[ADMIN] This list is now closed!

2006-01-22 Thread Dave Miller
If all goes according to plan, this should be the last post you receive on the mailing list version of this group. All subscribers to the mailing list should shortly receive a subscription notice for [EMAIL PROTECTED] If you are reading this via the netscape.public.mozilla.security newsgroup,

[ADMIN] mozilla-security is moving!

2006-01-21 Thread Dave Miller
It should be no secret these days that the Mozilla Foundation and its related projects are no longer a pet project of Netscape, yet the newsgroups we are using for public discussions still bear the Netscape name. We've been planning for years to move from netscape.public.mozilla.* to just

How to add extra property to window object

2006-01-08 Thread David Huynh
Hi all, I'm trying to write a Firefox extension that adds an extra property to the window object that Web pages' scripts have access to. As you know, currently, scripts in Web pages can access such objects as window window.document window.navigator

Sonorisation et effets lumi�res � prix discount

2006-01-07 Thread jpp
SonoBoulevard.com vous souhaite une bonne AnnÊe 2006 ! DÊcouvrez sans plus attendre notre sÊlection de produits pour fËter la nouvelle annÊe... www.SonoBoulevard.com : MatÊriel de Sonorisation, Êclairage, musique... - BOOST DANCER LIGHT : Projecteur de lumiÉre demi sphÉre, effet couleur,

Sonorisation et effets lumi�res � prix discount

2006-01-07 Thread jpp
SonoBoulevard.com vous souhaite une bonne AnnÊe 2006 ! DÊcouvrez sans plus attendre notre sÊlection de produits pour fËter la nouvelle annÊe... www.SonoBoulevard.com : MatÊriel de Sonorisation, Êclairage, musique... - BOOST DANCER LIGHT : Projecteur de lumiÉre demi sphÉre, effet couleur,

Sonorisation et effets lumi�res � prix discount

2006-01-07 Thread jpp
SonoBoulevard.com vous souhaite une bonne AnnÊe 2006 ! DÊcouvrez sans plus attendre notre sÊlection de produits pour fËter la nouvelle annÊe... www.SonoBoulevard.com : MatÊriel de Sonorisation, Êclairage, musique... - BOOST DANCER LIGHT : Projecteur de lumiÉre demi sphÉre, effet couleur,

Sonorisation et effets lumi�res � prix discount

2006-01-07 Thread jpp
SonoBoulevard.com vous souhaite une bonne AnnÊe 2006 ! DÊcouvrez sans plus attendre notre sÊlection de produits pour fËter la nouvelle annÊe... www.SonoBoulevard.com : MatÊriel de Sonorisation, Êclairage, musique... - BOOST DANCER LIGHT : Projecteur de lumiÉre demi sphÉre, effet couleur,

Re: 401 user authentication window does not indicate protocol in 1.5

2005-12-23 Thread Jack
It was actually the windows machine that I was using at work. I will try to update the information when I get a chance. Nelson B wrote: Jack wrote: When I got the popup window due to 401 in 1.0.x, it used to indicate whether it was http versus https. 1.5 does not seem to indicate this as

security fixes in thunderbird 1.5 RC2

2005-12-23 Thread Jack
I was reading about thunderbird 1.5 RC2 at: http://www.mozilla.org/products/thunderbird/releases/1.5.html It says Many security enhancements. How does one find out the specifics? I do not want everybody to upgrade needlessly when it is working fine as that is a waste of time and money. I

Re: 401 user authentication window does not indicate protocol in 1.5

2005-12-19 Thread Nelson B
Jack wrote: When I got the popup window due to 401 in 1.0.x, it used to indicate whether it was http versus https. 1.5 does not seem to indicate this as 1.0.x did. Is this intentional? This is a problem because one can't tell whether redirection occured or not and so one can't be sure that

Re: Security bug policy

2005-12-17 Thread Florian Weimer
* Heikki Toivonen: Florian Weimer wrote: where can I find an updated security bug policy? It seems that it's been decided that crash bugs are not worth releasing advisories for, but I couldn't find any confirmation. The policy hasn't changed AFAIK, and it's still here:

