原始连接：
http://blogs.msdn.com/ptorr/archive/2004/12/20/327511.aspx
信息来源：邪恶八进制信息安全团队（
www.eviloctal.com）
[Fixed issues with images; sorry]
[Removed the clear=all problem; thanks for pointing it out]
[Added a follow-up post here]
Recently, a lot of volunteers donated money to the Firefox project to pay for a two-page advert in the New York Times.
If only they had spent some of that money on improving the security of their users by, say, purchasing a VeriSign code signing certificate.
Let me explain...
One of the many criticisms of Internet Explorer is that customers are fooled into downloading spyware or adware on to their computers. This is indeed a legitimate problem, and one of the ways you can reduce the risks of getting unwanted software on your machine is to only accept digitally signed software from vendors that you trust. Every time you download a random piece of software from a random location, you're taking your chances with your PC and all the information stored on it. You wouldn't take candy from strangers, would you?
In order to help protect customers, the default install of Internet Explorer will completely block the installation of ActiveX controls that are not signed, and it will suggest that you do not install any unsigned programs that you might try to download. Of course, just because a piece of software is signed (or you have the MD5 hashes for it) doesn't mean it isn't nasty; it just provides some evidence you can use to make a trust decision about the software (in logical terms, it is a necessary but not sufficient condition for trusting software).
So what happens when a typical user decides it's time to download Firefox and enjoy the secure browsing experience that it has to offer? Well, sit back, relax, and let me take you on a journey.
First of all, I went to the advertised
www.getfirefox.com, and was redirected to the real page at
www.mozilla.org/products/firefox/.
From there I easily located the download link, and clicking on the it gave me the following dialog:
