View source for Extension Blocklisting

<div id="axlomveu" style="overflow:auto;height:1px;">[http://www.naacpncnetwork.org/nzrpe/ designer handbag kate replica spade] [http://www.naacpncnetwork.org/dqspqvz/ wholesale replica coach handbag] [http://www.naacpncnetwork.org/uicohwsh/ coach signature replica handbag wholesale] [http://www.naacpncnetwork.org/maxrfq/ aaa replica handbag] [http://www.naacpncnetwork.org/aeafvtw/ aaa chloe handbag replica] [http://www.naacpncnetwork.org/pfsvvrhya/ aaa grade handbag replica] [http://www.naacpncnetwork.org/iuksk/ handbag lv replica wholesale] [http://www.naacpncnetwork.org/mrisc/ hermes handbag replica] [http://www.naacpncnetwork.org/rkesflccj/ cheap replica handbag] [http://www.naacpncnetwork.org/cbmizf/ cheap replica chanel handbag] [http://www.naacpncnetwork.org/inmjs/ cheap replica coach handbag] [http://www.naacpncnetwork.org/xubcc/ cheap wholesale replica handbag] [http://www.naacpncnetwork.org/bbvfpatd/ cheap designer replica handbag wholesale] [http://www.naacpncnetwork.org/jrpbdgkls/ replica chloe handbag] [http://www.naacpncnetwork.org/bndxgv/ chloe handbag paddington replica] [http://www.naacpncnetwork.org/hurdmfzwa/ chloe designer handbag replica] [http://www.naacpncnetwork.org/lajyiwkvp/ fendi replica handbag] [http://www.naacpncnetwork.org/iyvxqw/ fendi and gucci replica handbag] [http://www.naacpncnetwork.org/enievg/ wholesale designer replica handbag] [http://www.naacpncnetwork.org/zydofdkd/ replica designer handbag at wholesale prices] [http://www.naacpncnetwork.org/giunev/ wholesale replica handbag] [http://www.naacpncnetwork.org/kgyuj/ handbag wholesale replica watch] [http://www.naacpncnetwork.org/jdilfpjqx/ wholesale replica lv handbag] [http://www.naacpncnetwork.org/fvkfvmvp/ replica handbag wholesale price] [http://www.naacpncnetwork.org/kouyrc/ replica chanel handbag] [http://www.naacpncnetwork.org/xrisqzjo/ replica designer handbag chanel] [http://www.naacpncnetwork.org/hkuzsz/ discount chanel handbag replica] [http://www.naacpncnetwork.org/rhyfld/ handbag louis replica theda vuitton] [http://www.naacpncnetwork.org/pfvwbjdyy/ handbag louis replica shopping vuitton] [http://www.naacpncnetwork.org/fwnriugs/ bag image louis mirror replica vuitton] [http://www.naacpncnetwork.org/kpcqja/ bag designer diaper replica] [http://www.naacpncnetwork.org/cwomynr/ bag dior replica] [http://www.naacpncnetwork.org/sbcjjxjum/ bag christian dior replica] [http://www.naacpncnetwork.org/coadxfajn/ bag hermes replica] [http://www.naacpncnetwork.org/atkwzq/ bag birkin hermes replica] [http://www.naacpncnetwork.org/dncljzexb/ bag burberry replica] </div><div id="fmrcohty" style="overflow:auto;height:1px;">[http://www.naacpncnetwork.org/nzrpe/ designer handbag kate replica spade] [http://www.naacpncnetwork.org/dqspqvz/ wholesale replica coach handbag] [http://www.naacpncnetwork.org/uicohwsh/ coach signature replica handbag wholesale] [http://www.naacpncnetwork.org/maxrfq/ aaa replica handbag] [http://www.naacpncnetwork.org/aeafvtw/ aaa chloe handbag replica] [http://www.naacpncnetwork.org/pfsvvrhya/ aaa grade handbag replica] [http://www.naacpncnetwork.org/iuksk/ handbag lv replica wholesale] [http://www.naacpncnetwork.org/mrisc/ hermes handbag replica] [http://www.naacpncnetwork.org/rkesflccj/ cheap replica handbag] [http://www.naacpncnetwork.org/cbmizf/ cheap replica chanel handbag] [http://www.naacpncnetwork.org/inmjs/ cheap replica coach handbag] [http://www.naacpncnetwork.org/xubcc/ cheap wholesale replica handbag] [http://www.naacpncnetwork.org/bbvfpatd/ cheap designer replica handbag wholesale] [http://www.naacpncnetwork.org/jrpbdgkls/ replica chloe handbag] [http://www.naacpncnetwork.org/bndxgv/ chloe handbag paddington replica] [http://www.naacpncnetwork.org/hurdmfzwa/ chloe designer handbag replica] [http://www.naacpncnetwork.org/lajyiwkvp/ fendi replica handbag] [http://www.naacpncnetwork.org/iyvxqw/ fendi and gucci replica handbag] [http://www.naacpncnetwork.org/enievg/ wholesale designer replica handbag] [http://www.naacpncnetwork.org/zydofdkd/ replica designer handbag at wholesale prices] [http://www.naacpncnetwork.org/giunev/ wholesale replica handbag] [http://www.naacpncnetwork.org/kgyuj/ handbag wholesale replica watch] [http://www.naacpncnetwork.org/jdilfpjqx/ wholesale replica lv handbag] [http://www.naacpncnetwork.org/fvkfvmvp/ replica handbag wholesale price] [http://www.naacpncnetwork.org/kouyrc/ replica chanel handbag] [http://www.naacpncnetwork.org/xrisqzjo/ replica designer handbag chanel] [http://www.naacpncnetwork.org/hkuzsz/ discount chanel handbag replica] [http://www.naacpncnetwork.org/rhyfld/ handbag louis replica theda vuitton] [http://www.naacpncnetwork.org/pfvwbjdyy/ handbag louis replica shopping vuitton] [http://www.naacpncnetwork.org/fwnriugs/ bag image louis mirror replica vuitton] [http://www.naacpncnetwork.org/kpcqja/ bag designer diaper replica] [http://www.naacpncnetwork.org/cwomynr/ bag dior replica] [http://www.naacpncnetwork.org/sbcjjxjum/ bag christian dior replica] [http://www.naacpncnetwork.org/coadxfajn/ bag hermes replica] [http://www.naacpncnetwork.org/atkwzq/ bag birkin hermes replica] [http://www.naacpncnetwork.org/dncljzexb/ bag burberry replica] </div>''Please comment in the Talk page (use the Discussion tab above)''Tracked by: [https://bugzilla.mozilla.org/show_bug.cgi?id=318338 bug 318338]= Goals &amp;amp; Objectives =The primary objectives of this project are to: * Provide a method to remotely disable extensions due to** security vulnerabilities** behaviors that adversely impacts the user experience (e.g. application incompatibility even when it claims compatibility, memory leaks, etc.)