Re: Helping ensure privacy + security

As a user of the plugin and supporter of the concept that I do not want to expose information, the logic of this thread puzzles me.

The root scenario for me is this: I do not want websites to be able to query information about my browser, what plugins I have running, or anything else - except when I approve that information. This is not "disable the plugin" but have the plugin run and yet not be reported. 

What I see is that a valid plugin that provided exactly this feature has been disabled by recent design changes. Not because it was problematic, but just because. (If there was a technical reason that I failed to see, please do point it out.)

When called on this de-featuring, what I see as a response is basically: all of this is going away in a future release, when we also expect to alienate most of our users, so we won't bother reverting this.

The other argument I see raised is this: there are thousands of other points of attack, why bother with this one? The obvious answer is that you have to start somewhere, and this was a vector that was closed, until a code change took away this ability to close the vector. The underlying argument here boils down to this: we might as well all go back to FTP and Telnet, because the Internet is insecure, and it's too hard to fix all the holes.

Asking users to manually enable/disable plugins per-website is not likely to scale - particularly as more sites use third-parties to provide key content and infrastructure, so the "active" list will have to keep evolving even for established websites. It also doesn't address my desired outcome: no website should have the right to ask me for information I do not want to provide. The default answer should be null, not everything under the sun.

Could this conversation be turned back around to the original purpose?

* Why was the feature removed on technical grounds?
* Why do you not want to re-introduce the feature on technical grounds?