Slashdot Mirror

K-meleon, Moz based browser I use (and have for 3 years both at home and here at work on winders) was fixed by the users with a simple User_Pref

Which is exactly how it's actually fixed on normal Mozilla and Firefox as well. What's your point? That there absolutely shouldn't be a fix easy enough for non-techies to use just because it can be done by fudzing around the hidden config system?

Who needs a 20Mb download, huh?

The people who couldn't possibly understand even about:config, or well, not really, they could always just install the 512 byte shellblock.xpi

You just have to love how easy it is to install this Mozilla patch. What IE fix works this simply? Open page. Click link. If this were IE, there would be one, minor, takes-forever step now: Restart computer.

I'm quite happy to see that the Mozilla team is pro-active in fixing the bugs that could allow MalWare to install unchecked.

The Mozilla team isn't proactive on security issues. The dangers of Windows URL schemes have been known to the Mozilla team since mid-2002:

http://bugzilla.mozilla.org/show_bug.cgi?id=163767

If they had implemented a whitelist of known-good URL schemes back then, it would have been a proactive security measure. Fixing things after they have been announced on some mailing list (or reported privately) is, of course, only reactive.

With the cost of upgrades, the continued security holes, the perceived instability, the required activation, and the neutering of XP Home... I really don't see myself or others upgrading from Win98 or Win2K without being forced to.

How's that going to happen? Microsoft is going to have to discontinue support for those operating systems.

And, I suspect that's their longer term plan. By cutting support, when the next window of bit-rot or software bloat forces a user to consider their options, I think Microsoft is banking on intimidating them into a newer version of the OS, no matter the cost.

It was precisely the anticipation of this world wide event that made me switch to using Apple's OS X (based on FreeBSD!) and start finding non-Microsoft solutions via Linux.

I've found a new mouth piece as well. When I went to evangelize alternate solutions to friends and family, I got the standard "but you're a geek" roll of the eyes. I was, however, able to convert my wife of alternatives to Microsoft with the use of applications such as Mozilla's Firefox as a browser replacement to get rid of pop-ups/adware and Thunderbird to stop her from getting infected with viruses.

Upon learning that there are alternative solutions with better features that let her not have to deal with everyday annoyances, she was an easy sell on Linux, and now uses Putty and SSHing -- something I never thought I'd see!

She's the one who gets creditability marks with her friends. They know she's an artist and not a computer geek. If she's raving about it, they want to try it, because obviously it's not above their level.

Linux, however, is going to have to compete hard with Microsoft. It isn't Linux's free price tag or outstanding stabilily that's holding it back. It's complexity.

The learning curve is too great for the non-technical user to setup and immediately start using it. Microsoft scores big when it comes to easy install for a basic system, and they actually do automatic updates quite well from a simplicity standpoint.

What many geeks don't get is simple computer users are willing to give up power and features for ease of use. If someone put out a basic distribution that auto-detected hardware, did an easy install, and set up the basic environment with nothing but the standard Office tools -- much like a dumbed down version of Mandrake or BeOS or the free OpenBeOS version.

Microsoft sees that "we don't get it" and aren't catering a special distribution to "grandma", and with that fact they leverage Windows into homes, knowing that once someone invests in learning something, they usually don't switch without good cause (frustration, cost, or inapplicability to task).

With the cost of upgrades, the continued security holes, the perceived instability, the required activation, and the neutering of XP Home... I really don't see myself or others upgrading from Win98 or Win2K without being forced to.

How's that going to happen? Microsoft is going to have to discontinue support for those operating systems.

And, I suspect that's their longer term plan. By cutting support, when the next window of bit-rot or software bloat forces a user to consider their options, I think Microsoft is banking on intimidating them into a newer version of the OS, no matter the cost.

It was precisely the anticipation of this world wide event that made me switch to using Apple's OS X (based on FreeBSD!) and start finding non-Microsoft solutions via Linux.

I've found a new mouth piece as well. When I went to evangelize alternate solutions to friends and family, I got the standard "but you're a geek" roll of the eyes. I was, however, able to convert my wife of alternatives to Microsoft with the use of applications such as Mozilla's Firefox as a browser replacement to get rid of pop-ups/adware and Thunderbird to stop her from getting infected with viruses.

