Slashdot Mirror

What exactly is a "Mozilla certificate"?

SSL certificates are quite standardized, and Mozilla supports several versions of that standard.

http://mozilla.org/projects/security/pki/psm/#stan dards

First, yup. Pre-fetch FAQ.

Second, XHTML 2.0 is being developed, which will radically change things. Make your suggestions known now.

Finally, I believe that's what SVG is for. Mozilla has some support for SVG, but it's not enabled in regular builds, IIRC.

Andreesen adding the IMG tag was a big mistake, and a very bad implementation of embedding media. The OBJECT tag is what we should have had all along.

He also complained about Mozilla's vaunted "standards compliance." His exact words: "Mozilla invents its own standards, and it's the only one to comply to them."

For the most part, this is only true if your friend believes that the W3 is a subsidiary of AOL. Needless to say, it isn't, and in fact many of the standards which Mozilla follows (While IE only sorta follows) were written by groups that included representatives from Microsoft. A partial list of the (real, non-Mozilla invented) standards that Mozilla enforces can be found here.

Isn't javascript "write once, run anyware" kinda stuff?

It'd be nice, wouldn't it.

JavaScript is a Netscape invention, always has been. As such, Netscape did write its own standard and is the only one to comply with it. However, there IS a real standard known as ECMAScript that Moz and IE both do a reasonably good job of supporting. Unfortunately, this does not cover everything. ECMAScript can be thought of as defining the 'core' of what scripting on browsers is often used for.

Beyond the core are the areas of scripting that make up the buzzword-compliant DHTML (Dynamic HTML, a fancy way of saying JS, CSS, and HTML)

This is where cross-browser scripting gets hairy. The standards used for manipulating documents dynamically are collectively defined by the W3 as the DOM, or Document Object Model, which has many uses outside of HTML, but we'll stick to its HTML uses for now. Unfortunately, some of the more advanced elements of the DOM are still in a drafting phase, and as such are not ready to be used as standards. Meanwhile, browsers implement support in their own ways, lacking any sort of rules to adhere to. It's my hope that as these drafts are finalized into W3 Recommendations, that MS will include support for them as I know Mozilla will. Until then, browser detection will continue being a way of life for advanced client side scripting.

The vulnerabilities listed are all already fixed in mozilla 1.01 and 1.1, except for the potential privacy violation in onUnload (bugzilla). That one's hardly terrible - it's possible to add javascript to your website so that you can tell which url the user went to when he leaves your site. Pretty minor given that a) it just tells the "attacker" which of his links you clicked and b) a lot of sites already achieve the same effect using links to redirect scripts instead of direct links.

This whole thing is really overblown. The issue the register picks on as the most important - the https-http-https redirect warning thing - is actually the least important. They talk about the importance of HTTPS for ecommerce but they don't seem to understand what the real security issues here (Oh my god, a malicious website can confuse me about whether my connection to it is encrypted! Doom! We're all doomed!).

Most of those bugtraq/securityfocus listings are from a list of fixed security bugs that the mozilla people fixed and listed in bugzilla that were posted to bugtraq. It doesn't help anyone improve security if your reward for being open is a scaremongering article that says your product is "riddled with security holes". It's an easy way for The Register to get hits knocking mozilla with most of their work already done for them - by the mozilla developers.

On a funny sidenode, while trying to use the link above:
"Sorry, links to Bugzilla from Slashdot are disabled."

One way would be to use the browser ID to add a little 'info' strip to the top of pages, specifically for IE users. It could be just a small one-line table at the top of pages -- maybe with a contrasting background to be noticeable, and say something like:

"Internet Explorer has several vulnerabilities that may allow others to take over your machine. You may want to apply fixes or try alternatives.

I can't find the link to the 'master list' of unpatched IE flaws, I had it bookmarked somewhere.. But I would imagine using the browser ID string the client sends to apache, this could be done in PHP or something similar. Yeah, it'd probably be a performance hit, but for anything but the biggest sites, it might work.

