Slashdot Mirror

It provides a coloured bar (yellow/green) for HTTPS connections in which a user-provided identifier is displayed. So you type in the secure site's URL the first time (https://my.bank.com/), then enter an identifier in the petname bar ("Online banking (Twylite)"). Every time you connect to the site in future the extension will pick up an exact match on the domain name and change the bar to green. Other untrusted SSL sites get yellow. Non-SSL sites are white.

How long until all browsers have a url checker built in with some simple basic rules applied?
Eg: If the address contains ".bank.com" and there is a "." after the com then alert the user / disable javascript / etc.

Yes, I do know that for a lot of people having technology that calls attention to these kinds of problems just causes them to not worry about it. There are, however, too many people who just don't have a clue, are not capable or don't care. I've taught many of them to be careful.

I still wonder why people don't use the Firefix / Adblock / Filterset.G combination as a basic starting point.

It is good to see that there are some anti-phishing addons for Firefox now.

How long until all browsers have a url checker built in with some simple basic rules applied?
Eg: If the address contains ".bank.com" and there is a "." after the com then alert the user / disable javascript / etc.

Yes, I do know that for a lot of people having technology that calls attention to these kinds of problems just causes them to not worry about it. There are, however, too many people who just don't have a clue, are not capable or don't care. I've taught many of them to be careful.

I still wonder why people don't use the Firefix / Adblock / Filterset.G combination as a basic starting point.

It is good to see that there are some anti-phishing addons for Firefox now.

How long until all browsers have a url checker built in with some simple basic rules applied?
Eg: If the address contains ".bank.com" and there is a "." after the com then alert the user / disable javascript / etc.

Yes, I do know that for a lot of people having technology that calls attention to these kinds of problems just causes them to not worry about it. There are, however, too many people who just don't have a clue, are not capable or don't care. I've taught many of them to be careful.

I still wonder why people don't use the Firefix / Adblock / Filterset.G combination as a basic starting point.

It is good to see that there are some anti-phishing addons for Firefox now.

1. Browsers don't distinguish between .com, .org, or .bank urls, so they would need to be augmented to indicate to the user that they are on a banking site, and this indicator must itself be unspoofable; so why the half measure? Why not go all the way and use the Petname Toolbar for Firefox which provides just such an unspoofable indicator right now without the need for limiting it to .bank domains?
2. Encourages complacency on the part of the banks, as they will think that .bank gains them some measure of security; it does not.
3. What is $50k when a typical attack on a bank nets the criminals >$1M?
4. The solution to this problem is not greater regulation (which this "solution" is -- subject to all the bureaucracy, corruption and inefficiencies that regulation entails), the solution is technical, and it already exists
5. Still subject to DNS spoofing/hijacking/poisoning, etc. as others have mentioned

1. Browsers don't distinguish between .com, .org, or .bank urls, so they would need to be augmented to indicate to the user that they are on a banking site, and this indicator must itself be unspoofable; so why the half measure? Why not go all the way and use the Petname Toolbar for Firefox which provides just such an unspoofable indicator right now without the need for limiting it to .bank domains?
2. Encourages complacency on the part of the banks, as they will think that .bank gains them some measure of security; it does not.
3. What is $50k when a typical attack on a bank nets the criminals >$1M?
4. The solution to this problem is not greater regulation (which this "solution" is -- subject to all the bureaucracy, corruption and inefficiencies that regulation entails), the solution is technical, and it already exists
5. Still subject to DNS spoofing/hijacking/poisoning, etc. as others have mentioned

The *REAL* Exchange killer will be CalDAV. Yet another proprietary calendaring/scheduling back end from Zimbra means competing with MS on their turf - and we all know how that always turns out. But when F/OSS apps implement open standards, they kick ass. Think HTTP/HTML - Apache. Think SMTP/POP/IMAP - Sendmail, Postfix, Cyrus, etc. These are the most important protocols and applications around. It's time to do the same with calendaring.

Proprietary calendaring solutions only extend as far as your local implementation. I want to coordinate my schedule with more people than that. I want my coordinate my calendar with my family, with my friends, with my vendors, with my collegues at other institutions, with local town events, with my kid's school - NOT just my co-workers. I don't want to care if they use webmail, crackberries, or whatever. This requires open standards. The standards exist. They are pretty new. Now we just need good reference implementations. If Zimbra does this, I predict they will own the market.

