Filed under: Internet, Utilities, Windows, Macintosh, Linux, Productivity, Mozilla, Browser Tips
Disable XPI Install Delay: Firefox add-on of the day
by Ryan Sullivan Mar 7th 2007 at 10:00AM
As often as I make an attempt to suggest Firefox add-ons that multi-task, every once in a while you come across a great one that does just one stupid thing which makes your Firefox experience better. The one trick pony I'm talking about is the Firefox add-on called Mr Tech Disable XPI Install Delay.
Its purpose might be easy to guess after reading the title; it removes the delay that you see when you install any Firefox extension. Now you might be asking yourself "Why does the delay exist in the first place?" It is part of a security measure that prevents websites installing anything into your browser without your knowledge. This add-on just disables the delay of the XPI install so, you'll still get a pop-up asking you to install now or cancel; In the interest of internet safety we should remind you, if you have XPI install delay turned off using this plug-in and aren't expecting a plug-in install... you should still click cancel. XPI Install Delay only removes the three seconds you have to think about not doing something stupid. It doesn't indemnify you from the idiocy of blindly clicking "Install".
I don't know if this is a labor of love or merely the brainchild of four very gifted games designers, but Level Up is a really weird mash-up of gaming elements that you have probably never seen in a Flash game before.
Let's start with the premise itself: Groundhog Day meets Memento. The game experience revolves around 'days': you explore the world and the clock slowly ticks towards the evening. You bounce around picking up gems and talking to the denizens of 'Level Upland'. Eventually you feel tired and head back to ...
Reader Comments (Page 1 of 1)
Grammar freak said 11:02AM on 3-07-2007
I have a lot of extenstions, but honestly, I think the time it would take me to download and install this (not to mention the time to write this post) would be longer than the cumulative delay of all 20ish extensions i have.
Reply
Ben Compton said 11:16AM on 3-07-2007
http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs
This is a common misconception. The delay is not there to make you think about the stupid thing you might be trying to do; it's there to prevent these kinds of race condition attacks. (See the link above for details.)
Reply
Ben Compton said 11:13AM on 3-07-2007
http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs
The delay isn't there to make you think about the stupid thing you're about to do; it's there to circumvent the kind of race conditions illustrated in the blog post above. (It specifically mentions the Firefox XPI install delay.) It's a bad idea to turn that off.
Reply
keeves said 12:20PM on 3-07-2007
The security risk of installing an extension like this is (IMO) very low.
If the delay isn't there, in theory it is possible for a website to trick the user to click to download a add-on unknowingly, and then install it without realizing it (either by a keyboard key depression or similar, see link in above post).
However since 99.99% of firefox users will have a three-second delay, it is very unlikely that any malicious website would write code to implement an attack on the tiny tiny fraction of firefox users to use this extension... even if technically it would be possible.
Reply
Nosh said 2:02PM on 3-07-2007
One of the main purposes for the delay is so users don't accept the installation by an accidental mouse or keyboard action.
This is one of the dumber (and potentially dangerous) Firefox extensions and a techie site like yours should not be highlighting it esp. when there are so many goobers out there!
Reply
RP said 4:18AM on 3-08-2007
Outlook's calendar/appointment reminders used to drive me crazy for the same reason -- I'd be typing along when suddenly they'd pop up and steal focus. Before I could stop typing I invariably hit SPACE or ENTER and closed the Outlook reminder -- before I could read it.
Firefox came up with an elegant solution to this problem.
Reply
Nicolás said 3:16PM on 3-10-2007
Go about:config
security.dialog_enable_delay
set the value to 0 (zero)
Delay removed. No extensions required ;)
Anyways, is NOT RECOMMENDED to do this since is a bugfix
http://bugzilla.mozilla.org/show_bug.cgi?id=162020
rgds
http://www.zonafirefox.net
Reply