Re: [FD] Mozilla extensions: a security nightmare

2015-08-06 Thread Bruce A. Peters
The exact same way ubuntu and the unix os has done it for many, many years. Using the sudo method. Everytime a restricted user needs to install a plugin, they are prompted for the administrator(root) password. After reviewing windows 10, It's obvious this problem will never be fixed and

Vulnerable MSVC++ runtime distributed with LibreOffice 5.0.0 for Windows

2015-08-06 Thread Stefan Kanthak
Hi @ll, the just released latest version 5.0.0.5 of LibreOffice.org for Windows distributes (once again) a completely outdated and vulnerable MSVC++ runtime. The installer package LibreOffice_5.0.0_Win_x86.msi contains the files msvcp80.dll 8.0.50727.42 msvcr80.dll 8.0.50727.42

Re: [FD] Mozilla extensions: a security nightmare

2015-08-06 Thread Stefan Kanthak
Ansgar Wiechers bugt...@planetcobalt.net wrote: On 2015-08-05 Stefan Kanthak wrote: Mario Vilas mvi...@gmail.com wrote: If this is the case then the problem is one of bad file permissions, not the location. Incidentally, many other browsers and tons of software also store executable code

FreeBSD Security Advisory FreeBSD-SA-15:19.routed

2015-08-06 Thread FreeBSD Security Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 = FreeBSD-SA-15:19.routed Security Advisory The FreeBSD Project Topic:

Re: [FD] Mozilla extensions: a security nightmare

2015-08-06 Thread Reindl Harald
that's all fine but * nothing new, independent of lightning * how do you imagine a restricted user install a extension otherwise * and no - he must not do that is not a acceptable solution security and usability are always a tradeoff hence the topic *is* nonsense Am 05.08.2015 um 21:27 schrieb

FreeBSD Security Advisory FreeBSD-SA-15:18.bsdpatch

2015-08-06 Thread FreeBSD Security Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 = FreeBSD-SA-15:18.bsdpatch Security Advisory The FreeBSD Project Topic:

Re: [FD] Mozilla extensions: a security nightmare

2015-08-06 Thread Christoph Gruber
Reindl Harald h.rei...@thelounge.net wrote: that's all fine but * nothing new, independent of lightning ACK * how do you imagine a restricted user install a extension otherwise Real sandboxing, if not possible, give the users the possibility to activate admin-installed extension, and

Re: [FD] Mozilla extensions: a security nightmare

2015-08-06 Thread Reindl Harald
Am 06.08.2015 um 19:03 schrieb Christoph Gruber: Reindl Harald h.rei...@thelounge.net wrote: that's all fine but * nothing new, independent of lightning ACK * how do you imagine a restricted user install a extension otherwise Real sandboxing, if not possible, give the users the

Re: [FD] Mozilla extensions: a security nightmare

2015-08-06 Thread Stefan Kanthak
Mario Vilas mvi...@gmail.com wrote: This makes no sense. Right. W^X obviously doesnt make sense to YOU. Administrator can write everywhere and users can write their own directories. There is no privilege escalation here, no security boundary being crossed. Who wrote anything about

Re: [FD] Mozilla extensions: a security nightmare

2015-08-06 Thread Andrew Deck
Well, here's my 2 cents: - Yes, it's unfortunate that firefox extensions are not in write-protected parts of the FS. - No, it's not worth eight paragraphs of ranting on this mailing list, use of all caps, or calling some piece of software evil. - The sudo-like functionality present in Windows

Re: [FD] Mozilla extensions: a security nightmare

2015-08-06 Thread Stefan Kanthak
Mario Vilas mvi...@gmail.com wrote: If it can only be written by your own user, what would be the security boundary being crossed here? Please read AGAIN what I already wrote! | The security boundary created by privilege separation ie. Administrator/root vs. user | and installation of