I've also noticed that some IE browsers appear to be sending the actual patch revision! Example:

217.81.215.xxx - - [06/Nov/2002:00:00:19 -0600] "GET / HTTP/1.1" 200 34629 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; QXW0339a; Q312461; .NET CLR 1.0.3705)"

Q312461 leads us to a MS Knowledgebase

article. I've no idea what the QXW0339a is, though.

Interesting. So one could go so far as to take the patch version off the browser ID string, check it against a database of strings, and return a comment that mentions the serious vulnerabilities affecting that version. I'd be happy to just run something that added a small tagline to the top of pages for all IE browsers, though. The more sites that did something like this, the more the word would get out. I think it'd be productive. :)

How my favourite bug was turned into a feature is the best example I have of how easy it is to get off the track with big projects like this.

The bug got lost in several threads, flames and arguments about what IE does or does not do, until it was finally marked WONTFIX by a Mozilla demi-god. IMHO, they missed the point. There is a constant refrain in Bugzilla about whether something is "standard" or not.

From my experience, the argument about web standards is used to either fix or not fix something, depending on how someone feels about a problem.

Don't think it's a problem? don't fix it and say "it's not standard, so we won;t" or "it's not standard, but we break the standard everywhere where it makes sense". Some behaviour need changing? The same arguments apply.

I may be just whining here, but sometime I think the fact that Mozilla is a web browser is lost in the arguments. I still love Moz, but the fact that the right-margin jumps around on my otherwise fine HTML 4.x and CSS pages will always bother me.

Douglas Schmidt's Adaptive Communication Environment (ACE) is a fantastic pattern based os abstraction library. You can get a copy of it at cs.wustl.edu. It will provide you with abstractions for threads, IO, configuration, etc and it runs on every platform imaginable. It also support many compilers. You can use the built in make system as well to do cross platform compiling. Another good cross platform build system can be found in the mozilla source code. You can grab a copy of it at mozilla.org and see how they handled cross platform compiling. It uses nspr, another pretty good os abstraction library.

Ah good, someone got in before me :) It is definatly a good idea to separate out the GUI part when dealing with cross-platform applications, since a lot of portability problems reside there.

In all honesty, I don't recommand Qt or wxWindows - they are great toolkits, but you lose out heavily on productivity compared to visual development environments with GUI builders. While both of these have associated builder tools, I don't consider them very mature of capable compared to VB or Delphi/C Builder. There is also a write-once-debug-and-tweak-everywhere concern (just getting wxWindows looking good on Windows and Solaris takes some effort).

Java is a great choice as it is supported on many platforms, has powerful GUI classes, a couple of builder products, and has several means for client/server support, including CORBA. But for UI applications it isn't hugely productive (strangely enough).

Some of your other options include ParaGUI and SDL, gTk, GraphApp, V, Mozilla's XPToolkit and XUL, and WideStudio.

I have grappled with exactly this question (legacy C/C++ needing to go cross platform with GUIs), and the best answer I've come up with so far is to keep your main code in C/C++ (since you have the legacy code AND the skills), define a clear UI abstraction layer, and create the UI in a scripting language such as Tcl or Python. Use SWIG to tie the script to native C functions.

I have more experience with Tcl/Tk, and believe it is more widely portable (especially the GUI consistency), but it is slower and arguably more difficult to program than Python. Still, this depends on what skills you can acquire, and what your UI requirements are.

Prechelt has an empirical comparison of some languages, including C/C++, Python, Tcl and Perl, and most importantly he has productivity figures! Keith Waclena has a Language Crisis page of comparisons, and Doug Bagley hosts the Great Computer Language Shootout. There are all invaluable resources for determining a balance between portability, functionality and productivity.

Why not see what others who are facing the same issue have done? In particular, I'm thinking of mozilla, which is another C++ application which has builds for Linux x86, Windows, OS X, OS/2, HPUX, AIX and Solaris.

Yeah, they had to make their own toolkit (XUL), but I don't know if you need one (it wasn't totally clear from the question).

In particular, check out this helpful document the mozilla team made about writing portable C++ code.

