said by Mele20 :

I don't think Fx has any business following some setting in IE. That makes no sense to me. They are COMPLETELY SEPARATE browsers and should have nothing in common.

said by Mele20 :

As for forcing your AV to scan your download that also is not a good idea.

said by Mele20 :

These are reasons why I continue to use Fx 1.5 on my host computer. I don't need Mozilla pulling a Microsoft and trying to boss me around.

said by BandHeight :

Well, the download / execute policy setting, though identified by MS as an IE setting in some of the GUIs where the policy can be changed, is actually a policy of the OS that was intended to be followed by other clients (email apps, browsers, etc.) that run on the system.
Yes, Mozilla could have opted to not use that particular interface, but they seem to have their sights on business / office environments where admins expect the policy to be respected by installed software.

I have no real problem with them respecting the settings, but they did not really provide an elegant solution for the user to ignore the policy when desired. Pointing the user to a GUI that associates the settings with an IE icon (as well as being mixed in with other policies that FF does not adhere to) so that the settings can be adjusted is very, very clumsy.

Well, what will likely happen (per the usual progression) is that we'll be using FF 5 and you will, by then, have switched to FF 3. Why not just give your heart to it now instead of playing so hard to get all the time.

said by Mele20 :

IE has always been very unsafe as far as downloads go as you can RUN the download.

said by vicks :

... Mozilla added this warning just a few days ago with Firefox 3 release. Mozilla is in late!!!!

said by Cudni :

are you sure?

said by Cudni :

it is good to be sure, what happens when you click to download .exe in FF 2 ?

said by vicks :

You didn't understand what is Windows Security Zone.
Try these steps:
1. download an exe with Firefox 2
2. save to disk
3. run it
result: when you run it, no warning is shown because the file has not marked by an alternate data stream

said by vicks :

You didn't understand what is Windows Security Zone.
Try these steps:
1. download an exe with Firefox 2
2. save to disk
3. run it
result: when you run it, no warning is shown because the file has not marked by an alternate data stream

Since XP SP2, Internet Explorer 6 marks all downloaded files by an alternate data stream which tells it comes from Internet zone and so Windows shows this warning:

said by Mele20 :

That article doesn't seem very relevant. It is talking about email attachments. Besides, IE has always been very unsafe as far as downloads go as you can RUN the download. In Fx you are REQUIRED to save to disk which is much safer. So, I don't see where Microsoft can get off telling Fx users how to handle downloads. That's just crap.

said by Mele20 :

As for me embracing Fx3 "now"...damn good thing I have 1.5 on the host machine. Fx3 on my XP Pro SP2 virtual machine appears completely borked ...

said by Mele20 :

So, these features are not working for me at all.

said by Mele20 :

I don't understand your point. YOU had to add the ADS to get Fx to react. Soo....?

Plus, I thought Fx reacted if you had INsecure settings on IE not secure settings. Why would Fx stop you if the IE settings are secure? It should stop you only if the IE settings are insecure.

said by Mele20 :

Auto quote isn't working.

said by Mele20 :

I understand what Bandheight said.

said by Mele20 :

My reply is that it is not true that Fx3 is placing ADS on downloads.

said by Mele20 :

It is not doing for me.

said by Mele20 :

Auto quote isn't working.

I understand what Bandheight said. My reply is that it is not true that Fx3 is placing ADS on downloads. It is not doing for me. Therefore, this feature does not work. Bandheight has Service Pack 3 for XP. I have SP2. Maybe Service Pack 3 is required for this to work? If so, that is another good reason to not install SP3...getting too bossy.

said by Mele20 :

What "feature" was added in SP2?

said by »support.microsoft.com/?kbid=883260 :

The Attachment Manager in Windows XP SP2 can help protect your computer from unsafe attachments that you might receive with an e-mail message and from unsafe files that you might save from the Internet.

If the Attachment Manager identifies an attachment that might be unsafe, the Attachment Manager prevents you from opening the file, or it warns you before you open the file.

The Attachment Manager uses the IAttachmentExecute application programming interface (API) to find the file type, to find the file association, and to determine the most appropriate action.

Microsoft Outlook Express, Microsoft Windows Messenger, Microsoft MSN Messenger, and Microsoft Internet Explorer use the Attachment Manager to handle e-mail attachments and Internet downloads.

When you save files to your hard disk from a program that uses the Attachment Manager, the Web content zone information for the file is also saved with the file. For example, if you save a compressed file (.zip) that is attached to an e-mail message to your hard disk, the Web content zone information is also saved when you save the compressed file.

said by »smallvoid.com/article/ie-attachm···ger.html :

Windows XP SP2 includes a new feature called Attachment Manager, which monitors files downloaded from the Internet or received as e-mail attachments.

