Slashdot Mirror

I just use Firefox Portable with IETab for the internal POS (not talking about point of sale folks) applications that won't work in anything but internet exploder. Oh and Hidetab comes in handy from time to time too.

I highly HIGHLY recommend a flash blocking add-on like FlashBlock for Firefox. There will be a play button where all the embeded flash videos would be and it won't load them until you click play. You can of course whitelist sites that you'd like to load all flash from. But now you don't have to have those 10 pages in tabs each with 2, 3 or more flash ads or graphics eating up CPU cycles.

SSLed checksums for the binaries... oh, wait, Mozilla doesn't bother publishing those, for some reason.

Really? So what are these, then? https://archive.mozilla.org/pub/mozilla.org/firefox/releases/3.6/SHA1SUMS

We don't advertise it because anyone competent to check SHA1 hashes should be able to check PGP signatures, and the mirror network scales unlike hosting everything ourselves. Obviously the SSL server is not mirrored because giving out the cert would make it pointless.

I see your post as +5, but maybe people are modding you without clicking the link. I still see:

        Remember visited SSL details and warn when changes, like SSH
        Importance: enhancement with 8 votes (vote)

A tool made for GUI mockups like Firefox Pencil is even easier than Inkscape or Scribus.

Yes, it's a plugin/add-on. Give it a try, you might be surprised.

> You forget that any CA can sign for any web site.

That attack won't work if Mozilla stopped the useless debates and just fixed their browser:

https://bugzilla.mozilla.org/show_bug.cgi?id=286107

That bug is already nearly FIVE years old.

The concern of "same site, different CA" is overblown, warn and let the user approve the new CA for the site - if the user gets lots of "New CA" warnings for the same site the user SHOULD get suspicious and not do anything till the user gets out-of-band confirmation that stuff is actually OK.

Users who don't want or can't handle such warnings should use the "Stop bothering me, I don't care that much about security" browser setting.

It won't really matter - they can (and already do) get pwned in so many other ways.

The thing is Mozilla doesn't really care about actual security, and neither do the CAs or most websites. They just care about the appearance of security. It's all about "pay us every year and your users won't get scary warnings".

In case anyone thinks DNSSEC will help, DNSSEC will just allow people to collect more tolls/taxes without really improving security (it actually facilitates DoS attacks :) ).

Why do Certificate Authorities have to be either completely trusted or not trusted at all? It couldn't be a ton of work to enable restrictions to be placed on the domains a CA is authoritative for.

Looks like there's already a thread discussing this for the Mozilla suite.

Just install AutoPager and you get the article in one long page. You find performance per dollar at page 17 and other interesting nuggets of information well before that last page conclusion.

Ouch, have you tried: BetterPrivacy
Auto deletes flash cookies on exit and/or after a user-configurable expiration timeout.

Someone mentioned it in passing but I'll say it directly: FlackBlock

I'm not one to turn off the web with NoScript or not contribute to sites I'm visiting by using AdBlock. FlashBlock is a great compromise. Normal ads, no stupid flash instability. Click on the flash when actually want it to run for where it's actually needed. You'll be surprised how well it works.

This feature is here now for Firefox users with the Better Privacy extension.

Get FlashBlock or NoScript to turn off flash altogether.

Get BetterPrivacy to automatically delete Flash cookies on exit; it seems to work well.

Get FlashBlock or NoScript to turn off flash altogether.

Get BetterPrivacy to automatically delete Flash cookies on exit; it seems to work well.

Get FlashBlock or NoScript to turn off flash altogether.

Get BetterPrivacy to automatically delete Flash cookies on exit; it seems to work well.

To automatically get rid of these use the BetterPrivacy add-on.

