5 ms·

> GNUzilla runs its own plugin finder service at gnuzilla.gnu.org. To specify this at runtime, visit the url about:config in your browser, find the pfs.datasour

• kentonv 12y ago
  > I hope they sign packages... And defend against attacks that trick you into installing a known-vulnerable version of the plugin (which of course has a valid signature, since it was believed to be good at the time of release). And avoid using error-prone package signature algorithms, like the one Android uses that originates from Java and has had several vulnerabilities. And don't send any personally-identifiable or private user information to the server when checking for updates. And... actually, no, just don't distribute software over HTTP, even if signed.
• quidam 12y ago
  In its current implementation the plugin finder just redirects to the gnash source at ftp.gnu.org (which is signed) or the mozplugger website. This will be updated to provide a more useful response to the user, in particular it will try to provide a way to install the appropriate package from the repos of the distro the browser is running on. The note about changing to http comes from the fact that the finder service doesn't work through https://gnuzilla.gnu.org/ https://gnuzilla.gnu.org/ but http://gnuzilla.gnu.org/plugins/PluginFinderService.php http://gnuzilla.gnu.org/plugins/PluginFinderService.php We would work on this too.