Re: Extensions manager ideas

["Marcelo E. Magallon" <mmagallo debian org>]

On Mon, Sep 06, 2004 at 02:33:10AM -0400, Ricardo Veguilla wrote:

 > I think it will be a good idea to define a epiphany-extension
 > mime-type (or just a specific file extension, perhaps .epy-ext) so
 > the user could install the epiphany-extension by clicking a link from
 > a web page or by clicking the downloaded file in the file-manager.
 > Drag and drop should be an option too.

 Uhm.

 Unlike Firefox'es, epiphany's extensions aren't run in a sandbox[0],
 are they?  And they aren't Javascript, they are full blown binary code,
 with access to the dynamic loader and whatnot.

 The first problem with that is binary compatibility among... well among
 a whole load of stuff: different Linux architectures, different OSes,
 different Linux distributions for the same architecture, ...

 The second is more serious: security.  This screams Outlookish
 nightmare.

 *Please* make installing extensions a very concious decision and
 provide a highly visible way of *not* allowing them (a "Enable
 Extensions", default "no", right under "Enable Javascript" would be a
 start).

 Marcelo

 [0] My Firefox extensions don't seem to have access to the filesystem
     and that's Very Good So(TM).