One of the key arguments that people like to taunt regarding software security and specifically open source security is the fact that they compare say redhat enterprise 4 to Windows 2003. If you look at the Redhat Errata you may start to be alarmed. The question then comes around... 'who actually installs EVERY single redhat package when they install the whole system?'.. the answer from my experience is very few. However that is where many of the comparisons come from. If you segregate the overall number of comparable systems between linux and windows you will often find that the number of security vulnerabilities to be not wildly different. However if you compare the whole distribution's release to a windows install then your going to think.. 'dang windows is secure'. There are several other points in the argument that I tend to enjoy asking people who use these types of numbers.
1. if you have so few vulnerabilities what is your exposure footprint? e.g. how many people are trying to trojan you on windows vs linux?
2. how many of the vulnerabilities have been reported by the community that develop the software? If we look at Firefox for example most of their vulnerabilities are not actually reported by hackers or security experts but by their core developers who realise someone else in their team wrote some crap code or didn't properly do something. Here are some URL's to give some further evidence http://www.mozilla.org/security/announce/2009/mfsa2009-47.html http://www.mozilla.org/security/announce/2009/mfsa2009-63.html (although after actually going to find evidence I found that in 3.0 and 3.5 most vulnerabilities came from researchers and not the community like many earlier releases)

One of the key arguments that people like to taunt regarding software security and specifically open source security is the fact that they compare say redhat enterprise 4 to Windows 2003. If you look at the Redhat Errata you may start to be alarmed. The question then comes around... 'who actually installs EVERY single redhat package when they install the whole system?'.. the answer from my experience is very few. However that is where many of the comparisons come from. If you segregate the overall number of comparable systems between linux and windows you will often find that the number of security vulnerabilities to be not wildly different. However if you compare the whole distribution's release to a windows install then your going to think.. 'dang windows is secure'. There are several other points in the argument that I tend to enjoy asking people who use these types of numbers.
1. if you have so few vulnerabilities what is your exposure footprint? e.g. how many people are trying to trojan you on windows vs linux?
2. how many of the vulnerabilities have been reported by the community that develop the software? If we look at Firefox for example most of their vulnerabilities are not actually reported by hackers or security experts but by their core developers who realise someone else in their team wrote some crap code or didn't properly do something. Here are some URL's to give some further evidence http://www.mozilla.org/security/announce/2009/mfsa2009-47.html http://www.mozilla.org/security/announce/2009/mfsa2009-63.html (although after actually going to find evidence I found that in 3.0 and 3.5 most vulnerabilities came from researchers and not the community like many earlier releases)

gad_zuki! makes a good point: Is the open Web capable of delivering an experience analogous to the Flash animations and games seen at, say, Newgrounds?

Yes. See DHTML Lemmings. It was written six years ago. WebGL is also on the horizon:

http://hacks.mozilla.org/2009/09/webgl-for-firefox/
http://hacks.mozilla.org/2009/09/three-more-webgl-demos/
http://hacks.mozilla.org/2009/10/webgl-in-the-wild/
http://hacks.mozilla.org/2009/12/webgl-goes-mobile/
http://hacks.mozilla.org/2009/12/webgl-draft-released-today/

And here's WebGL combined with Theora video to create a 360 degree interactive video:

http://bjartr.blogspot.com/2010/01/long-delayed-webglu-update-some-360.html

gad_zuki! makes a good point: Is the open Web capable of delivering an experience analogous to the Flash animations and games seen at, say, Newgrounds?

Yes. See DHTML Lemmings. It was written six years ago. WebGL is also on the horizon:

http://hacks.mozilla.org/2009/09/webgl-for-firefox/
http://hacks.mozilla.org/2009/09/three-more-webgl-demos/
http://hacks.mozilla.org/2009/10/webgl-in-the-wild/
http://hacks.mozilla.org/2009/12/webgl-goes-mobile/
http://hacks.mozilla.org/2009/12/webgl-draft-released-today/

And here's WebGL combined with Theora video to create a 360 degree interactive video:

http://bjartr.blogspot.com/2010/01/long-delayed-webglu-update-some-360.html

gad_zuki! makes a good point: Is the open Web capable of delivering an experience analogous to the Flash animations and games seen at, say, Newgrounds?