Bedework already supports CalDAV. Bedework/Sakai integration is taking place. Lightning and Sunbird work on top of CalDAV. CalDAV is happening. So Zimbra: please please please get on CalDAV, so we don't have to continue suffering the interminable curse of incompatible proprietary calendering protocols. As we've seen, when open standards take off, even Microsoft has to play along. It's time.

The *REAL* Exchange killer will be CalDAV. Yet another proprietary calendaring/scheduling back end from Zimbra means competing with MS on their turf - and we all know how that always turns out. But when F/OSS apps implement open standards, they kick ass. Think HTTP/HTML - Apache. Think SMTP/POP/IMAP - Sendmail, Postfix, Cyrus, etc. These are the most important protocols and applications around. It's time to do the same with calendaring.

Proprietary calendaring solutions only extend as far as your local implementation. I want to coordinate my schedule with more people than that. I want my coordinate my calendar with my family, with my friends, with my vendors, with my collegues at other institutions, with local town events, with my kid's school - NOT just my co-workers. I don't want to care if they use webmail, crackberries, or whatever. This requires open standards. The standards exist. They are pretty new. Now we just need good reference implementations. If Zimbra does this, I predict they will own the market.

Bedework already supports CalDAV. Bedework/Sakai integration is taking place. Lightning and Sunbird work on top of CalDAV. CalDAV is happening. So Zimbra: please please please get on CalDAV, so we don't have to continue suffering the interminable curse of incompatible proprietary calendering protocols. As we've seen, when open standards take off, even Microsoft has to play along. It's time.

Richard Stallman of the Free Software Foundation devised, in addition to some marvelous software, the GNU General Public License (GPL for short). Or the CopyLeft it is sometimes called.

It is quite a revolutionary document, using the "copyright" tool to to protect your right to use free software.

Unfortunately using copyright to protect free software is a lot like using a Jackal to guard the hens.

In fact, various inconveniences relating to this have resulted in modifications such as the LGPL (Library General Public License) and more recently the NPL (Netscape Public License)

I call these matters mere inconveniences, the real damage will occur when the Jackal's, (sorry, I mean lawyers), actually get to test the GPL in court for the first time.

Thus enter my version.

Its very simple.

Entirely consistent.

Completely unrestrictive.

Easy to apply.

The "No problem Bugroff" license is as follows...

The answer to any and every question relating to the copyright, patents, legal issues of Bugroff licensed software is....

Sure, No problem. Don't worry, be happy. Now bugger off.

All portions of this license are important..

• "Sure, no problem." Gives you complete freedom. I mean it. Utterly complete. A bit of a joke really. You have complete freedom anyway.
• "Don't worry, be happy." Apart from being good advice and a good song, it also says :- No matter what anyone else says or does, you still have complete freedom.
• Now bugger off. The only way to get rid of pushy Jackals is to ignore them and not feed them. The GPL is just begging somebody to take it to court. Can't you just see it. Exactly the same thing that happened when some twit (not Linus) registered Linux as his own personal trademark. People got upset, started a fund, and hired, off all ruddy things, a Jackal to try and defend the chicken! Who really benefits from this trademark / patent / copyright thing anyway? The lawyers. Who made it up in the first place? The lawyers.

OK so the last part of the license sounds a bit harsh, but seriously folks, if you are a :-

• Lawyer asking these legalese questions... You should go off and learn an honest trade that will actually contribute to life instead of draining it.
• Programmer asking these legalese questions... You have amazingly powerful tools in your hands and mind, use them to ask and answer the worthwhile questions of life, the universe and everything. Stop mucking about with such legal nonsense and get back to programming.
• User/reader asking these question... Don't worry. Go off and be happy. Have fun. Enjoy what has been created for you.

ironically enough - the Canadian English dictionary I have doesn't recognize 'spellcheck' or 'plugin' as words.

shift the processing load to your own machine rather then expect Slashdot to do it, and your spellcheck is site independent.

You could check for or write a GreaseMonkey script for Firefox. You do use Firefox, right?

