Slashdot Mirror

It's OCTOBER. It's not news anymore. There was a big hubbub about Opera claiming the best browser award despite coming in at #88 compared to Firefox at #1.

You have another extension that allows that somehow?

I hope they've fixed the bug that caused "A script on this page is causing mozilla to run slowly. If it continues to run, your computer may become unresponsive. Do you want to abort the script?" to show up. Extensions that don't work correctly is one thing, but it's unacceptable when they affect other parts of the browser.

Debian does abide by Mozillas trademark policy. The problem, was that Mozillas policy was to not expect Linux distributors to be covered by the general trademark policy, http://weblogs.mozillazine.org/gerv/archives/00834 7.html - but Debians policy is that everything should be freely redistributal and modified - thus Debians Mozilla package couldn't have a non-general trademark policy and still abide by Debians guidelines.

All that aside, I believe what they settled on that they needed to do was make sure all references said "Debian Firefox" or equivalent - instead of "Mozilla Firefox" - just so it's clear that it's not the core version straight from Mozilla. The intention was to remove the Mozilla name from sight - which in the long run seems somewhat perplexing for brand recognition, but to each their own in the pursuit to protect themselves.

Follow this thread on Mozilla Forums for more information. But don't be complacent if you're running the new Beta and be sure to upgrade.

Working fine for me (I'm the developer). Be sure you've copied NPSWF32.dll from your local plugins directory to the Portable Firefox\plugins directory. Also, keep in mind, that it probably won't work on a PC with no Flash installed.

If you need further assistance, drop a note in the support topic:
http://forums.mozillazine.org/viewtopic.php?p=1757 821

You can probably override Firefox's platform-specific setting for what to do on a middle-click by setting some things in about:config.

FWIW, there's no updated version of the Mozilla Suite, either - anyone who's using that is, well, stuck.

I'm the Firefox fanboy in my company for sure, but I have a growing trust issue with Mozilla here. Firefox 1.0.7 was released this morning, and http://www.mozillazine.org/ said to expect the list of known security vulnerabilities at http://www.mozilla.org/projects/security/known-vul nerabilities.html#firefox1.0.7 would be updated soon. With every other previous minor release this page was swiftly updated with all the security bulletins. Since its been two months since the previous minor update, what is Mozilla not telling us? A quick check of the new build announcements at http://www.squarefree.com/burningedge/ shows a lot of security updates and a lot of regressions. So where are they?

The original article is missleading, it mentions some outdated version numbers that should rise suspicion, besides the fact that this is reported nowhere else. If you look at Mozillazine, you will find this article from June:
Korean Mozilla Site Hacked
This site was not an official "mozilla.org" site but a korean fan site, and it was hacked, like MSN Korea a week before:
internetnews article
So some hackers in june broke into a korean site that has nothing to do with the mozilla foundation, altered files by adding virusses. This slashdot article makes me feel sad.

Sorry for hack.
by channy

Thursday June 9th, 2005 6:39 PM

Reply to this message

This is Channy Yun, leader of Mozilla Korean Community. This site is not official web sites of Mozilla Foundation. And this hack is orginated by no patch for PHP vulnerability of my hosting company for mozilla.or.kr. I will change it with backup and fix it with my ISP. Sorry for your worry.

These aren't under the control of mozilla.org:

Korean Mozilla Site Hacked
Thursday June 9th, 2005

Unlike Mozilla Europe, Mozilla Japan and Mozilla China, the Korean Mozilla site is not officially affiliated with the Mozilla Foundation. The community-run site offers localised Korean versions of Mozilla applications, Korean user support forums and a Korean translation of MozillaZine.

But yeah, someone either on purpose or accidentally infected the installer files and they got posted on this site.

Unlike Mozilla Europe, Mozilla Japan and Mozilla China, the Korean Mozilla site is not officially affiliated with the Mozilla Foundation.

Those hackers could just as well have served people distributions of Firefox infected with a virus.

It's me the AC again...

ActiveX controls are executable code. Firefox extensions can contain executable code. Once we're talking about executable code, it has full access to your system.

So to answer your question: a Firefox extension has the same amount of access to your system as an ActiveX control. Period.

If you don't believe me, check out this thread in the Mozilla support forums, which is a report of a malicious Firefox extension in the wild.

