Firefox/Projects/Plugin Update Referrals

Overview

Our goal is to get as many people who use Firefox to also update their plugins to improve the security of their systems. We want to do this in the Firefox 3.6 time frame. Suggested path is:

• Maintain a list of common plugins and versions.
• Offer a page on mozilla.com that checks plugin versions and offers links to updated versions of those plugins.
• Use the plugin blocklist capabilities in Firefox to push users to update.

Non-goals

• Automatic downloading and updating of plugins

Design

The browser should use the existing blocklist functionality in order to figure out if someone has old plugins installed.

The user would be notified in the following ways:

• User visits a page with an outdated plugin. The plugin is allowed to load. A notification box is shown in that tab, informing user that the plugin is outdated. There's a "More Info" (or "Get me Updated") button, that takes the user to the page on mozilla.com. This page would list all outdated plugins the user has installed, not just the one that was just used.

• When the user manually checks for updates via Help -> Check for Updates, it also checks for outdated plugins. If there are any, provide a link to the mozilla.com page. This would be emphasized more if there is no update to Firefox itself. If there is a Firefox update, show the mozilla.com page automatically after Firefox restarts (only if there are plugins that haven't been warned about before).
  • Note: It may be a bad idea to show this page after an update, as it would compete with the What's New/First Run pages. Alternatively, What's New/First Run pages could detect if any plugin is outdated, and show a link to the outdated plugins page as needed.

• On startup (not after an update), if outdated plugins are detected, open a tab to the outdated plugins page. This would only happen once for a plugin version.
  • Note: This may not be desirable, as per https://bugzilla.mozilla.org/show_bug.cgi?id=511529#c5

• On the Plugins tab of the extension manager, there would be a "Check for updates" button (or link). Clicking this would open a tab to the outdated plugins page. Additionally, the items for outdated plugins would indicate that they're outdated.

• When the blocklist service updates from a periodic check and detects an outdated plugin (that hasn't been warned of before), it shows an alert (via the alerts service) informing the users. Clicking on this alert would open a tab to the plugins page on mozilla.com.

Progress

See Plugins:PluginCheck for updates on the website and service side of this problem.

See Security:ThePluginProblem for some thoughts from Chris Hofmann on the topic.

Web Site

• Website/Sprints/PluginProblem

Service

morgamic leading.

• Still under design, see documentation

Server bugs:

• • https://bugzilla.mozilla.org/show_bug.cgi?id=465891
  • https://bugzilla.mozilla.org/show_bug.cgi?id=465894
  • https://bugzilla.mozilla.org/show_bug.cgi?id=465898

Partners

• Kev not in the loop yet. Need to work with at least:
  • Apple (Quicktime)
  • Adobe (Flash, Shockwave, Reader)
  • Microsoft (Silverlight)
  • DivX
  • Sun (Java)

Firefox

• Integration with mozilla.com not spec'd.
• Initial experience not spec'd.

Bugs

None yet.