The security dialog should be shown before the add-on is downloaded, this is how it has been in the past. (If it should even be shown in the first place, bug 414751)

Can you please explain how this isn't the exact polar opposite of bug 414751?

In a way it is an exact polar opposite, one is dependent on the other. If in the end the security dialog is not shown because its not really needed then this bug could be closed. If the the security dialog is here to stay, then it should be shown before the add-on is downloaded and this bug comes into play.

I guess a better question is, how is this a bug given that we do show the install confirmation dialog now?

The best thing to do for perceived performance might be to show the dialog *while* downloading the addon. Then users will only have to wait if the download takes longer than responding to the dialog. Do we have all the information we need before we download the XPI, though?

(In reply to comment #4) > The best thing to do for perceived performance might be to show the dialog > *while* downloading the addon. Then users will only have to wait if the > download takes longer than responding to the dialog. Do we have all the > information we need before we download the XPI, though? No, we need to pull a bit of the xpi to know that the xpi is signed.

I guess we could have AMO tell us whether the XPI is signed (along with telling us the name of the author, etc). Then we will have all the information we need to show the dialog, and we just need to verify that the information matched.

I'm morphing this bug into the suggestion from comment 4 which would be a nice thing to have, and applies to webpage triggered installs as well as those started from the get add-ons pane. It is very unlikely that this will be coming in Firefox 3 since it would involve fair changes to xpinstall. (In reply to comment #6) > I guess we could have AMO tell us whether the XPI is signed (along with telling > us the name of the author, etc). Then we will have all the information we need > to show the dialog, and we just need to verify that the information matched. That is a possibility but would still require quite a lot of work to achieve and I think there is more value in having it work for all installs, not just those from the get add-ons pane.

So this actually becomes bug 375288