Firefox Will Add a New Drive-by-Download Protection (zdnet.com) 31
Mozilla will add a new security feature to Firefox in October that will make it harder for malicious web pages to initiate automatic downloads and plant malware-laced files on a user's computer. From a report: Called a drive-by download, this type of attack has been around for two decades and usually takes place when users visit a website that contains malicious code placed there by an attacker. The role of the malicious code is to abuse legitimate features in browsers and web standards to initiate an automatic file download or download prompt, in the hopes of tricking the user into running a malicious file. There are multiple forms of drive-by downloads, depending on the browser feature attackers decide to use. Browsers like Chrome, Firefox, and Internet Explorer have, across the years, gradually deployed various forms of protections against automatic drive-by downloads, but 100% protection can't be fully achieved because browser makers can't fully block legitimate web features and also because of the shifting landscape of web attacks, with attackers always finding a new hole to poke at.
We need to be protected from browser makers (Score:1, Troll)
Re: (Score:1)
They released it too early. They know the problems with the UI and are fixing them - the beta version has a list of stuff they know are bad and are on their "get done" list.
and they're all the stupid thing that it should never have been released without. Like opening a new tab every time you click a homepage link.
I still rate firefox, but the management need a good kick up the arse, and out the door.
Re: (Score:2, Troll)
The new Firefox android is so bad it basically killed it
Indeed! Fuck Firefox. You've made yourself useless to me on tablets and phones! At some point, waaayyy in the future, I *might* consider going back, IF they revert/restore previous features. For now it's (shudder!) Chrome.
Re: (Score:1)
The next version of Firefox Android will enable all add-ons again, but like the old version the majority won't work properly because of broken UIs. Most add-ons have UIs for desktop Firefox which don't work on mobile.
Neat but (Score:2)
Me, also. Hidden reasons Firefox was changed? (Score:2)
I also like Snap Links Plus. I haven't found something like that for the new Firefox. And Ghostery.
And there are other add-ons I need. Firefox management seems very insufficient.
We need a browser law that says browser providers must make clear how the browser works, there must be no hidden operations.
We need a browser law? An example. (Score:2)
Someone on Slashdot said that Google is still doing that.
It seems to me that Google CEO Sundar Pichai should be replaced with someone more kind and open and honest and caring.
One Feature to Rule Them All (Score:2)
Re: (Score:2)
Is it ok if it also listens to your mic and uses the AI to transcribe everything you say.... for voice control ;-)
Fixing bugs as a feature (Score:2)
but 100% protection can't be fully achieved because browser makers can't fully block legitimate web features and also because of the shifting landscape of web attacks, with attackers always finding a new hole to poke at
So fixing bugs is now marketed as an 'additional protection' feature.
If only there was a browser maker that could throw hundreds of millions on development and choose which features to and not to implement because of security or other concerns because they have their in-house developed rendering engine and UI...
blah (Score:2)
I've had users for years complaining about having to click hundreds of links to download. (a search engine for physics data).
As I wanted to actually have a reliable method of 'click one button to download lots of links', I had played around with how to get around some of the limits in javascript. (things like waiting a half second between triggering each download, etc.).
Anyone know of any tools that work well for when it's an actual intentional download, and not just a driveby? I remember I tried playing
Bulk-download can be done (Score:1)
Anyone know of any tools that work well for when it's an actual intentional download, and not just a driveby?
For something like a search engine where the people running the search engine WANT to make it easy to bulk-download the results, it should be easy:
Either provide a "store"-like experience where the user could "add some/all results to cart" for bulk-download after he has his "cart" the way he wants it, or provide a way to export the resulting URLs to a file and provide a one-button tool that would download all the links in a file. I'm thinking maybe a shell script that calls geturl or something equivalent.
I
Re: (Score:2)
Exactly, implement it server side, not in the browser in javascript like most developers are trying to do nowadays for almost everything. Build a zip file on the fly or whatever is needed but simply do it server side. Javascript hacks may stop working any day a browser update is released.
I still implement most of the functionality server side with minimal use of javascript. It makes much more robust applications. I don't understand why developers make their applications dependent on browser implementations
Re: (Score:1)
Re: (Score:2)
'click one button to download lots of links'
Did you mean files rather than links. Because the result of downloading hundreds of links (to web pages) is hundreds of tabs. If what you meant is files, then there is tar | gzip (I'm certain a logical equivalent exists for more primitive systems). The files can either be pre-packed on the server if they are typically always downloaded together. Or a simple Perl server side script can feed them to the tar | gzip pipe on the fly based on user selection.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Waterfox + DownThemAll (if you can find it).... https://addons.thunderbird.net... [thunderbird.net]
Re: (Score:2)
Actually there's Firefox and Chrome versions too.
Cool, now can we please fix this other problem? (Score:2)
What about drive-by arguments? [youtube.com]
Re: (Score:2)
Or drive-by-wire?
Sure they can block legitimate features (Score:1)
because browser makers can't fully block legitimate web features
If by "legitimate features" you mean features that were created for an initially used for legitimate purposes? Sure web browsers can block them, and they have, for good reason: At some point, the danger to users or more likely to the web browser vendor's bottom line or public reputation outweighed the benefit of maintaining them.
Flash Player, goodbye, or goodbye soon.
Older plugin APIs, goodbye, or goodbye soon.
Even some useful-at-one-time HTML 1.0 features are now unofficially or officially deprecated or
Does this include ... (Score:2)
Re: (Score:2)
Another Solution (Score:2)
To a problem that does not exist. The only time I have ever seen a "drive by download" is when using Microsoft Internet Exploder.
Perhaps someone should explain the concept of a "drive by download" because (except for very badly designed hunks of shit such as come from Microsoft and presumably Google) I have never experienced a browser "receiving" a file that it did not ask for.
Maybe Mozilla should rethink (Score:2)
You can't totally protect someone from their ignorance unless YOU violate their freedom and rights. Along with free speech, the right to be dumb is an absolute necessity.
While I am ranting! If un requested downloads is such a problem, here is my question for everyone.
Why do most web site run scripts from dozens of different places. Is that not a security risk. Each time I us
How about A switch? (Score:2)
How about a download switch. Turn it on, and downloads are permitted. Turn it off, and all downloads are blocked.