7098888
story
Comments: 265 +- Technology: Firefox 3.6 Locks Out Rogue Add-ons on Wednesday November 18, @10:13AM
background: url(//a.fsdn.com/sd/topics/topicmozilla.gif); width:80px; height:64px;
mozilla
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
background: url(//a.fsdn.com/sd/topics/topicit.gif); width:75px; height:61px;
it
CWmike writes "Mozilla will add a new lockdown feature to Firefox 3.6 that will prevent developers from sneaking add-ons into the program, the company said. Dubbed 'component directory lockdown,' the feature will bar access to Firefox's 'components' directory, where most of the browser's own code is stored. Mozilla has billed the move as a way to boost the stability of its browser. 'We're doing this for stability and user control [reasons],' said Johnathan Nightingale, manager of the Firefox front-end development team. 'Dropping raw components in this way was never an officially supported way of doing things, which means it lacks things like a way to specify compatibility. When a new version of Firefox comes out that these components aren't compatible with, the result can be a real pain for our shared users ... Now that those components will be packaged like regular add-ons, they will specify the versions they are compatible with, and Firefox can disable any that it knows are likely to cause problems.'"
Related Stories
Necessity is a mother.
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.
I want a mechanism for pluck-outs... (Score:2, Interesting)
At my company I would like a stripped-down Firefox without features like awesome bar and other bloat. Is there a way to do this, easily?
Also I have the SmartQ 7 and SmartQ 5 MIDs which are basedon the ARM processor. Thedefault browseris Midori... can I get a Firefox compiled for the ARM to run on that?
I hink firefox shoudl focus on these and similar issues...
Re:I want a mechanism for pluck-outs... (Score:4, Funny)
Parent
Re:I want a mechanism for pluck-outs... (Score:5, Funny)
The mental image that came to mind when I saw that convinces me that I watch WAY too much porn...
Parent
Re:I want a mechanism for pluck-outs... (Score:5, Interesting)
The awesome bar, and most of the other firefox bloat, should be plugins. Firefox had this great plugin architecture which everyone and their dog used- except the firefox devs.
Why doesn't firefox ship with an array of "default" plugins, all of which can be disabled? There's no need for something like awesomebar to be core, is there?
Parent
Re: (Score:3, Informative)
Sure you can. You can wipe sites from the history (and thus from the location database) relatively easily.
You can begin typing, highlight a search result by hovering over it with the mouse, then press the Del key to remove that result.
You can also open the history tab, type something in Search, tab into the search results list, Ctrl-A to select all, and press the Del key to remove all of them.
Finally, you can add the HistoryBlock [mozilla.org] extension which silently prevents certain sites (domains or subdomains) from b
Re: (Score:3, Insightful)
Re:That was the idea behind Firefox/Firebird/Phoen (Score:5, Insightful)
Tired of reading these sorts of comments. Sure there's some "bloat", but what that bloat is varies by opinion. I've read where supporting CSS is "bloat". Graphics are "bloat". tabs are "bloat". RSS. etc.
My understanding (and please tell me if I'm wrong) is the point of Firefox was to supply a WEB BROWSER. Back then when you downloaded it you also got an email program, news reader, wysiwyg website builder, etc. Firefox was JUST a browser. Still is.
If you REALLY want where everything is an option go build it yourself. Have something where you choose which renderer you want (Moz's, Webkit, etc), whether or not to have tabs, allow plugins, command line version, etc. Hit next a few times and presto your very own browser.
Parent
This is one that really needs to come as default: (Score:3, Funny)
Christian Anti-Porn 1.0.5 [mozilla.org].
Flee sexual immorality (1Co 6:18). Christian Anti-Porn will filter links and alert the user if any porn websites are clicked. This will not block but warn every Christian that he is going to crucify Jesus Christ again if he proceeds to such websites.
Re: (Score:3, Funny)
No. I'm quite happy with Midori [twotoasts.de].
Re: (Score:3, Funny)
.NET Anyone? (Score:5, Insightful)
Last February, and again in May, Firefox users complained when they found that Microsoft had pushed the .Net Framework Assistant add-on and the Windows Presentation Foundation (WPF) plug-in to their browsers as part of the .NET Framework 3.5 Service Pack 1 (SP1) update, which was delivered via Windows Update.
That's the first thing I thought of when I read the summary.
Re:.NET Anyone? (Score:4, Insightful)
Parent
Re:.NET Anyone? (Score:5, Funny)
What do you mean? As far as I know, in all the instances where a toolbar is bundled with some other software, the toolbar installation is clearly mentioned in the software EULA, so each time the toolbar is installed, the user agreed that he wanted it. As a developer for a Web optimizer plugin, this Firefox change will make it much harder for us to reach our users.
Parent
Re:.NET Anyone? (Score:5, Insightful)
the toolbar installation is clearly mentioned in the software EULA, so each time the toolbar is installed, the user agreed that he wanted it. As a developer for a Web optimizer plugin, this Firefox change will make it much harder for us to reach our users.
I fail to see the downside for anybody but you, and you make it sound like you clearly deserve it.
