558194 - Unknown plug-ins should default to click-to-play state

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Plug-ins, enhancement)

Description

[Alex Limi (:limi) — Firefox UX Team]

If an installer or a web site installs a new plug-in in your browser that we don't already know about, the default behavior when we encounter it should be opt-in — i.e. something like this:

 Click to activate EvilPlugin content]

 [ ] Always activate EvilPlugin content

File under: "basic decency on the internet" ;)

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

How will we maintain the list of plugins that we "know about"?

I think it may be the case that this list needs to be locale-specific or localizable, especially for China and Korea, because Chinese and Korean sites use (site-specific) plugins much more commonly than other sites.

Comment 2

[Georg Fritzsche [:gfritzsche]]

Tracking this in the CtPDefault list. This should get resolved by the current click-to-play plans, with only a core set of plugins being excepted from it.

Comment 3

[Benjamin Smedberg]

Resolving old bugs which are likely not relevant any more, since NPAPI plugins are deprecated.