[tor-bugs] #10280 [Firefox Patch Issues]: Torbrowser shouldn't load flash into the process space by default

[Tor Bug Tracker & Wiki]

#10280: Torbrowser shouldn't load flash into the process space by default
--------------------------------------+----------------------------
     Reporter:  mikeperry             |      Owner:
         Type:  enhancement           |     Status:  needs_revision
     Priority:  normal                |  Milestone:
    Component:  Firefox Patch Issues  |    Version:
   Resolution:                        |   Keywords:
Actual Points:                        |  Parent ID:
       Points:                        |
--------------------------------------+----------------------------
Changes (by cypherpunks):

 * status:  new => needs_revision


Comment:

 >If we can touch up this patch a bit to also add a button in the
 Addons->Plugins UI such that users can enable plugins by clicking on that
 button (in addition to via the Torbutton settings)

 Attached complete version. As enhancement it doesn't requires any changes
 to Torbutton code. No need to show warning and ask user anything while
 enabled to load plugins if this ticket didn't counted as bug. But TBB
 should be shipped with ''plugin.disable'' preference defined as true.

 About patch. It's still fragile in several places. First, it observes
 changes of preference by ''PluginProvider'', but this can't guarantee
 plugins was loaded or unloaded already. Need to change code of
 ''nsPluginHost::Observe'' from nsPluginHost.cpp instead to generate new
 notify for ''PluginProvider'' after operations was complete. Second, it
 used observer by gListView. Installing of addonlisteners for every plugin
 to catch onUninstalled would be more correct version instead. (During test
 it failed to catch it correctly at first show of glistview and required
 many code, so unsure about this way)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10280#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online