> If you're using the automatic updating functionality (which the majority of people are) then it absolutely applies. Which is why I don't get my updates via a

> If you're using the automatic updating functionality (which the majority of people are) then it absolutely applies. Which is why I don't get my updates via an automatic Mozilla updater, but rather via my distribution. > The reality is that if you trust Mozilla to provide software updates then you can trust them to provide Javascript As I indicate above, I don't trust them that much. You're right that the update problem and the JavaScript problem are identical. Allowing pushed updates makes individual targeting far too easy for an adversary.