Re: 401 user authentication window does not indicate protocol in 1.5

2005-12-10 Thread Jack
This is a problem because one can't tell whether redirection occured or not and so one can't be sure that one is sending the user name and password over a secure channel. Is there a settings to enable display of the protocol (http v. https) as well? Jack wrote: Include general news group as

Security bug policy

2005-12-08 Thread Florian Weimer
Hi, where can I find an updated security bug policy? It seems that it's been decided that crash bugs are not worth releasing advisories for, but I couldn't find any confirmation. Florian ___ Mozilla-security mailing list Mozilla-security@mozilla.org

Re: 401 user authentication window does not indicate protocol in 1.5

2005-12-04 Thread Jack
Include general news group as well. Jack wrote: When I got the popup window due to 401 in 1.0.x, it used to indicate whether it was http versus https. 1.5 does not seem to indicate this as 1.0.x did. Is this intentional? ___ Mozilla-security

Re: Fist time using newsgroup

2005-12-02 Thread Elric
FACE wrote: On Sat, 25 Dec 2004 16:59:39 -0300, Alejandro Fuentes [EMAIL PROTECTED] in netscape.public.mozilla.browser wrote: _at@ wrote: Remline wrote: http://www.newzbot.com/ Dobi Yonkoff wrote: Can anyone help me find other news servers? I'm a beginner with newsgroups.

Re: Fist time using newsgroup

2005-12-02 Thread Arne
Once upon a time *Elric* wrote: FACE wrote: On Sat, 25 Dec 2004 16:59:39 -0300, Alejandro Fuentes [EMAIL PROTECTED] in netscape.public.mozilla.browser wrote: _at@ wrote: Remline wrote: http://www.newzbot.com/ Dobi Yonkoff wrote: Can anyone help me find other news servers? I'm a

Cleaning worm from Netscape 7.2 mail folders

2005-11-29 Thread Greg
My virus program keeps detecting the following infections, but does not clean them. I hate to delete myu mail folders and loose several years of saved messages, so is there a way to clean the infections without deleting the folder? If not, is there a way to export the messages into annother

Re: Disabling Internet Keywords on Firefox

2005-11-24 Thread Florian Weimer
* Jack: That just sends terms typed in the browser to your URL specific by config property keyword.URL. It has some sort of logic to see whether or not it is a host name. If it is not a hostname (or URL form), then it make the query to keyword.URL. I do not understand how this would

Re: Disabling Internet Keywords on Firefox

2005-11-24 Thread Jack
I was a little slow there. You just want a way for the third action to be disabled. I find it annoying more than anything because I use browsers on many different systems and I some times get surprised by this action. Yes, you are correct that it can violation a users privacy if one has

Re: Disabling Internet Keywords on Firefox

2005-11-23 Thread Jack
Remove the keyword field (or leave it blank) for all your bookmarks. Florian Weimer wrote: Is there an easy way to disable Internet Keywords on Firefox 1.0.x? I'm asking here because this feature might violate user privacy, especially if you don't trust Google.

Re: Disabling Internet Keywords on Firefox

2005-11-23 Thread Florian Weimer
* Jack: Remove the keyword field (or leave it blank) for all your bookmarks. I haven't set any keywords on bookmarks. But I recalled the term Internet Keywords only when writing my question. Going back to the browser configuration, I see that there is a keyword.enabled property, which

Re: Disabling Internet Keywords on Firefox

2005-11-23 Thread Jack
That just sends terms typed in the browser to your URL specific by config property keyword.URL. It has some sort of logic to see whether or not it is a host name. If it is not a hostname (or URL form), then it make the query to keyword.URL. I do not understand how this would violate a user's

Elimina el elemento seleccionado de los procedimientos de plataformas.

2005-11-20 Thread 5632
Elimina el elemento seleccionado de los procedimientos de plataformas.

cannot load libpipnss.so on Digital UNIX 4.0F

2005-11-15 Thread Urs Traber
Dear all, I have built mozilla 1.7.12 on Digital UNIX 4.0F. Running mozilla from the local build directory fails to load libpipnss.so. However, when I use make DESTDIR=/tmp install, package the tree, install it as root, run regxpcom and regchrome as root, but then run mozilla as normal user,

permissionmanager.add() fails

2005-10-03 Thread Michael Vincent van Rantwijk
I don't know where to put this, but this call: permissionManager.add(URI, document, permission); no longer works. Is this a bug or a feature (I sure hope not)? Thank you, Michael ___ Mozilla-security mailing list Mozilla-security@mozilla.org

