Slashdot Mirror

(Almost all) The banks over here use a kind of calculator device. You insert your pass into it. Your normal pass you use for withdrawal from ATM's....

Here is Luxembourg, banks are too cheap for handing out these calculator thingies. Instead they use a scratch-off plastic card with 16 alphanumeric digits on it. When logging in to their service, the site choses 2 (or some 3) positions out of the 16 possible, and you have to enter the corresponding digits.

This key is different every X seconds (I don't know the interval).

Well, here in Luxembourg, the "good" banks do it the same: the key (in our case: choice of scratch card numbers) is valid a set amount of time. However, some of the (less technically savy banks) propose you a different choice of digits each time you hit reload... so a thief who has sniffed some numbers (but not all) can just keep on hitting reload until the bank asks for numbers that he has... not good!

If you want to transfer money, you get another screen. You have to insert the number shown on the screen into the device. After you hit 'OK', another number is shown on the device, you type this in the inputbox of the website. After it is verified, the transfer will be processed.

Our banks do not have this additional security yet... (Apart from maybe Cortal-Consors. I know their German operation has such a system).

This is all done on HTTPS...

In Luxembourg too. No bank is foolish enough to use plain http. and works with most browsers.

Unfortunately, this is not the case in Luxembourg (although some progress was made over the course of last year).

The currently worst offenders have a gateway page which features a Rube-Goldberg like chain of Java Applets, Java Script code, and VB code which only works on Internet Explorer (the Java Applet is MS proprietary java (using the proprietary com.ms.util.SystemVersionManager class...). The output of this is fed, via the VB script, and then the Javascript (!) into a second URL, which gives you access to the Web application itself. Interestingly enough, once that gate is passed, there is no further dependancy on MS-ware, and you can cheat yourself access to the contents (graphs of their mutual funds) by entering that second URL manually.

For their homebanking they have the same "proprietary applet" hack, and in addition a server-implemented browser check. Manually enter the JVM=1 bit into the URL, and fake an Internet Exploder User Agent and you are in! What the hell are they thinking?

I believe this is one of the most secure methods I can imagine. It is not flawless maybe, but it works and there is much needed to hijack information from the sessions. Without the device, the pass and the account number one can do nothing. Without the PIN you still go nowhere....

Indeed, the number generated by the device makes it secure even against keystroke loggers that may be installed (but don't challenge your luck either...)

While I understand your point, I'd like to point out that Trillian isn't open source.

On a side note, K-Meleon and Trillian aren't cross-platform. I consistently put my friends and family on Firefox, Thunderbird, and Gaim, so that when they eventually move to Linux (an inevitability, I think, barring an Apple-based purchase), they'll be well-acquainted with the applications they'll use most.

Thunderbird 1.0.2 has been out for a while now, but the only language its currently available in, is English. Firefox 1.0.2 has allready been translated to most languages, but i'm still waiting for the new dutch Thunderbird :-( see for yourselves: Thunderbird languages page. and Firefox languages page.

Thunderbird 1.0.2 has been out for a while now, but the only language its currently available in, is English. Firefox 1.0.2 has allready been translated to most languages, but i'm still waiting for the new dutch Thunderbird :-( see for yourselves: Thunderbird languages page. and Firefox languages page.

Yep, this shouldn't really be happening, and there appears this appears to be already logged in Bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=24788 4 (remember you need to copy and paste that URL into a new tab kiddies as Bugzilla will 'disable' the request from Slashdot)

I'm still amazed at the awesomeness of Mozilla/FireFox's communications regarding bugs.

The bug they fixed now shows it again. I mean, look at the bugzilla entry for it:

https://bugzilla.mozilla.org/show_bug.cgi?id=28559 5

It's fast, no bullshit and to the point. I love being able to look inside this whole process. I wonder how things fare with regards to these kinds of bugs in the UberCorps.

did not work on my mac. still best to get it from the ftp site for me:

here

The "update" downloaded fine for me... but all it does it download the complete 1.0.2 installer and run that! You might as well just download that from here, and then *uninstall* your existing version before you install the new one. No biggie if you don't uninstall first, but you'll end up with the older version still in the Windows Add/remove programs list.

Actually, from what I gather, all you need to do is look at a special GIF image, and voila, your computer will execute any code embedded in the image. This vulnerability went public 13 days ago. I am unaware of this actually being exploited in the wild. See here and here.

