Re: Removing Firefox Version Number

On Aug 16, 7:13 pm, Kai Engert <[email protected]> wrote:
>
> An attacker might block a user's ability to update.


Asa, I believe you have not yet addressed this argument.

Here's something for you to try:
- depending on your operating system, edit file /etc/hosts or its
equivalent (it's a plain text file)
- add this line:
127.0.0.1 aus3.mozilla.org

(this assumes that NO service is running on port 443 on your own
computer.)
(A MITM attacker can easily do the equivalent of this and point this
hostname to an appropriate server.)

- download a nightly build that is 2 weeks old, e.g. from
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2011-08-03-03-07-53-mozilla-central/

- start the nightly build
- open the about dialog

In my testing, this shows "Nightly, 2011-08-03, Nightly is up to
date".

If you remove the version number from this dialog, you are unable to
notice that your connection to the update server is being blocked.

Kai