Interesting fishing attempt that fails with Mozilla mail

2005-09-23 Thread Jean-Marc Desperrier
I just received an obvious fishing message that was directing me to https://signin.ebay.com. It looked really interesting, fishing using an https site rings a bell, but this was the real ebay login site (I had a doubt at first, was that the comeback of some i18n trick ?), so I really wondered

Solution for FF vulns

2005-09-21 Thread Brian Lindquist
Hire a few hackers, in order to determine the persons skills just setup up a server and let everyone go at it. Seems logical...of course the question remains, can you trust them? ___ Mozilla-security mailing list Mozilla-security@mozilla.org

Re: Tips on server-side URL sanitizing?

2005-09-19 Thread Frank Hecker
Thanks for the info! Frank -- Frank Hecker [EMAIL PROTECTED] ___ Mozilla-security mailing list Mozilla-security@mozilla.org http://mail.mozilla.org/listinfo/mozilla-security

Re: Tips on server-side URL sanitizing?

2005-09-18 Thread Gervase Markham
Frank Hecker wrote: First, I won't be allowing HTML tags in submitted comments. My plan was to simply use the Perl CGI::EscapeHTML function (Blosxom is written in Perl) to convert '', '', double quote, and 0x8b and 0x9b to the corresponding HTML character entities prior to the submitted

Re: I see a lot of Hits on Port 80 TCP what are they ?

2005-09-08 Thread nospam
!:?) wrote: Hello, I have Netscape for my ISP and they use AOL Servers. (They are owned by AOL) Using Netscape 7.2 Browser Email Client, Netscape ISP Dial-up. I switched ISP's several Months ago. I see a large number of Hits on Port 80, some are Web Sites, most are users and never Seen so

OpenSSL certs on Mozilla

2005-09-08 Thread nospam
I see mozilla browsers allow import of PKCS12 certs (I'm using mozilla on linux). There's a lot of documentation on creating certs for apache, but I'm looking for the command for creating a cert for mozilla that the web site owner can sign and then use for access to the private web page. I

I see a lot of Hits on Port 80 TCP what are they ?

2005-08-22 Thread !:?)
Hello, I have Netscape for my ISP and they use AOL Servers. (They are owned by AOL) Using Netscape 7.2 Browser Email Client, Netscape ISP Dial-up. I switched ISP's several Months ago. I see a large number of Hits on Port 80, some are Web Sites, most are users and never Seen so many hits on

Re: Multitab vs. unique session id

2005-08-18 Thread RML
Using CTRL-N creates a new window with the same session-id, indeed. So my question takes on an other course (knowing that all browser have this kind of behaviour): If a user asks for his personals on tab A and tab B in FF (for example), deletes his data on tab B and then tries to edit it on tab

Re: Multitab vs. unique session id

2005-08-18 Thread RML
Ok, this suggest a solution in the application and not in the environment it runs in. Is that realy how it works? I would like to think this problem is best dealt with on the level where you can control it all in one procedure like in the webserver/webclient. But if this is how it works...

Re: Multitab vs. unique session id

2005-08-17 Thread Jean-Marc Desperrier
RML wrote: Yes, IE gives me 2 session id's. That what I expected to get on a multi-tab browser too. Are you *sure* of that ? If you click twice on the blue e, you'll get two instances of the application, and then two different session id. But if you get a new windows of the same instance

Re: Multitab vs. unique session id

2005-08-16 Thread Michael Vincent van Rantwijk
Planet Internet Nieuws wrote: I'm currently writing a .NET application and I run into a problem using multi-tab browsers (like FireFox). I'm using the unique ASP.NET session-id to keep track of security issues with a logged-in user. The session id is one-on-one with his/her security account.

Re: Multitab vs. unique session id

2005-08-16 Thread RML
Next question: differs a cookie with individual tab in FireFox? Michael Vincent van Rantwijk [EMAIL PROTECTED] schreef in bericht news:[EMAIL PROTECTED] Store a session cookie with that session id and check if that cookie is stored ;) Michael

Re: Multitab vs. unique session id

2005-08-16 Thread Benjamin D. Smedberg
Planet Internet Nieuws wrote: I'm currently writing a .NET application and I run into a problem using multi-tab browsers (like FireFox). I'm using the unique ASP.NET session-id to keep track of security issues with a logged-in user. The session id is one-on-one with his/her security account.

