Slashdot Mirror

If firefox wants to sell security, they need to appear secure.

That was his argument, alright. Appear secure. Sell security. Yep, that's what MS is doing, too - selling products that appear secure. They'll be selling Palladium next, too. Not that it would be a lot of help, but that's not the point, as it's pretty much meant to help their bottom line.

This is by now already redundant, but a signed binary is nothing to the average user. Heck, Verisign means nothing to the average user, either. They will happily check the "always trust" option for self-signed AX controls without wondering what it means.

On the other hand, if you do understand a little about security, you have the option of getting the (in this case win32) binary together with the .asc signature from ftp.mozilla.org, then get gpg, import the appropriate key from a public server, verify the signature and, if matching, run "Firefox Setup 1.0.exe" to install a verified, trusted version of the program.

I agree, however, that unsigned extensions don't seem trustworthy. However, until some peer review mechanism is adopted for "official extensions", this is again a rather moot point. Do you trust an extension that's signed by foo@bar.com? even if this is somehow endorsed by mozilla.org (key signing, etc.) how do you know that foo does follow at least minimal security practices? and so on. It all depends on your paranoia level. Luckily, with javascript extensions, at least some people have the time/interest to unpack it and pore over the code to make sure it isn't trojaned. For stuff like flash, you have to trust the vendor, which makes it about on the same level of 'security' as claria et al.

It's not quite what you describe but maybe it could be expanded.

What everyone seems to be missing is that Mozilla does sign their binaries.
They provide a GPG signature .
Sure, it is not from Microsoft's preferred partner, Verisign, but that does not change that fact that Moz signs their code with an accepted standard.
Not Microsoft's standard of choice to be sure, but still a standard.

Here's the Bugzilla link https://bugzilla.mozilla.org/show_bug.cgi?id=24875 1

I have already helped address part of the problem. I submitted a patch for signtool will allow developers to sign their extensions with a digital certificate. Signtool is part of the Network Security Services project. While the patch was submitted this summer the next version of NSS (3.10 which includes the patch) has yet to be released.

My own FireFox extension is signed by my employer's code signing certificate.
http://www.j-maxx.net/abtrans/abextension.php

Why not read the source code and complie it yourself????

Mozilla is (and has) been working on it. Unfortunately, trying to convert UI elements into anything remotely accessible is not an easy task. All things considered, though, I'd say they're doing a decent job.

And, speaking of which, it's impossible to actually follow the WAI guidelines on Slashdot, as it strips out the 'abbr' tag. Hopefully that will be added if and when it becomes standards-compliant. Or was that just a rumor?

http://ftp.mozilla.org/pub/mozilla.org/firefox/rel eases/

File a bug report if you don't like it.
Bugzilla

Actually the mozilla.org is taking big steps. The "engine" of Firefox has been greatly improved since the Firefox1.0 branch separate from main code chunk. Like mozilla1.8a5 and mozilla1.8a4. Or you can get information about how many bugs got fixed every day from mozillazine forum.

Overall, the mozilla is under heavy development, and no "comfort zone" for such an open source project.

Actually the mozilla.org is taking big steps. The "engine" of Firefox has been greatly improved since the Firefox1.0 branch separate from main code chunk. Like mozilla1.8a5 and mozilla1.8a4. Or you can get information about how many bugs got fixed every day from mozillazine forum.

Overall, the mozilla is under heavy development, and no "comfort zone" for such an open source project.

Word of mouth advertising is the best. With the NYT article, and "geeks" like us spreading the word about Firefox, more and more people are starting to use it.

Just the other day, I had a friend who couldn't go to any site on the net without IE crashing and the Send Report box coming up (does anyone actually send the reports??). Anyway, she was getting frustrated, so I pointed her to Firefox's download site. She downloaded it and now uses it exclusively. She loves the look and feel and says it seems much faster in rendering sites. I told her there may be a couple sites she will have to use IE for, but for the most part, Firefox will work.

She said she is going to tell her friends about it. As I said earlier, word of mouth advertising is the best way to get the word out....especially for people that aren't very knowledgeable technology wise.

I have been using 1.8a5 for a while now, it is very stable (1.8a1 screwed things up for me).

I do have a complaint about Moz Mail though, it wants to display my entire headers for emails, which are huge. I have kept the same profile so I don't know why this should change.

I prefer Mozilla over firefox, mostly I guess since I have used Mox since M13, and I am used to the way it works, such as shortcuts and the search bar.

I wish more extentions worked with Mozilla though.

--
Blog

I use that as well, it is from the Firefox Tips & Tricks.

Also a hint for using it, generally just typing something in will work. But if you want to search for something like "slashdot.org", you may have to use keyword:"slashdot.org" instead. Firefox will want to interpret it as a web address otherwise.

