Favorite Files

No favorite files added yet

Recent Posts

1. Comment - Plug-In Raises Firefox Security Doubts

   (Jul 20, 2005 - 2:15 PM)

   Here's the big difference I see: Although ActiveX content now requires approval by default (at least in Windows XP SP2), the Web site gets to initiate the process of installation. It gets to trigger the security bar pop up that asks you if you want to install the ActiveX component. No Web site gets to ask you whether or not you want to install a Firefox plug-in, other than providing an "Install Now" button or something. You must diliberately go to the plug-in page, choose the plug-in, and install it. Most home users will likely never install a Firefox plug-in. Many would probably never even realize they exist. But I'm confident that many of those same home users install ActiveX controls without thinking twice about it. "Apparently, I must have this to use this Web site. I guess I better install it." The difference is that the plug-in architecture makes installing plug-ins more like downloading and installing software -- something that you must deliberately choose to do. If someone doesn't go around Web pages randomly hitting "Install Now" buttons, it's not likley they would ever install a plug-in without evaluating their need for it. They would have to first seek it out. With IE and ActiveX, the Web page gets to prompt you to install the ActiveX component. That's a different ball game in my mind. If I'm going to release a moderately informed person onto the Internet, I think I know which of these provides the better chance of offering a problem-free experience.
   
   And none of this takes into consideration users of Windows 2000, ME, or 98. They still exist, you know. As far as I know, the "Welcome" mat is still out in the most up-to-date version of IE in each of these operating systems. Windows XP SP2 may close the gap and give us something to debate when choosing between IE and Firefox, but the older versions of Windows make the choice a no brainer.
   
   I'd personally like to see the ability to install plug-ins turned off by default in Firefox. Since most inexperienced users will likely use the default setting, this eliminates some of the risk involved with plug-ins. I wouldn't even mind if this was something you had to control in about:config. That makes it that much more difficult for inexperienced users to get in trouble.