Re: Multitab vs. unique session id

2005-08-16 Thread RML
Well, the problem is that I've divided my users into different groups. And those groups have various levels of authorities. The problem that occurs is that, not knowing which browser-tab is using my application, I can't be sure what permissions to give to the application-user should users use

Re: Multitab vs. unique session id

2005-08-16 Thread Benjamin D. Smedberg
RML wrote: Well, the problem is that I've divided my users into different groups. And those groups have various levels of authorities. The problem that occurs is that, not knowing which browser-tab is using my application, I can't be sure what permissions to give to the application-user

Re: Multitab vs. unique session id

2005-08-16 Thread RML
Yes, IE gives me 2 session id's. That what I expected to get on a multi-tab browser too. Michael Vincent van Rantwijk [EMAIL PROTECTED] schreef in bericht news:[EMAIL PROTECTED] RML wrote: Next question: differs a cookie with individual tab in FireFox? No, because two tabs are just like

Re: Multitab vs. unique session id

2005-08-16 Thread RML
That'll get me somewhere. Thanks. Michael Vincent van Rantwijk [EMAIL PROTECTED] schreef in bericht news:[EMAIL PROTECTED] RML wrote: Well, the problem is that I've divided my users into different groups. And those groups have various levels of authorities. The problem that occurs is

Re: Multitab vs. unique session id

2005-08-16 Thread Michael Vincent van Rantwijk
RML wrote: Yes, IE gives me 2 session id's. That what I expected to get on a multi-tab browser too. Hm, and what happens when you open two windows, not tabs, in Mozilla Firefox? Michael Vincent van Rantwijk [EMAIL PROTECTED] schreef in bericht news:[EMAIL PROTECTED] RML wrote: Next

Re: Multitab vs. unique session id

2005-08-16 Thread RML
Just tested that and that worries me even more... Got the same session-id too. Which means that an administrator uses the same session id as a regular user does. Doesn't sound too good. Michael Vincent van Rantwijk [EMAIL PROTECTED] schreef in bericht news:[EMAIL PROTECTED] RML wrote: Yes,

Re: Firefox password manager doesn't work with Yahoo. remembered as username

2005-08-12 Thread Ulrich Boche
Matt Nordhoff wrote: On 08/11/05 10:00, Bob Chauvin ( Paix dehors ) wrote: Yahoo! sets the form so the password manager will ignore it. There's a Remember Password bookmarklet that should make the password manager work, but I don't have the link to it. Shouldn't it be up to the user

Re: Firefox password manager doesn't work with Yahoo. remembered as username

2005-08-12 Thread Matt Nordhoff
On 08/12/05 15:29, Ulrich Boche wrote: Matt Nordhoff wrote: On 08/11/05 10:00, Bob Chauvin ( Paix dehors ) wrote: Yahoo! sets the form so the password manager will ignore it. There's a Remember Password bookmarklet that should make the password manager work, but I don't have the link to it.

Re: Firefox password manager doesn't work with Yahoo. remembered as username

2005-08-12 Thread Michael Vincent van Rantwijk
Ulrich Boche wrote: Matt Nordhoff wrote: On 08/11/05 10:00, Bob Chauvin ( Paix dehors ) wrote: Yahoo! sets the form so the password manager will ignore it. There's a Remember Password bookmarklet that should make the password manager work, but I don't have the link to it. Shouldn't it be

Re: Security warnings and obedience to authority

2005-08-11 Thread Fabrizio Marana
Duane [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] Nelson B wrote: Two buttons: rip me off, protect me from the rip off would undoubtedly change user responses. I doubt it, their ISP/tech support etc would tell them to ignore it as an over reaction... Rather then trying

Re: Security warnings and obedience to authority

2005-08-11 Thread Ka-Ping Yee
On Thu, 11 Aug 2005, Fabrizio Marana wrote: Duane [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] Nelson B wrote: Two buttons: rip me off, protect me from the rip off would undoubtedly change user responses. I doubt it, their ISP/tech support etc would tell them to

