gecko-mediaplayer package should not bundle so many plugins for security reasons

Bug #1053985 reported by nick rundy
12
This bug affects 3 people
Affects Status Importance Assigned to Milestone
ubuntu-meta (Ubuntu)
Expired
Undecided
Unassigned

Bug Description

Web browser plugins are a major vector for exploit on the internet. For security reasons, it is best not to install plugins you don't need. Yet Ubuntu-packages bundle numerous plugins together. For example, if I use one single plugin (e.g., Windows Media Player Plug-in), I have to install the gecko-mediaplayer package. Yet the gecko-mediaplayer package installs 4 additional plugins in addition to the Windows Media Player Plug-in. I NEVER use the 4 additional plugins that are installed. Further, among the 4 additional plugins installed are QuickTime and RealPlayer. Two plugins that are notoriously exploited on the web.

The gecko-mediaplayer package should not bundle so many plugins together. A separate package should exist for each plugin. Or some other solution should be developed that allows users to only install the plugin they actually use.

Security is a major problem these days and users should not have to install more plugins than they actually use, especially when the unused plugins are notorious for security vulnerabilities.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ubuntu-meta (Ubuntu):
status: New → Confirmed
Revision history for this message
dino99 (9d9) wrote :

This is a general nightmare all across the system, and so often requested to stop this madness of multiple cross dependencies. Very bad poor design.

Revision history for this message
Kevin DeKorte (kdekorte-gmail) wrote :

gecko-mediaplayer is a single plugin with an emulation layer for the various plugins. So the same plugin that does windows media also does quicktime, and others. So splitting them doesn't really give you anymore security.

Also, if the user is concerned about this, they can start gnome-mplayer and choose edit -> Preferences [plugin] and then disable the plugins they do not want emulated.

Revision history for this message
Bryan Quigley (bryanquigley) wrote :

Does Kevin's answer make sense to you? I'd also be curious if you still see a need to install the gecko-mediaplayer package in 2015.

(I'm pushing to remove all NPAPI plugins from the various default installs and gecko-mediaplayer just got dropped from lubuntu in vivid indicating not much use case anymore)

Changed in ubuntu-meta (Ubuntu):
status: Confirmed → Incomplete
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for ubuntu-meta (Ubuntu) because there has been no activity for 60 days.]

Changed in ubuntu-meta (Ubuntu):
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers