Slashdot Mirror
Firefox Greasemonkey Extension Security Problem
Mr2001 writes "A recent thread on the Greasemonkey mailing list suggests that the popular Firefox extension is fatally insecure. It seems rogue pages can read any file from your disk and send it to any site, using an XmlHttpRequest. Time to uninstall GM?"
Precious mod points? Make sensible contributions, and you'll get more mod points, though what someone with no clue what to do with an apostrophe will do with mod points I do not know. Troll. And no, today I have no mod points. Goodbye.
http://www.usdoj.gov/criminal/cybercrime/1030NEW.h tm
Computers connected to the internet are "protected computers" under the statute. Crippling the software under the guise of an "update" is illegal.And then they'll get hold of the contents of your home directory!
.bash_login .bash_logout .gaim .gnucash .kde .kde2 .mozilla bin doc
blah markov_chain other users spiff
And then your directory!
What next? Your buddy list from Gaim? Your bank account from GnuCash? Your address book from Thunderbird? What other security holes you have in Firefox, from extensions? Something you wanted to keep secret in your documents?
Linux is not always safe.
---
A guy walks up to his friend and sees him hitting himself on the head with a hammer. "Why are you doing that!?", he asks. "Because it feels so good when I stop.", was the reply.
Generated by SlashdotRndSig via GreaseMonkey
Why is it that when you believe something it's an opinion, but when I believe something it's a manifesto?
It's about transparency and trust. If you can't see that, they you are just as blind as the developers who pulled this stunt.
Its also illegal.
In what will surely be flamed or moderated down..... Mozilla(Firefox, etc) is reaching the point where competing with Microsoft becomes hard/more fair to microsoft. Their install base has grown past the "anti-microsoft-for-the-sake-of-anti-microsoft" people and now it has become a target that actually is large enough to aim at. Some estimates have Mozilla market share as high as 25%. This means that there are now people actively searching for security holes, as well as problems with updating the install base, for fear of obsoleting plugins and extentions. It will be interesting to see what happens as Mozilla foundation naturally looses momentum as they try to re-wage the browser wars. -- Posted from Mozilla 1.7.8
Its misleading the way it was done. The user thinks they're getting an upgrade or bug fix, when in fact they're losing functionality.
If its wrong for spammers to be dishonest to end users, its also wrong for developers. Good intentions are no excuse.
It is up to the individual, once the software has been installed on their computer, to decide whether they want to disable potentially insecure features. The original author has absolutely zero rights to try to take such an action "under the radar," and the courts have taken this position time and again.
the people using greasemonkey aren't your average users - they're (hopefully) not complete n00bs. They should be able to decide, on an individual basis, whether the perceived benefits are greater than the potential risks.
The person thinks they're getting an update, rather than being informed, as required by LAW, that the "update" decreases functionality.
If you have an issue with this, take it up with your local congresscritter - but remember, if you allow F/LOSS developers to unilaterally sneak in degredations without informed user consent, then you also have to allow Microsoft the same liberty. Do you REALLY want that legislated into law?
The current situation, which requires disclosure and informed consent, is the best we've come up with to date.
Why? Because I can't believe that anyone would be STUPID enough to try to "fix" a potential exploit in such a dumb-as way. And that, when I called "bullshit" on it, I immediately got dumped on by a bunch of syncopating knee-jerk "open source devs can do no wrong" posters who don't want us to operate to the same standards as closed-source devs? Yeah, its a flame war, all right, but its not trolling. Not in the least!
So look at the facts:
- There was a "potential" - exploit. Not one in the wild. Just a possible one, that affects only a small subset of users
- To reduce the damage caused by their mistake, the developer unilaterally decides that its better to cripple the software through an "update" rather than give the users the information they need to make an informed decision, and decide for themselves whether they want to continue using the functions in question
- The (the developers) post on their list that they're going to intentionally cripple it through the update mechanism, doing an end-run around the whole informed consent issue, and, incidently acting illegally
So, how the fuck is this trolling? Did you see a single post with a "Burma Shave" jingle in it? NoMore Facts:
- Fact: The L'Oreal case I cited was profiled on W5 almost 20 years ago. It bankrupted the IT company. Unfortunately, it's a bit before most posters time, but it established in court that developers can't unilaterally "throw the switch".:
- Fact: It is YOUR RIGHT to be informed as to what the intent of any update is. Not just "this is an update that closes a potential exploit", but "this is an update that will intentionally fuck up any scripts that depend on this API, so if you need to make calls to gm_API_xxxx, don't patch"
- Fact: We would all be bitching if Microsoft pulled something like this. They don't. Every patch contains an explanation to what its INTENDED (as opposed to accidental side-effects) effect is, and includes the possibility to "just say no."
- Fact: We're acting like a bunch of hypocrites if we don't hold F/LOSS to the same standards of disclosure.
So, please tell us, mister A. C., just how the fuck this is a troll?As for the mods, I don't mind taking the karma hit for speaking the truth. But if they go back through my JEs, they'll also see that Troll Tuesday has ZERO to do with "trolling" in the way that you seem to think it does, and that it's more about raising the level of debate, specifically, about challenging the conventional, knee-jerk reactions that have turned slashdot into slushpot.