> Allow me to quote from the blog post As I said, that point (the one you quoted me on originally) does not make mention of signing, and the quote you gave the

> Allow me to quote from the blog post As I said, that point (the one you quoted me on originally) does not make mention of signing, and the quote you gave there did not exist when I wrote the comment, as you well know. This is silliness of the highest order. > Well, in my case, we got our browser plugin audited by Veracode and things worked out. "Things work out" until they don't. As a fellow security professional, you should know as well as I do: no matter how many audits you do, you're still fucking something up, and someone will find it if it's valuable enough to do so. This is as true of your code as it is mine or anyone else's.