A few months back I downloaded all the Firefox extensions from addons.mozilla.org, and found Windows executables in the XPI (Firefox extension package) files for foxamp, firefoxview, mozilla_archive_format, and flashgot. You can download the packages and check them out yourself, if you want. Just rename the .XPI file to .ZIP and open them up. If memory serves, the ZIP contains JAR files, so you'll have to look in them too. (WinZip can open JAR files...) Just keep digging into those archives until you find the .EXE files. You'll find 'em!

As a result, I hate the way Firefox looks on my computer. Camino helps with that, but it follows an older code-base.

There's a new version of Camino out. Camino 1.0a1 is built from the same codebase as Firefox 1.5b1.

An AC mentioned that Firefox `has the power to emulate what [anything else] innovates', which sounded sarcastic, but is to me one of the big selling points. Have something you like from another browser? Come on over to Firefox, where it'll do that and more. That is, Firefox can be all the best bits of every browser, after a little browsing on UMO or The Extensions Room (my favourite). I don't know of any other browser which supports this level of customisability (although I'm sure I'll be informed soon if there are any).

Sure, see Asa's blog: http://weblogs.mozillazine.org/asa/archives/007682 .html http://weblogs.mozillazine.org/asa/archives/007860 .html

Sure, see Asa's blog: http://weblogs.mozillazine.org/asa/archives/007682 .html http://weblogs.mozillazine.org/asa/archives/007860 .html

The Yahoo toolbar can be easily removed from Acrobat Reader 7 by right-clicking and unchecking the "Search the Internet" item.

You can even remove the annoying ads displayed in the right hand corner: http://weblogs.mozillazine.org/asa/archives/007183 .html

The Yahoo toolbar is everywhere though, I noticed it even appears in the Plaxo toolbar for Outlook.

I dont want to have to fire up a mail program just to get someone's phone number.

I would have preferred something like 2.0, because I've always associated SeaMonkey with the Mozilla Application Suite (which was up to 1.7.11, last time I checked). From a brief glance at the project page, it looks like it has similar functionality to that suite ("all-in-one internet application suite").

You can always use Sessionsaver.

http://kb.mozillazine.org/SessionSaver

Asa already addressed most of his critique.

You should read Asa's reply to this article.
Read it here.

It's very interesting. :-)

i think we will see cool things soon thanks to python
http://weblogs.mozillazine.org/roadmap/archives/00 8865.html

Right now Firefox has the ability to change the URL box colour to show that it is a secure site.

Well, why not as part of the anti-phishing concept, make it so all IDN sites cause that same URL window to show a different colour, so once again the user gets a visible prompt to be extra vigilant that the site is legit.

Those that use IDN due to their nationality can thereby continue to use IDN where necessary (and as with all Firefox stuff, customise userchrome.css to NOT change the colour if they want).

Personally I already customise my security colours with custom graphics to make it really obvious when security gets broken. It's a trivial step to do the same with IDN. For more info on my customisation you can visit Mozillazine (direct link from /. won't work so copy and paste URL and remove spaces):

http://forums.mozillazine.org/viewtopic.php?t=1288 49

Find me someone that was nailed by the accidental vulnerability.

So it is security by obscurity that you are preaching?

Maybe you're just one of the naysayers

Actually, I'm a Firefox user, I just don't feel the need to assert its superiority at every available opportunity, regardless of its merits.

it always strikes me how firefox issues always end up being theoretical.

Malware writers tend to target the most popular software. Firefox has been targeted too, though. Here's the first reference to it that Google turned up. Here's another.

Yeh, I like to make numbers up, but I forgot to label it sarcastic. Fuck you, loser.

I'm a loser because I dare to point it out when you make stuff up to prop up stupid arguments? Have some dignity and just back off when you are wrong instead of resorting to name-calling. Don't be so childish.

These are a few sites that I found helpful. Some are a little old but I got something out of all of them.

http://www.xulplanet.com/
http://kb.mozillazine.org/Dev_:_Extensions
http://roachfiend.com/archives/2004/12/08/how-to-c reate-firefox-extensions/
http://businesslogs.com/technology/firefox_extensi on_tutorial.php
http://www.bengoodger.com/software/mb/extensions/p ackaging/extensions.html
http://mozilla-firefox-extension-dev.blogspot.com/
http://books.mozdev.org/index.html
http://www.mozilla.org/xpfe/gettingstarted.html

Of course another good way to learn about extensions is to download a few and look at the code. That has probably been the biggest help to me once the tutorials, etc. gave me the basic idea of what is going on.

