Mozilla may add a tool to its upcoming Firefox 3.0 web browser that will automatically block websites Google thinks harbour malicious downloads. Mozilla's security chief remained tight-lipped when asked about the potential web-security feature, however, saying Mozilla is "not ready to talk about the feature".
Details of the Firefox 3.0 feature can be found on a blog by a Firefox designer and in a discussion of the feature in Bugzilla, the management system that Mozilla uses to track changes in its software.
"Similar to how Firefox 2.0 blocks websites that are potentially going to try to steal your personal information, Firefox 3.0 will block websites that we believe are going to try to install malicious programs on your computer," said Alex Faaborg, a user experience designer in a blog entry last week.
"Mozilla is coordinating with Google on this feature."
And in a Bugzilla entry that offers comments from Mozilla and Google employees - including Chris Hofmann, Mozilla's director of engineering, and Mike Shaver, its director of ecosystem development - information is even more free-flowing about malicious site blocking in the next major update to the Firefox web browser.
The discussion centres on how Firefox 3.0 will warn or alert users to a potentially malicious site. Faaborg mocks up a warning notice, then someone else offers up another option entitled "Scarier error page". But at times the thread lingers on technical issues.
"If a site does not appear in the blacklist but the response from Google says 'this is a malware site', will Firefox stop showing the page immediately and load this error page in its place?" asked Jesse Ruderman, a PhD student at the University of California, San Diego, and an unpaid Firefox developer.
"I think the plan for malware is to only use the local lists so we don't have to slow down page load or unload a page (which would probably be too late anyway)," replied Tony Chang, one of the Google software engineers who works full-time on Firefox.
"This is an example of how development goes on [at Mozilla]," said Window Snyder, the company's chief security officer.
"This is a great example of working with the [open-source] community" in a give-and-take atmosphere where ideas are batted back and forth, she added.
Still, she wouldn't commit Mozilla to adding a malicious blocking tool to the anti-phishing filter already present in Firefox. "It's definitely one of the things we're looking at," Snyder acknowledged, while noting that the feature is currently rated P2 (Priority 2). By Mozilla's definitions, only P1 features are mandatory for Firefox 3.0.
More on page 2