Actually, from what I gather, all you need to do is look at a special GIF image, and voila, your computer will execute any code embedded in the image. This vulnerability went public 13 days ago. I am unaware of this actually being exploited in the wild. See here and here.

A while ago I had the chance to talk with a Chatzilla developper on irc, and he said the lack of progress on Chatzilla could be attributed to the fact XULRunner wasn't yet released (at the time) and that they were waiting for it.

XULRunner description :

XULRunner is a single installable package that can be used to bootstrap multiple XUL+XPCOM applications that are as rich as Firefox and Thunderbird. [http://wiki.mozilla.org/XUL:Home_Page]

I don't know in what state the app currently is, but I was told it would greatly simiplify the packaging of Chatzilla, similarly to ffx.

Is it just me, or is 'Mitchell' supposed to be 'Michelle'?

No.

Mitchell is the general troubleshooter, spokesperson and policy arbitrator for mozilla.org. She works extensively with companies and projects using Mozilla. . . .

to the first freemail provider who codes a XUL interface for its webmail. Meanwhile, i'll stick with my IMAP and POP3 accounts.

I grabbed today's build and couldn't find anything in the preferences to configure the middle button. The Mozilla build works but not Firefox.

Is Firefox more secure than Internet Explorer?

Yes, Firefox and all other Mozilla-based products are more secure. Why? Here is a list of the most important reasons:

* It is not integrated with Windows, which helps prevent viruses and hackers from causing damage if they somehow manage to compromise Firefox.
* There is no support for VBScript and ActiveX, two technologies which are the reasons for many IE security holes.
* No spyware/adware software can automatically install in Firefox just by visiting a web site.
* Firefox doesn't use Microsoft's Java VM, which has a history of more flaws than other Java VMs.
* You have complete control over cookies.

It's a Gecko bug, which has been fixed and will be included in Firefox 1.1. The fact that it's a Gecko bug is proven by the fact that ctrl+plus / ctrl+minus fixes it - if it were an HTML problem, it would display the same after changing font size.

Also note that Slashdot works fine with Opera and KHTML-based browsers.

Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=21752 7
Note that bugzilla blocks slashdot referrers.

"So why write an entire browser instead of adding native widgets to the Mac port of Firefox?"

Where's the mac version?

There is no mac version. While Phoenix could be made to run on Mac without much trouble, we see no point in competing with Chimera. Chimera is the lightweight, standalone Mozilla browser solution for Mac OS X. We have received requests for a Mac classic version, and are considering the idea.

"So why write an entire browser instead of adding native widgets to the Mac port of Firefox?"

Where's the mac version?

There is no mac version. While Phoenix could be made to run on Mac without much trouble, we see no point in competing with Chimera. Chimera is the lightweight, standalone Mozilla browser solution for Mac OS X. We have received requests for a Mac classic version, and are considering the idea.

Any word on the progress to fix these [popups]? It's not just Firefox;...

Well, for Firefox and Mozilla, type "about:config" in the address bar, right click in the main window, new integer. Name it "privacy.popups.disable_from_plugins" and set the integer value to 2. It will reduce popups, especially if you have flash.

These hidden preferences for FireFox are fantastic... and one of the Mozilla developers documented them fully. He also created an extension to show them in the GUI.

Sounds nice, why don't you put it on update.mozilla.org, so more people will become aware of this extension.
I'm personally using the "Bookmarks Synchronizer" Extension available here.
It allows you to syncronize your bookmarks with your own FTP server or WebDav account.

I tried Portable Firefox, but since I'm using Firefox on (at least) 3 different operating systems and I can install extensions on all of them it's much easier with this plugin.

However, bookmark synchronizer does work with firefox 1.0 and above, and is updated regularly, and is generally pretty neat. Bookark Synchronizer

from the portable firefox page
File / Directories Created - A directory (%userprofile%\Application Data\Mozilla\Firefox) is created on the
local machine (if Firefox is not installed locally) and a pluginreg.dat file is created within it. A Talkback directory
is also created. (this is a limitation of Firefox, see Bug 272983)

well that sort of negates the whole point really, apps should be self contained, not touch the registry or create anything on the hard drive
lets hope the FF dev team will fix that bug because while it exists it ruins the whole idea of USB apps

win developers please dont use the registry, just use an .ini file and keep everything in a folder, iam sick of seeing spurious remnants of applications littered all around my windows/system32 and windows directories and other locations like %APPDATA% and X:\program files/common files/

just keep it in a single folder like Mac's try to do (although macs often suffer the same thing but in the preferences directory

I mean, even the "freecreditreports.com" is a scam that is not free. Duh, why would they pay for an ad on TV for free stuff?