Upon learning that there are alternative solutions with better features that let her not have to deal with everyday annoyances, she was an easy sell on Linux, and now uses Putty and SSHing -- something I never thought I'd see!

She's the one who gets creditability marks with her friends. They know she's an artist and not a computer geek. If she's raving about it, they want to try it, because obviously it's not above their level.

Linux, however, is going to have to compete hard with Microsoft. It isn't Linux's free price tag or outstanding stabilily that's holding it back. It's complexity.

The learning curve is too great for the non-technical user to setup and immediately start using it. Microsoft scores big when it comes to easy install for a basic system, and they actually do automatic updates quite well from a simplicity standpoint.

What many geeks don't get is simple computer users are willing to give up power and features for ease of use. If someone put out a basic distribution that auto-detected hardware, did an easy install, and set up the basic environment with nothing but the standard Office tools -- much like a dumbed down version of Mandrake or BeOS or the free OpenBeOS version.

Microsoft sees that "we don't get it" and aren't catering a special distribution to "grandma", and with that fact they leverage Windows into homes, knowing that once someone invests in learning something, they usually don't switch without good cause (frustration, cost, or inapplicability to task).

Don't you mean:

Firefox fixes for Windows security holes don't get into the hands of users until they click the link for the .xpi update package on http://www.mozilla.org/security/shell.html.

Besides...when the next release is out one day after the flaw is discovered (I know, the general situation was known a year or so ago, but it wasn't realized that it was a security problem that MS wasn't going to fix until the day before the patch came out...) what the heck difference does it make that you've got to wait for the next release?

Has an awesome popup blocker ... Not one POP Up gas gotten through.. Yet.

I'd love to put a link on my web site, but are there any promotional buttons, such as buttons provided to advertise Mozilla Firefox?

It's a long-standing bug. God it took long time to be acknowledged because it's WIN32-specific bug.

Oh and FF 0.9 broke the fix.. For some reason devs have been dragging their feet about checking it into the branch builds.

With that fix FF/TB/Mozilla become so snappy you won't believe it.

It's a long-standing bug. God it took long time to be acknowledged because it's WIN32-specific bug.

Oh and FF 0.9 broke the fix.. For some reason devs have been dragging their feet about checking it into the branch builds.

With that fix FF/TB/Mozilla become so snappy you won't believe it.

This is more thant well known. Bugzilla

Question: Does anyone know how this affects Netscape 7.1, and whether the ***PATCH*** will work on it as well?

FF has an image zooming extension but AFAIK it won't scale text and images automatically.

locating good extensions is a pain it would be nice to get them all in one place and rated by users.

But what would happen to the bounced back shot if there was a mirror attached to it as well? ;-)

Is it SO hard to use Plain Text Links?

My website, which gets like 60.000 hits per month, shows a rise in Gecko's market share in the last couple of months, from 8% in April, to 30% in July.

The website isn't all technical BTW.

I wonder if it has something to do with me using Firefox buttons on the main page.

This is actually a big issue in the development "community". Although the organization itself has resolved its position -- that non-compliant feature support is a slippery slope -- marking bugs as "WONTFIX" or "INVALID" in Bugzilla ends in dozens of duplicate bugs. The fourth most-reported bug (bug 25537) is in fact requests for a non-compliant (and MSIE-originating) feature -- alt tags as tooltips.

This isn't the only one, either. Backslashes in URLs (bug 93197) is another one that comes to mind where Mozilla is between a rock and a hard place. Either Mozilla looks broken if you try to visit a moderately complex page created by Word, or it will effectively send the message that "buggy HTML is okay". Arguably, Mozilla's voice is still a small one in the fight, but say they become big. Do they keep doing things The Wrong Way? Or do they fix it, and then all of the developers who learned coding on Microsoft products and thought it was the right way file bugs?

I support them sticking to their principles. Poor HTML markup (and non-standard DHTML) should be scorned. That's what "Tech Evangelism" bugs are for.

0.8 because I can't get TabBrowser Extensions to work on 0.9

Maybe this extension will help.

Mozilla rises from the dead (or at least a deep sleep) and goes mainstream rather quickly. Impressive :)

OT: Here's a marketing idea which has probably thought of before. Link the Firefox page saying how/why to switch from IE (http://www.mozilla.org/products/firefox/switch.ht ml) to the words 'Internet Explorer' to increase Firefox ranking in Google, etc. But put it in a sentence so the casual reader knows it's not an IE link.