Yes. See DHTML Lemmings. It was written six years ago. WebGL is also on the horizon:

http://hacks.mozilla.org/2009/09/webgl-for-firefox/
http://hacks.mozilla.org/2009/09/three-more-webgl-demos/
http://hacks.mozilla.org/2009/10/webgl-in-the-wild/
http://hacks.mozilla.org/2009/12/webgl-goes-mobile/
http://hacks.mozilla.org/2009/12/webgl-draft-released-today/

And here's WebGL combined with Theora video to create a 360 degree interactive video:

http://bjartr.blogspot.com/2010/01/long-delayed-webglu-update-some-360.html

gad_zuki! makes a good point: Is the open Web capable of delivering an experience analogous to the Flash animations and games seen at, say, Newgrounds?

Yes. See DHTML Lemmings. It was written six years ago. WebGL is also on the horizon:

http://hacks.mozilla.org/2009/09/webgl-for-firefox/
http://hacks.mozilla.org/2009/09/three-more-webgl-demos/
http://hacks.mozilla.org/2009/10/webgl-in-the-wild/
http://hacks.mozilla.org/2009/12/webgl-goes-mobile/
http://hacks.mozilla.org/2009/12/webgl-draft-released-today/

And here's WebGL combined with Theora video to create a 360 degree interactive video:

http://bjartr.blogspot.com/2010/01/long-delayed-webglu-update-some-360.html

gad_zuki! makes a good point: Is the open Web capable of delivering an experience analogous to the Flash animations and games seen at, say, Newgrounds?

Yes. See DHTML Lemmings. It was written six years ago. WebGL is also on the horizon:

http://hacks.mozilla.org/2009/09/webgl-for-firefox/
http://hacks.mozilla.org/2009/09/three-more-webgl-demos/
http://hacks.mozilla.org/2009/10/webgl-in-the-wild/
http://hacks.mozilla.org/2009/12/webgl-goes-mobile/
http://hacks.mozilla.org/2009/12/webgl-draft-released-today/

And here's WebGL combined with Theora video to create a 360 degree interactive video:

http://bjartr.blogspot.com/2010/01/long-delayed-webglu-update-some-360.html

Even Mozilla dodges taxes because they are a "non profit" and get PAID millions of dollars from google as part of a business deal. But I guess if you pay a tiny percentage of that money to pay for nerds to work on open source, you're immune from criticism on Slashdot.

Right. Because the income dealings of a non-profit corporation are really just so shrouded in secrecy, loopholes and backroom deals.

In the time it took me to respond, Microsoft just wrote off more in taxes than the Mozilla Foundation is worth.

http://www.mozilla.org/foundation/documents/mf-2008-audited-financial-statement.pdf

Blow me.

I think you're full of it. Microsoft is a key committed member of the CSS WG and continue to work in good faith helping the group.

Yeah, that must be why people were getting out of the CSS WG because of Microsoft's behavior: 1, 2, 3, 4

Since you're big on the whole standards thing, you might like to know that IE8 is the only fully CSS 2.1 standards compliant browser at the moment.

Nope. That is a blatant lie if I ever saw one.

With regard to ECMAScript4, Microsoft had some fundamental differences with whether it was worth expanding the language considering the legacy baggage and the need to add modern scripting features.

Actually, ECMAScript 4 was seen as a threat against Silverlight: 1, 2

Camino is a Gecko browser. It's whole purpose in life is to be the equivalent of Firefox, but use OS X's native Aqua toolkit and follow its user interface guidelines. It's even listed on Mozilla's website. You're right, though, the the most obvious explanation for Safari is that Apple got burned by relying on others for a browser too many times. I would have preferred if they used all their Safari developers to get behind the Camino project instead (no reason they can't fork if they ever need to), but oh well.

Someone else mentioned Zotero, which looks really good and I'm meaning to try it, once I've cleared out over due projects.

What I have used for quite some time, with great results, is the Firefox extension called Scrapbook. Just select the HTML you want to keep from a web page, and you're nearly done. https://addons.mozilla.org/en-US/firefox/addon/427

Is it possible to use the User Agent Switcher addon for Firefox and trick your employer's site into thinking you're using ie6?

Here you go:

https://addons.mozilla.org/en-US/firefox/addon/3173
http://mrl.nyu.edu/~dhowe/TrackMeNot/

I don't actually use it, I just googled it.. oh the irony.

