[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #9454 [TorBrowserButton]: Torbrowser shouldn't load any plugins if user didn't changed security settings
#9454: Torbrowser shouldn't load any plugins if user didn't changed security
settings
------------------------------+---------------------------------------------
Reporter: cypherpunks | Owner: mikeperry
Type: defect | Status: new
Priority: normal | Milestone:
Component: TorBrowserButton | Version:
Keywords: | Parent:
Points: | Actualpoints:
------------------------------+---------------------------------------------
Comment(by cypherpunks):
Replying to [ticket:9454 cypherpunks]:
> plugin was loaded to browser's address space already.
It's not how a Gecko Plug-in works. https://developer.mozilla.org/en-
US/docs/Gecko_Plugin_API_Reference/Plug-
in_Basics#Understanding_the_Runtime_Model
No any code loaded in to memory till it required, according this document.
It's absolutely safe to enumerate any system-wide installed plug-ins as
long as Torbutton disables plug-in with exist code. If any code can bypass
Torbutton protections then it can bypass Torbutton entirely and do even
worse things than it.
The only concern may keep is monitoring of plug-in existence in add-ons
list. But that is paranoia on a basis of insufficient information.
I suggest to close this bug as wontfix or notabug.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9454#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs