5 ms·

Don't block anything excepting drive-by downloads. If I click on something with the intent to download it, it shouldn't matter what the source is. This is why

Don't block anything excepting drive-by downloads. If I click on something with the intent to download it, it shouldn't matter what the source is. This is why I use FireFox.

Karunamon 8y ago
Firefox's nannying isn't much less irritating (forced plugin signing, etc.)
maccard 8y ago
Yes it should - if I'm on https://trustedsite.com https://trustedsite.com and they link to http://notsotrustedsite.com/someexe.exe http://notsotrustedsite.com/someexe.exe you are vulnerable.
- gpm 8y ago
  Linking from https://trustedsite.com https://trustedsite.com to https://nottustedsite.com/someexe.exe https://nottustedsite.com/someexe.exe doesn't seem to be much better. Nottrustedsite.com can serve you a malicious exe either way. Https protects you against network MITMs, not evil sites sending you evil executables.
jasonlotito 8y ago
So, the thing is, they are working to ensure that is true. If you download it from a non-secure source, it can be changed on route. What you intend to download and what you actually download are different.
- lightedman 8y ago
  Hash checks, file signatures, etc. make that a non-issue. At this point, with all the restrictions happening, how about we just require a license to use the internet? Just skip all this crap because that's about where we're heading now.
nukeop 8y ago
Until you fall victim to clickjacking.
- lightedman 8y ago
  I actually read the URL in the status bar when I hover over things to click. Not once in my nearly 40 years of life have I ever fallen prey to clickjacking.
ar0 8y ago
I also use Firefox, but this discussion should probably not be the reason to do so: Mozilla has stated that they are tentatively onboard with the approach proposed by the Chrome team: http://lists.w3.org/Archives/Public/public-webappsec/2019Apr/0012.html http://lists.w3.org/Archives/Public/public-webappsec/2019Apr...
CydeWeys 8y ago
This seems like a direction Firefox would go in too. Web security is important, and preventing downloading of insecure executables is an easy win for security.

Don't block anything excepting drive-by downloads. If I click on something with the intent to download it, it shouldn't matter what the source is. This is why I use FireFox.

Karunamon 8y ago

Firefox's nannying isn't much less irritating (forced plugin signing, etc.)

maccard 8y ago

Yes it should - if I'm on https://trustedsite.com https://trustedsite.com and they link to http://notsotrustedsite.com/someexe.exe http://notsotrustedsite.com/someexe.exe you are vulnerable.

gpm 8y ago
Linking from https://trustedsite.com https://trustedsite.com to https://nottustedsite.com/someexe.exe https://nottustedsite.com/someexe.exe doesn't seem to be much better. Nottrustedsite.com can serve you a malicious exe either way. Https protects you against network MITMs, not evil sites sending you evil executables.

jasonlotito 8y ago

So, the thing is, they are working to ensure that is true. If you download it from a non-secure source, it can be changed on route. What you intend to download and what you actually download are different.

lightedman 8y ago
Hash checks, file signatures, etc. make that a non-issue. At this point, with all the restrictions happening, how about we just require a license to use the internet? Just skip all this crap because that's about where we're heading now.

nukeop 8y ago

Until you fall victim to clickjacking.

lightedman 8y ago
I actually read the URL in the status bar when I hover over things to click. Not once in my nearly 40 years of life have I ever fallen prey to clickjacking.

ar0 8y ago

I also use Firefox, but this discussion should probably not be the reason to do so: Mozilla has stated that they are tentatively onboard with the approach proposed by the Chrome team: http://lists.w3.org/Archives/Public/public-webappsec/2019Apr/0012.html http://lists.w3.org/Archives/Public/public-webappsec/2019Apr...

CydeWeys 8y ago

This seems like a direction Firefox would go in too. Web security is important, and preventing downloading of insecure executables is an easy win for security.