They actually used to use the OSX spellchecker and stopped because it had major issues with dictionary support.
Here's the bug for it

There are also efforts being made to use GStreamer for Firefox. See https://bugzilla.mozilla.org/show_bug.cgi?id=422540

As for Mozilla, the stated reason for not using gstreamer/quicktime/directplay is the potential for security exploits in those frameworks

Not really. They made that argument specifically for DirectShow, but it remains a very weak one. Meanwhile, they've added GStreamer support to Fennec, but still refuse to add it to the desktop version, and the reason explicitly given for this is purely political in nature:

A solution that seems logical on the surface is to simply expose each platform's underlying media playback engine through the HTML 5 video element—DirectShow on Windows, GStreamer on Linux, and QTKit on Mac OS X. This would make it possible for the browser to play any video formats that are supported natively on the user's computer.

From a purely technical perspective, this is not an impossible problem to solve as there are already existing libraries that do this and provide a cohesive abstraction layer on top. One prominent option is Nokia's Phonon library. It could also possibly be done by using the Quicktime and DirectShow plugins for GStreamer.

Mozilla strongly opposes this approach because it would heighten the risk of fragmentation. Allowing content providers to use any codec that is available on the user's computer might undermine the advantages of the HTML 5 media element because there would be no consistency guarantee and content would not be able to work everywhere. That is, however, arguably the situation that already exists as a result of the impasse in the codec debate.

More importantly what happens when some one creates a firefox plugin that randomly accesses web sites, thus obfuscating your any actual web usage and poisoning perverts data base mining efforts. A similar tool to track me not https://addons.mozilla.org/en-US/firefox/addon/3173, perhaps making a random selection from logical IP address ranges. Whta happens if you are a frequent user of stumbleupon https://addons.mozilla.org/en-US/firefox/addon/138, who is liable for those choices, you or stumbleupon, I've pressed that button more than 100,000 times and I certainly take no responsibility for where it ends up. Then there is change of IP address, what was once a child safe IP address can months latter become a child porn address and, vice versa. Now add IPv6 into that and naughty web sites can literally have thousands of IP addresses, scattered and not tied to a particular range. One could image the 2 year databases could become huge and contaminated with millions even billions of false connection records.

More importantly what happens when some one creates a firefox plugin that randomly accesses web sites, thus obfuscating your any actual web usage and poisoning perverts data base mining efforts. A similar tool to track me not https://addons.mozilla.org/en-US/firefox/addon/3173, perhaps making a random selection from logical IP address ranges. Whta happens if you are a frequent user of stumbleupon https://addons.mozilla.org/en-US/firefox/addon/138, who is liable for those choices, you or stumbleupon, I've pressed that button more than 100,000 times and I certainly take no responsibility for where it ends up. Then there is change of IP address, what was once a child safe IP address can months latter become a child porn address and, vice versa. Now add IPv6 into that and naughty web sites can literally have thousands of IP addresses, scattered and not tied to a particular range. One could image the 2 year databases could become huge and contaminated with millions even billions of false connection records.

As an example of how this gets used, take a gander at the CSS of a page sometime. You might see something like -moz-border-radius or -moz-background-size - these are CSS attributes that Mozilla supports, and that may be similar to but not exactly the similarly named W3C standards. That's how you're supposed to do it - if you're going to claim that you support a standard, then support the goddamn standard. Don't half-ass it in an incompatible way.

I like the idea of LocalRodeo but it seems to be able to work only with a Alpha version of FF 3.0.
I'm surprised that FF does protect against "Intranet Exploration" and "DNS-Pinning" built-in.

https://addons.mozilla.org/en-US/firefox/addon/5055

may i recommend detiny url expander a small add on for firefox https://addons.mozilla.org/en-US/firefox/addon/13140

which expands the above link to http://web.archive.org/web/20001202200100/http://---www.goatse.cx/ (If you really want to click it you will have to go to the parent post)

This is security theatre of the worst kind. Their whole (and only plausible) excuse for doing this is that nobody can pretend to be CNNIC over https now; given the reactions of people familiar with CNNIC I wonder why the hell anyone would in the first place.

