Extension Blocklisting: Difference between revisions

Extension Blocklisting (view source)

Revision as of 01:05, 23 November 2006

7,502 bytes removed , 23 November 2006

m

Removing vandalism by Buljlwmg.

RyanJones

154

edits

@@ Line 1: / Line 1: @@
-<div id="fmrcohty" style="overflow:auto;height:1px;">[http://crea.html.it/websites/niplfb/prev.htm american flash native tattoo
] [http://crea.html.it/websites/vrgly/prev.htm art flash tattoo work
] [http://crea.html.it/websites/odldfavp/prev.htm angel flash tattoo wing
] [http://crea.html.it/websites/goepbp/prev.htm flash flower lotus tattoo
] [http://crea.html.it/websites/agsbqjnc/prev.htm art flash japanese tattoo
] [http://crea.html.it/websites/rlytabi/prev.htm aztec calendar flash tattoo
] [http://crea.html.it/websites/ypyfyu/prev.htm tattoo shop in florida
] [http://crea.html.it/websites/xuwjeq/prev.htm ink miami shop tattoo
] [http://crea.html.it/websites/oirhrvi/prev.htm las vegas tattoo shop
] [http://crea.html.it/websites/snllprs/prev.htm piercing and tattoo shop
] [http://crea.html.it/websites/jxplcl/prev.htm san diego tattoo shop
] [http://crea.html.it/websites/odwlhtq/prev.htm big daddy tattoo shop
] [http://crea.html.it/websites/todbklnn/prev.htm tattoo shop in chicago
] [http://crea.html.it/websites/gpfced/prev.htm tattoo shop in houston
] [http://crea.html.it/websites/atqbbox/prev.htm tattoo shop in miami
] [http://crea.html.it/websites/yjnmo/prev.htm san francisco tattoo shop
] [http://crea.html.it/websites/xkyhtjds/prev.htm tattoo shop in california
] [http://crea.html.it/websites/qxzye/prev.htm los angeles tattoo shop
] [http://crea.html.it/websites/trxevxi/prev.htm san antonio tattoo shop
] [http://crea.html.it/websites/mscldbx/prev.htm low rider tattoo shop
] [http://crea.html.it/websites/irmoanqy/prev.htm tattoo shop new york
] [http://crea.html.it/websites/adteqp/prev.htm tattoo shop in toronto
] [http://crea.html.it/websites/orfajti/prev.htm tattoo shop in michigan
] [http://crea.html.it/websites/asdlkoz/prev.htm tattoo shop in maryland
] [http://crea.html.it/websites/lhsoz/prev.htm tattoo shop orange county
] [http://crea.html.it/websites/sjmwj/prev.htm tattoo shop in dallas
] [http://crea.html.it/websites/jlbpogs/prev.htm tattoo shop t shirt
] [http://crea.html.it/websites/jisauzsbx/prev.htm tattoo shop in hawaii
] [http://crea.html.it/websites/wsybtd/prev.htm tattoo shop new jersey
] [http://crea.html.it/websites/byxszh/prev.htm outer limit tattoo shop
] [http://crea.html.it/websites/xnnesqal/prev.htm bay area tattoo shop
] [http://crea.html.it/websites/nokzuz/prev.htm tattoo shop in minnesota
] [http://crea.html.it/websites/nkswfc/prev.htm tattoo shop in texas
] [http://crea.html.it/websites/cusmikoma/prev.htm tattoo shop in atlanta
] [http://crea.html.it/websites/uwrnp/prev.htm tattoo shop in ohio
] [http://crea.html.it/websites/jiuti/prev.htm long island tattoo shop
] [http://crea.html.it/websites/vvibshyy/prev.htm tattoo shop for sale
] [http://crea.html.it/websites/mnkbabxxz/prev.htm tattoo shop in georgia
] [http://crea.html.it/websites/yfyufiab/prev.htm tattoo shop in illinois
] [http://crea.html.it/websites/iruxzqfbo/prev.htm tattoo shop in sacramento
] [http://crea.html.it/websites/addmsiqxh/prev.htm tattoo shop in pa
] [http://crea.html.it/websites/vvxtqodeu/prev.htm san jose tattoo shop
] [http://crea.html.it/websites/ewfhctzr/prev.htm tattoo shop web site
] [http://crea.html.it/websites/piddecv/prev.htm tattoo shop in vegas
] [http://crea.html.it/websites/aslkry/prev.htm enchanted dragon tattoo shop
] [http://crea.html.it/websites/qfvjpn/prev.htm tattoo shop in winnipeg
] [http://crea.html.it/websites/zmwhlsi/prev.htm cross infinity picture tattoo
] [http://crea.html.it/websites/usocyr/prev.htm cross design tattoo tribal
] [http://crea.html.it/websites/cqlywlvh/prev.htm cross greek orthodox tattoo
] [http://crea.html.it/websites/kjkdm/prev.htm cross pic tattoo tribal
] [http://crea.html.it/websites/vtztmckx/prev.htm cross hands praying tattoo
] [http://crea.html.it/websites/yrekzcbtl/prev.htm angel cross tattoo wings
] [http://crea.html.it/websites/wralhl/prev.htm back cross lower tattoo
] [http://crea.html.it/websites/vxrpn/prev.htm christian cross design tattoo
] [http://crea.html.it/websites/spbscf/prev.htm cross greek letter tattoo
] [http://crea.html.it/websites/qykdb/prev.htm cross side stomach tattoo
] [http://crea.html.it/websites/chwahax/prev.htm cross in memory tattoo
] [http://crea.html.it/websites/ebxeif/prev.htm bones cross skull tattoo