Why not see what others who are facing the same issue have done? In particular, I'm thinking of mozilla, which is another C++ application which has builds for Linux x86, Windows, OS X, OS/2, HPUX, AIX and Solaris.

Yeah, they had to make their own toolkit (XUL), but I don't know if you need one (it wasn't totally clear from the question).

In particular, check out this helpful document the mozilla team made about writing portable C++ code.

I'm guessing you'll get plenty of suggestions to change your language, which is certainly something to consider if you have that option.

But if you're like me, you don't have that option. You've got a load of C++ that's not simply going to magically transform into Python or Java overnight.

I would suggest the hard road. Boil down supported standard features in the compilers that you can use and tell people to stick to that list unless they can make a case that all of the compilers now support the new feature that they want to use.

Although I feel it is dated now, Netscape used to publish such a guide for their developers.

For example, in our early days, we would not permit namespaces or RTTI.

Now, as compilers have gotten more supportive of the ISO C++ standard, we permit those features in our codebase.

But we haven't yet decided to open the floodgates on exception handling, although it's supported pretty broadly.

Finally, you really need an automated build system that runs the latest repository snapshots through the compilers on all the platforms and throws the results up on a web page, like Tinderbox.

That will tend to enforce good standards as developers will see that their check-in attempts fly through with green and no warnings, or get dirty yellow about warnings, or red with downright errors during the build.

XDocs is only competition to the rarely utilized PDF Forms technology, not to PDF entirely. OfficeXML + XDocs does compete somewhat with PDF + PDF Forms.

What is more interesting is that W3C is close to finalizing a candidate recommendation called XForms, and XDocs appears to be very similar in its goals and the requirements it fulfills.

I had been working on a COM server-side XForms processor for my former employer until recently. The goals of a server-side processor are mostly to automate many mundane tasks of web application development: data binding and validation. There are other interesting open source server-side XForms or XForms-inspired processors in Java: chiba.sf.net and Apache Cocoon.

Here is a Mozilla bugzilla feature request. However, I currently do not have the bandwidth to work on a Mozilla version independently due to other Free Software project committments. It would be interesting to combine with some recent achievements in Mozilla embedded WYSIWYG editing like xopus2.

And a massive pile of duplicate reports to boot.

Chimera 0.6 (released yesterday), a stable Cocoa-based Mac OS X browser also based on Gecko rendering and free beer/speech (neologism needed: frebeech? frespeer?) but cleaner and faster than the competition IMHO. Give it a try. Its own Bugzilla bug reporting makes for a sort of amusing read, if you're idle. Same problem, lots of redundant bugs or "whoops my machine was messed up" or "gee, wouldn't it be great for you to work your tail off for free to deliver this obscure feature."

Bugs can wear you out, the Web is still pretty raw. Now, I didn't want this mention of Chimera to be redundant, so I searched Slashdot first and got:

Searching For: chimera
HTTP/1.1 200 OK Date: Tue, 05 Nov 2002 14:42:04 GMT Server: Apache/1.3.26 (Unix) mod_gzip/1.3.19.1a mod_perl/1.27 mod_ssl/2.8.10 OpenSSL/0.9.6g X-Powered-By: Slash 2.003000 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=iso-8859-1
OK
The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, pater@slashdot.org and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Apache/1.3.26 Server at slashdot.org Port 80

Chimera 0.6 (released yesterday), a stable Cocoa-based Mac OS X browser also based on Gecko rendering and free beer/speech (neologism needed: frebeech? frespeer?) but cleaner and faster than the competition IMHO. Give it a try. Its own Bugzilla bug reporting makes for a sort of amusing read, if you're idle. Same problem, lots of redundant bugs or "whoops my machine was messed up" or "gee, wouldn't it be great for you to work your tail off for free to deliver this obscure feature."