Re: Firefox password manager doesn't work with Yahoo. remembered as username

2005-08-11 Thread Matt Nordhoff
On 08/11/05 10:00, Bob Chauvin ( Paix dehors ) wrote: Can anyone verify that the Firefox pw maanger d/n work with Yahoo? Specifically, I use the https site to log-in, but Firefox doesn't prompt. Older versions of FF would prompt AFTER I had type my username/password and clicked the submit

TrustBar 0.4 beta 9.3.1, with Hey! Training Mode - please help test usability

2005-08-10 Thread Amir Herzberg
I've just placed new version of TrustBar including Hey! component for testing usability and training users, please save to disk and then open via FireFox, from: http://www.cs.biu.ac.il/~herzbea//TrustBar/Latest%20TB.xpi The Hey! component is designed to support testing for other bars so I'll

Free Mac Mini from the gratis network. Com on, just check it out. It won't kill you.

2005-08-10 Thread CMS
This really works. I have already received a free psp ___ Mozilla-security mailing list Mozilla-security@mozilla.org http://mail.mozilla.org/listinfo/mozilla-security

Re: Making file control text editor readonly

2005-08-08 Thread James Ross
Justin Wood (Callek) wrote: p.s. Why is no-one honoring the Followup-To of n.p.m.security? Actually, you're the only one who's set any follow-up of the posts I have, and I've not seen any replies to any of your messages. I'm not even going to see *this* reply, so don't get too stuck-up about

Re: Making file control text editor readonly

2005-08-08 Thread Matt Nordhoff
On 08/07/05 23:43, Mats Palmgren wrote: roc wrote: Why can't you open the file browser and paste the URL in there? The native file picker which we use in trunk GTK2 builds does not have a text field. The general UI design of that thing is just a disaster. It's also painfully slow on

Re: Making file control text editor readonly

2005-08-07 Thread roc
That's an argument for fixing bug 111821, not an argument against making the textbox read-only. ___ Mozilla-security mailing list Mozilla-security@mozilla.org http://mail.mozilla.org/listinfo/mozilla-security

Re: Making file control text editor readonly

2005-08-07 Thread roc
Why can't you open the file browser and paste the URL in there? Rob ___ Mozilla-security mailing list Mozilla-security@mozilla.org http://mail.mozilla.org/listinfo/mozilla-security

Re: Making file control text editor readonly

2005-08-07 Thread Neil
roc wrote: That's an argument for fixing bug 111821, not an argument against making the textbox read-only. Or at least an argument for fixing bug 111821 before making the textbox read-only. -- Warning: May contain traces of nuts. ___

Re: Making file control text editor readonly

2005-08-07 Thread Robert Kaiser
roc schrieb: Why can't you open the file browser and paste the URL in there? Because it needs two clicks and several mouse movements more? Robert Kaiser ___ Mozilla-security mailing list Mozilla-security@mozilla.org

Re: Making file control text editor readonly

2005-08-07 Thread Justin Wood (Callek)
Robert Kaiser wrote: roc schrieb: Why can't you open the file browser and paste the URL in there? Because it needs two clicks and several mouse movements more? Robert Kaiser Not to mention if for accessability reasons you use the mouse for copy/paste. (a simple right-click in the

Re: Making file control text editor readonly

2005-08-07 Thread Mats Palmgren
roc wrote: Why can't you open the file browser and paste the URL in there? The native file picker which we use in trunk GTK2 builds does not have a text field. The general UI design of that thing is just a disaster. It's also painfully slow on directories with many files, I often see delays

Re: Making file control text editor readonly

2005-08-06 Thread Jan Darmochwal
[EMAIL PROTECTED] wrote: In https://bugzilla.mozilla.org/show_bug.cgi?id=258875 I propose making the text control in a file input be readonly. This will prevent various kinds of spoofing attacks, but it may affect usability. Any objections/counterproposals? I like jruderman's idea from bug

Re: Making file control text editor readonly

2005-08-06 Thread Robert Kaiser
[EMAIL PROTECTED] schrieb: In https://bugzilla.mozilla.org/show_bug.cgi?id=258875 I propose making the text control in a file input be readonly. This will prevent various kinds of spoofing attacks, but it may affect usability. Any objections/counterproposals? Actually, I also like being able