Yes, it is not like free stuff has ads.

Kjella

He was asserting that what matters was the "whole Mozilla Project", though -- I was trying to justify that the Suite is soon not really going to be a part of that.

There is an extension that you can use as well called Adblock--second most popular on the official site. In fact, it is my opinion that customization of extensions (and themes) contribute greatly to the popularity of Firefox. Also, with some manual tweaks (not found in that program), it is the fastest browser I've ever used--slashdot fully loads uncached in less than 2 seconds and I'd probably get it even faster if I had a better computer.

First of all, bad rendering is not always the case and even when it is it's easily fixed with combination of ctrl++ and ctr+- key strokes. Secondly as someone who follows FF development I can assure you that this bug has been fixed on a trunk long time ago and nightly build users must have alread forgotten about this rendering issue. see bug 217527 for more information.

"Now, it's a shame firefox doesn't come with a handy-dandy MSI file"

Well, the latest trunk builds do. Obviously, a corporate or university (or other large-scale deployment setting) woudln't want to roll out a development build, but I would think that we can see official MSI's for the next point release.

User Agent Switcher works nicely. :) It did in this case anyhow. (At least as far as I tested.)

Actually, there are a number of 3rd party msi's floating around the net, but for official msi support, bug 231062 is the one to watch:

https://bugzilla.mozilla.org/show_bug.cgi?id=23106 2

(You'll have to copy/paste that link, bugzilla frowns on slashdot referrers)

What does this mean for Minimo (Mozilla's mini-browser that was funded/supported by Nokia)?

No idea.

It's been less than a year since they announced their financial support for the project,.

The funding actually started in 2003, though.

I know the mozilla foundation released a few early versions for Windows CE/Pocket, but I haven't heard anything about the mobile phone version.

Windows on Pocket PC (Windows Mobile for Pocket PC) is basically the same as Windows on mobiles (Windows Mobile for Smartphone). So it already works on phones.

I wouldn't be worried too much about Minimo going away. The Mozilla Foundation hired Doug Turner away from AOL (formerly Netscape) last December to work on it full time. The Minimo project site has been update recently too and is worth a quick browse if you're interested in the current state of things.

What does this mean for Minimo (Mozilla's mini-browser that was funded/supported by Nokia)?

No idea.

It's been less than a year since they announced their financial support for the project,.

The funding actually started in 2003, though.

I know the mozilla foundation released a few early versions for Windows CE/Pocket, but I haven't heard anything about the mobile phone version.

Windows on Pocket PC (Windows Mobile for Pocket PC) is basically the same as Windows on mobiles (Windows Mobile for Smartphone). So it already works on phones.

I wouldn't be worried too much about Minimo going away. The Mozilla Foundation hired Doug Turner away from AOL (formerly Netscape) last December to work on it full time. The Minimo project site has been update recently too and is worth a quick browse if you're interested in the current state of things.

Until Minimo 1.0 is released ;)

What does this mean for Minimo (Mozilla's mini-browser that was funded/supported by Nokia)? It's been less than a year since they announced their financial support for the project,. I know the mozilla foundation released a few early versions for Windows CE/Pocket, but I haven't heard anything about the mobile phone version.

What makes it really bad though is that it does exactly what Mozilla tells you not to do:

Prior to installing Firefox 1.0.1, please ensure that the directory you've chosen to install into is clean and doesn't contain any previous Firefox installations.

Well, first of all, I'd call Windows XP SP2 their latest release.

Well then, if you are going to count minor versions of the same release, then the latest update to Debian 3.0 was released on January 1st, 2005! Call it "Service Pack 4" if you like, we call it Debian GNU/Linux 3.0r4.

Running a 2002 release of Windows XP doesn't prevent you from installing the lastest version of Mozilla, Firefox or . The version of Mozilla in Debian stable is currently 1.0.0, and Firefox isn't even there!

Get real! Do you install Mozilla, Firefox, etc from WindowsUpdate.com? I think not! Nothing stops you installing the above mentioned software on either Debian "stable" or Windows XP. As with Windows, Debian "stable" users can download it from mozilla.org or other 3rd party sites.

Windows Installer (MSI) packages will be availible with versions 1.1. These make it possible to do enterprise wide installs.

