Hacker News Reader

Comment by lightedman | Hacker News Reader

Don't block anything excepting drive-by downloads. If I click on something with the intent to download it, it shouldn't matter what the source is.

This is why I use FireFox.

View on HN

Yes it should - if I'm on https://trustedsite.com and they link to http://notsotrustedsite.com/someexe.exe you are vulnerable.

Linking from https://trustedsite.com to https://nottustedsite.com/someexe.exe doesn't seem to be much better. Nottrustedsite.com can serve you a malicious exe either way.

Https protects you against network MITMs, not evil sites sending you evil executables.

I also use Firefox, but this discussion should probably not be the reason to do so: Mozilla has stated that they are tentatively onboard with the approach proposed by the Chrome team: http://lists.w3.org/Archives/Public/public-webappsec/2019Apr...

So, the thing is, they are working to ensure that is true. If you download it from a non-secure source, it can be changed on route. What you intend to download and what you actually download are different.

Hash checks, file signatures, etc. make that a non-issue.

At this point, with all the restrictions happening, how about we just require a license to use the internet? Just skip all this crap because that's about where we're heading now.

This seems like a direction Firefox would go in too. Web security is important, and preventing downloading of insecure executables is an easy win for security.

Firefox's nannying isn't much less irritating (forced plugin signing, etc.)

Until you fall victim to clickjacking.

I actually read the URL in the status bar when I hover over things to click. Not once in my nearly 40 years of life have I ever fallen prey to clickjacking.

Reply on news.ycombinator.com