Re: Making file control text editor readonly

2005-08-06 Thread James Ross
Robert Kaiser wrote: [EMAIL PROTECTED] schrieb: In https://bugzilla.mozilla.org/show_bug.cgi?id=258875 I propose making the text control in a file input be readonly. This will prevent various kinds of spoofing attacks, but it may affect usability. Any objections/counterproposals? Actually, I

Re: Making file control text editor readonly

2005-08-06 Thread Neil
James Ross wrote: whether the code should be able to *read* the value is another question, but I suspect there is some long and silly history about allowing that Maybe make it so that the page can only read the value if it was chosen via the filepicker? -- Warning: May contain traces of

Re: Making file control text editor readonly

2005-08-06 Thread Justin Wood (Callek)
Robert Kaiser wrote: See https://bugzilla.mozilla.org/attachment.cgi?id=17860 from bug 57770 (https://bugzilla.mozilla.org/show_bug.cgi?id=57770). The problem is that the *user* did all the interaction with the form, and still managed to attempt an upload of a system file (whether the code

Re: Making file control text editor readonly

2005-08-06 Thread Justin Wood (Callek)
Neil wrote: James Ross wrote: whether the code should be able to *read* the value is another question, but I suspect there is some long and silly history about allowing that Maybe make it so that the page can only read the value if it was chosen via the filepicker? Why, if I know the

Re: Making file control text editor readonly

2005-08-06 Thread Robert Kaiser
See https://bugzilla.mozilla.org/attachment.cgi?id=17860 from bug 57770 (https://bugzilla.mozilla.org/show_bug.cgi?id=57770). The problem is that the *user* did all the interaction with the form, and still managed to attempt an upload of a system file (whether the code should be able to *read*

Re: Making file control text editor readonly

2005-08-05 Thread Heikki Toivonen
[EMAIL PROTECTED] wrote: In https://bugzilla.mozilla.org/show_bug.cgi?id=258875 I propose making the text control in a file input be readonly. This will prevent various kinds of spoofing attacks, but it may affect usability. Any objections/counterproposals? Please don't - or make it an option

Making file control text editor readonly

2005-08-03 Thread rocallahan
In https://bugzilla.mozilla.org/show_bug.cgi?id=258875 I propose making the text control in a file input be readonly. This will prevent various kinds of spoofing attacks, but it may affect usability. Any objections/counterproposals? Rob ___

Seleccione una tabla o una consulta para utilizar como ori gen de datos para el nuevo formulario, informe o págin a de acceso a datos.

2005-07-31 Thread Para las selecciones
Acuerdas de limpiar tu habitacion hoy.

Re: Security warnings and obedience to authority

2005-07-29 Thread Nelson B
Fabrizio Marana wrote: As Ping points out in his blog, there are two steps in a typical phishing attack: first the email message, then the website. So when the end-user clicks on the link to the website, (s)he has already accepted an authority twice. Unfortunately for us, the authority of

Re: Security warnings and obedience to authority

2005-07-29 Thread Duane
Nelson B wrote: Two buttons: rip me off, protect me from the rip off would undoubtedly change user responses. I doubt it, their ISP/tech support etc would tell them to ignore it as an over reaction... Rather then trying to explain the finer details of what exactly is occurring, this isn't

Re: Security warnings and obedience to authority

2005-07-26 Thread Ka-Ping Yee
Frank Hecker: I thought this was an interesting blog post, with obvious implications for the issue of warning dialogs in Firefox, Thunderbird, etc. http://usablesecurity.com/2005/07/19/obedience-to-authority/ Florian Weimer wrote: all-too-common security warnings are not effective at all

Re: Security warnings and obedience to authority

2005-07-26 Thread Fabrizio Marana
As Ping points out in his blog, there are two steps in a typical phishing attack: first the email message, then the website. So when the end-user clicks on the link to the website, (s)he has already accepted an authority twice. Unfortunately for us, the authority of the phisher... People

Re: Security warnings and obedience to authority

2005-07-23 Thread Florian Weimer
* Frank Hecker: I thought this was an interesting blog post, with obvious implications for the issue of warning dialogs in Firefox, Thunderbird, etc. http://usablesecurity.com/2005/07/19/obedience-to-authority/ This is certainly a problem. The more significant issue (and I believe it's

