4 ms·

There are a number of reasons that we're taking these steps. First, click to play for vulnerable plug-ins will make driveby exploits less likely to be successf

There are a number of reasons that we're taking these steps. First, click to play for vulnerable plug-ins will make driveby exploits less likely to be successful. Second, it gives users some protection while while they wait for a time to upgrade a plug-in that's more convenient to them. Third, we've learned that if you simply take the plug-in away, users don't upgrade, they switch to one of the other browsers on their system which isn't taking their (potentially similarly vulnerable) plug-in away. This is not the only answer, though. It's a step in an ongoing process to protect more users and one that I believe all browser vendors are converging on.

JoshTriplett 14y ago
> Third, we've learned that if you simply take the plug-in away, users don't upgrade, they switch to one of the other browsers on their system which isn't taking their (potentially similarly vulnerable) plug-in away. That make sense, and that sounds like the real reason. The first two reasons would work just as well with disabling the plugin entirely without the click to bypass. However, if you think people will ignore the warnings and run another browser entirely, that seems like a good argument for letting them use the plugin with Firefox, as long as you have an appropriately severe warning about what it means to let a site access a vulnerable plugin.
- nnethercote 14y ago
  > However, if you think people will ignore the warnings and run another browser entirely, that seems like a good argument for letting them use the plugin with Firefox, as long as you have an appropriately severe warning about what it means to let a site access a vulnerable plugin. An informed user can also make a judgment depending on how trustworthy they think the site is.