These are currently availible on the trunk builds if you want to test them out
firefox-1.0+.en-US.win32.installer.msi

One of the goals of Perl 6 is to make non-trivial projects possible. That's good. The way it's being done is bad. Perl was once a lightweight, extremely flexible language. Now it's become a huge ugly monster. People wanted OO, so a nasty hack was bolted on top to allow some semblance of it. Now this nasty hack is being expanded. Sure, the code's different, but the basic form is the same. Kludge upon kludge upon kludge; I'd much rather have a nice, clean, pure language (and not one with loads of irritating whitespace thank you very much).

The same goes for the syntax. All the switching between $, @ and % is really irritating (ask a newbie how to get at the length of the keys array of a hash inside a hash, for example), and the changes proposed for 6 are just making this worse -- it seems that Larry, in his infinite wisdom, wants to prefix every data type with a different hard-to-type character. Perl was only designed for the three data types, and adding more is a mess.

Perl 6 is a complete rewrite, but it keeps all the mess which has accumulated over the previous versions. This is not good. Sure, my const int $var = 27; may look neat (in the same way that, say, Pascal does), but $var isn't entirely constant, or entirely an integer, it's just a hack which makes it sort of behave like one. It's like Ada all over again! The whole thing is an exercise in pseudo-computer science masturbation with little real purpose except to please the managers who dislike the one thing that makes Perl special.

On a similar note is regexes. I'm an avid fan of regular expressions simply because a nondeterministic finite automata is far more flexible than linear code. However, Larry must have been smoking that cheap $2 crack when he wrote this. Does he want Perl 6 to be flex or something?

I won't be going on to use 6. It's a nice idea, but it's completely unnecessary. It won't make large projects any easier to manage (the language is still, at heart, an almighty hack -- an impressive one, but still a hack). It won't make OO any cleaner. It won't make development any faster. I'd prefer to use a language which has always been pure synthesis of science and engineering, not some half-baked imposter.

Perl 6 will be nice, but I'm guessing it will be the end of Perl. It can't do what it wants to do whilst still being based upon a nasty mess. There are now other options, which provide all of Perl's power and none of the mess. Sorry, but *BSD^H^H^H^H Perl is dying.

> There is none.

Actually, there is. The W3C offering is XForms, which is indeed being implemented in Firefox. Together with CSS, it's quite powerful.

If google really want to do what described in this article, word processor, a spreadsheet app, a photo editor, an instant messenger, a browser, a music jukebox, and any other "software application" running inside a Web framework , a new way of communication is need. Those protocols used today like Asynchronous JavaScript + XML, combines JavaScript, dynamic HTML, and XMLHTTP are too complicated.

Developers need something simpler and bolder to work efficiently.

And a new IDE is needed also, nvu + venkman is far from enough.

What, you run vi in a terminal window, that's more than enough, I think.

But when you install IE Tab Extensions, it has the same level of functionality as Firefox with Tabbrowswer. WTF? Let's compare vanilla installs of IE to Firefox, here. Anything is possible with add-ons.

Yeah, because we all konw how many decent add-ons IE has...

Come on. One of FF's biggest selling points, at least to myself, is the idea that there are so many new little extensions developed for it all the time. Many of the extensions aren't reallly that good, but personally, I've really gotten used to Tabbrower Preferences and FoxyTunes.

But when you install IE Tab Extensions, it has the same level of functionality as Firefox with Tabbrowswer. WTF? Let's compare vanilla installs of IE to Firefox, here. Anything is possible with add-ons.

Yeah, because we all konw how many decent add-ons IE has...

Come on. One of FF's biggest selling points, at least to myself, is the idea that there are so many new little extensions developed for it all the time. Many of the extensions aren't reallly that good, but personally, I've really gotten used to Tabbrower Preferences and FoxyTunes.

The fact that the roadmap mentions Gecko 1.8 and doesn't mention Mozilla 1.8 anywhere isn't enough of a clue? And the fact that the Mozilla Application Suite - Transition Plan explictly states that there will be no Mozilla 1.8 release is not enough of a hint for you?

Hello Mitchell, Good idea to leverage /. for community input. My main question, as you may guess with my interest in the webclient project, is: what is the future of the embedding api an the Gecko Runtime Environment? Lots of people are embedding Gecko (and a few of them are doing so with webclient). Can we count on these APIs being supported going forward? Ed

I think that's what Xul Runner is all about. It includes not only Gecko, but other core technologies as well, such as networking, XUL, SVG, etc.

Someone has made a calendar extention to Firefox/Thunderbird, but Mozilla is still making Sunbird. Someone has made an extension to edit html, but we're still asking about composer.