Security warnings and obedience to authority

2005-07-19 Thread Frank Hecker
I thought this was an interesting blog post, with obvious implications for the issue of warning dialogs in Firefox, Thunderbird, etc. http://usablesecurity.com/2005/07/19/obedience-to-authority/ Frank -- Frank Hecker [EMAIL PROTECTED] ___

Re: Security alert

2005-07-18 Thread Michael Lefevre
On 2005-07-18, Vrodok the Troll [EMAIL PROTECTED] wrote: On 18 Jul 2005 14:04:21 GMT, in netscape.public.mozilla.security, Michael Lefevre [EMAIL PROTECTED], by way of Message-id [EMAIL PROTECTED], wrote: [snip] There was a problem with the release, which was discovered with Firefox first, so

Security alert

2005-07-17 Thread David Fosdike
CERT and others are recommending going to version 1.7.9 - there are some references to it on Mozilla's site but I can't find the download. Any ideas? David Fosdike dfosdike at nospam(leave this out and change 'dots' and 'at') dot elders dot com dot au

Re: click events not coming thru

2005-07-14 Thread vikiez
Hi charlie, have similiar problems ... have you made some progress in the meanwhile? viz charlie schmitt wrote: *If there's a better place to post this please let me know I have a simple xul application which records a browser session. I capture (at the moment) click and change

Re: new anti-fraud mailing list for discussing improving browser security UI

2005-07-04 Thread Gervase Markham
Amir Herzberg wrote: I wonder: was the mere fact of you meeting with them a secret? If so, did you get permission to disclose this secret (was it declassified)? The existence of the meeting was not a secret. http://weblogs.mozillazine.org/gerv/archives/008126.html It must have been `top

Re: Is there a Mozilla security process?

2005-07-03 Thread Amir Herzberg
Space Riqui wrote: --- Heikki Toivonen [EMAIL PROTECTED] wrote: after playing around for a while I managed to go to a site I had set a petname for but the petname field showed untrusted (I've been unable to reproduce this, though) This has happened to me a few times with the following web

Re: new anti-fraud mailing list for discussing improving browser security UI

2005-06-29 Thread Amir Herzberg
Doug Ludy wrote: I am a newcomer who knows a little bit about group process. It has been fascinating to watch this newsgroup at work--brilliant minds and powerful egos working toward similar goals. I am reminded of a debate in the English parliament. Rather than viewing the current impasse

Re: new anti-fraud mailing list for discussing improving browser security UI

2005-06-29 Thread Amir Herzberg
Gervase Markham wrote: Amir Herzberg wrote: It is not an issue of fairness, it is an issue of open process. I am indeed disappointed to find that Mozilla is not acting openly. As a believer in open process, I am concerned that the result may be suboptimal. I would like the process to be

Checking URL against black list - privacy and efficiency concerns

2005-06-29 Thread Amir Herzberg
There were several good threads we left in Mozilla.security, which I think we may want to revisit and try to resolve in the new anti-fraud list. For now, I'm cross-posting, although I suggest we continue only on anti-fraud if nobody objects, simply since it is more focused. Heikki Toivonen

Re: new anti-fraud mailing list for discussing improving browser security UI

2005-06-29 Thread Gervase Markham
Duane wrote: But how can you trust a process going on behind closed door and excluding everyone else? We're not developing security protocols, we're developing best practices and UI. And I am very strongly of the opinion that there needs to be a public review process, and have made that

new list for open discussion of anti-phishing

2005-06-28 Thread Amir Herzberg
Gervase Markham wrote: Ian Grigg wrote: This is clearly not the case - in partnership with the other browser vendors, we are together working out the most appropriate UI and then all implementing it. That's fine, but of course not currently an open process. Duane kindly setup an open

new anti-fraud mailing list for discussing improving browser security UI

2005-06-28 Thread Amir Herzberg
Gervase Markham wrote: Ian Grigg wrote: This is clearly not the case - in partnership with the other browser vendors, we are together working out the most appropriate UI and then all implementing it. That's fine, but of course not currently an open process. Duane kindly setup an open

Re: new anti-fraud mailing list for discussing improving browser security UI

2005-06-28 Thread Doug Ludy
Gervase Markham wrote: Amir Herzberg wrote: It is not an issue of fairness, it is an issue of open process. I am indeed disappointed to find that Mozilla is not acting openly. As a believer in open process, I am concerned that the result may be suboptimal. I would like the process to be

Re: Is there a Mozilla security process?

