> The problem is security. NPAPI plug-ins can run arbitrary code on > your machine. If we made it easier to install NPAPI plug-ins than to > run EXEs, all the malware authors would flock to NPAPI just like > they've flocked to ActiveX in the past, which used to be (still is?) > easier to install than EXEs.
I am not convinced that "security" is a valid reason for Chrome not to provide a mechanism for embedding NPAPI plugins (as IE and Firefox do). My plugin needs to support all the common browsers, and I am sure I am not alone with this requirement. Therefore, if Chrome does not provide an "embedded" mechanism, I am forced into developing a "non- embedded" solution. This is the reason why "security" is not a valid argument ... by not providing an embedding mechanism, you are not preventing NPAPI plugins being installed ... you are simply making it inconvenient for plugin developers and, more importantly, making it a less pleasant experience for users. For IE and Firefox, I am able to use an "embedded" solution (using OBJECT and EMBED HTML tags respectively). For Chrome, I am forced into using a "non-embedded" solution where I wrap my NPAPI plugin as an Extension (ie .crx file) and reference the .crx file using an HTML HREF tag accompanied by some "if you are running under Chrome, click here" text. Although this non-embedded approach allows my NPAPI plugin to be installed and run under Chrome, it is not ideal from the following respects: a) It requires a more manual and untidy "if you are running under Chrome, click here" approach, instead of the more automated clicking on an embedded object approach (which is provided by IE and Firefox) b) It does not allow an automated upgrade mechanism for the plugin In my view, Chrome is lacking in this area in comparison to its competitors, and I would request you to consider providing such an "embedding" mechanism. Regards, Kevin (Antix Labs Ltd) --~--~---------~--~----~------------~-------~--~----~ Chromium Developers mailing list: [email protected] View archives, change email options, or unsubscribe: http://groups.google.com/group/chromium-dev -~----------~----~----~----~------~----~------~--~---
