Re: TrojanHorse with Mozilla / Firefox

Daniel Veditz wrote:
<snip>
> We've noticed attempts like this recently and are taking steps to address
> it. As a first stop-gap, sites are no longer be able to launch installs
> during page load (easy to work around, but a quick band-aid to specific
> abuses we've seen). This is already in recent nightlies of Firefox and
> Mozilla. Second, at the cost of greatly reducing the usefulness of
> XPInstall, we're restricting its use to whitelisted sites or else people can
> explicitly download the file and then launch it (as they can do with an .exe
> install).

Daniel,

This is great news, but if you're going to restrict XPInstall sites to a 
whitelist, can you make sure there's a UI option for it?  Or at least 
make sure people get a pop-up to let them know what's going on when an 
XPInstall trigger is blocked?

XPInstall is a great feature, despite its flaws, and I think people 
should be able to continue using it if they want to.

-- GuruJ.