Parent
Re:.NET Anyone? (Score:5, Insightful)
> What do you mean? As far as I know, in all the instances where a toolbar is bundled with some other
> software, the toolbar installation is clearly mentioned in the software EULA, so each time the toolbar
> is installed, the user agreed that he wanted it. As a developer for a Web optimizer plugin, this Firefox
> change will make it much harder for us to reach our users.
Q. What's the difference between a 'trojan' and 'malware'?
A. Malware has a EULA.
I can't even *begin* to emphasize how badly it pisses me off when some app tries to sneak BHOs and plugins into their installer... almost always in ways that someone in a hurry to install the app that's actually *desired* will overlook. I flat-out refuse to ever use Yahoo and Google's toolbars, *precisely* because they have so many people trying to ram them down my throat and trick me into installing them.
Parent
Re:.NET Anyone? (Score:5, Insightful)
If it's "mentioned in the EULA" it might as well be "on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard'". About the same amount of people will be able to read & understand it.
Parent
Ninite installs only programs you pick? (Score:3, Interesting)
Re:.NET Anyone? (Score:5, Informative)
Those components were installed by editing the Windows registry, not 'dropped in' as is discussed here (Firefox looks in various locations to find plug-ins and addons to load).
Parent
Re: (Score:3, Insightful)
Maybe you should stop installing malicious software, then.
There's a perfectly good reason why these apps need to look in multiple locations: different users have different setups.
It's all well and good to have "one location", until that one location on one person's machine is an administrator-only location that non-privileged users can't edit, meaning they have no ability to customize their use of the software. I don't give a crap what p
Re: (Score:3, Informative)
http://slashdot.org/comments.pl?sid=1407593&cid=29776261 [slashdot.org]
link, because "plain old text" turns urls into links
Re: (Score:2)
they said they would have a solution, and this is a viable one. That is exactly what I had in mind as well. Like they say, locks keep honest people honest.
Re: (Score:2)
Yes, and I think that's pretty much what they're taking aim at. They already specifically blacklisted the add-on a while ago, causing huge cheer as well as huge backlash. It seems that with this approach they want a more flexible solution by making sure people can disable stuff they don't want.
Re: (Score:3, Informative)
This is different from that. Those are actually packaged as add-ons so this change wouldn't affect them at all.
What Mozilla should do about those IMO is one of two things: 1) Enable the uninstall button for globally installed extensions (IE installed for all users) on Administrator accounts (in Windows; root on Linux... assuming Linux has global extensions) 2) Take steps to prevent or discourage apps from trying to plop extensions down and install them in Firefox without the user's consent. The "official"
Re:.NET Anyone? (Score:5, Informative)
Well, as no one reads the article, this doesn't concern .NET update in any way:
In actuality, Microsoft did not drop its code into Firefox's components directory, Nightingale confirmed. "The .Net Framework and WPF use our existing extension/plug-in mechanisms, that's why we were able to disable them when they were found to be vulnerable," he said in a follow-up e-mail. "They aren't impacted by this change."
Parent
Re:.NET Anyone? (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
What a textbook example of a strawman argument! Firefox was not intended to manage software installed to "C:\Program Files\" an
Re: (Score:3, Interesting)
It's an artifact of supporting system wide extension installation, rather than per user. Microsoft probably should have used per user installation of the plugin (even though .NET is arguably a system wide update). Removing the support is probably overkill, as I imagine it is useful in managed environments.
User perspective (Score:5, Insightful)
From a user perspective, this sounds like a good move. Stability problems in Firefox always seems to stem from add-ons or extensions. Lock that crap down, and make the devs code the right way.
Re:User perspective (Score:4, Insightful)
From a user perspective, this sounds like a good move. Stability problems in Firefox always seems to stem from add-ons or extensions. Lock that crap down, and make the devs code the right way.
Correction - stability problems in Firefox have always been blamed on add-ons or extensions. Of course the developers always became deaf when people having issues with no plug-ins installed.
Parent
Re: (Score:3, Insightful)
Because --safe-mode is too much?
To get help all I've ever had to do is run the program in --safe-mode and see if the bug is still there (often it's not), personally i like keeping a blank profile and launching it with --no-remote anyway, but --safe-mode isn't that much to ask, given they are normally caused by addons
Effects on Add-on Development (Score:3, Interesting)
Or is this just a method to lock out some Add-on with already known problems?
Re: (Score:3, Insightful)
Re:Effects on Add-on Development (Score:5, Informative)
The MS plugin is not effected by this. It did things in the proper way, the documented method for adding system wide extensions rather than user level extensions. That is why Mozilla could easily disable the insecure version of the plugin, because it actually followed the rules.
MS just added a registry key that pointed at the files for the extension, which is well documented and used by many other pieces of software to allow plugins to be installed even before Firefox, and allowing any version of Firefox (or Thunderbird or whatever) to find them, even after installation into some random directory.
If you bother to read the article, it says the same. Google Desktop Search on the other hand, doesn't follow the rules and will be blocked unless Mozilla makes a work around for them or Google updates GDS to follow the rules.