2005-06-27 Thread Amir Herzberg
Space Riqui wrote: --- Heikki Toivonen [EMAIL PROTECTED] wrote: after playing around for a while I managed to go to a site I had set a petname for but the petname field showed untrusted (I've been unable to reproduce this, though) This has happened to me a few times with the following web

Re: Criteria for an antiphishing tool

2005-06-27 Thread Duane
Ian Grigg wrote: 2. This policy seems to have arisen alongside or from a closed meeting of a month or so ago. Duane (representing a CA of 2000 members) didn't get invited to the closed meeting of CAs and browser manufacturers. No minutes, no agenda, no published results. There is only one

Re: Need help w/programmatic installation of Client Certs

2005-06-27 Thread Mike Stokes
Customer demand. We have to support both browsers now. Duane [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] Mike Stokes wrote: Thanks again for all of your help Duane. I'm going to go do some more research on this. I can't use any of the technologies that you use due to our

Re: Need help w/programmatic installation of Client Certs

2005-06-27 Thread Mike Stokes
Nelson, Thanks for the info. I'm gonna go check out those Netscape reference docs right away. Nelson B [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] Mike Stokes wrote: I'm new to the Netscape/Firefox/Mozilla platform and I've been tasked with providing a programmatic method for

Re: Criteria for an antiphishing tool

2005-06-27 Thread Gervase Markham
Ian Grigg wrote: On the notion of common and consistent security UI policy - how is that any different to follow the leader ? It's synonymous as far as I can see it. sigh The implication of the phrase follow the leader is that we are just doing what others are doing simply because they are

Re: Criteria for an antiphishing tool

2005-06-27 Thread Gervase Markham
Ian Grigg wrote: This is clearly not the case - in partnership with the other browser vendors, we are together working out the most appropriate UI and then all implementing it. This is news. Are you intending to announce this or does it remain embargoed ? What is clear about it? Who's in

Re: Criteria for an antiphishing tool

2005-06-26 Thread Amir Herzberg
Ian Grigg responded to Gerv: Amir Herzberg wrote: So, Mozilla plays `follow the leader`? Nice to know. Not exactly the original goal of the project, was it? Up to this point, our discussions have been reasonably civil, but now you are just throwing clearly ridiculous assertions around.

Re: Criteria for an antiphishing tool

2005-06-26 Thread Ian Grigg
Guys, this will be my last post, for reasons that I hope are clear. If anyone wants to discuss phishing, let me know. I'm hopeful a specialist list for cross-fertilisation of phishing efforts will pop up soon. On Saturday 25 June 2005 23:07, Gervase Markham wrote: Ian Grigg wrote: On the

Re: Strange mail recieved with thunderbird

2005-06-25 Thread Ian Grigg
On Saturday 25 June 2005 12:16, Jeroen van Iddekinge wrote: Hi, I got the following mail in mine Thunderbird (1.0 linux) email box. what the hell is it? It doesn't event have a proper header (no 'receaved' etc.. header) Is it a bug or a virus? No, accidental usage?! Someone is

Re: Strange mail recieved with thunderbird

2005-06-25 Thread Jeroen van Iddekinge
Hi, Hmm yes , but wat about the missing headers? There is no 'recieved' header etc... the recieving smtp server should add it to the message isn't it? regards Jeroen. On Saturday 25 June 2005 12:16, Jeroen van Iddekinge wrote: Hi, I got the following mail in mine Thunderbird (1.0 linux)

Plugin nonsense

2005-06-25 Thread Dave A.
The behavior of scanning the system for all sorts of plugins and enabling them by default needs to stop. Not only is the default behavior to enable external plugins by default without prompting the user, but there is no convenient way to disable them from the UI. I've been setting the

Re: Plugin nonsense

2005-06-25 Thread J. Greenlees
Dave A. wrote: The behavior of scanning the system for all sorts of plugins and enabling them by default needs to stop. Not only is the default behavior to enable external plugins by default without prompting the user, but there is no convenient way to disable them from the UI. I've been

  1   2   3   4   5   6   7   8   9   10   >