Since Asa Dotzler of Mozilla keeps deleting me from his blog, this is just to publicize just how crap Mozilla's security practices really are. Yes, they issue patches quickly, and they have an excellent policy of paying for disclosure for remote exploit holes. But they don't design securely at all, and they certainly don't test securely.

I asked a very simple question in Ask Asa #17: Basically, who was responsible for the testing/QA failure that led to a security regression in Firefox 1.0.4, how will they be censured, and what is being done to prevent a similar recurrence.

He didn't answerand has deleted every comment I post, in which I've said the same thing. I think it's a fair question. Not answering is pretty crappy, but censoring just because he spends too much time being 'visible' and not enough time actually doing QA is truly pathetic.

Asa isn't the funloving guy his blog projects, he can be a complete idiot too. Spread the word.

Since Asa Dotzler of Mozilla keeps deleting me from his blog, this is just to publicize just how crap Mozilla's security practices really are. Yes, they issue patches quickly, and they have an excellent policy of paying for disclosure for remote exploit holes. But they don't design securely at all, and they certainly don't test securely.

I asked a very simple question in Ask Asa #17: Basically, who was responsible for the testing/QA failure that led to a security regression in Firefox 1.0.4, how will they be censured, and what is being done to prevent a similar recurrence.

He didn't answerand has deleted every comment I post, in which I've said the same thing. I think it's a fair question. Not answering is pretty crappy, but censoring just because he spends too much time being 'visible' and not enough time actually doing QA is truly pathetic.

Asa isn't the funloving guy his blog projects, he can be a complete idiot too. Spread the word.

Since Asa Dotzler of Mozilla keeps deleting me from his blog, this is just to publicize just how crap Mozilla's security practices really are. Yes, they issue patches quickly, and they have an excellent policy of paying for disclosure for remote exploit holes. But they don't design securely at all, and they certainly don't test securely.

I asked a very simple question in Ask Asa #17: Basically, who was responsible for the testing/QA failure that led to a security regression in Firefox 1.0.4, how will they be censured, and what is being done to prevent a similar recurrence.

He didn't answerand has deleted every comment I post, in which I've said the same thing. I think it's a fair question. Not answering is pretty crappy, but censoring just because he spends too much time being 'visible' and not enough time actually doing QA is truly pathetic.

Asa isn't the funloving guy his blog projects, he can be a complete idiot too. Spread the word.

Problem turned out to be that FF1.5b1 needs gdiplus.dll. Windows XP comes with it, but earlier versions of windows needs to download it separately. read more here: http://forums.mozillazine.org/viewtopic.php?p=1731 455#1731455

The bug has been disclosed by Mozilla staff and a patch fixing the reported buffer overflow has already been applied to the CVS tree, so expect a public security update very soon. In the meanwhile, as a temporary work-around, you can fully protect your browser opening "about:config" and setting the network.enableIDN preference to false, see the full story here.

Everybody knew Acid2 complaince wouldn't make it in Gecko 1.8. It's not like passing some random test is super-important as long as normal pages render properly.

To view IE specific pages, you can install the IEView extension to Firefox. To view the same pages within Firefox just like Netscape8, check out the following post http://forums.mozillazine.org/viewtopic.php?p=1640 418#1640418

detailed in this thread

People who are complaining about broken extensions or crashes should read the warning on the download page for the beta: Note: This is not the final release of our Web browser, it has been made available for testing purposes only, with no end-user support. If that sounds scary, you'd probably be better off with the latest version of Firefox 1.0. Basically this is saying that you should not install this on the computer of your grandma, who barely knows how to hit the power switch, because something will probably get broken and grams will call you about it. I'm not suggesting that everyone here who is a noob, I'm saying that people shouldn't say things like, "I've installed this on 100 computers and the new theme is ugly. These people don't know how to change any options or fix the problem." Well, they're not the type of people who should be using beta software. Yes, it is kind of annoying that extensions get broken with most new releases, but they are working on improving the update procedure. Currently, the program warns you when you first update that the following extensions aren't compatible and it offers to search for updated versions. If new versions aren't available, it disables the extensions. I believe they are working on a feature that warns you BEFORE you update that the following extensions may be incompatible. There is also some discussion about implementing a blacklist feature so that extensions with major issues, like the greasemonkey security flaw, are disabled until a fixed version is released. Like others have said, to get extensions to work you can do one of three things: Unzip the xpi and change maxversion to 1.6 or something similar, or you can install nightly tester tools and right click on every disabled extension and click "make compatible," or if you are trying to install a new extension that might not work and you have nightly tester tools installed, it has a checkbox at the bottom of the xpi install window that says "install using nightly tester tools to force compatibility." Basically you can force almost any extension to load in beta 1, and assuming the extension isn't really old, it should work without a problem. Oh, and for the person who said that they should work on a stable 1.0.7 build; builds with a number after the second decimal point (ie. 1.0.x) are basically just security fixes and don't try to fix usability problems, unless the problem breaks almost all extensions like 1.0.5 did. For anyone using XP classic theme, or a version of Windows previous to XP, here's a link to code that you can put in your userchrome.css file to get things basically looking the way they used to. http://kb.mozillazine.org/Firefox_windows_classic