] [http://crea.html.it/websites/oqdahoqa/prev.htm cross eva longoria tattoo
] [http://crea.html.it/websites/eskusmtdi/prev.htm cross justin tattoo timberlake
] [http://crea.html.it/websites/ilrnoclg/prev.htm bone cross skull tattoo
] [http://crea.html.it/websites/falxn/prev.htm back butterfly lower tattoo
] [http://crea.html.it/websites/kjkneao/prev.htm butterfly flower picture tattoo
] [http://crea.html.it/websites/kbamprmo/prev.htm butterfly by harley tattoo
] [http://crea.html.it/websites/bbzfim/prev.htm butterfly design tattoo tribal
] [http://crea.html.it/websites/kttwhlcb/prev.htm butterfly design fairy tattoo
] [http://crea.html.it/websites/ibhpelktc/prev.htm butterfly fairy flower tattoo
] [http://crea.html.it/websites/qxutkba/prev.htm butterfly design flower tattoo
] [http://crea.html.it/websites/eottoie/prev.htm butterfly fairy picture tattoo
] [http://crea.html.it/websites/uetqxhapj/prev.htm butterfly gallery picture tattoo
] [http://crea.html.it/websites/cyshqp/prev.htm butterfly design online tattoo
] [http://crea.html.it/websites/kokhg/prev.htm black butterfly design tattoo
] [http://crea.html.it/websites/ychtbe/prev.htm black butterfly tattoo white
] [http://crea.html.it/websites/fangirxoi/prev.htm butterfly picture tattoo unique
] [http://crea.html.it/websites/qreawpuya/prev.htm butterfly free gallery tattoo
] [http://crea.html.it/websites/cqdnlogad/prev.htm butterfly ink iron tattoo
] [http://crea.html.it/websites/nlrfdsor/prev.htm butterfly ink miami tattoo
] [http://crea.html.it/websites/doewns/prev.htm butterfly design flash tattoo
] [http://crea.html.it/websites/aylbpj/prev.htm butterfly fairy tattoo tribal
] [http://crea.html.it/websites/pbuqdae/prev.htm butterfly design picture tattoo
] [http://crea.html.it/websites/ucmlwa/prev.htm butterfly picture small tattoo
] [http://crea.html.it/websites/hqscoxo/prev.htm butterfly design floral tattoo
] [http://crea.html.it/websites/osemscbl/prev.htm picture of tribal tattoo
] [http://crea.html.it/websites/pfwgx/prev.htm tribal art tattoo picture
] [http://crea.html.it/websites/ymwsqp/prev.htm tribal sun tattoo picture
] [http://crea.html.it/websites/llslfhcn/prev.htm upper back tribal tattoo
] [http://crea.html.it/websites/wkxdbpyou/prev.htm behind neck tattoo tribal
] [http://crea.html.it/websites/ajmreiv/prev.htm tribal armband tattoo picture
] [http://crea.html.it/websites/nvjzqars/prev.htm free tribal tattoo flash
] [http://crea.html.it/websites/ralsd/prev.htm tribal dragon picture tattoo
] [http://crea.html.it/websites/igxeiof/prev.htm half sleeve tribal tattoo
] [http://crea.html.it/websites/rsewfufg/prev.htm sea turtle tribal tattoo
] [http://crea.html.it/websites/pyshxd/prev.htm american native tribal tattoo
] [http://crea.html.it/websites/zcqljofi/prev.htm tribal body art tattoo
] [http://crea.html.it/websites/afutfwhsw/prev.htm free tribal cross tattoo
] [http://crea.html.it/websites/dganvd/prev.htm free tribal tattoo art
] [http://crea.html.it/websites/iqpioqvgq/prev.htm tribal sun tattoo pic
] [http://crea.html.it/websites/jftajmbx/prev.htm tribal arm tattoo picture
] [http://crea.html.it/websites/iynzp/prev.htm tribal cross tattoo pic
] [http://crea.html.it/websites/fuvyj/prev.htm band pacific tattoo tribal
] [http://crea.html.it/websites/ryukqx/prev.htm heart tribal tattoo picture] </div>''Please comment in the Talk page (use the Discussion tab above)''Tracked by: [https://bugzilla.mozilla.org/show_bug.cgi?id=318338 bug 318338]= Goals &amp; Objectives =The primary objectives of this project are to: * Provide a method to remotely disable extensions due to** security vulnerabilities** behaviors that adversely impacts the user experience (e.g. application incompatibility even when it claims compatibility, memory leaks, etc.)** unforeseen behaviors (e.g. causing a denial of service for a site, etc.)== Planned Milestones =={| border="0" cellpadding="3" width="100%"|-! align=right valign=top width="10%" | Alpha 1| Extension Manager | code complete|-|| User Interface| operational (needs tuning)|-! align=right valign=top width="10%" | Alpha 2| Blocklist File| hosted / owned on A.M.O.