that tweet. The plug-in has no opportunity to execute code when Firefox is launched, only when instantiated by a web page. Besides, there's no need for a browser plug-in to detect when Firefox is run: the LaunchServices framework responsible for launching applications on OS X can simply check whether the application it is launching appears to be a web browser.

cpeterso 11y ago
Thanks for the correction. The only analysis I have found is this blog post from someone at Opera (Published: 2014-04-07, Updated: 2015-08-26). Do you know when the "Default Browser Helper" plug-in is instantiated? It was shipped in OS X 10.9, so it may no longer be relevant. https://www.aeyoun.com/technote/default-browser-plugin.html https://www.aeyoun.com/technote/default-browser-plugin.html
- bdash 11y ago
  The plug-in provides a scripting interface that's only available to pages hosted via HTTPS on apple.com. The scripting interface exposes whether Safari is the default browser, and allows for prompting the user to change their default browser. To my knowledge the only place this was used was a "Welcome to OS X Mavericks" page that was shown shortly after installation of that version of OS X. I doubt that it's been used since.