hi jeff, our whole codebase is open source and will be monitored by a lot of people so it is rather unlikely that code could be smuggled in by a malicious third-party without getting noticed. updates that we release are digitally signed and verified before they are applied. updates are also tested and need to be signed off by multiple different people within mozilla, before they are released to the public so an attacker would have to compromise multiple people/systems. since updates for firefox and thunderbird often contain critical security fixes i think you're better off leaving them on...

Thanks Philpp, I appreciate your response. It comes close, but does not quite address my main concern. Is it merely a matter of policy that your updates are tested and signed off on before release, or is it physically impossible to send out updates without multiple people approving? The issue is that we tend to trust updates more than new software, but this recent Petya attach has made me realize that this trust can be exploited. If someone hacks Mozilla, can they use your system to deliver their own malware without you being able to prevent it? If so, then the fact that you are open-source and have good systems to ensure reliable updates is kind of beside the point. I suspect the software company that got hacked with Petya probably also had good systems to ensure good software, but the hackers didn't care. Thanks again for your time, Philpp.

we're mostly volunteers replying here in the forum - if you're interested more in the nitty-gritty parts of the process you might get a better answer reaching out to the release engineering team at mozilla: https://wiki.mozilla.org/ReleaseEngineering

Thanks Philpp! I'll do that.

The other day FireFox let a "demon" malware click through, which popped up pages telling me to call a phone number "for Microsoft", or else they would erase my Hard Drive. . . . I thought I escaped via Ctrl-Alt-Del and shutting down FireFox, but the next day, FireFox opened without any of my Tabs, and I had to re-download it and re-install it, and I never got all my Tabs back. Is there a record of those Tabs stored "inviolate" somewhere, so I can open them all up again? I snapped a picture/PDF of what the malware said - it was on a click on July 6 or so, about U.S. Bank (how they are supposed to help with foreclosure), or maybe it was from a click on July 4, re Problems at U.S. Bank (it could be on both of those clicks), so how do I attach my PDF of that extortion attempt and/or takeover attempt against my computer?

Sorry for the duplication . . . If the PDF-picture still shows, it is about the attack reported by Richard_Palomer above.