Re: "Mark of the web" considered harmful

2005-04-24 Thread Nigel McFarlane
But it's not just web pages, is it? Almost all Word or Excel files basically have the "dirty bit" - when you fire them up, you are asked if you trust the file and if you want to run the macros. That's right, and the mechanism you describe for Word matches the behaviour I proposed for the scripte

Re: Possible security policy for local disk access

2005-04-24 Thread Nigel McFarlane
Mozilla can't save files to disk; only users can do that using Mozilla as a tool. That's splitting hairs. :-) Such files are not to be trusted /de facto/, because we can assume the user has not audited them. No it's not. To extend you Word analogy elsewhere, Mozilla users can save .doc files to

Re: Possible security policy for local disk access

2005-04-24 Thread Nigel McFarlane
What I didn't say was this: This is a really hard problem. That's why (in my view) some time and effort should be spent on the problem rather than just doing what "seems like" a good idea. For those seeking a real solution, as opposed to a "best efforts," which is the only practical way forward,

Re: Low security SSL sites

2005-04-24 Thread Peter Gutmann
Heikki Toivonen <[EMAIL PROTECTED]> writes: >Ian G wrote: >> Peter Gutmann wrote: >>> 1. Disable SSLv2 in your browser (i.e. take it to the state that it >>> should >>>have been shipped in in the first place). >> >> Right. Perhaps we should file a bug? >Something like?: >https://bugzilla.mo

Re: Low security SSL sites

2005-04-24 Thread Peter Gutmann
Nelson B <[EMAIL PROTECTED]> writes: >Any time mozilla disables a feature that works in IE, it only costs >mozilla marketshare. People who cannot reach a popular site with >mozilla cite this as another reason to go back to IE. What might help a bit is if Mozilla displayed slightly more informati

Re: Low security SSL sites

2005-04-24 Thread Peter Gutmann
Ian G <[EMAIL PROTECTED]> writes: >Jaqui Greenlees wrote: >> Peter Gutmann wrote: >>> You can see where the magic-numbers problem has lead with the magic >>> number >>> "128". Provided that you mention this magic number somewhere in your >>> marketing literature, your product will be regarded as

Re: How to shut down the Java applets process?

2005-04-24 Thread Ron Hunter
wylbur37 wrote: When I visit a website that uses applets, the Java coffee-cup icon shows up in the system tray. When I right click on the icon, the only choices are ... About Java Technology, Go to Java.com, Open Control Panel, Hide Console, Hide Icon. Even when I left the website, the Java i

Re: How to shut down the Java applets process?

2005-04-24 Thread Roland
On 24-4-2005 11:34, wylbur37 wrote: When I visit a website that uses applets, the Java coffee-cup icon shows up in the system tray. When I right click on the icon, the only choices are ... About Java Technology, Go to Java.com, Open Control Panel, Hide Console, Hide Icon. Even when I left the

How to shut down the Java applets process?

2005-04-24 Thread wylbur37
When I visit a website that uses applets, the Java coffee-cup icon shows up in the system tray. When I right click on the icon, the only choices are ... About Java Technology, Go to Java.com, Open Control Panel, Hide Console, Hide Icon. Even when I left the website, the Java icon was still i