4 ms·

Malware is currently setting the preference and installing itself. How can you stop that?

• xjay 11y ago
  If software could reliably know when the setting was changed-- --It could warn the user: Hey, isn't it convenient that this check was disabled just before this addon was about to be installed? Perhaps a three strikes approach, where, if you disabled the warning, you'd still have to suffer through the warning three more times. You'd need a reliable way to store the state to avoid tampering.
  • mappu 11y ago
    > You'd need a reliable way to store the state to avoid tampering. It's the same problem. If the user can set it, then it can also be set by malware running at the same privilege as the user. The only solution is to move the check outside of this privilege level (i.e. the readonly `.text` section of the firefox binary in /usr/ or Program Files). That's what the signing requirement does.
    • jMyles 11y ago
      But if malware is running at the same privilege as the user, I have all sorts of more serious problems. Why is this worth stripping me of sovereignty over my browser?
• tomjen3 11y ago
  How can you stop malware fiddling with bits to allow installation of extensions?
  • mappu 11y ago
    >How can you stop malware fiddling with bits to allow installation of extensions? Require signed extensions - and have the code that does the signing check be locked for modification (e.g. 755 root in /usr/)