253027 - Allow executables to be opened...with caution.

Status: RESOLVED WONTFIX

(Toolkit :: Downloads API, enhancement)

Description

[M. LaPlante]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2

I know this issue has been brought up before, and is generally sneered at by
some of the Mozilla staff, but please consider my angle before denying this
request.  I'm a big fan of IE's ability to open executable files automatically
upon download.  I'm a system administrator by trade, and I spend countless time
downloading software, patches, and the like to install on people's computers. 
FireFox has become my browser of choice for reasons I need not explain here, but
I'm upset daily that I cannot use it to install executables.  Whenever I need an
executable, I will actually copy the URL out of FireFox, open a Run box in
Windows, and paste it there to bring up the Open/Save dialog in IE.

From what I've seen, the Mozilla folks see the ability to run executables as a
security threat.  Here's my logic on how it could be, and how it can be prevented:
1) Most ignorant users who wish to open unsafe files will hardly be denied by
needing to save the file before they open it.  They'll save a virus to their
desktop, double click it, and still get infected.
2) Automatically running executables IS a bad idea, and should NOT be
allowed...this is the key as far as I'm concerned.  You should not deny the
ability to run an executable file from the browser, but you *should* prevent it
from being done automatically without user concent.

In the end, it comes down to intentions and efficiency.  Take into account the
number of steps required with and without the option:

Internet Explorer using Open:
1) Click Link
2) Select Open

Mozilla using only available option Save:
1) Click Link
2) Navigate Save Dialog
3) Save File
4) Locate file from Windows
5) Double click file
6) After running, manually delete the file.

As you can see, this is extremely inefficient for anyone simply looking to run a
program!  When I'm installing software on a computer, I want the simplest most
efficient way of accomplishing the task, and Mozilla is making the process
needlessly, almost painfully, complicated and slow.  For a browser which is
appreciated most by power users around the world, purposely making life
complicated is *not* the way to win over users!  I emplore you not to brush off
this request, as I'm sure there's a group of users who will agree with me.

I also have another suggestion for implementation:  As I already noted,
automatically opening executables should never be allowed for security purposes.
 Further more, if you're still not comfortable allowing this feature, perhaps
including it as an option only would be more acceptable.  By default, leave
Mozilla as it stands...but somewhere in the Preferences, bury an option to allow
executables to be opened from the source, so we power users can have our way
too.  Thanks all.

Reproducible: Always
Steps to Reproduce:

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

>4) Locate file from Windows
>5) Double click file

or click "Launch file" in the progress dialog/download manager

Comment 2

[M. LaPlante]

(In reply to comment #1)
> >4) Locate file from Windows
> >5) Double click file
> 
> or click "Launch file" in the progress dialog/download manager

Also valid, but that does not allow for removal of the file (at least in
FireFox).  Therefore unless you plan on storing it, you still have to navigate
in Windows and delete.  And if you planned on storing, this feature would not
apply to begin with...so really that doesn't make the process any more efficient.

Comment 3

[Ali Ebrahim]

In the download manager, you can right click a file and click on "Open
Containing Folder". This takes you to the folder within which the file is
located, and you can delete it from there without having to navigate for a long
time through Windows Explorer. Is this good enough for you?

The current behaviour of never allowing to run from the download dialog was put
in place with a lot of thought into user behaviour. For every 1 person who would
do the right thing, there are 10 people who wouldn't.

An acceptable implementation might be via a preference, but this is something
that certainly goes on the back-burner for now.

Comment 4

[M. LaPlante]

(In reply to comment #3)
> For every 1 person who would
> do the right thing, there are 10 people who wouldn't.
> An acceptable implementation might be via a preference, but this is something
> that certainly goes on the back-burner for now.

You're not necessarily wrong about this, but if it's true, you're admittedly 
frustrating 1/11 of Mozilla's user base.  That has to be quite a large number 
of people! And that's not even counting the percentage of users who have not 
yet converted to FireFox/Mozilla due to it's lacking usability features such 
as these that are already found elsewhere.  As far as I'm concerned, the 
proper attitude is when in doubt, give the option.  I would be perfectly 
satisified with having to turn on a Preference to enable this capability.  I 
also understand that the Firefox staff has more pressing matters, and don't 
expect immediate gratification, but I think the back burner is better than in 
the trash.  I thank you for your consideration.

Comment 5

[Stephen Smith]

Better to annoy 1/11 than 10/11. Although at times such behaviour might be
desirable, the security of the Firefox UI should never be compromised in order
to mirror that of IE. IMHO this is a WONTFIX.

Comment 6

[Peter van der Woude [:Peter6]]

You can use the Launchy extension for this

WONT

Comment 8

[Liam K.]

Couldn't we add something in about:config that could be changed to enable it? This way, only those who really know what they're doing can configure it.

Comment 11

[Roman]

Mozilla's position on this issue is so weird.

Does Firefox already allow EXE files to be opened? Why, YES! You just double-click it in the downloads list and it opens. What security concerns is everyone on about? Whatever they are, they are obviously irrelevant because Firefox already allows EXE files to be opened.

So what is on with requiring the file to be saved first? How on Earth does that affect security in any way whatsoever?