The Register® — Biting the hand that feeds IT

Making open-source browsing safe for the masses

David Eddleman

Well! 

Posted Thursday 2nd August 2007 11:27 GMT

"It's a problem on both sides."

Thank you and goodnight.

Anonymous Coward

"It's a problem on both sides." 

Posted Thursday 2nd August 2007 13:22 GMT

True, but one side has fixed it. The other is pretending it doesn't exist.

I.M.Fantom

It's a feature, not a problem. 

Posted Thursday 2nd August 2007 15:22 GMT

is Microsoft's usual reply.

Dillon Pyron

Other platforms 

Posted Thursday 2nd August 2007 17:19 GMT

OS X. Does Safari get passed this "malcious code" and is there a know (KNOWN) exploit for it?

Linux. Plenty of other browsers. Same question.

Steve P

It was always a Firefox problem 

Posted Thursday 9th August 2007 04:46 GMT

The problem was that Firefox registers the 'firefoxurl:' URL scheme and failed to validate the data they were getting through it. That they are not validating the data is what makes it a Firefox problem.

They are using the same mechanism that Real Player uses to register 'rtsp:', Media Player to register 'mms:', Steam to register 'steam:', your mail program uses to register 'mailto:', and your browser uses to register 'http:' and 'https:'.

With the variety of url schemes supported, it's hardly reasonable to assume Microsoft can really validate each type.