Bugs can wear you out, the Web is still pretty raw. Now, I didn't want this mention of Chimera to be redundant, so I searched Slashdot first and got:

Searching For: chimera
HTTP/1.1 200 OK Date: Tue, 05 Nov 2002 14:42:04 GMT Server: Apache/1.3.26 (Unix) mod_gzip/1.3.19.1a mod_perl/1.27 mod_ssl/2.8.10 OpenSSL/0.9.6g X-Powered-By: Slash 2.003000 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=iso-8859-1
OK
The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, pater@slashdot.org and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Apache/1.3.26 Server at slashdot.org Port 80

Chimera (Mac browser based on Mozilla, like Phoenix for Linux/Windows) now has Talkback. Maybe they'll be able to backport it to Mozilla.

Mozilla has an open bug to integrate Bayesian spam filtering into the next release of the software. Most of the work is done. They're just waiting on incorporation of a message filtering plugin architecture.

Mozilla has an open bug to integrate Bayesian spam filtering into the next release of the software. Most of the work is done. They're just waiting on incorporation of a message filtering plugin architecture.

Mozilla has an open bug to integrate Bayesian spam filtering into the next release of the software. Most of the work is done. They're just waiting on incorporation of a message filtering plugin architecture.

congratulations J., on your acquisition of your free pass into the brave gnu wwworld of open/honest communications/commerce. what!!??, you haveN'T gotten won yet? gadzuks!

Start Here(tm)

you're welcome.

Drink Swahilli(tm)

I thought I was the only person who hated Bugzilla's UI. I can use it, but I think it is incredibly messy and hard to use.

The query page was recently reordered to put the more commonly-used things at the top, and make it more understandable. Have you used the new version (it's been the default on bugzilla.mozilla.org for a few months.

When I want to do quick searches, I have to pretend to be entering a new bug, since the normal search form has way too many useless details on it.

QuickSearch is also available on the front page :-)

Gerv

This is why Mozilla kicks ass.

Chimera

Speaking only on bugzilla places like Red Hat and Mozilla, any bug you file will generate an email to someone, so that bug report should at least get looked at.

Of course, with limited resources, they may have to decide how big of a priority your bug is, but you should probably at least try to go through the estabished bug-reporting channels before deciding that they don't work.

Just because a package has zero bugs reported doesn't mean that nobody looks at those bug reports - it means that no users care enough to file anything on them. Tons of bugs in the "unconfirmed" state would be a better indication that nobody looks at them.

I also can't find a link to the source off of their page, which, I assume, would allow me to ./configure, make, make install. The README mentions, and I quote,

Getting the Source
1. Go to the root of your mozilla tree.
2. cvs up -Pd browser and toolkit

But where is the root of my mozilla tree? What then? Do I do the ./configure... stuff?

I'm honestly sorry to bug y'all, but I reckon some other people are wondering how to do this too.

~squidgyhead

Edit > Preferences > Advanced > Scripts & Plugins. Uncheck Allow scripts to: Open unrequested windows. Works for me. Mozilla is a wonderful thing.

1. Mozilla interface feels "heavy" and slow. The buttons just feel "heavy" to me. IE6 feels light and it looks like a Windows program. Plus, it loads more quickly.

No Argument here. Part of the reason why Phoenix exists...

2. Google toolbar. Yeah, I've used the mozdev one... and it's just not as impressive. I cannot do the following with the Mozdev bar:

I agree a real Google toolbar would be nice. Almost all my searches are mapped onto Mozilla keywords though, which works pretty well. Along w/ the search sidebar and background tabs, I think overall, Mozilla still wins on searching.

4.View Partial Source. Once again, mostly a web developer tool, but an invaluable one at that. I highlight any part of the page, click "View Partial Source", and I'm staring at the source code that created that part of the page.

Mozilla does this. At least mine does, it may have been an extension I installed a long time ago. As a web Developer, here's my list of favorite Mozilla features (I will never do web development in a browser that doesn't have an equivalent to these):

• DOM Inspector" - omg, this is the best thing ever
• Venkman - built-in JavaScript Debugger / Profiler
• Mozilla Source Generator - view the generated source from the DOM
• Gecko - the most complete standards support of any existing browser. I can trust Mozilla's CSS output instead of assuming it's wrong.

