Firefox 8 released [LWN.net]

Firefox 8 released

Posted Nov 10, 2011 9:23 UTC (Thu) by job (guest, #670)
In reply to: Firefox 8 released by ekj
Parent article: Firefox 8 released

You just said "disabled by default" with many more words. The question remains what Mozilla can do to remedy this?

The only thing I can think of is to make installation really convoluted, perhaps require that several different changes are made, in sync, to undocumented file formats. A reasonably intelligent person would recognize this as a solution probably worse than the problem.

I'm slightly sad that not only is the release announcement made of these nonsensical PR bullet points, but they are repeated on news sites and blogs while no one understands what they mean. People do not seem to expect anything else anymore. Web browser development has been made more ivory tower-ish over the past few years and all that's visible on the outside is new window dressing every few months.

to post comments

Solution is simple...

Posted Nov 10, 2011 9:48 UTC (Thu) by khim (subscriber, #9252) [Link] (3 responses)

The only thing I can think of is to make installation really convoluted, perhaps require that several different changes are made, in sync, to undocumented file formats.

Not really. You only need one such file - and you already have it: browser binary. Just sign the preferences file with some key unique to the browser build - and that's it. You will need to include keys for all previous officially released builds, obviously (to make it possible to upgrade), but this is not a big deal.

Sure, crapware developers may try to scan you binary to find embedded keys, but these schemes will be inherently fragile. Your goal is not to make something impossible but merely make something unfeasible, after all.

Solution is simple...

Posted Nov 10, 2011 17:03 UTC (Thu) by job (guest, #670) [Link] (2 responses)

I'd like to challenge that. Even if keys were unique for each build they are stored somewhere and a third party installer could just as easily extract them. You would need to obfuscate keys by hand at random positions for each release for this scheme to slow down a third party installer noticeably.

It amounts to a pretty standard copy protection scheme, and all of those are broken not very long after release. (By people who receive by pay by the way, defeating this installer would be worth money.)

This is not so simple.

Posted Nov 10, 2011 17:42 UTC (Thu) by khim (subscriber, #9252) [Link] (1 responses)

You would need to obfuscate keys by hand at random positions for each release for this scheme to slow down a third party installer noticeably.

Nope. We are talking crapware here, not malware. You only need to slow down it enough to trigger § 1201. After that point you don't have an example of crapware. It's clearly illegal malware and should be treated as such: it will be added to virus databases, etc.

This is not so simple.

Posted Nov 14, 2011 20:28 UTC (Mon) by job (guest, #670) [Link]

I see. I would never have thought that I would find EUCD/DMCA on my side some day, but what do you know...