Search options

It has some issue to be sorted out, I think that asap they can make an addon that strictly apply to mozilla policies you'll find it there.

Get a good manual on public key encryption mechanisms.
If you encrypt a message to me I can read it, you (and everybody else) can't.

there were already request from the userbase (well, me and blivengood :-P ) to secure and standardize the gpg interface:
+ here: http://firegpg.tuxfamily.org/forum/viewtopic.php?id=143
+ and there: http://firegpg.tuxfamily.org/forum/viewtopic.php?id=139

so, I hope you really take that direction.

I understand all of your concerns but, right now, firegpg is behaving really badly about security. Even if not so, I too dislike this autoupdate feature: firefox updates really well all of his extensions and, if you're going to package it as a deb this feature will cause you lots of headaches (I talk by experience: I did install enigmail.xpi over enigmail.deb and it was a mess).
So, please, consider removing it or providing a checkbox option.

regarding this and hidden start post: what about using enigmail inter process communication javascript?
from the source:

// ipc.js: Run environment for Javascript CGI

// Global functions available to Javascript CGI:
//   write(arg1, arg2, ...)   : writes to "stdout"
//   writeln(arg1, arg2, ...) : writes to "stdout" with newline
//   getEnv(name)  : return value of environment variable or null string
//   execSh(command) : executes command and returns its stdout (requires ipcserv)

this will be a lot more secure than current implementation.

(btw: is ipc.xpt in your svn repository somehow related?)

well, between 0.4.0 and 0.4.1 I just remove a couple of no longer used extensions.
I did try uninstalling firegpg, cleaning entries in global preferences file and reinstalling it again. same results.
Tomorrow I can try running it inside another profile (luckily, no ms windows at home :-P ).

ciao