The first bug seems to be bug 915, which is over eight years old! I guess no one is bothered enough by that to fix it. The second might not be a bug according to bug 34415.

The first bug seems to be bug 915, which is over eight years old! I guess no one is bothered enough by that to fix it. The second might not be a bug according to bug 34415.

the OpenGL API for the Canvas tag that the WHATWG has been working on

Only a minor point to clarify, but the WHATWG hasn't been working on the OpenGL API, and the 2D canvas (which it has worked on, and which has been implemented) isn't designed to be hardware-accelerated. Some Firefox and Opera developers have been experimenting with exposing OpenGL ES, and it seems likely that they will propose it in the WHATWG at some point to get standardisation, but that hasn't happened yet and it isn't much of a priority, and I expect it will take quite a while to get it sorted out.

(I've done some work with pseudo-3D in the 2D canvas, which is kind of slow, so I'm quite interested in how it's going to progress in the future.)

Dude. CANVAS. Hello?

Microsoft pulled the wool over your eyes. They were showing you a DOM app that needed to modify the rendering tree in order to make a move. This is similar to a 3D Scene Graph, but without the hardware acceleration. When Microsoft showed you the Silverlight app, they were showing you a hardware-accelerated drawing program. The very purpose for which Canvas was created.

As for the AI speed (assuming that the performance issues weren't entirely being caused by the DOM manipulations), Silverlight still uses Javascript for scripting. If it can run so much faster in their CLR scripting why don't they use their new Javascript engine in Internet Explorer?

In case you think I'm joking, that is exactly what Mozilla is doing with their new Tamarin engine. The new engine is faster and more feature rich, ergo it's being integrated into the browser platform. To make matters even more interesting, Mozilla and Adobe are sharing the development of the engine, so that they can both use it. Mozilla in the browser, Adobe in Flash.

I'm sorry. Microsoft is pulling a fast one on you. There is no need for Silverlight other than to lock you into Microsoft technology.

'More important than the source code is an Open Format .. Flash is a proprietary, binary format and the Specification [adobe.com] forbids you from building an alternative player'

According to this Adobe is releasing Flex under the Mozilla Public License (MPL) which states:

'The Initial Developer hereby grants You a world-wide, royalty-free, non-exclusive license .. to make, have made, use, practice, sell, and offer for sale, and/or otherwise dispose of the Original Code'

How is 'Open Format' defined in the current context and do you have a citation for the Silverlight license.

was Re:Xaml v/s Flex, Format is the key

https://addons.mozilla.org/

"The web site addons.mozilla.org supports authentication for the page you are viewing. The identity of this web site has been verified by XRamp Security Services Inc, a certificate authority you trust for this purpose"

Well, the description of your history is correct in that, that when Cacert wanted inclusion at Mozilla, all alarm bells came on...So far so good.

But the Mozilla CA policy exists in some form since beginning of 2005 at the web site of Frank Hecker (President of the Mozilla Foundation). That was about when StartCom started its own authority. Since then many CAs were included and processed at Mozilla (See history), based on that policy, the very same policy which was eventually approved my Mozilla.

Therefore what I meant is, that already for over two years, Cacert could have been included - the very same way StartCom was. More than that, the Mozilla policy was created and defined in a way, which made it possible for Cacert and StartCom to comply.

However, I think that there are some real problems with community projects in order to have them comply even to the most basic requirements of CAs. This is one of the reasons, why I personally don't believe in the current structure of Cacert to be ever successful - even if it's a nice idea.

There was no such promise

https://bugzilla.mozilla.org/show_bug.cgi?id=21524 3#c164

Pasting for those to lazy to follow the link.

Rich Freeman wrote:
>
> It just seems like as an organization we [The Mozilla Foundation]
> should be trying to foster open source projects.