Or you could tweak an about:config setting and switch the behavior to a normal Google search.
http://kb.mozillazine.org/About:config_entries#Mis cellaneous
Find keyword.URL and change it to
http://www.google.com/search?ie=UTF-8&q=

You won't have access to mutiple search engines via the address bar, but some improvement is better then none.

See: Mozilla SVG Update and Mozilla SVG Status for some more info.

When installing Firefox 1.5

(1) Backup your old Firefox 1.0 profile
(2) Start with a clean profile, its best to use a clean profile
(3) Update your extensions
(4) If the extensions still complain, try this following the directions from this link

For those here that run Windows in the Classic theme, here a link to info on how to fix the menu looks http://kb.mozillazine.org/Firefox_windows_classic

Some people may not have the option to install software.

Other than people surfing the Internet in a public library, should these people be viewing entertainment web sites on company time anyway?

Some people may not have a broadband connection so downloading Firefox may take too long to be practical.

Firefox Setup is 4.7 MB. Most dial-up Internet connections are v.90 or v.92, which can download a file that size in 20 minutes. How is that impractical?

I do not know but is there a standard compliant browser available for WINCE and Palm devices? I know that WINCE has IE.

Opera for Mobile is out now on all these phones, and a port of Mozilla to handheld devices is being worked on (see Minimo roadmap).

by keeping SSL 2.0, you maintain backward compatability for virtually zero-cost

The problem is that SSL 2.0 servers will hang on a 3.0 handshake. So the 2.0 handshake is tried first.

Meaning that for servers configured to respond to both 2.0 and 3.0, you end up using the worst one. So that is the non-zero cost they try to avoid.

It's a troll, but I'll bite and see if I can get a free worm.

This is just wrong. A bit of research (http://weblogs.mozillazine.org/asa/, http://planet.mozilla.org/ shows that the developers, including Asa, routinely listen to users and often ask for comments. And from the point of view of an insider (bugs I've reported: 55), developers respond quickly and helpfully to anyone who isn't wasting their time, and even those who are but do it in a curteous way.

A few other specific points: the Mozilla Corporation is not for-profit. Nothing about a corporation says it has to be. It merely falls under business laws, making it easier for other businesses to interact with Mozilla.

And with respect to bug 18574, it's the one about MNG support. To quote a few things from the bug:

However, MNG inclusion won't even be considered until there is true reason to include it. According to some numbers I believe I saw at libmng or png.org/pub/mng, the number of MNG/JNG images ranges in the hundreds or the low thousands. Period. Worldwide. Ever. Almost all of these images are also set up as testcases, not as practical media on sites.

Its not something that'll likely change going forward, unless MNG support is really low cost (i.e. not 200-300k). At 50-80k the case becomes stronger, of course. The "if you support it, they will come" argument is weak, since we did support this for three years and the content didn't come.

The link posted in that site won't display the problem -- visit the wiki to display the problem (https://register.btinternet.com/ is a current offender).

Why just modify the GUI when you can replace it entirely and still use the Worst Rendering Engine(tm) ever? Oh, wait, that is Lynx.

Internet Explorer rendering in Firefox.

NOTE: I haven't tried it out or anything (you'd probably have to read the entire thread and use the unstable branch of Firefox -- 1.0.5), so I can not guarantee anything.

Yeah, and check out this review:
http://weblogs.mozillazine.org/asa/archives/008300 .html

Yeah... Google Desktop Search 1.0 (Gold) supported Thunderbird indexing. Link for the unbelieving: http://www.mozillazine.org/talkback.html?article=6 188

There's a blog post here with a link to another presentation from the conference.