Slashdot Mirror
Firefox 3.6 Locks Out Rogue Add-ons
CWmike writes "Mozilla will add a new lockdown feature to Firefox 3.6 that will prevent developers from sneaking add-ons into the program, the company said. Dubbed 'component directory lockdown,' the feature will bar access to Firefox's 'components' directory, where most of the browser's own code is stored. Mozilla has billed the move as a way to boost the stability of its browser. 'We're doing this for stability and user control [reasons],' said Johnathan Nightingale, manager of the Firefox front-end development team. 'Dropping raw components in this way was never an officially supported way of doing things, which means it lacks things like a way to specify compatibility. When a new version of Firefox comes out that these components aren't compatible with, the result can be a real pain for our shared users ... Now that those components will be packaged like regular add-ons, they will specify the versions they are compatible with, and Firefox can disable any that it knows are likely to cause problems.'"
At my company I would like a stripped-down Firefox without features like awesome bar and other bloat. Is there a way to do this, easily?
Also I have the SmartQ 7 and SmartQ 5 MIDs which are basedon the ARM processor. Thedefault browseris Midori... can I get a Firefox compiled for the ARM to run on that?
I hink firefox shoudl focus on these and similar issues...
If you keep throwing chairs, one day you'll break windows....
Last February, and again in May, Firefox users complained when they found that Microsoft had pushed the .Net Framework Assistant add-on and the Windows Presentation Foundation (WPF) plug-in to their browsers as part of the .NET Framework 3.5 Service Pack 1 (SP1) update, which was delivered via Windows Update.
That's the first thing I thought of when I read the summary.
Put identity in the browser.
From a user perspective, this sounds like a good move. Stability problems in Firefox always seems to stem from add-ons or extensions. Lock that crap down, and make the devs code the right way.
So what would be the effect on Add-on development? Would it make it more difficult to develop them? Would it constrain the Add-on developers?
Or is this just a method to lock out some Add-on with already known problems?
In the browser wars, people tend to forget sometimes that marketshare is an inherent part of how much your browser will come under attack. Issue's like these, while it's good they're being patched, should have been taken care of a long time ago in anticipation of things to come. Firefox is still my preffered method of browsing, but thats because I am a halfway knowledgeable user that uses adblock, noscript, betterprivacy, use privately encrypted TOR when about (Iron Key) and only allow certain cookies. I used to recommend it to people, but now it seems just as bad (GASP) as IE with a standard install. I agree with jkrise (First Post!), there needs to be something like sub-builds that focus on security. I still like firefox better, as I occasionally evaluate the other browsers, and find them all lacking more than firefox in some areas. Just my two cents of subjective opinion though. Carpe Out.
"It's ok, I'm completely secure as long as my iron is off"
Works great, till you have someone like myself, who just specifies that my components are compatible with Firefox 2.* to 10.* so I don't have to worry about a new version claiming my plugin isn't compatible even though it is, which has happened enough in the past that I just don't care anymore.
Am I wrong? Yes. Is Mozilla wrong? Yes, you never trust the external code to tell you the truth, basic programming 101.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Not that I disapprove of this particular decision, but imagining the Slashdot's reaction to Microsoft implementing a thus-describable feature makes my head spin...
In Soviet Washington the swamp drains you.
I notice this doesn't extend to plug-ins and extensions found via the various plugins directories and registry keys. If it were me, I'd extend this feature to include saving a list in a locked-down location of all known extensions/add-ons found via the plugin directories and via registry keys. Every time the browser started, if it found a plugin or extension being loaded via the registry or a plugin directory that wasn't on the list, it'd notify the user what the plugin was and ask whether they wanted it enabled or not. That way nothing can get added to the browser without the user knowing and approving of the change.
Down in the advanced options I'd add a setting to give expert users the additional option of removing the plugin by either removing it's files from the plugins directory it was found in or removing it's registry keys depending on how it was found.
It was supposed to be a stripped down browser, instead of the bloat of the full Mozilla. And, when they started, they were close. But now they seem to be heading back in the other direction.
The acutal problem is that firefox blindly loads whatever is in that directory. .NET framework firefox extension did).
Locking the directory is a hack of a solution that others, especially Microsoft will easily find a way around. The proper answer is that Firefox needs to compare components it finds by their signature (checksum and name combo or whatever) with a secure list of components it is authorised by the user to load, before it loads them.
