Comments on: Malicious XPIs run executable binaries http://blog.codefront.net/2004/03/27/malicious-xpis-run-executable-binaries/ Rails, Firefox, Anime, Mac Thu, 11 Mar 2010 23:55:41 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: Minh Nguyễn http://blog.codefront.net/2004/03/27/malicious-xpis-run-executable-binaries/comment-page-1/#comment-2147 Minh Nguyễn Thu, 01 Jan 1970 00:00:00 +0000 http://blog.codefront.net/archives/2004/03/27/malicious-xpis-run-executable-binaries/#comment-2147 I’m not so sure that David Tenser verifying all the XPIs alone would scale too well. :) I’m not so sure that David Tenser verifying all the XPIs alone would scale too well. :)

]]> By: Dark Reflexions http://blog.codefront.net/2004/03/27/malicious-xpis-run-executable-binaries/comment-page-1/#comment-2148 Dark Reflexions Thu, 01 Jan 1970 00:00:00 +0000 http://blog.codefront.net/archives/2004/03/27/malicious-xpis-run-executable-binaries/#comment-2148 <strong>Disappointing</strong> A malicious Firefox .XPI was created I'm just gunna trackback and link you to the blog of a person I know (internet-wise), because his post was very well written. It will be fixed by the Mozilla developement project somehow, but... Disappointing
A malicious Firefox .XPI was created I’m just gunna trackback and link you to the blog of a person I know (internet-wise), because his post was very well written. It will be fixed by the Mozilla developement project somehow, but…

]]> By: Cheah Chu Yeow http://blog.codefront.net/2004/03/27/malicious-xpis-run-executable-binaries/comment-page-1/#comment-2146 Cheah Chu Yeow Thu, 01 Jan 1970 00:00:00 +0000 http://blog.codefront.net/archives/2004/03/27/malicious-xpis-run-executable-binaries/#comment-2146 <blockquote>Verified by whom? mozilla.org?</blockquote> I'd say a good, trusted authority is good enough. The people at mozdev.org, David Tenser, mozilla.org are possible candidates.

Verified by whom? mozilla.org?

I’d say a good, trusted authority is good enough. The people at mozdev.org, David Tenser, mozilla.org are possible candidates.

]]> By: 0zone http://blog.codefront.net/2004/03/27/malicious-xpis-run-executable-binaries/comment-page-1/#comment-2145 0zone Thu, 01 Jan 1970 00:00:00 +0000 http://blog.codefront.net/archives/2004/03/27/malicious-xpis-run-executable-binaries/#comment-2145 There should be a team that checks packages that are submitted, if the team finds that the packages are ok then they add the file name and md5 of the file to a database that gets checked by the installer. If the installer can't find the entry then it should display a warning stating that the package could not be verified and ask them if they want to continue (no should be default). There should be a team that checks packages that are submitted, if the team finds that the packages are ok then they add the file name and md5 of the file to a database that gets checked by the installer. If the installer can’t find the entry then it should display a warning stating that the package could not be verified and ask them if they want to continue (no should be default).

]]> By: Jesse Ruderman http://blog.codefront.net/2004/03/27/malicious-xpis-run-executable-binaries/comment-page-1/#comment-2144 Jesse Ruderman Thu, 01 Jan 1970 00:00:00 +0000 http://blog.codefront.net/archives/2004/03/27/malicious-xpis-run-executable-binaries/#comment-2144 "Best solution, to me? Verified and digitally signed XPIs are allowed to run without hindrance." Verified by whom? mozilla.org? “Best solution, to me? Verified and digitally signed XPIs are allowed to run without hindrance.”

Verified by whom? mozilla.org?

]]>