When a downloaded file is saved to a disk formatted with NTFS, then it will update the meta data for the file with the zone (Internet- / Restricted-zone) it was downloaded from. The meta data is saved as an Alternate Data Stream (ADS), which is a feature of NTFS where the same filename can be used to cover multiple data streams.

I understand what Bandheight said. My reply is that it is not true that Fx3 is placing ADS on downloads. It is not doing for me. Therefore, this feature does not work. Bandheight has Service Pack 3 for XP. I have SP2. Maybe Service Pack 3 is required for this to work? If so, that is another good reason to not install SP3...getting too bossy.

said by BandHeight :

Results (image posted: FF-Streams.png)

- IE7 - Added ADS; execution prompts user
- FF 3.0 - Added ADS; execution prompts user
- Opera 9.5 - Did not add ADS; execution proceeds without prompt
- GetRight 5.2d - Did not add ADS; execution proceeds without prompt

said by Mele20 :

I don't understand your point. YOU had to add the ADS to get Fx to react. Soo....?

said by Mele20 :

Plus, I thought Fx reacted if you had INsecure settings on IE not secure settings. Why would Fx stop you if the IE settings are secure? It should stop you only if the IE settings are insecure.

said by BandHeight :

If you have a Policy for high security, it prompts the user or blocks the activity completely (Zone 3 or Zone 4, respectively). If the user chooses a less secure Policy (Zone 1 or 2), the prompting and blocking do not occur at all or are lessened.

I think you are fundamentally misunderstanding this topic.

EDIT:
By the way, once the downloaded file is tagged with a Zone 3 ADS per policy, FF is out of the picture. The prompt that a user gets when the file is executed is then received from the OS and it looks just like the prompt that a Zone 3 file downloaded by IE would look (see images in this post).

Of course, this does not apply for Zone 4 because no file is actually downloaded, so no ADS can be added and the file-blocked message comes immediately from the browser itself (thus the 2 different screen-shots in my previous post).

said by Mele20 :

...But there is no Spellbound extension for Fx3 and I cannot turn off the spell checker even though the box to use it in Options/advanced is unchecked. I also cannot turn it off on the Vista machine. I have to right click uncheck the "check spelling" box every time I go to make a post. Then when I preview the post and want to change something, add something, the spell checker has been turned back on. It is awful. It is like a leech that cannot be dislodged....

said by HA Nut :

Other than the about:config entry where the AV scanning is set, has anyone read exactly how FF 3 goes about determining how to call up the AV and run the proper command(s) to actually perform the scan? I've ran FF 3 with the scanner on and off and saw no perceptible difference.

said by OZO :

And here is one more issue which I think is very important and unfortunately was missed in this thread - and it's portability. I need a portable web browser that I may take with me to any place (with all my configuration settings, especially security settings) and run it there. I will never achieve this with IE (without its total sandboxing, which is quite difficult to obtain in an uncontrolled environment). If FF starts to relay on uncontrolled environment, "honoring" its settings, I do not need such browser and will go with Opera or something else. Sorry...

said by BandHeight :

What you say:
...
What an IT admin might say:
...
It's all about perspective, I suppose.

- FF is really only honoring policy in regard to downloads / attachments. This may not make FF 3.0 safer, but it certainly doesn't make it any less secure, especially since it heretofore ignored the policy anyway (meaning it operated in the equivalent of the zone policy's least restrictive zone).

Beyond that, FF gets some modifications to it in order for it to be portable (e.g., it gets its disk cache disabled, among other things), so the same thing would apply in regard to zone policy.

said by OZO :

Then it comes to browsers's developers attitude (or their perspective).

said by OZO :

Do you really mean Trusted zone (or zone #2)? Do they save ADS with ZoneID=2 line?

said by OZO :

Now, that's finally the right direction to move :). I mean to make FF portable. But then forget about zone configuration which is saved in registry.

said by Herohtar :

You actually do not have to modify the Security Zones settings at all -- the browser.download.manager.scanWhenDone setting is responsible for adding the ADS. If you disable that, the zone information will no longer be added and you won't get the security warning.

More information can be found here: »blog.case.edu/bes7/2008/04/21/re···refox_30

said by BandHeight :

To make this most effective, I still say that there should be a Master On / Off option. As it stands now, simply setting:

browser.download.manager.scanWhenDone false

is problematic:

- it turns off AV scanning, which is expected
- it impacts FF zone policy functionality, which is unexpected and even perhaps baffling unless you know that they share common APIs
- it impacts FF zone functionality, but only partially, e.g., it prevents ADS from being embedded in files, but it still honors the blocking of downloads from URLs in Zone 4 (at least per my testing).

said by HA Nut :

None of this discussion affects XP Home right? Since it doesn't support Group Policies?