I still use the Mozilla suite over Firefox for one basic reason.

"Password manager" on Firefox is horrendously crippled. See bug here

This bug is a showstopper for me and countless others, but it continues to categorized as "minor". How odd.

_Am

Firefox search box resize tip.

I've just started up moz (it's been a while) and I'm surprised that they even bothered putting the extra search box in that isn't big enough and gets in the way.

I can't see how they though it was easier to use then a great big button with the word search written on it.

Having two possible text input boxes instead of one is a big step in the wrong direction.

someones already raised the bug and it got the usual , it hurts me head to think about this one, won't fix, should be an extension.

It is an extension. It works on all OS's. Get it here: tab extensions

Or if that doesnt work, just go to the firefox extensions place and look for it.

And please stop being so fucking annoying.

I hate the small size of the box I'm given to enter my search terms.

I haven't tried it myself, but there is an extention for Firefox which claims to let you resize the searchbox: https://addons.update.mozilla.org/extensions/morei nfo.php?application=firefox&id=349&vid=1245

That is the power of Firefox. It's much easier to add new features or "fix" things you don't like. No need to go hacking the sourcecode or re-compiling it!

Use this extension here to resize the google toolbar in FF(or any other toolbar for that matter). If you ever have a problem with FF there's a 99% chance someone else is having the same problem, and a pretty good chance someone has already developed a workaround.

Too many options have been removed from the preferences window in FF/TB. The new design isn't very usable for the more complicated tabs (such as Advanced).

It was probably done to make it easier for new users. I know my parents, for example, are intimidated by the options dialogue in IE or Mozilla/Netscape.

For us advanced users, there is always the about:config URL and some other extentions such as Tweak Network: https://addons.update.mozilla.org/extensions/morei nfo.php?application=firefox&id=327&vid=989 and others I can't find now.

You can get Nvu (I have it), but it's not the same thing. Nvu is more reaching up towards the Frontpage/Dreamweaver crowd (reaching because it ain't there yet). In Mozilla, I could just hit edit page and there it was. I found this especially useful for adjusting tables, especially when I used vi for PHP code editing.

I.e. Mozilla Composer is an integrated part of the Mozilla suite, which makes it convenient to use. Nvu (and Dreamweaver, which I also use) are not integrated parts of Firefox (unless someone has made an extension for this since I last looked).

cuneAform is another contentder for Composer replacement. However, the reviews say that it isn't ready yet. It is in the correct space though (a Composer replacement needs to be accessible as a Firefox extension).

Firefox seems to be designed as a very good replacement for IE. It is faster, safer and has more features, but it cannot do what Mozilla does. I have always viewed the Fireefox and Mozilla as being for different crowds. Firefox is for those who want a fast and simple browser, but don't need the ability to customize all the settings. Mozilla is for the power users who want to tweak every portion of their browser. I for one hope no one ever replaces Mozilla with Firefox, because although I like Firefox, I don't enjoy being restricted on what I can tweak. If you don't know what I am talking about, go download it here http://www.mozilla.org/products/mozilla1.x/ Then play with the preferences, you won't be able to miss the differences.

I think that the tabbrowser preferences extension does that and some other useful things. Search for it on http://update.mozilla.org/.

Nearly all of the 1.7.5 Mozilla Suite fixes are in Firefox 1.0. Firefox 1.0's code is Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0. This is a small upgrade for Mozilla 1.7 to reach Firefox 1.0 parity. Firefox v1.1 will be based on Mozilla 1.8 (currently at 1.8 alpha 5), and Mozilla 1.8 should be released first. I wouldn't say either one is ahead in terms of technology, since they share so much.

Whether we'll one day have a suite of applications replace the actual suite seems to vary month to month and depends on who you ask. Personally, I would've liked that as a goal for Mozilla's 2.0 release.



PS: Mozilla 1.8/Firefox 1.1 should have the new user stylesheet code to support a color override for it.slashdot.org!

I've been using the XmlHTTP stuff in IE for a while now, in the form of "Web Service Behaviors". MS makes it pretty easy to use, and gives you support for both synchronous and asynchronous web services calls from the browser. Pretty cool stuff.

Of course, being a good MS developer, one should always look into the issues you posted...

1. How secure is this? IOW, does it rely on anything at all other than JavaScript on the client side, or does it hook into the OS on some level? If it does, how well is it isolated from the more dangerous bits in the OS?

It relies on JAvascript and the Browser. The browser uses an activeX XmlHTTP object. This is used in the same process as the browser runs in.

