Slashdot Mirror
Firefox 3.6 Locks Out Rogue Add-ons
CWmike writes "Mozilla will add a new lockdown feature to Firefox 3.6 that will prevent developers from sneaking add-ons into the program, the company said. Dubbed 'component directory lockdown,' the feature will bar access to Firefox's 'components' directory, where most of the browser's own code is stored. Mozilla has billed the move as a way to boost the stability of its browser. 'We're doing this for stability and user control [reasons],' said Johnathan Nightingale, manager of the Firefox front-end development team. 'Dropping raw components in this way was never an officially supported way of doing things, which means it lacks things like a way to specify compatibility. When a new version of Firefox comes out that these components aren't compatible with, the result can be a real pain for our shared users ... Now that those components will be packaged like regular add-ons, they will specify the versions they are compatible with, and Firefox can disable any that it knows are likely to cause problems.'"
At my company I would like a stripped-down Firefox without features like awesome bar and other bloat. Is there a way to do this, easily?
Also I have the SmartQ 7 and SmartQ 5 MIDs which are basedon the ARM processor. Thedefault browseris Midori... can I get a Firefox compiled for the ARM to run on that?
I hink firefox shoudl focus on these and similar issues...
If you keep throwing chairs, one day you'll break windows....
Last February, and again in May, Firefox users complained when they found that Microsoft had pushed the .Net Framework Assistant add-on and the Windows Presentation Foundation (WPF) plug-in to their browsers as part of the .NET Framework 3.5 Service Pack 1 (SP1) update, which was delivered via Windows Update.
That's the first thing I thought of when I read the summary.
Put identity in the browser.
From a user perspective, this sounds like a good move. Stability problems in Firefox always seems to stem from add-ons or extensions. Lock that crap down, and make the devs code the right way.
So what would be the effect on Add-on development? Would it make it more difficult to develop them? Would it constrain the Add-on developers?
Or is this just a method to lock out some Add-on with already known problems?
In the browser wars, people tend to forget sometimes that marketshare is an inherent part of how much your browser will come under attack. Issue's like these, while it's good they're being patched, should have been taken care of a long time ago in anticipation of things to come. Firefox is still my preffered method of browsing, but thats because I am a halfway knowledgeable user that uses adblock, noscript, betterprivacy, use privately encrypted TOR when about (Iron Key) and only allow certain cookies. I used to recommend it to people, but now it seems just as bad (GASP) as IE with a standard install. I agree with jkrise (First Post!), there needs to be something like sub-builds that focus on security. I still like firefox better, as I occasionally evaluate the other browsers, and find them all lacking more than firefox in some areas. Just my two cents of subjective opinion though. Carpe Out.
"It's ok, I'm completely secure as long as my iron is off"
Works great, till you have someone like myself, who just specifies that my components are compatible with Firefox 2.* to 10.* so I don't have to worry about a new version claiming my plugin isn't compatible even though it is, which has happened enough in the past that I just don't care anymore.
Am I wrong? Yes. Is Mozilla wrong? Yes, you never trust the external code to tell you the truth, basic programming 101.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Not that I disapprove of this particular decision, but imagining the Slashdot's reaction to Microsoft implementing a thus-describable feature makes my head spin...
In Soviet Washington the swamp drains you.
I notice this doesn't extend to plug-ins and extensions found via the various plugins directories and registry keys. If it were me, I'd extend this feature to include saving a list in a locked-down location of all known extensions/add-ons found via the plugin directories and via registry keys. Every time the browser started, if it found a plugin or extension being loaded via the registry or a plugin directory that wasn't on the list, it'd notify the user what the plugin was and ask whether they wanted it enabled or not. That way nothing can get added to the browser without the user knowing and approving of the change.
Down in the advanced options I'd add a setting to give expert users the additional option of removing the plugin by either removing it's files from the plugins directory it was found in or removing it's registry keys depending on how it was found.
It was supposed to be a stripped down browser, instead of the bloat of the full Mozilla. And, when they started, they were close. But now they seem to be heading back in the other direction.
But doesn't this undermine the open source nature of this software?
Surely people should be able to install any plugins, dodgy or not, if they want to, on their own system?
The acutal problem is that firefox blindly loads whatever is in that directory. .NET framework firefox extension did).
Locking the directory is a hack of a solution that others, especially Microsoft will easily find a way around. The proper answer is that Firefox needs to compare components it finds by their signature (checksum and name combo or whatever) with a secure list of components it is authorised by the user to load, before it loads them.
The other fix firefox needs is to deny installed extensions the ability to prevent the user from uninstalling them (like Microsoft's
That's why I started using Phoenix in the first place. However, I am guilty of running up to a dozen plugins...
I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.
You do get notified when at least some of those methods are used the next time you start Firefox. Pretty sure it's been that way since shortly after the MS plugin fiasco.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Rogues does it from behind.