The other fix firefox needs is to deny installed extensions the ability to prevent the user from uninstalling them (like Microsoft's
That's why I started using Phoenix in the first place. However, I am guilty of running up to a dozen plugins...
I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.
You do get notified when at least some of those methods are used the next time you start Firefox. Pretty sure it's been that way since shortly after the MS plugin fiasco.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
If it doesn't allow rogue add-ons, does it allow nethack ones?
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
They don't disable installing the plugins, they disable installing them the wrong way.
And of course, you can always get the Firefox source and disable the check, if you really want.
The Tao of math: The numbers you can count are not the real numbers.
Tired of reading these sorts of comments. Sure there's some "bloat", but what that bloat is varies by opinion. I've read where supporting CSS is "bloat". Graphics are "bloat". tabs are "bloat". RSS. etc.
My understanding (and please tell me if I'm wrong) is the point of Firefox was to supply a WEB BROWSER. Back then when you downloaded it you also got an email program, news reader, wysiwyg website builder, etc. Firefox was JUST a browser. Still is.
If you REALLY want where everything is an option go build it yourself. Have something where you choose which renderer you want (Moz's, Webkit, etc), whether or not to have tabs, allow plugins, command line version, etc. Hit next a few times and presto your very own browser.
Will this prevent Adobe from installing their mongoloidish "Download Manager" Add-on that's set up to start every time you open a new window instead of just running when you start your browser?
I seem to remember that IE 8 does something like this when it's first installed, asking if you want any IE extensions enabled at all, and whether you want IE extensions blocked until you approve them, or something of that nature. But suffice to say that I don't install IE often enough to remember for sure.
It really isn't that simple. You could be running *nix or a mac. You might go to the same 3 sites everyday, but never browse new things. Due to the nature of the ways browsers are installed by default (which you imply you are using) you could get infected by even legitimate websites (who resell adspace to unscrupulous buyers) and not even realize it. With no tools, how do you propose to prevent cross-site scripting attacks, Java-script attacks, etc? I actually don't run a/v on personal systems. But I do run daily scans (while I'm at work) with multiple tools. I used to use no software firewall, relying on my strict PIX access-lists to protect me, but now I am using windows 7 and the firewall is so granular it is a good extra step. You are actually a malicious wet dream, someone who thinks they have everything so secure, that as long as you hide the bot/trojan etc well enough, they will never know they are a zombie machine. Just because you haven't been infected in over 20 years doesn't mean you can't get infected tomorrow. So, either you customize your browser intricately (JS, active-x settings, etc) or your just playing Russian roulette. Read this for tips on where you might be lacking. http://www.cert.org/tech_tips/securing_browser/
"It's ok, I'm completely secure as long as my iron is off"
I honestly don't understand why a web browser, which today is a platform for doing almost anything, would let any foreign code run without an explicit user request/confirmation - in the form of a standard, Firefoxy window the user knows. It's simply not security minded. Don't trust other people's code!
They say this can only be used from Chrome, but... um... I'm still not happy about having this in the API at all. :(
Every time the browser started, if it found a plugin or extension being loaded via the registry or a plugin directory that wasn't on the list, it'd notify the user what the plugin was and ask whether they wanted it enabled or not.
Don't ask me anything. Add-on's and extensions should only be included if you go to a Firefox UI and turn them on. There won't be any stealth additions, and if people really want some plug-in they'll figure it out, and the vendors will help by giving instructions.
Also, don't ask me about upgrades. Just upgrade the plug-in when starting (and restart if you must), and give me a way to lock an add-on at a particular version.
tomorrow who's gonna fuss
What, you mean, MS prevent programs from being installed or even piggybacking on other installs?
I don't know of anyone who'd be against that except the sales/marketing assholes of the world.
But that's ok. You seem to have a straight head judging from your sig.
Spies do it from behind, pretending to be someone else!
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
The way to handle this in firefox is to create separate browser profiles, one locked down for online banking and other stuff where you need extra security, and one for causal browsing. This is more secure than the way IE handles it.
Posted by a Debian GNU/Linux user
No no no, I think he's right, images, toolbars, panes, tabs are necessary infrastructure, RSS is not, the awesome bar is not, bookmarks are not, the question is, does this look like an extension? then why not make it a *default* extension? That way disabling the "bloat" would be easy for those who care and invisible for those who don't.
