4 ms·
Why don't firefox make it so that the only way a plugin can be installed is with user confirmation? I'd never want a plugin automatically installed without know
by axod 17y ago
Why don't firefox make it so that the only way a plugin can be installed is with user confirmation? I'd never want a plugin automatically installed without knowing about it (I've never had that happen, but may be different on OSX).
- swolchok 17y agoThat's impossible under traditional system configurations. Windows Update can always update whatever "user has confirmed" record Firefox stores, because it has administrative access to the machine.
- axod 17y agoSurely just make the [user confirmed plugin install] update something with a secret hash token. When firefox starts, it checks each plugin has been explicitly accepted by the user. If not, it alerts them. Sure, you could reverse engineer the signing token, and hack around it, but that wouldn't get you many friends.
- swolchok 17y agoNeither does including anti-Microsoft code in your product. (it doesn't protect against shadier players because those don't care about having friends.)
- axod 17y agoThat's not anti-ms. That's just good security. I'd like to know when something is messing with my browser executable.
- swolchok 17y agoLike I said, it's not effective. If malware wants to futz with your browser executable, it's just going to patch the executable, not conveniently go through the plugin interface around which you've designed some forgeable security token.