3 ms·

The security of the browser is conditional on the security of the platform in the first place, so this does not make sense. Anything that can edit the settings

by ambrop7 11y ago

The security of the browser is conditional on the security of the platform in the first place, so this does not make sense. Anything that can edit the settings of the browser without its knowledge can interfere with the browser and other software in other bad ways. It especially does not make sense for users who actually do have a reasonably secure platform, and these "security features" are then purely an annoyance.

JohnTHaller 11y ago
Here's the thing, though. They work. It's far easier for a low to mid-tier bundleware company to build a basic browser extension that inserts ads or takes over the homepage/search engine using basic off-the-shelf components than it is for them to install a system-level networking component that intercepts and changes browser networking calls without breaking things. Google Chrome took a dual pronged approach to disallow all extensions except those in their online store an disallow third party changes to browser settings. So, bundleware can't easily install into Chrome. It can easily install into Firefox because you or anyone else on the PC can install whatever you want. Just because this practice doesn't apply to or benefit you doesn't mean it doesn't apply to and benefit the majority of browser users. Remember, the majority of Firefox users don't even use extensions at all. Closing this hole would increase their security browser-wise. Ironic Note: Google Chrome, while attempting to block bundleware from interfering with its own operation, is one of the most widely distributed bundleware apps. Installers that use dark patterns (tricking users to not notice they're installing a new default browser) from Oracle's Java to Adobe Flash to Avast to Antivir all are used to install Chrome onto systems (hopefully) without the user noticing.
- yuhong 11y ago
  Of course, Google Chrome itself is probably less malicious than many of the other bundleware. I wonder how many would have supported Firefox doing the same thing in 2004.

by ambrop7 11y ago

JohnTHaller 11y ago

Here's the thing, though. They work. It's far easier for a low to mid-tier bundleware company to build a basic browser extension that inserts ads or takes over the homepage/search engine using basic off-the-shelf components than it is for them to install a system-level networking component that intercepts and changes browser networking calls without breaking things. Google Chrome took a dual pronged approach to disallow all extensions except those in their online store an disallow third party changes to browser settings. So, bundleware can't easily install into Chrome. It can easily install into Firefox because you or anyone else on the PC can install whatever you want. Just because this practice doesn't apply to or benefit you doesn't mean it doesn't apply to and benefit the majority of browser users. Remember, the majority of Firefox users don't even use extensions at all. Closing this hole would increase their security browser-wise. Ironic Note: Google Chrome, while attempting to block bundleware from interfering with its own operation, is one of the most widely distributed bundleware apps. Installers that use dark patterns (tricking users to not notice they're installing a new default browser) from Oracle's Java to Adobe Flash to Avast to Antivir all are used to install Chrome onto systems (hopefully) without the user noticing.

yuhong 11y ago
Of course, Google Chrome itself is probably less malicious than many of the other bundleware. I wonder how many would have supported Firefox doing the same thing in 2004.