3 ms·

Oh, really? I hope not in production builds, at least. Defense in depth concept is not new either.

• Manishearth 9y ago
  You also need an environment variable to be set for it to work. But yes, it seems to be something you can flip in production. The argument being that if you're in a position to flip prefs you already can break security in a million ways. It's not something you can accidentally flip either. (The pref doesn't actually "let viruses take over the computer", it just turns off all the security checks)
  • madez 9y ago
    I feel like having a global switch for all security checks is already not a good idea.
    • bugmen0t 9y ago
      It's unlikely to be abused by am attacker, if it requires starting Firefox with a certain environment variable. Chrome has the same thing with a command line switch. Useful for some internal unit/integration tests for release and test builds, but really dangerous when pointed to the web.
    • Manishearth 9y ago
      Actually, "all the security checks" is inaccurate; it seems to enable certain special powers in JS. It turns off one security measure. These special powers seem to be enough to compromise other stuff; but again, if you're in a position to flip that switch you already can compromise other stuff.
  • bzbarsky 9y ago
    It doesn't even turn off "all the security checks". It does make it so that certain APIs that let you do all sorts of stuff web content can't normally do are exposed.