Comment by xg15
9 years ago
> If someone distrusts their add-ons, why trust their browser at all?
"Well, I'm your bank. You already gave me authority to reinvest all your savings. Why are you mad now that I invested everything into bitcoin futures?"
What exactly does "trust" mean? We might have given mozilla such a widespread access exactly because we trust them not to abuse it. Stuff like this undermine that trust.
Maybe not be the best analogy since that is exactly what banks do with your money while it's parked in your savings account - invest it in whatever they feel like. Probably not Bitcoin futures because the bank manager doesn't want to, but there's nothing stopping them from doing exactly that.
No, the bitcoin futures were my point. Of course they can re-invest in principle but the trust is tgat they won't invest them into something that is an obvious risk.
And no, they can't: In many countries there are regulations forbidding high-risk investments with regular savings accounts for exactly that reason.
How is this extension an abuse of that trust?
Before, we didn't need to trust them, because we didn't have to. We had all the code, we could verify the code we can read is the code in the binary we use via checksums. Now the code contains the ability to go fetch arbitrary code behind our backs and run it against our will. Firefox is now malware and it's a real damn shame.
> Now the code contains the ability to go fetch arbitrary code behind our backs and run it against our will.
How is that not what automatic updates are?
Right. I trust my browser vendor to send me automatic updates without me reviewing because I believe that's net good for my security. I'd prefer to live in a world where I don't have to question that.
1 reply →