Firefox version 3.6.8 on Ubuntu 10.04

[Colin Law]

On 16 August 2010 10:03, Basil Chupin <blchupin at iinet.net.au> wrote:
> On 16/08/2010 18:09, Colin Law wrote:
>> On 16 August 2010 05:07, James Takac<p3nndrag0n at gmail.com>  wrote:
>>
>>> Or 5, a website script installed it. Alaska not allow sites seek permission
>>> before installing things. For this possibility I'd install the noscript
>>> plugin which disables scripts by default. You can enable them on a site by
>>> site basis as needed
>>>
>> Are you suggesting that a web site can install a Firefox add-on via
>> javascript without asking the users permission?
>>
>> Colin
>>
>
> Edit>Preferences>Security>Warn me when sites try to install add-ons....
>

To quote from the FF help for the 'Warn me when sites try to install
add-ons' on that dialog

'Warn me when sites try to install add-ons: Firefox will always ask
you to confirm installations of add-ons. To prevent unrequested
installation prompts which may lead to accidental installations,
Firefox warns you when a website tries to install an add-on and blocks
the installation prompt. To allow installations from a specific site,
click Exceptions..., enter the site name, and click Allow. Uncheck
this optionpreference to disable the warning for all sites.'

I agree that the above is a not particularly clear, but I read it as
saying that there will always be a confirmation request before
installing an add-on, whether the box is checked or not, but if it is
checked then there will be a warning that the page attempted to
request an installation, and the installation prompt will not be shown
(and the add-on not installed of course).  So to summarize, whether
the box is checked or not, an add-on will not be installed without
explicit OK from the user.

It is a pity that the help for a security page should not be absolutely clear.

Colin