Paul Crowley

If you follow the bug, you'll find a debate among Firefox developers about whether whitelisting or blacklisting was most appropriate for protocol handlers. Blacklisting won out: the argument is that the whole *point* of having protocol handlers was so that the browser could defer to them if it didn't recognise a protocol. Whitelisting turns out to be the right thing: the argument is that the Windows security people couldn't pour piss from a boot if the instructions were written on the sole.