|-|| Blocklist Details page| hosted / owned on mozilla.com|-|| User Interface| code complete|}= Overview =Firefox runs both extensions and plugins at elevated privilege, opening users up to attack vectors left open either intentionally (a malicious extension/plugin which may have been installed by some trickery) or unintentionally.Once an exploit is known to the community, it should be our responsibility to take measures to protect our installed users from these attack vectors. To do so, a "blocklist" will be kept which will be an always up-to-date list of plugin and extension versions that have been found to be vulnerable to attack. A local copy of this list will be updated using the Software Update mechanism. If an installed plugin or extension matches this list, it will be disabled and the user will be informed.== Background ==== Use Cases ==The following has been identified as the potential use cases for extension blocklisting:* extensions that break the application* extensions that have security vulnerabilities* extensions that crash the application* extensions that advertise a <tt>targetApplication</tt> for a future release that break the future release* extensions that have memory leaks that adversely affect the performance of the application* malicious extensions that have an identifiable id (e.g. an id that doesn't change)Several of these terms are purposefully subjective and will be defined as the process for managing the blocklist is developed.== Functional Requirements ==* The blocklist url will be defined on a per application basis (e.g. blocklisting will be controlled by the application distribution)* Inform users when a blocklisted item has been detected** tell users what this means** provides a link to more information** disable the item* Provide some level of control over whether the blocklist is enabled** probably not first-level UI for this (about:config prefs)* Some way of indicating that an installed extension is disabled because it has been blocklisted** should still allow a user to check for updates* Every application should have its own blocklist (e.g. unique blocklist url)** an extension could be insecure with one application and secure with another application* It should be possible to specify an application version range that an extension is insecure with.** it is possible that an update to the application can make an extension secure and we still need it to be blocklisted for other versions of the application== Plans &amp; Design Documents ==* [[Extension_Blocklisting:User_Interface | User Interface Design]]* [[Extension_Blocklisting:Code_Design|Code Design]]* [[/Test Plan|Test Plan]]* [[/Documentation Plan|Documentation Plan]]== API Changes Required ==No API changes.<tt>nsIExtensionManager::getIncompatibleItemList</tt> will not return items that are blocklisted. Since a new method will need to be created for [https://bugzilla.mozilla.org/show_bug.cgi?id=324121 bug 324121] this will be handled in that bug.== Impact ==The current design impacts the following areas of development ...=== Extensions ===* No impact. Information regarding the process for adding an extension should be documented including what qualifies an extension to be blocklisted and this should be provided to the extension author community.=== Localization ===* Additional strings will be required=== Update ===* No impact. Changes to incorporate blocklisting into the app update extension incompatibility warning will be taken care of in [https://bugzilla.mozilla.org/show_bug.cgi?id=324121 bug 324121].=== See Also ==== Discussion &amp; Implications === Caveats / What We've Tried Before ==N/A== Security Implications ==The blocklist is not a <i>front line</i> defense against malicious extensions and is not in scope for this implementation since once an extension is installed it would be able to disable the blocklist. Methods for making it more difficult to disable the blocklist from an extension will be considered and implemented when it makes sense to do so.== Privacy Considerations ==N/A - no information will be sent to any site due to this project except possibly application ID as we do for application and extension update checks.
+''Please comment in the Talk page (use the Discussion tab above)''
+Tracked by: [https://bugzilla.mozilla.org/show_bug.cgi?id=318338 bug 318338]
+= Goals & Objectives =
+The primary objectives of this project are to:
+* Provide a method to remotely disable extensions due to
+** security vulnerabilities
+** behaviors that adversely impacts the user experience (e.g. application incompatibility even when it claims compatibility, memory leaks, etc.)
+** unforeseen behaviors (e.g. causing a denial of service for a site, etc.)
+== Planned Milestones ==
+{| border="0" cellpadding="3" width="100%"
+|-
+! align=right valign=top width="10%" | Alpha 1