Now thanks to a complete and utter retard at Mozilla blithely following a script without regard to the real world consequences, everyone gets to live with those consequences: hundreds of millions of net users who more often than not blindly click Yes to anything, who have been trained to associate a blue/green address bar with "safe".

Thanks for making the internet a "safer" place, Mozilla. Ugh.

Not sure about Opera, but here is the resolution of the same issue for Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=340198

the longest discussion in the system is from 2002 (http://bugzilla.mozilla.org/show_bug.cgi?id=147777 [mozilla.org]).

Actually, an even earlier discussion can be found here: https://bugzilla.mozilla.org/show_bug.cgi?id=57351. And that one is probably not the oldest one either...

I wrote longest discussion. Furthermore, I pointed out that one of the first entries in Bugzilla was back in 2000, actually I meant exactly the link you provided. Thus your comment is superfluous, please read my reply again.

the longest discussion in the system is from 2002 (http://bugzilla.mozilla.org/show_bug.cgi?id=147777 [mozilla.org]).

Actually, an even earlier discussion can be found here: https://bugzilla.mozilla.org/show_bug.cgi?id=57351. And that one is probably not the oldest one either...

History stealing is even older than Jeremiah Grossman's blog posting, he also simply copied the idea: this design flaw was reported in bug tracking system of Mozilla (Netscape) back in 2000, the longest discussion in the system is from 2002 (http://bugzilla.mozilla.org/show_bug.cgi?id=147777).

If you read the article, they clearly state that history stealing is a well-known technique, they just use it in a different setting to be able to find out the "group fingerprint".

Old people, non-geeks, spouses of slashdotters maybe. Seriously, a lot of people still use IE. There are reason though. I was able to "convert" my wife from IE to FF a few months ago, however, her company's payroll system only works on IE. Once she switches it on, she continues using it.

Have you suggested IE Tab?

That is my suggestion also, W3 . I addition I would recommend firebug. https://addons.mozilla.org/en-US/firefox/addon/1843 There is no better teacher than seeing how the scripts are actually implemented.

Yes there is.

I can think of two reasons that Firefox would have to use a lot of memory: DOM caching and plug-in leaks. DOM caching stores information about pages you have recently visited so that the back button, undo close tab (Cmd-Shift-T), and undo close window (Cmd-Shift-W) work quickly. As for plug-in leaks, use Flashblock and they will be less noticeable, which should hold you over until Firefox implements Chrome-style multiprocessing.

Firefox for Blackberry
Sorry, no plans. Due to its Java-based operating system and the inability to build native components, Firefox is not compatible on the Blackberry OS.

So according to Mozilla.org:

Firefox for iPhone
We do not have plans to build an iPhone browser due to constraints with the OS environment and distribution.

Firefox for Blackberry
Sorry, no plans. Due to its Java-based operating system and the inability to build native components, Firefox is not compatible on the Blackberry OS.

Firefox for Symbian
We currently have no plans to develop Firefox for the Symbian platform.

So, not available for iPhone, Blackberry and Symbian? Thats what, 3/4 of the smartphone market?

Its a shame as the Blackberry needs a decent browser. Opera Mini 5 is ok but I guess I will have to wait for Skyfire for flash support.

Check here for info on other ports:

https://wiki.mozilla.org/Mobile/Platforms

As far as Symbian is concerned they say "We currently have no plans to develop Firefox for the Symbian platform." Because after all there are so many more phones running Windows Mobile and Maemo than Symbian.....

Stick with Opera Mobile, it's an excellent mobile browser anyway.

According to this page they aren't targeting blackberry at all. They say that it's a problem that the platform is based on Java, which seems strange to me since they are working on an Android version and that is also a java based platform.

Not just one device, it is Firefox Maemo 1.0. Which means it can run any Nokia running Meamo 5.0. There are other versions which are in various stages of development. For eg, its in Alpha 3 for Windows Mobile 6.0.
Check https://wiki.mozilla.org/Mobile/Platforms for more info