Whoa, there. I'd just like to point out that CaCert is not an open source
project in any sense of the term. It uses open source software *internally* to
provide a free (as in beer) service, but CaCert distributes no free (as in
*freedom*) software, and no software that could even remotely be considered
open source. Just the opposite in fact, see the license here, on their site:
http://www.cacert.org/src-lic.php

It clearly states that you:
1. may NOT modify the source code [...]
2. may NOT make copies of the source code [...]
3. may NOT give, sell, loan, distribute, or transfer the source code files
to anyone else, an, my favorite:
4. may NOT use [CaCert] software created for any purpose or reason other than
verifying that there are no unknown vulnerabilities or the like or otherwise
making your own assessment of the integrity of the source code and the security
features of the CaCert software

Furthermore, below it goes on: "All rights not expressly granted to you
[editorial comment: which would be "none"] in these license terms are reserved
by CAcert. CaCert retains ownership of all copyrights and other intellectual
property rights throughout the world in the CAcert source code and software.
You agree that CAcert will be given a perpetual non-exclusive rights to any and
all derived code, and you hereby assign rights in any modifications you make to
the source code and in any bug reports you submit to CAcert."

This just may be the single most disgusting and ill-advised hybrid software
license I have ever read. The author apparently seeks to keep the software
100% proprietary, guarding it from "competitors", and protecting potential
future licensing revenue, while simultaneously benefiting from the efforts the
open source developer community to fix its bugs, and attest that it is not
malware, for free.

Although I wrote an impassioned comment (#12 above, of 161 so far!)
https://bugzilla.mozilla.org/show_bug.cgi?id=21524 3#c12 in *support* of
CaCaert, uh, 4 years ago now, and was a CaCert user and Assurer, I discontinued
my involvement because the source code was released by the founder only months
later, after much prompting and delay, and when it was finally unveiled, these
onerous licensing restrictions were "slipped in" with zero community
discussion.

When I asked why the code was not made open source, the founder described his
perceived threat that if it was made open source, then other free CA's would
start popping up out of nowhere to run our code and to compete with CaCert and
he felt that this would decrease CaCert's chances of getting its root cert into
Mozilla, and then IE.

This seemed a paranoid and protectionist attitude and I've no longer
participated in the Assurer program or the CaCert community since, though I
have monitored the mailing lists. After the founder's recently announced
resignation, perhaps the new board of directors (or whatever governing body
structure they adopt) will revisit this anti-competitive, closed source
position.

I had though a free CA would be a good thing, and if one is good, then two is
better, and hundred would be fantastic! So if they all *do* pop up, and share
code and development effort, I believe that all will benefit and perhaps,
someday, all will be accepted by all the browsers, and Verisign and the sma

https://bugzilla.mozilla.org/show_bug.cgi?id=21524 3#c164

Pasting for those to lazy to follow the link.

Rich Freeman wrote:
>
> It just seems like as an organization we [The Mozilla Foundation]
> should be trying to foster open source projects.

Whoa, there. I'd just like to point out that CaCert is not an open source
project in any sense of the term. It uses open source software *internally* to
provide a free (as in beer) service, but CaCert distributes no free (as in
*freedom*) software, and no software that could even remotely be considered
open source. Just the opposite in fact, see the license here, on their site:
http://www.cacert.org/src-lic.php

It clearly states that you:
1. may NOT modify the source code [...]
2. may NOT make copies of the source code [...]
3. may NOT give, sell, loan, distribute, or transfer the source code files
to anyone else, an, my favorite:
4. may NOT use [CaCert] software created for any purpose or reason other than
verifying that there are no unknown vulnerabilities or the like or otherwise
making your own assessment of the integrity of the source code and the security
features of the CaCert software

Furthermore, below it goes on: "All rights not expressly granted to you
[editorial comment: which would be "none"] in these license terms are reserved
by CAcert. CaCert retains ownership of all copyrights and other intellectual
property rights throughout the world in the CAcert source code and software.
You agree that CAcert will be given a perpetual non-exclusive rights to any and
all derived code, and you hereby assign rights in any modifications you make to
the source code and in any bug reports you submit to CAcert."

This just may be the single most disgusting and ill-advised hybrid software
license I have ever read. The author apparently seeks to keep the software
100% proprietary, guarding it from "competitors", and protecting potential
future licensing revenue, while simultaneously benefiting from the efforts the
open source developer community to fix its bugs, and attest that it is not
malware, for free.