So, I'm not complaining, and it's not as though I can't find a calendar or HTML editor or chat program. Still, I'm curious about whether there are other apps in the pipeline.

IMO the roadmap doesn't make it clear enough that the 1.8 and 1.9 releases shown are platform releases and not suite releases. Unless you follow moz development religiously (I don't) it's not very clear from the roadmap.

Also the roadmap reads much like the king james edition of the bible, it contradicts itself everywhere. At the top:

The new, significant roadmap update hoped for early in 2004 has been postponed. See Brendan's roadmap blog for thoughts that may feed into it. An interim roadmap update focused on the "aviary 1.0" releases of Firefox 1.0 and Thunderbird 1.0, and the 1.8 milestone that will follow, is coming soon.

... which makes one think 1.8 (the suite) is forthcoming. Then a little further down:

Updated: Continue to perform sustaining maintenance, including security updates, on the SeaMonkey application suite's final stable branch (1.7.x) for enterprises and other organizations with large existing Mozilla deployments.

... ah, this must be gospel. No more suite releases. But wait, a little further down:

We are not retiring the SeaMonkey application suite, or its XPFE front end, in the foreseeable future.

Emphasis mine. Is it any wonder people are confused and angry?

Sorry, I meant to say that it was answered in the documents linked to from her blog, especially this ("We probably won't use the same naming conventions, as we need to be clear that this is not a Mozilla Foundation product release"), and this, which has release plans and project planning info, and notes in several places that the naming and versioning will change.

Sorry for the tone of my previous post.

Sorry, I meant to say that it was answered in the documents linked to from her blog, especially this ("We probably won't use the same naming conventions, as we need to be clear that this is not a Mozilla Foundation product release"), and this, which has release plans and project planning info, and notes in several places that the naming and versioning will change.

Sorry for the tone of my previous post.

Please see here.

Shouldn't the Firefox team be more concerned about crashes? These two ABC news stories, Chavez: Low Oil Rates a Thing of the Past and Blair's Anti-Terrorism Law Wins Approval, for example, crash the latest version of Firefox (1.01) every time. The crashes have been known and fixed for 6 months (Copy and paste the URL, Bugzilla does not accept links from Slashdot.). They have been fixed in the recent developer builds (see bottom of page), but you are warned that recent builds may have other bugs. Shouldn't the developers of a program with "more than 25 million" users release crash fixes quickly or at least warn users?

More reports from users, sometimes imperfect, with minimal editing for clarity:

http://developers.slashdot.org/comments.pl?sid=141 586&cid=11864609 "The last few releases have a habit of freezing up in various ways. It's not something that happens every day, but it happens a lot more than it used to."

http://developers.slashdot.org/comments.pl?sid=141 586&cid=11865831 "... firefox DOES NOT let other applications that need it [memory] get it back. it [Firefox] routinely crawls the machine to a halt until it's killed and restarted."

http://developers.slashdot.org/comments.pl?sid=141 586&cid=11866690 "[Firefox] really shouldn't use as much memory as it does, and it shouldn't have the memory retention policy that it does either. The amount of memory that it uses does matter, because it completely fragments the heap, it pushes the address space of other programs to disk, and it performs... [badly] after you've used another program that requires a lot of memory.

http://slashdot.org/comments.pl?sid=141586&cid=118 68266 "basically after using firefox heavily for a while (many tabs open and closed, often on complex pages) firefox will start eating 100% CPU and become slow as molasses and never recover."

http://slashdot.org/comments.pl?sid=141586&cid=118 75707 "I have found that if I load a PDF document and then use 'Back' to back up to the page which had the link pointing to the pdf document that Firefox crashes. Eventually, the adobe reader process also crashes."

http://slashdot.org/comments.pl?sid=141586&cid=118 63855 "I'm on a Mac, so it tends to only actually crash when it's loaded down and I hit a bad flash or java applet"

http://slashdot.org/comments.pl?sid=141586&cid=118 63924 "Usually though it [Firefox crash] happens after an extend period of time, without fail really, as my lone firefox window often stays open for days on end, so while my usage habits aren't much (compared to some at least) in the short term, in the long term the crashes have been making me wonder if a memory leak may be the cause, but sadly I lack the time to investigate it myself."

http://slashdot.org/comments.pl?sid=141586&cid=118 64110 "There are bugs that cause memory leaks and slowdowns, relating to plugins and Javascript. Any one of the page