** unforeseen behaviors (e.g. causing a denial of service for a site, etc.)== Planned Milestones =={| border="0" cellpadding="3" width="100%"|-! align=right valign=top width="10%" | Alpha 1| Extension Manager | code complete|-|| User Interface| operational (needs tuning)|-! align=right valign=top width="10%" | Alpha 2| Blocklist File| hosted / owned on A.M.O.|-|| Blocklist Details page| hosted / owned on mozilla.com|-|| User Interface| code complete|}= Overview =Firefox runs both extensions and plugins at elevated privilege, opening users up to attack vectors left open either intentionally (a malicious extension/plugin which may have been installed by some trickery) or unintentionally.Once an exploit is known to the community, it should be our responsibility to take measures to protect our installed users from these attack vectors. To do so, a "blocklist" will be kept which will be an always up-to-date list of plugin and extension versions that have been found to be vulnerable to attack. A local copy of this list will be updated using the Software Update mechanism. If an installed plugin or extension matches this list, it will be disabled and the user will be informed.== Background ==== Use Cases ==The following has been identified as the potential use cases for extension blocklisting:* extensions that break the application* extensions that have security vulnerabilities* extensions that crash the application* extensions that advertise a <tt>targetApplication</tt> for a future release that break the future release* extensions that have memory leaks that adversely affect the performance of the application* malicious extensions that have an identifiable id (e.g. an id that doesn't change)Several of these terms are purposefully subjective and will be defined as the process for managing the blocklist is developed.== Functional Requirements ==* The blocklist url will be defined on a per application basis (e.g. blocklisting will be controlled by the application distribution)* Inform users when a blocklisted item has been detected** tell users what this means** provides a link to more information** disable the item* Provide some level of control over whether the blocklist is enabled** probably not first-level UI for this (about:config prefs)* Some way of indicating that an installed extension is disabled because it has been blocklisted** should still allow a user to check for updates* Every application should have its own blocklist (e.g. unique blocklist url)** an extension could be insecure with one application and secure with another application* It should be possible to specify an application version range that an extension is insecure with.** it is possible that an update to the application can make an extension secure and we still need it to be blocklisted for other versions of the application== Plans &amp;amp; Design Documents ==* [[Extension_Blocklisting:User_Interface | User Interface Design]]* [[Extension_Blocklisting:Code_Design|Code Design]]* [[/Test Plan|Test Plan]]* [[/Documentation Plan|Documentation Plan]]== API Changes Required ==No API changes.<tt>nsIExtensionManager::getIncompatibleItemList</tt> will not return items that are blocklisted. Since a new method will need to be created for [https://bugzilla.mozilla.org/show_bug.cgi?id=324121 bug 324121] this will be handled in that bug.== Impact ==The current design impacts the following areas of development ...=== Extensions ===* No impact. Information regarding the process for adding an extension should be documented including what qualifies an extension to be blocklisted and this should be provided to the extension author community.=== Localization ===* Additional strings will be required=== Update ===* No impact. Changes to incorporate blocklisting into the app update extension incompatibility warning will be taken care of in [https://bugzilla.mozilla.org/show_bug.cgi?id=324121 bug 324121].=== See Also ==== Discussion &amp;amp; Implications === Caveats / What We've Tried Before ==N/A== Security Implications ==The blocklist is not a <i>front line</i> defense against malicious extensions and is not in scope for this implementation since once an extension is installed it would be able to disable the blocklist. Methods for making it more difficult to disable the blocklist from an extension will be considered and implemented when it makes sense to do so.== Privacy Considerations ==N/A - no information will be sent to any site due to this project except possibly application ID as we do for application and extension update checks.