Although I wrote an impassioned comment (#12 above, of 161 so far!)
https://bugzilla.mozilla.org/show_bug.cgi?id=21524 3#c12 in *support* of
CaCaert, uh, 4 years ago now, and was a CaCert user and Assurer, I discontinued
my involvement because the source code was released by the founder only months
later, after much prompting and delay, and when it was finally unveiled, these
onerous licensing restrictions were "slipped in" with zero community
discussion.

When I asked why the code was not made open source, the founder described his
perceived threat that if it was made open source, then other free CA's would
start popping up out of nowhere to run our code and to compete with CaCert and
he felt that this would decrease CaCert's chances of getting its root cert into
Mozilla, and then IE.

This seemed a paranoid and protectionist attitude and I've no longer
participated in the Assurer program or the CaCert community since, though I
have monitored the mailing lists. After the founder's recently announced
resignation, perhaps the new board of directors (or whatever governing body
structure they adopt) will revisit this anti-competitive, closed source
position.

I had though a free CA would be a good thing, and if one is good, then two is
better, and hundred would be fantastic! So if they all *do* pop up, and share
code and development effort, I believe that all will benefit and perhaps,
someday, all will be accepted by all the browsers, and Verisign and the sma

Should this community be related to the Mozilla Foundation and comply, since day one, with the requirements to get a root certificate in Firefox?

Mozilla has an open policy. The problem is not Mozilla, but as in your suggestion Cacert, which in four years time failed to comply to the policy of Mozilla.

However there are essential problems running a CA by volunteers - which one of the reasons why there isn't any such volunteer CA supported by major software vendors.

Should this community be related to the Mozilla Foundation and comply, since day one, with the requirements to get a root certificate in Firefox?

Should this community be related to the Mozilla Foundation and comply, since day one, with the requirements to get a root certificate in Firefox?

I followed this thread, while becoming an assurer for CA cert.
Long read, but worth it to understand the complexities in getting "trusted".

Essentailly theres a lot of hoops to jump through and at 1st glance seems excessive. But in reality it's necessary to keep the system from becoming redundant.

https://bugzilla.mozilla.org/show_bug.cgi?id=21524 3

Took you folks 20 years to get to pre-emptive multitasking. Don't think you've really got much room to be calling everyone else "filthy."

Also, you've apparently not heard of Gran Paradiso, which is a rebuild of Firefox from the ground up to use native Cocoa interfaces, or Camino, for that matter.

You're losing, numbnuts. Time for all you and all your cutting friends to bail out of Apple and move on to Amiga.

"Lightning is a fairly new development. Its first public release was in early 2006. However, being based off of the same backend code as Mozilla Sunbird(TM), it is maturing quickly"

It got some positive press recently, does it work? Is anyone using it?

http://www.mozilla.org/projects/calendar/lightning /

Adobe's open source efforts aren't all talk. They have been quite reasonable at shepherding PDF as an open standard. Also, they have recently open-sourced a JIT engine for JavaScript which Mozilla is adopting for Mozilla 2 (and thus, likely, Firefox 4). In addition to better performance, this could result in better compatibility between Flash's ActionScript and Firefox's JavaScript in the future.

It's true that we'll probably never see open-source Flash from Adobe. But I don't think it's fair to compare Adobe's attitudes toward open source to Microsoft.

Or Folder Account,which does something similar but is more intuitive for me. But then again, I am the author.

Zimbra is a nice collaboration server with (web-based) email and calendaring. It's written in Java and has AJAX. I'm not sure how important it is to you to modify the calendar at the application level, but I'm sure you can at least export a (read-only) iCal feed from Zimbra.

Sunbird's goal is to support reading and writing of iCal via CalDAV, but Sunbird is very immature and highly unstable.

I haven't used these, but with Exchange server clones like Open-Xchange, you should be able to use Outlook. Not sure what Web interfaces they export, or what Web-based Exchange calendaring clients exist.

Of course, make sure you didn't dismiss Google Calendar prematurely. This should suffice if you don't need too many bells/whistles, and it relieves you of many burdens. If you really want an application to use, you can use CalGoo, but this (very early-in-development) program has always been excrutiatingly slow for me (and I tried their latest beta draft).