The security hole that I know of is not going to be on the client. If anything there is a whole from client to server in the communication. If you are using HTTPS or a custom encryption to communicate it's probably not a big deal. The only other big deal is if you are using public web services and don't secure your WSDL. That in my mind is the biggest issue. The behavior needs to have a WSDL in order for it to set up a proxy. WSDL by nature means you can get a listing of all the methods and parameters that a web service uses. So.. don't put anything super secure on your web service that a browser is going to be talking directly to.

2. If it does require anything other than JS - even if it does only require JS - is it Windows only, or have our good friends at Microsoft realised why a goodly portion of the tech community is, ummm, hesitant to accept thier 'vision' of what computing should be?

If you do a little digging you'll see that remote web service calls from the browser are still a relatively "new" thing. There is no W3C standard as of yet. There are other browsers (Mozilla, etc.) that have a similar implementation. For now, it's just like everything else.. wait until a standard emerges and the next version of the browser (or service pack) will probably implement it along with some "extensions".

For non MS types, check out Mozillas verison.

Personally, I love the Tabbrowser Preferences Extension.
It adds a lot of options, lot of customizations, etc... everything you mentioned and more.

check it out!

Someone needs to make that into an extension

Never mention your competitor? I don't think competitor is quite the word here. IE vs. Firefox is not really a competition either. The reason Coke sells better than Pepsi is because people have tried both, and they think "I like Coke better." The reason 90% or so (the vast majority) of poeple use Internet Explorer isn't because they think "I tried both and weighing the featurs of each, I choose IE."

It's much more of a matter of people (A) not hearing about Firefox, and (B) not using it because they don't know how.
Both can easily be solved with a 5-minute download and 30 seconds of explaining "popup blocker" and "safe browsing".

Back to 'never mention your competitor in advertising' is usually a bad idea because:

1) It recognizes the competition, implies that they are viable competitors, and creates awareness of them.
2) It credits/merits the competition, almost suggests there's a reason to choose their product.

I really don't feel that either of the two apply here.

A) IE is very recognized. I don't think there is anyone that uses the internet that doesn't know what it is.
B) Nobody 'chooses' IE. It is spoon-fed to everyone and most people either don't know better or don't care.

C) "Implies your product won't/can't stand up on its own merits" --Well, in a way it can't. The biggest problem with other browsers is lack of awareness. If you don't represent Firefox as 'an alternative to IE' you will not be likely to influence anyone but attuned computer users.

D) As for "= you have LOST" -- Either that, or 'are losing' or 'are behind'. EVERY PC and Mac comes standard with IE, and EVERY PC has it currently installed. The vast majority of people who use the internet use IE. Firefox has a long way to go.

All in all, Firefox is the best browser available. If you don't believe me, then you probably don't have The AdBlock Extention installed. For now, yell as loud as you can, "INTERNET EXPLORER SUCKS, USE FIREFOX". Seems to work pretty well for me.

Let's look at past trends. Whenever Microsoft buys a company, they take its product, and over time, make it increasingly worse, or decreasingly better, depending on your point of view. Take speedisk, for example. Microsoft bought that and turned it into defrag... And it promptly turned into a piece of junk, in my opinion. (Well, this whole post is my opinion, but the last sentence was more so.)

The question I pose is this: Will this anti-spyware actually be effective anymore, or will it lose its effectiveness due to various reasons, such as:

• Since this is Microsoft we're talking about, it will probably be integrated into the OS kernel, or some other place where it doesn't belong. This means that it will be included with every copy of Windows. All the spyware makers have to do is figure out its weaknesses, and find ways to work around it. Voila... spyware will continue to get through.
• Due to the above, Microsoft will release patches. But knowing Microsoft, these will be few and far between.
• Since this spyware engine will be included with Windows, other spyware removal makers will simply go out of business, a la Netscape... Oh, wait.
• Even if Microsoft releases patches to stay ahead of the spyware makers, the latter parties will probably be more agile than Microsoft, to borrow a treasured piece of marketroidspeak. This means that they will release new spyware faster than Microsoft can release patches, a la virus authors being faster than McAfee and the like.

Therefore, the scope of this post greatly exceeds the specific problem of spyware, though it be a big problem, and addresses some of the larger issues surrounding the misconfiguration of Windows in its default install and the difficulty of reconfiguring it with saner settings.

But hey, I give 'em credit for trying.

Because:

• forms aren't that FUBAR'ed at reload
• statusbar-content isn't shared between tabs
• Doubleclick-marking of words doesn't mess up
• DHTML-animations are quick
• Soft hyphens don't result in weird marking of text
• gif animations doesn't suddently restart due to imagelib's single object-approach
• et cetera

I know that somebody will feel attacked and quickly riposte ("The statusbar-issue is only a problem, because Firefox has tabs, and IE doesn't even have tabs, besides *I* never visit sites using DHTML and silly animations, and I surf at textmode meaning that I never doubleclick, and animgifs are for lusers and who uses soft hyphens anyway"). If only people would put the same energy into bugfixing. I am encouraged to report bugs, yet I feel ridiculed when I post a bug report (e.g. #231123) with a simple test case and almost a year after it is still UNCONFIRMED.