This seems like this will improve firefox security. What firefox really needs however is a security zones feature that IE has had for over 10 years. You can create security zones, which contain lists of different sites and then place a site into that zone. The zone includes all settings for every possible feature a website uses, including flash and other plugins, java, javascript features, cookies, to name a few. This way you can use one database of sites for all settings rather than creating seperate lists of sites for each individual feature. This is one way that IE surpasses Firefox in security. Going to Firefox was in many ways a downgrade and has far more primitive security control.
If it doesn't allow rogue add-ons, does it allow nethack ones?
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
Yes, but by choice. Your 12 plugins may be different than my 12 plugins. If they build everything in, they remove that choice.
Tired of reading these sorts of comments. Sure there's some "bloat", but what that bloat is varies by opinion. I've read where supporting CSS is "bloat". Graphics are "bloat". tabs are "bloat". RSS. etc.
My understanding (and please tell me if I'm wrong) is the point of Firefox was to supply a WEB BROWSER. Back then when you downloaded it you also got an email program, news reader, wysiwyg website builder, etc. Firefox was JUST a browser. Still is.
If you REALLY want where everything is an option go build it yourself. Have something where you choose which renderer you want (Moz's, Webkit, etc), whether or not to have tabs, allow plugins, command line version, etc. Hit next a few times and presto your very own browser.
Will this prevent Adobe from installing their mongoloidish "Download Manager" Add-on that's set up to start every time you open a new window instead of just running when you start your browser?
I seem to remember that IE 8 does something like this when it's first installed, asking if you want any IE extensions enabled at all, and whether you want IE extensions blocked until you approve them, or something of that nature. But suffice to say that I don't install IE often enough to remember for sure.
All that does is add one more hoop for the bad guys to jump through.
It really isn't that simple. You could be running *nix or a mac. You might go to the same 3 sites everyday, but never browse new things. Due to the nature of the ways browsers are installed by default (which you imply you are using) you could get infected by even legitimate websites (who resell adspace to unscrupulous buyers) and not even realize it. With no tools, how do you propose to prevent cross-site scripting attacks, Java-script attacks, etc? I actually don't run a/v on personal systems. But I do run daily scans (while I'm at work) with multiple tools. I used to use no software firewall, relying on my strict PIX access-lists to protect me, but now I am using windows 7 and the firewall is so granular it is a good extra step. You are actually a malicious wet dream, someone who thinks they have everything so secure, that as long as you hide the bot/trojan etc well enough, they will never know they are a zombie machine. Just because you haven't been infected in over 20 years doesn't mean you can't get infected tomorrow. So, either you customize your browser intricately (JS, active-x settings, etc) or your just playing Russian roulette. Read this for tips on where you might be lacking. http://www.cert.org/tech_tips/securing_browser/
"It's ok, I'm completely secure as long as my iron is off"
I honestly don't understand why a web browser, which today is a platform for doing almost anything, would let any foreign code run without an explicit user request/confirmation - in the form of a standard, Firefoxy window the user knows. It's simply not security minded. Don't trust other people's code!
A good resson to stay with Firefox 3.5.x
They say this can only be used from Chrome, but... um... I'm still not happy about having this in the API at all. :(
You're right. RSS aggregation is extremely important to browsing the web...
Every time the browser started, if it found a plugin or extension being loaded via the registry or a plugin directory that wasn't on the list, it'd notify the user what the plugin was and ask whether they wanted it enabled or not.
Don't ask me anything. Add-on's and extensions should only be included if you go to a Firefox UI and turn them on. There won't be any stealth additions, and if people really want some plug-in they'll figure it out, and the vendors will help by giving instructions.
Also, don't ask me about upgrades. Just upgrade the plug-in when starting (and restart if you must), and give me a way to lock an add-on at a particular version.
tomorrow who's gonna fuss
Yes. Your point being?
What, you mean, MS prevent programs from being installed or even piggybacking on other installs?
I don't know of anyone who'd be against that except the sales/marketing assholes of the world.
But that's ok. You seem to have a straight head judging from your sig.
"Is there a way to do this, easily?" Go grab the source code and rip out "awesome bar" and recompile. "Can I get a Firefox compiled for the ARM to run on that?" Of course you can, that's the beauty of open source. If it hasn't been port, then port it yourself. If you can't port or compile yourself, hire somebody to do it for you. If you mean "I want everything in a special version with features that only matter to me that I don't have to spend any time, money or effort on, because I'm entitled to it!" then I think you're fucked.
What's bloat and what's not may not be black and white but some functionality, such as the 'awesome bar', which has nothing to do with browsing and is an actual impediment to many users, is obviously bloat. Implementing functionality such as the awesome bar via plug-in is a great idea but will never happen because firefox dev's like Edward Lee would rather tell users what's good for them than listen to feedback.