Overall, the tabs, sidebars, tools, and other interfaces make Mozilla by and large my favorite development browser. Here are some of my big nits:

• HTTP logging / browser - wish I could see this stuff without having to go to a separte network sniffer/logger
• Better Info - would like to see all HTTP headers, cookies, source, dom from one centralized interface. there is a 'web developer' version on Mozilla being worked on... that might be way cool
• Crash Recovery for Tabs - Total Recall gets broken, Multizilla only records one window's tabs
• Form Ranging - it's still broken, part of the larger problem...
• ...that Content Editing is weak sauce. Whatever browser has significantly improved form/editing capabilities will definitely have my endearment - stuff like inline editing, or for forms, basic stuff like better local form input capture/caching, integration of editing commands, etc.

1. Mozilla interface feels "heavy" and slow. The buttons just feel "heavy" to me. IE6 feels light and it looks like a Windows program. Plus, it loads more quickly.

No Argument here. Part of the reason why Phoenix exists...

2. Google toolbar. Yeah, I've used the mozdev one... and it's just not as impressive. I cannot do the following with the Mozdev bar:

I agree a real Google toolbar would be nice. Almost all my searches are mapped onto Mozilla keywords though, which works pretty well. Along w/ the search sidebar and background tabs, I think overall, Mozilla still wins on searching.

4.View Partial Source. Once again, mostly a web developer tool, but an invaluable one at that. I highlight any part of the page, click "View Partial Source", and I'm staring at the source code that created that part of the page.

Mozilla does this. At least mine does, it may have been an extension I installed a long time ago. As a web Developer, here's my list of favorite Mozilla features (I will never do web development in a browser that doesn't have an equivalent to these):

• DOM Inspector" - omg, this is the best thing ever
• Venkman - built-in JavaScript Debugger / Profiler
• Mozilla Source Generator - view the generated source from the DOM
• Gecko - the most complete standards support of any existing browser. I can trust Mozilla's CSS output instead of assuming it's wrong.

Overall, the tabs, sidebars, tools, and other interfaces make Mozilla by and large my favorite development browser. Here are some of my big nits:

• HTTP logging / browser - wish I could see this stuff without having to go to a separte network sniffer/logger
• Better Info - would like to see all HTTP headers, cookies, source, dom from one centralized interface. there is a 'web developer' version on Mozilla being worked on... that might be way cool
• Crash Recovery for Tabs - Total Recall gets broken, Multizilla only records one window's tabs
• Form Ranging - it's still broken, part of the larger problem...
• ...that Content Editing is weak sauce. Whatever browser has significantly improved form/editing capabilities will definitely have my endearment - stuff like inline editing, or for forms, basic stuff like better local form input capture/caching, integration of editing commands, etc.

I had the same gripes as you, until I realized I could set Mozilla to open Mail/New as the default component. So although it doesn't solve the problem of massive memory consumption, it's easy to have quick access to your browser and mail clients seperately. So until Minotaur comes full circle, this seems to be the easiest, although not the most resource efficient solution.

There is another project Thunderbird that will create a mail client as an adjunct to Phoenix. My understanding is that the approach will be more modular in nature so as to enable stand alone use of the browser, the mail client or both.

And it has it. Http://www.mozilla.org/projects/phoenix/extensions /. Go get Phoenix and this and goto town.

Phoenix 0.4 does not work on Windows95. This is a problem with core Mozilla code and probably impacts all Mozilla-based products created after about Oct. 23rd.

You could always try reading the release notes
Its knows issue # 2

PLEASE NOTE: You MUST create a new profile for Phoenix 0.4. We made changes to several items including pop-up whitelisting which are not compatible with the 0.3 and even recent nightly profiles. To create a new profile start Phoenix by running phoenix.exe -ProfileManager and click on the "Create Profile" button. You must also delete your old Phoenix directory rather than just overwriting the files there. Not doing so WILL result in problems and you should not file any bugs on Phoenix unless you've first done a clean install and tested on a new profile. As Phoenix stabilizes more this will not be necessary but until then these steps are absolutely necessary.

Phoenix is getting bloated. I knew it would happen.