This is essentially like not allowing code from anyone other than MS to be dropped into the Windows directory, and requiring it to be put somewhere else and properly registered with the system rather than throwing it in the system32 directory and loading it as if it were trusted code from MS.
Parent
Re: (Score:3, Insightful)
I disagree with the "proper way." I do not use .NET and have no wish for that to be in a competitor's browser. To me the proper way is for me seek out a download, preferably through an XPI, but definitely not through Windows/Microsoft Update.
Although I thought I read it, I didn't see the link to the second page to TFA, so thanks for redirecting me back to it.
Re:Effects on Add-on Development (Score:4, Insightful)
but it isn't a .NET addon. Its a Firefox addon.
So you should be perfectly able to install any .NET update from WU safe in the knowledge that it is not affecting your non-.NET applications, like Firefox.
Parent
Re: (Score:3, Insightful)
So what would be the effect on Add-on development? Would it make it more difficult to develop them? Would it constrain the Add-on developers?
Its the same reason why IE made it easier to develop web pages by tolerating broken HTML code.
People were using unintended features to make their work easier, but then when the unintended feature was removed then it breaks a lot of things.
In that respect, the developers should have wrote to spec in the first place rather than taking advantage of loopholes because it mi
Marketshare Issues. (Score:4, Informative)
Re: (Score:3, Insightful)
I am a halfway knowledgeable user that uses adblock, noscript, betterprivacy, use privately encrypted TOR when about (Iron Key) and only allow certain cookies.
Do you really feel this is necessary? Sounds like you are jumping through a lot of hoops and degrading your browsing at the expense of a tin-foil hat.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Do you really feel this is necessary? Sounds like you are jumping through a lot of hoops and degrading your browsing at the expense of a tin-foil hat.
If you are doing anything of importance with your browser, yes. If all you do is surf the web all day, then usually, no.
If you work with online banking, do other forms of commerce online, then you need to treat your web browser like your bank should because it is, by extension, your bank. If any form of VPN connections are used to your work, then you need to treat your computer as a work computer and secure it appropriately. Also, if you surf for porn, you really need to use this as the most nasty ex
It's not that simple (Score:3, Interesting)
Components specifying version compatibility ... (Score:4, Insightful)
Works great, till you have someone like myself, who just specifies that my components are compatible with Firefox 2.* to 10.* so I don't have to worry about a new version claiming my plugin isn't compatible even though it is, which has happened enough in the past that I just don't care anymore.
Am I wrong? Yes. Is Mozilla wrong? Yes, you never trust the external code to tell you the truth, basic programming 101.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
The addon Mr. Tech Toolkit has this option. Under its options Misc -> XPI install options -> Enable Addons Compatibility checking
Re: (Score:3, Informative)
FF less than 3.6
1. Right-click -> New -> Boolean
2. Name: extensions.checkCompatibility
3. Value: false
FF more than or equal to 3.6
extensions.checkcompatibility. is used instead (bug 521905). "" is the application version, including alpha and beta releases but excluding minor version updates. For example: Firefox 3.6b2 -> extensions.checkCompatibility.3.6b Firefox 3.6 -> extensions.checkCompatibility.3.6 and Firefox 3.6.1 -> ext
Doesn't extend to all externally-installed add-ons (Score:4, Insightful)
I notice this doesn't extend to plug-ins and extensions found via the various plugins directories and registry keys. If it were me, I'd extend this feature to include saving a list in a locked-down location of all known extensions/add-ons found via the plugin directories and via registry keys. Every time the browser started, if it found a plugin or extension being loaded via the registry or a plugin directory that wasn't on the list, it'd notify the user what the plugin was and ask whether they wanted it enabled or not. That way nothing can get added to the browser without the user knowing and approving of the change.
Down in the advanced options I'd add a setting to give expert users the additional option of removing the plugin by either removing it's files from the plugins directory it was found in or removing it's registry keys depending on how it was found.
Re:Doesn't extend to all externally-installed add- (Score:3, Informative)
You do get notified when at least some of those methods are used the next time you start Firefox. Pretty sure it's been that way since shortly after the MS plugin fiasco.
The actual problem is... (Score:4, Insightful)
The acutal problem is that firefox blindly loads whatever is in that directory. .NET framework firefox extension did).
Locking the directory is a hack of a solution that others, especially Microsoft will easily find a way around. The proper answer is that Firefox needs to compare components it finds by their signature (checksum and name combo or whatever) with a secure list of components it is authorised by the user to load, before it loads them.
The other fix firefox needs is to deny installed extensions the ability to prevent the user from uninstalling them (like Microsoft's
Re: (Score:3, Informative)
> they should have an "approved" list within the browser's data
That's precisely what this fix does.
> as opposed to a "disabled" one
I have no idea why you decided there's such a list. Was it something in the article?
That's assuming you're talking about component loading, not add-ons; from the latter part of your comment it sounds like you're talking about add-ons...
nethack (Score:4, Funny)
If it doesn't allow rogue add-ons, does it allow nethack ones?