1028673 - Plugin Whitelist Request: Avaya's Scopia Conference Client Dispatcher plugin

Status: RESOLVED WONTFIX

(Firefox Graveyard :: Plugin Click-To-Activate Whitelist, defect)

Description

[Ronny]

<<Please supply the following information for new plugin whitelist requests>>

Plugin name: Conference Client Dispatcher
Vendor: Avaya, Inc. 
Point of contact: [e-mail]
Current version: Windows: 1.5.0.5 Mac: 0.35
Download URL: http://scopia.avaya.com 
The plugin will automatically be downloaded when attempting to install the client.
Sample URL of plugin in use: http://scopia.avaya.com 

Plugin details:
The conference client dispatcher manages the conference client versions, starts the client upgrades and runs the conference client. 

<<For each affected operating system, please copy the plugin information from about:plugins in Firefox>>

Windows:
File: npClientInstMgr.dll
Path: C:\Users\<username>\AppData\Local\Radvision\Installer\1.5.0.5\npClientInstMgr.dll
Version: 1.5.0.5
State: Enabled
MIME Type: application/x-confclient_dispatcher_0.2
Mac:
File: ClientManager64_0.35.plugin
Path: /Users/<username>/Library/Internet Plug-Ins/ClientManager64_0.35.plugin
Version: 0.35
State: Enabled
NPAPI plug-in for Mac Conference Client

MIME Type: application/x-confclient_dispatcher_0.35


Are there any variations in the plugin file name, MIME types, description, or version from one release to the next?

Windows: Version rarely changes. However it still might change in new release. MIME type doesn’t change.
Mac: Version changes with every release. MIME type changes according to version (e.g. application/x-confclient_dispatcher_0.36, application/x-confclient_dispatcher_0.37 etc.)

Are there any known security issues in current or older versions of the plugin?
No

Additional Information:
We plan to remove the use of NPAPI in our client installer in our next major version release

Comment 1

[Benjamin Smedberg]

We believe that the correct experience for this plugin is not automatic activation, especially because this updates client software on the user computer. The application is not accepted.

Comment 2

[Ronny]

As this is a temporary solution, and our application only changes our own software, that too only after asking the user and getting his/her approval - we will absolutely do nothing unless the user confirms - can you please elaborate why the request was rejected?

Comment 3

[Ronny]

Can you please explain again why the request was rejected? thanks

Comment 4

[Benjamin Smedberg]

In general, we believe that users should explicitly opt-in to additional software running in their browser. In this case, users can do that via the plugin activation prompts, or you can package the plugin in a Firefox extension for users to install/accept. Once the user has accepted the plugin via "Always Enable" on a domain, it should continue working.

The whitelist is a Firefox mechanism to temporarily bypass this requirement for certain, especially while they are transitioning to a native HTML solution. But in this case the user impact is minimal and the builtin plugin activation UI is better.