No no no, I think he's right, images, toolbars, panes, tabs are necessary infrastructure, RSS is not, the awesome bar is not, bookmarks are not, the question is, does this look like an extension? then why not make it a *default* extension? That way disabling the "bloat" would be easy for those who care and invisible for those who don't.
Put differently, why don't firefox devs learn to write extensions?
But... the future refused to change.
There are two things that I think are drastically needed in Firefox, and they should be #1 priority. First is the ability to disable the "aditional plugins are required to view all the content of this page" type messages. I have all the plug-in installed that I want, and will not install anymore. The second is an option to truly lock down Firefox so that NOTHING can be installed/added without the user seeing a window where they can either allow or reject ANYTHING that any outside agency wants to install. This is the way it should have been from day one! No web site, OS update, etc should have ever been able to install anything without the end user's knowledge and consent!!
RSS is bloat IMO and definitely shouldn't be in the core browser, I just use iGoogle to display my RSS feeds.
Wow, it's so easy to use! It's almost like having Synaptic for MS Windows programs!
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
Have you even actually compiled Firefox before?
"Now I am become Death, the destroyer of worlds"
Christian Anti-Porn 1.0.5.
Flee sexual immorality (1Co 6:18). Christian Anti-Porn will filter links and alert the user if any porn websites are clicked. This will not block but warn every Christian that he is going to crucify Jesus Christ again if he proceeds to such websites.
Misunderstood what I said, but I didn't write it very well. What I'm saying is a core feature for one isn't for another. I have ZERO problems with the Awesome Bar, I rather like it. I have zero use for RSS, wouldn't miss it if it was gone. However it being there doesn't hurt me any more then Minesweeper being on my computer when I install Windows.
What I'm tired of is people saying that Firefox is as bloated as Netscape Communicator or Mozilla was in the day. We're not even remotely near that. When they make Thunderbird a mandatory part of Firefox, I'll be concerned.
Italics are much better for emphasis than SHOUTING.
It's amazing the number of complaints people have for a free product with thousands of free accessories.
Comment removed based on user account deletion
I didn't misunderstand what you said, I know very well that what is bloat for someone might be a must for someone else, that's why extension are for, it allows you to have features in your browser that most users wouldn't like by defalut. The point is that, there being a perfect tool for extending and configuring Firefox, Firefox dev use, why? Even if you *Reapman* don't mind it someone else... lots of someone elses, do mind.
Actually I think you are the one missing the point saying that people can't say Firefox is bloated, you are taking a users are wrong approach, if enough users think your app is bloated then it is bloated. Or rather ask, what right you have to say it isn't bloated? Just because it is fine for you it doesn't mean it is fine for everybody.
Note that personally I don't find Firefox to bee too bloated, is just that I think the "core + default extensions" is the right way to go at this point in the life-cycle of Firefox.
But... the future refused to change.
This implies that at one point in time you did get all that with Firefox, when you're really talking about what is now SeaMonkey.
Correct.. Seamonkey, Netscape Communicator, etc. Back then you didn't have much of a choice, and Firefox was built to deliver that choice. Perhaps not worded 100% correct but most people these days consider Firefox the successor to that whole mess.
Now how I am going to view Gorgor's links on FARK without Greasemonkey? Wait, that might be a good thing...
Few things annoy me more than having a piece of software I install on my PC start fscking with other programs from other vendors. I found out some malicious program slipped a MS DRM plugin into my Firefox on my XP netbook (ALL DRM is malicious). I have to use Windows on the netbook for accessibility purposes because the magnifiers for Linux perform terribly on the thing. That doesn't give MS the right to infect my browser as part of their crusade to control the Internet.
So, in a world where we can't even trust the proprietary OS that we disabled folks are forced to run, thanks for taking steps to protect us from it, Mozilla.
I want a way to avoid installing (or at least enabling) the myriad of "language packs" that I'll never use, may introduce bugs in my browser or make it slower, and that make it difficult to see anything "new" that might've appeared there that I might need to see.
I really see no reason why ALL should be installed by default and enabled by default, when the GUI can tell quite clearly what language(s) I am using/preferring.
Wait - you think that an ex-cheerleader and ex-beauty queen is qualified to be POTUS? A woman who was caught up in scandal while serving PART of a term as governor? The same woman who QUIT HER JOB as governor, so she would have time to write a book? THAT Sara Palin? PUH-LEASE!!!!
Be honest - Palin's strongest point is her looks, and her second strongest is her faith in God. What else can she bring to the (arguably) most powerful office in the world? Please, don't ask me to vote for her cup size. I'm as lecherous as any 50 year old, but those mams won't do us any good at all when the shit hits the fan.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
At least her nipples are bigger than our current president's balls!
The Thing is.
Something tells me we are in for a nail shortage.
I know tobacco is bad for you, so I smoke weed with crack.