Phoenix is not getting bloated. Its download size is going down, for one thing. As stated earlier, the time to do the heavy lifting, feature work and redesign is early in the development cycle. That's where we are now -- this is 0.4, folks!

We're working hard to improve our support for extensions to reduce bloat. Without extensions support, we'd be pressured to include the add-ons in the default build.

Did you say something about a standalone mail client?... Yes. We did. Thank you for listening. It's called Thunderbird, and more information will be available later

Once there's SVG support in Phoenix, I'm done w/ IE. Or, can that be managed, & I'm too slow-witted to figure it out? Haven't been able to get the Adobe plug-in to work w/ Opera, & felt a genuine pang of grief when I read that "For various reasons, official Mozilla builds will not include SVG support for the near future." I track changes, etc., in the machines where I work in a map I wrote of the room in SVG. Gosh, it's useful, & my boss thinks it's pretty.

The release notes says that since Phoenix is still not mature, you should always delete your old installs of Phoenix, including profile, before installing a new release. I guess you should do that -- sorry for any confusion. :-P

It looks quite nice, but I still have a Java
problem with it, when trying to view a page that
contains java, it crashes:

[klink@dandelion]:/usr/local/src/phoenix$ ./phoenix
INTERNAL ERROR on Browser End: Could not read ack from browser
System error?:: Die Ressource ist zur Zeit nicht verfügbar

(see http://bugzilla.mozilla.org/show_bug.cgi?id=173254 )

Maybe someone here got an idea!?

Oh, that's right, you only have to design for IE now. Silly me, I forgot that all the other browsers are dead. That, or maybe, they all render DHTML exactly the same now? (HAHAHA)

(Well, maybe Lynx is dead, it's web page seems to be down...)

Are you sure you aren't just mixing this up with the UI for the <link> element? In other words, does your up button work on any page (like this one), or just for some?

Are you sure you aren't just mixing this up with the UI for the <link> element? In other words, does your up button work on any page (like this one), or just for some?

While Galeon very well may, Mozilla does not have an up button. However there is a feature request for one open in the bug tracking system. If you want it too, help fix it or at least vote for it!

Cheers //Johan

While Galeon very well may, Mozilla does not have an up button. However there is a feature request for one open in the bug tracking system. If you want it too, help fix it or at least vote for it!

Cheers //Johan

Capital One is one of the worst violators. Mozilla will not work even after changing the user agent. In fact, it appears they are just deliberately blocking Mozilla from working and refuse to stop. Here's the discussion of the bug at mozilla.org

The fact that Darwin appears to have a CISC-oriented design begs the hunch that Apple doesn't want to tie themselves to the MPPC platform. This could mean one of two things:

1) Apple wants to ensure that should Motorola ever tank on them, they have the ability to port OS X to a wider range of processors, and/or

2) Apple has specific possible platforms for OS X in mind in the future. x86 immediately comes to mind. Granted, this is a rumor that has run its course a million times over, but don't jump to conclusions. This may not mean an OS X port to x86. Looking at OS X and its multiple APIs (Carbon, Cocoa, Classic, "native Java"...) perhaps Apple may be plotting to roll out some sort of cross-platform API that would enable Mac OS X apps to run on, say, Windows. Support for such an API close to the kernel, as Apple would be capable of producing, would make such an API much faster on the Mac than, say, applications based on certain browser cum cross-platform COM system.

Just some speculation here.

for what it's worth, I am using Phoenix 0.3 and it works just fine with Defcredit CU's system here in au and the Commonwealth Bank's NetBank system. I had trouble using Opera though.

Appreciation for ebanka.com as they already supported some 0.9.x version of Mozilla when I asked them to update the no longer functional support for newer 0.9.x version. It was done in several days and their heavy JavaScript online banking app still works with latest Mozilla.

I am not so big client for them to have to take care of my complaint seriously.

You can find a partial list of banks/cc companies and their Mozilla support here

I only care because I've been following the capitalone.com bug for months with no help whatsoever from them.. Oh well. The MBNA site for my Linux Fund card works fine. I'll be cancelling my capitalone card soon.