Put differently, why don't firefox devs learn to write extensions?
But... the future refused to change.
Wow, it's so easy to use! It's almost like having Synaptic for MS Windows programs!
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
Have you even actually compiled Firefox before?
"Now I am become Death, the destroyer of worlds"
Christian Anti-Porn 1.0.5.
Flee sexual immorality (1Co 6:18). Christian Anti-Porn will filter links and alert the user if any porn websites are clicked. This will not block but warn every Christian that he is going to crucify Jesus Christ again if he proceeds to such websites.
Misunderstood what I said, but I didn't write it very well. What I'm saying is a core feature for one isn't for another. I have ZERO problems with the Awesome Bar, I rather like it. I have zero use for RSS, wouldn't miss it if it was gone. However it being there doesn't hurt me any more then Minesweeper being on my computer when I install Windows.
What I'm tired of is people saying that Firefox is as bloated as Netscape Communicator or Mozilla was in the day. We're not even remotely near that. When they make Thunderbird a mandatory part of Firefox, I'll be concerned.
Oh no, does this mean i have to have a seperate instance of firefox open or that i would have to completely shut down firefox just to switch from slashdot to a bank website? Youve got to be kidding me. IE will automatically apply the right settings without restarting when you go to a website, so i dont accidently visit the website with the wrong profile. With that pathetic idea on firefox i would have to completely shut down firefox and restart it with a different profile, and if i forgot to do that i would blow my entire security scheme. IE does it automatically and that is safer. So no, your idea will not work and is not safe.
Are you a Firefox developer. Why can;t Firefox just implement such a basic security feature as Zones, and furthermore it should be in the main browser since we all agree everyone should use it. Why not? The fact that IE has more security features than Firefox is just pathetic, quite frankly, it could be the case that IE is even safer and protects your privacy more with its Zones feature and as long as you keep it up to date. Why is Firefox so opposed to user friendliness and so ignorant of users needs?
Comment removed based on user account deletion
I didn't misunderstand what you said, I know very well that what is bloat for someone might be a must for someone else, that's why extension are for, it allows you to have features in your browser that most users wouldn't like by defalut. The point is that, there being a perfect tool for extending and configuring Firefox, Firefox dev use, why? Even if you *Reapman* don't mind it someone else... lots of someone elses, do mind.
Actually I think you are the one missing the point saying that people can't say Firefox is bloated, you are taking a users are wrong approach, if enough users think your app is bloated then it is bloated. Or rather ask, what right you have to say it isn't bloated? Just because it is fine for you it doesn't mean it is fine for everybody.
Note that personally I don't find Firefox to bee too bloated, is just that I think the "core + default extensions" is the right way to go at this point in the life-cycle of Firefox.
But... the future refused to change.
But caps are more standardized. Many forums don't handle italics. There's nothing wrong with the OCCASIONAL capitalized word for emphasis.
This implies that at one point in time you did get all that with Firefox, when you're really talking about what is now SeaMonkey.
Now how I am going to view Gorgor's links on FARK without Greasemonkey? Wait, that might be a good thing...
Few things annoy me more than having a piece of software I install on my PC start fscking with other programs from other vendors. I found out some malicious program slipped a MS DRM plugin into my Firefox on my XP netbook (ALL DRM is malicious). I have to use Windows on the netbook for accessibility purposes because the magnifiers for Linux perform terribly on the thing. That doesn't give MS the right to infect my browser as part of their crusade to control the Internet.
So, in a world where we can't even trust the proprietary OS that we disabled folks are forced to run, thanks for taking steps to protect us from it, Mozilla.
Wait - you think that an ex-cheerleader and ex-beauty queen is qualified to be POTUS? A woman who was caught up in scandal while serving PART of a term as governor? The same woman who QUIT HER JOB as governor, so she would have time to write a book? THAT Sara Palin? PUH-LEASE!!!!
Be honest - Palin's strongest point is her looks, and her second strongest is her faith in God. What else can she bring to the (arguably) most powerful office in the world? Please, don't ask me to vote for her cup size. I'm as lecherous as any 50 year old, but those mams won't do us any good at all when the shit hits the fan.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
At least her nipples are bigger than our current president's balls!
The Thing is.
Something tells me we are in for a nail shortage.
I know tobacco is bad for you, so I smoke weed with crack.