Fed up with Internet Explorer?

Usually, it goes to whatever the folks running the Foundation want it to go to. Their expenses include servers, and also the programmers, and other staff.

Doesn't look like they have anything set up for it, but in general with non-profits, you can restrict your donation. They either have to obey your condition, or refuse to accept the contribution.

If you're giving them $10, then restricting it is just going to be a pain the arse, and cost more to administrate than your donation than it's worth. If you want to give a larger amount that's restricted, drop them a line (address is on the donations page) and ask.

That's what all this is about. You know it, I know it, we all know it. Companies wanting to preserve their competitive advantage slap copyrights on anything in sight and charge through the nose for maintenance and upgrades.

You can see where all this is going, this me-first grubby-fisted lusting after dollars, this coveting of "trade secrets" and "intellectual property". As this practice proliferates, and as technological devices become more and more commonplace, consumers will be faced with a double-headed devil dog of a choice over every product they buy. Either buy into a proprietary "service plan" or throw the product away as soon as it breaks.

Say goodbye to the entrepenurial repair business, say hello to a world of locked-down trade secrets, where ideas are golden geese to be guarded and coveted, and most of humanity languishes in thrall to the companies with the most ruthless legal departments.

Does it have to be this way? No. We have it in ourselves to say no to this nightmarish future. Open source is one start, the idea of knowledge as a common good, to be shared not just because superior products result from open standards, but because freedom is a basic human need, like food or air.

The real goal, however, is to resist the greed that is the source of all this stifling legal red tape, and that comes down to each and every one of us. It starts with little things, like downloading Firefox, or giving a dollar to a panhandler. The future doesn't have to suck.

TabBrowser extensions are massively bloated, and the number of options is bewildering, even to an experienced user. It is best to use some of the smaller extensions writtent to duplicate the functions you need.

For opening new window link in new tabs, use Single Window

I also use rue's rewritten implementation of Pike's Session Saver for the recovery of tabs after a crash (only happened once in recent memory, but useful still), and disable all the other features as they annoy me. This version is repackaged for 0.9

The last extension I use to do with tabs (don't think it was in TBE, but essential for me still) is Flowing Tabs, which shrinks the sizes of the tabs to the title text if it is short (otherwise keeps them default size), and continues many tabs onto a second or third and so forth line rather than shrinking them until you can't see what's written.

I've been waiting for searchable bookmarks for about a decade now

Just bookmark your bookmarks file in your bookmarks toolbar, and use Find as You Type to search.

How about fixing some of the many top-voted bugs first? It's not glamorous but it would help make Mozilla/Firefox more useful in a real way. Top voted Bugzilla bugs

It's called Mozilla.

Submitted to bugzilla.mozilla.org here.

You mean more new features.

Forget new features, just fix the bugs. There are bugs (some inherited from Mozilla) that make Firefox unusable on some Linux systems. If you want ideas for what to work on, go to Mozilla's bug list.

This would be about 1000 times more useful than putting in yet more code bloat which will introduce yet more bugs. Of course, it won't gratify your ego as much. It's a question of what your goal is - accomplish something useful for the community, or pump up your ego.

That's the very reason Firefox was created: to offer a browser that can be as lean or as powerful as you want it to be, and to go between those extremes with a few clicks. Any of these suggestions would be implemented as extensions that could be disabled or removed instantly.

By the way, I recommend the Web Developer extension to easily turn off Javascript, cookies, styles, etc., plus dozens of other things. Very useful.

This is the only suggestion so far that really seems worth making the browser larger (and hence, slower).

Link Prefetching is already in Mozilla/Firefox.

I would suggest you get involved with the Mozilla project directly if you want to contribute.

Wow, he followed that suggestion fast:

Who is working on Firefox? Currently Ben Goodger (working for the Mozilla Foundation), Brian Ryner (for IBM), Pierre Chanial, Blake Ross, Dave Hyatt, Benjamin Smedberg, Darin Fisher and the wider community contributing to the Mozilla codebase.