You must be thinking of this one:

CustomizeGoogle https://addons.mozilla.org/en-US/firefox/addon/743

Display Quota

I've been using Camino, but I miss some Firefox features (which I use at work on Windows XP), so I tried switching to FF at home and the first thing I noticed is that Firefox can't maximize a window properly:

https://bugzilla.mozilla.org/show_bug.cgi?id=37870 1

Sigh. If FF can't properly implement one of the basic window operations available, it doesn't give me a lot of hope that they've really looked at it.

FF doesn't integrate well with OSX, but just get the "SwitchProxy" Extension. It allows you to easily have numerous proxies and switch between them.

https://addons.mozilla.org/en-US/firefox/addon/125

This bug has been there since Firefox 1.0. It's been in the bugzilla database for mozilla, item 306276 since August of 2005, and is marked "critical".

As someone who uses Firefox on the mac about 14 hours/day, it is far and away the most annoying part of the experience, because all the other issues can be worked around. With this bug you simply need to keep dragging your window over and over until Firefox lets it stay where it is (it seems to have something to do with other windows actively refreshing at the time). It frequently takes me 4 or 5 sequential efforts to move a window where I want it.

Lots of users are working on trying to make a perfect test case - the bug annotations get a new note at least once a week - but AFAICT no coders are actively working on solving it. If you have the skills to work on this problem (I don't), please join the team and contribute.

Don't forget google calendar provider either. Still not complete either, but definately worth it(you need lightning!). Now I can add stuff from tbird and google calendar shows it (shared calendar for vacations to let clients + friends know) as well as we use it for todo lists and other stuff(shared calendars) that really help us out. Not that the google calendar interface is bad, it's just more convenient sometimes to not have to leave the email client to do it.

I know this is a poor substitute, but you can edit your userChrome.css file to change the size of Firefox's search bar.

Slideshow is extremely useful for people who get a lot of pictures via email, and just want to look at them quickly.

I believe you're referring to using GCALDaemon. I followed the article at http://www.linux.com/article.pl?sid=07/02/14/15222 7 last night and things work pretty well.

I believe you're referring to using GCALDaemon. I followed the article at http://www.linux.com/article.pl?sid=07/02/14/15222 7 last night and things work pretty well.

One word: FoxMarks https://addons.mozilla.org/en-US/firefox/addon/241 0 One of the best plugin's ever for people with multiple pc's. Syncs everytime you add or remove a bookmark, and close/open ffx.

I uses Leetkey with Thunderbird for news reading in forums that use ROT13 frequently.

Since Firefox 3 and SeaMonkey 1.5 (and probably Thunderbird, too) will be based on XULRunner, this problem should be solved by then.

I love the Ctrl+L shortcut that gives focus to the address bar.

I have yet to see a browser for which F6 does not provide the same functionality. Mozilla's Firefox Keyboard Shortcut page doesn't even mention it. Granted you won't find the 'gg' or 'wiki' pseudo-commands in, say, IE, but F6 still does its job. As for the search bar, I'm not sure if there is a shortcut to get into there directly, but I do know you can tab into it once you have the focus in the address bar. This assumes, probably, that you don't have any other input field between the address and search bars in the toolbar. The Firefox help page does mention that Ctrl+Up and Ctrl+Down will let you cycle through the search engines, too.

Presumably the current version of autorewrap is disabled in Thunderbird 2.0 because the maxversion setting in the .xpi file is set to only allow it to run in Thunderbird 1.5.x. You can use the "MR Tech's Local Install" extension to force other extensions to essentially ignore that setting. This works in both Thunderbird & Firefox.

https://addons.mozilla.org/firefox/421/
http://www.mrtech.com/extensions/local_install/

- ozz

Go here.

https://addons.mozilla.org/en-US/firefox/addon/465 0

  or

http://disruptive-innovations.com/products/index.h tml

Scroll Down.

Install on thine Mac...Does it work?

The review says it has been tested on Win & Linux.
Lemme know if this works on a Mac.

Virtual Identity is essential if you, like many of us, maintain more addresses per inbox than can be conveniently managed via Thunderbirds's stock identity manager.

That is already being worked on and will probably make it into Firefox 3.

  https://bugzilla.mozilla.org/show_bug.cgi?id=16769