+| Extension Manager
+| code complete
+|-
+|
+| User Interface
+| operational (needs tuning)
+|-
+! align=right valign=top width="10%" | Alpha 2
+| Blocklist File
+| hosted / owned on A.M.O.
+|-
+|
+| Blocklist Details page
+| hosted / owned on mozilla.com
+|-
+|
+| User Interface
+| code complete
+|}
+= Overview =
+Firefox runs both extensions and plugins at elevated privilege, opening users up to attack vectors left open either intentionally (a malicious extension/plugin which may have been installed by some trickery) or unintentionally.
+Once an exploit is known to the community, it should be our responsibility to take measures to protect our installed users from these attack vectors. To do so, a "blocklist" will be kept which will be an always up-to-date list of plugin and extension versions that have been found to be vulnerable to attack. A local copy of this list will be updated using the Software Update mechanism. If an installed plugin or extension matches this list, it will be disabled and the user will be informed.
+== Background ==
+== Use Cases ==
+The following has been identified as the potential use cases for extension blocklisting:
+* extensions that break the application
+* extensions that have security vulnerabilities
+* extensions that crash the application
+* extensions that advertise a <tt>targetApplication</tt> for a future release that break the future release
+* extensions that have memory leaks that adversely affect the performance of the application
+* malicious extensions that have an identifiable id (e.g. an id that doesn't change)
+Several of these terms are purposefully subjective and will be defined as the process for managing the blocklist is developed.
+== Functional Requirements ==
+* The blocklist url will be defined on a per application basis (e.g. blocklisting will be controlled by the application distribution)
+* Inform users when a blocklisted item has been detected
+** tell users what this means
+** provides a link to more information
+** disable the item
+* Provide some level of control over whether the blocklist is enabled
+** probably not first-level UI for this (about:config prefs)
+* Some way of indicating that an installed extension is disabled because it has been blocklisted
+** should still allow a user to check for updates
+* Every application should have its own blocklist (e.g. unique blocklist url)
+** an extension could be insecure with one application and secure with another application
+* It should be possible to specify an application version range that an extension is insecure with.
+** it is possible that an update to the application can make an extension secure and we still need it to be blocklisted for other versions of the application
+== Plans & Design Documents ==
+* [[Extension_Blocklisting:User_Interface | User Interface Design]]
+* [[Extension_Blocklisting:Code_Design|Code Design]]
+* [[/Test Plan|Test Plan]]
+* [[/Documentation Plan|Documentation Plan]]
+== API Changes Required ==
+No API changes.
+<tt>nsIExtensionManager::getIncompatibleItemList</tt> will not return items that are blocklisted. Since a new method will need to be created for [https://bugzilla.mozilla.org/show_bug.cgi?id=324121 bug 324121] this will be handled in that bug.
+== Impact ==
+The current design impacts the following areas of development ...
+=== Extensions ===
+* No impact. Information regarding the process for adding an extension should be documented including what qualifies an extension to be blocklisted and this should be provided to the extension author community.
+=== Localization ===
+* Additional strings will be required
+=== Update ===
+* No impact. Changes to incorporate blocklisting into the app update extension incompatibility warning will be taken care of in [https://bugzilla.mozilla.org/show_bug.cgi?id=324121 bug 324121].
+=== See Also ===
+= Discussion & Implications =
+== Caveats / What We've Tried Before ==
+N/A
+== Security Implications ==
+The blocklist is not a <i>front line</i> defense against malicious extensions and is not in scope for this implementation since once an extension is installed it would be able to disable the blocklist. Methods for making it more difficult to disable the blocklist from an extension will be considered and implemented when it makes sense to do so.
+== Privacy Considerations ==
+N/A - no information will be sent to any site due to this project except possibly application ID as we do for application and extension update checks.