From Mozilla Firefox 0.9 (One Tree Hill) Release Notes

I don't know if he's a "programming god," but I seriously doubt he's "some highschool kid with all summer to screw around."

"PS: Not machine learning, but the sole requirement by me for a browser (dunno if its done in firefox now as hvent used it for a long time): Open new tab as a default rather than a new window, or at least provide the option."

There actually is an extension for Mozilla/Firefox that does this. It's called Single Window 1.0.

You can get it here.

Oh yeh and can u have a sidebar type plug in that shows whos on icq/msn/or even an irc type thingy-majig.

1. This is about the core browsers, not extentions.
2. Chat-based extentions already exist, such as ChatZilla (IRC-only).

If you won't get in trouble and don't have administrator on a work computer, you can install Firefox in My Documents. It works extremely well that way as a completely unpriviledged user. You can install themes and extensions too. I recommend it to those trapped at work ;)

Just found the page for Handling Mozilla Security Bugs.

A recent Globe and Mail article features a favorable report on the turn around of Mozilla's bug trackers. Seems that Mozilla may also have plans to impliment an auto-update feature, or at least auto-notifications.

A recent Globe and Mail article features a favorable report on the turn around of Mozilla's bug trackers. Seems that Mozilla may also have plans to impliment an auto-update feature, or at least auto-notifications.

Just for the sake of karma whoring, here are the instructions for patching Mozilla and Firefox.

Remember that this is only for those folks running Windows 2000 or Windows XP.

The text overlap on /. is known about:

bugzilla

They don't like /. referrers though, so you'll have to go to the URL yourself.

I don't think it will, but I haven't done complete reading on the subject. Check out the Mozilla Foundation Announcement on the new plugin architecture that will be shared between Safari, Opera, etc.

I think that because it's because it's a plugin architecture rather than a dynamically loaded code that the means of exploitation are less. However, poorly designed plugins will likely still be a problem.

=Brian

Corporate migrations are unlikely until someone fixes this bug. You can't surf to a server inside your firewall that uses a NetBIOS name (instead of a DNS name) if you also have a proxy enabled. Very common issue for corporations.

I bet a significant reason for the change is the grassroots marketing campaign started by some of the mozilla people a few weeks back. Here's your chance to help out. And don't forget to put the firefox promotional buttons on your site.

As far as I can see from a quick read of the referenced bug page, they didn't _know_ it was exploitable until the day before yesterday. Not fixing something that you don't know about doesn't seem negligent.

There's a couple of bug references to this, so I'll assume you were referring to the latest one that specifically refers to the shell: protocol. But I was looking at this bug which is a more general form of the same security hole. I'll quote from the bug description:


As we can see in bug 163648, external protocols can cause a lot of security
issues. But exploits for this bug are dangerous mainly if external protocol
handler is being requested automatically from HTML code via , and other
similar cases.

More, with relation to common sense, invoking an external protocol is absurd in
this case, because is request to return some data in browser,
not for launch external application.

So, disable external protocols in all cases, excluding , can solve this
problem.

Marking severity critical according to 163648.

That was filed on the 9th September 2002. It seems fairly clear to me that the whole point of this bug was that external protocol handlers are inherrently exploitable in win32.

Yes there is already a Bug Report addressing some of the issues with the updater. Mine doesn't work either.

i'm seeing an increase in the number of legit software dist's available via BT, etc. i mean, why does mozilla need to make the 1.7 RC available on BT?? Especially a lot of releases that already have mirrors on half a dozen servers internationally.

No, I didn't RTFA, i didn't read comments eaither.

Firefox

'Nuf said

It used to work, but someone broke it (bug 242799) in May. Supposedly there's a patch, but it didn't fix it for me.

Go here, download, install and use.

Wow, you've just managed to do what you said that users couldn't - that is use [the] alternative browsers.

Dumb fuck.

This is off-topic, but nonetheless should be of interest to mozilla users who are forced to use Outlook at work. Even more so for people who use linux at work and are forced to access email via Outlook Web Access (sob!).

Mozilla support for exchange servers (without IMAP) looks like it should now be implementable.

Bug 128284

Please vote for this bug if you desperately _desperately_ (like me!) need support for exchange!

The only changes were the security fix and the version number. That's why there isn't a 0.9.2 at all on Mac or Linux.