I do have to admit that I feel further in the process than the times I have sent bugfixes to Microsoft regarding bugs in IE. But it's a pity if development of a browser is only good by comparing it to a poor browser.

I guess I'll stick with Firefox. At least 'till I get bored posting bug reports :) (though I must admit that Firefox emulates IE-bookmark-icon-randomness pretty well by dublicating icons at random - the issue was also present in Mozilla 1.7)

(Bugzilla-link might be copypasted to avoid referer)

Try browsing the code inside a browser. Start here: http://lxr.mozilla.org/seamonkey/source/dom/src/ba se/nsDOMClassInfo.cpp

...and if you download in the next 10 minutes, we'll throw in the kitchen sink too!

"Its why Omniweb was the mac OS X browser before safari came out, because it was the most maclike. I love firefox, but I used to hate using it on the mac because, to preserve cross-platform uniformity, it didn't *feel* like a mac app."

In which case, try out Camino. From the site (emphasis mine): "Camino? (formerly known as Chimera) is a web browser for Mac OS X that has a Cocoa user interface, and embeds the Gecko layout engine. It is intended to be a simple, small and fast browser for Mac OS X."

Try accessing the PDF they have available... http://www.mozilla.org/press/nytimes-firefox-final .pdf I found my name with no problems.

There are no ads on their homepage or within their product that generate income, so just how exact are they funding their project (and advertisement).

The ad was paid for by donations (~10,000 people raised ~$250,000). In general, the project is funded by donations (some from large companies like AOL and individuals like Mitch Kapor), income from the Mozilla Store and business deals (I'm not sure if they do yet, but they plan to get revenue from the searches they refer to the engines in the Firefox Search bar). Some companies pay them to do specific work: Nokia is funding Minimo in this way.

They also get non-monetory donations. Companies like IBM and Sun employ hackers to code on Mozilla and many organisations offer services like free FTP mirroring.

I have installed the upgrade and all appears to be ok. However, when trying to read the hi-res Firefox ad (mentioned in a recent /. article) at http://www.mozilla.org/press/nytimes-firefox-final .pdf my preview program just consumes tons of memory and hangs. I have no idea whether it would have worked before the upgrade. Perhaps someone could try it out?

The Mozilla Foundation press release ( http://www.mozilla.org/press/mozilla-2004-12-15.ht ml) has links to a high resolution PDF http://www.mozilla.org/press/nytimes-firefox-final .pdf. Names are quite legible at 150%.

The Mozilla Foundation press release ( http://www.mozilla.org/press/mozilla-2004-12-15.ht ml) has links to a high resolution PDF http://www.mozilla.org/press/nytimes-firefox-final .pdf. Names are quite legible at 150%.

pdf here

http://www.mozilla.org/press/nytimes-firefox-final .pdf

Here you go...

High resolution PDF

You can zoom in to read the names nicely.

Thunderbird has this feature as well.

Answering my own question, according to the Bugzilla entry regarding WebDAV support in FireFox, it is at least being worked on, ableit perhaps slowly and sporadically. Bugzilla lists the "target milestone" as "Mozilla 1.9alpha".

If you need a mail client that behaves correctly during a Daylight Savings Time change, check:

http://www.mozilla.org/products/thunderbird/

Mozilla's LDAP SDK when doing LDAP work

The pre-1.5 concurrent threading classes

Command-line argument handler library

Log4J logging.

If you're using Firefox, check out Bookmarks Syncronizer. It works great for me. You can set it to download an xml file from a ftp server, merge all new entries with your existing bookmarks, and then upload a new copy on exit.

if you for once browse the Firefox Extension room at Mozilla, you would find this all amazing FTP Bookmark Synchronizer
it first stores your bookmarks on an FTP site of your choice and then you can download it to wherever you want.. I use it to synch my laptop and deskt after my burnt PSU took along with it data in my HDD
*OUCH!*

You know, it's just as easy to write Firefox-specific HTML as it is to write IE-specific HTML.

If Firefox takes any foothold in the market, I expect to see a lot more shitty HTML that won't render properly in, say, KHTML-based browsers like Safari.

https://update.mozilla.org/extensions/moreinfo.php ?application=firefox&id=14
Bookmark synchronizer. Works i guess.. can upload/download your bookmarks to/from http or ftp.

I wrote a php-script to handle the data from/to it.
http://www.fixme.se/~zxv/firefox-bookmarks.phps I make no guarantees about this working ;-)