Slashdot Mirror
Mozilla: The Good And The Bad
Rui del-Negro writes "According to this article at The Register, six security flaws in Mozilla were posted to BugTraq last weekend. They have not been added to the official Mozilla vulnerability list yet. But details can be found here, here, here and here (phew!).
Finally, two other bugs were found, relating to loading GIF files (in several Linux browsers) and Mozilla's (JavaScript) implementation of onUnload ( ).
Are they trying to prove they can beat Microsoft at their own game..? Or is someone just trying to win a prize?" On a brighter note, Zerbey writes "From Neil's Place here is 101 Things Mozilla can do which IE cannot. Very interesting reading and an excellent resource for convincing stubborn Internet Explorer users why they should switch. This article was also reported at Mozillazine. I'm still waiting for NTLM auth to be implemented so we can switch over at my workplace, the only reason we still have to use Internet Explorer."
Mozilla may have more bugs than a rainforest, but at least they're open about it, whereas Microsoft quietly releases patches over windowsupdate.
As of 1.2beta almost all of these are fixed. In general opensource is not a whole lot more secure than closed source (both are programmed by humans), they just are more open with information and quicker with fixes.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
"...resource for convincing stubborn Internet Explorer users why they should switch..."
Should be:
- Provides a better subjective browsing experience
If that's not true, you'll never win.I am a stubborn IE user. I read through that list, and I haven't found a reason to switch. Seems whoever wrote it doesn't use IE that much either. No hotkey to change font sizes? I guess CTRL+Mousewheel doesn't count as a hotkey.
Now, is there a 10 Things IE Can Do That Mozilla Can Not such as run ActiveX properly if at all so one can go to most msn.com sponsored sites such as MSN Chat? Or how about properly running the Java plugin so Yahoo! Chat doesn't crash after a few minutes. I'm not making this up. This happens everytime.
Believe me, like the rest of you, I love Mozilla, and I live by the tabbed browsing. But unfortunetly, there are a lot of things I do on the Internet that still force me to crawl back to IE.
Being a developer myself, I have a huge number of bugs that are reported to my team and I on a daily basis. While security is always a key concern, there is an entire process of validating a bug prior to adding it to an official bug list. An open source project, such as Mozilla, has to rely on the input of who know who for possible bugs, then also has to rely on a large number of volunteer developers to help validate the bug. Sometimes these processes take time.
Take the time to compare Mozilla's submitted bug report and their official bug list versus Microsoft's (that is if you can find a copy of it).
kha0z
Master of ImportChaos.com
How my favourite bug was turned into a feature is the best example I have of how easy it is to get off the track with big projects like this.
The bug got lost in several threads, flames and arguments about what IE does or does not do, until it was finally marked WONTFIX by a Mozilla demi-god. IMHO, they missed the point. There is a constant refrain in Bugzilla about whether something is "standard" or not.
From my experience, the argument about web standards is used to either fix or not fix something, depending on how someone feels about a problem.
Don't think it's a problem? don't fix it and say "it's not standard, so we won;t" or "it's not standard, but we break the standard everywhere where it makes sense". Some behaviour need changing? The same arguments apply.
I may be just whining here, but sometime I think the fact that Mozilla is a web browser is lost in the arguments. I still love Moz, but the fact that the right-margin jumps around on my otherwise fine HTML 4.x and CSS pages will always bother me.
-- clvrmnky
There will always be bugs, whether your software is open source, free, or otherwise. What matters is how you deal with them.
Why are people so hung up on the initial load time for IE versus Mozilla? Other than for that single metric, Mozilla runs circles around IE. Mozilla renders pages significantly faster, it provides fine -grained control for people who want it (per-site image blocking, per-site popup blocking, tabbed windows), and it generally doesn't allow people to get root/admin access to a box even when exploits are discovered.
I have convinced many people to try Mozilla, and from what I've seen none of them have switched back to IE.
#DeleteChrome
Or you could go to "Edit" -> "Preferences" -> "Advanced" -> "Scripts and Plugins" -> and uncheck "Enable JavaScript for...Mail and Newsgroups".
Does IE let you do that? Why do you need JavaScript in Mail anyway? I won't even accept HTML email.
Text is fine. I get the content without all the cookies and graphics.
"History doesn't repeat itself, but it does rhyme." Mark Twain
--
Twoflower
How sad. You don't 'talk' to a support technician with Mozilla, but you can usually get in contact with the person who actually wrote the code that's giving you trouble. Personally, I find this preferable to sitting on hold, paying through the nose for phone support, and talking to someone who hardly has the technical knowledge to use a computer, let alone code a browser. Mozilla's problems and bugs are well-documented; IE's are well-hidden. Mozilla has an excellent secuity track record; IE's security track record can be seen by the seemingly endless stream of advirories and patchs.
It's a shame that these Fortune 500 companies choose inferior products with inferior support on the basis that they're able to hear a human voice when there's some sort of problem; regardless of whether or not that human voice has the slightest understanding of the problem, the solution, or even the product.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
I think Mozilla is in a position to really get innovation going again. Being a Web developer who started back in 1994, I remember first using Mosaic and Netscape back when features came so fast and furious that you really like progress was an everyday thing. I haven't felt that way lately (at least about Internet Explorer). So without further ado, here are some ways to innovate at a fundamental level, changing some things that should have been obvious.
First, making navigation buttons out of the link tags is great. But does Mozilla pre-fetch the "next" link, so that if I actually decide to go to the next page (likely), it comes up fast? WebTV has this feature. Makes the Web feel faster.
Second, why am I entering HTML tags into a plain text field? Where is the HTML text field? You know, a form object that comes with B, I, and U buttons, and allows me to visually format the text before sending (and which is delievered as standard, XHTML 1.0 compliant markup)? I've seen that Microsoft's new Web-based Outlook tools have this, but they use over 100k of JavaScript files to accomplish it. Shouldn't we just have something like this: <htmlarea></htmlarea>???
Finally, one of the things I've been waiting for is the ability to set images or other objects on angles. For example, if I wanted to have the slashdot logo appear as if it were on an incline, I might use CSS to specify the image display at -15 degrees. And if this were exposed to JavaScript, I could make some interesting animations. But I haven't seen this in CSS yet.
In short, I remember fondly when Netscape pushed the envelope -- I remember Andreesen adding the img tag, I remember Netscape implementing the file upload tag. I think some working demos of this stuff might help it gain acceptance, and give people a reference model to work from. Not to mention make Mozilla seem much more useful than Explorer.
My Greasemonkey scripts for Digg &
I've found that the Bugzilla for Mozilla, Newsgroup usefulness, and general web resources are better, or at least equal to, that of Microsoft. Microsoft has an edge with phone support but, I run 10 servers and 50 workstations, all running Microsoft with SQL, Exchange, NT, 2000, and more - and I've never had to call them. I won't.
I dread calling them. It costs money, immense amounts of time, and I would sit on hold just knowing I'd end up with a moron who would suggest that I try rebooting.
This notion that a software company must be responsible for it's software, so that someone can be held liable and can be counted on to help, is really just dependency and lack of personal responsiblity, and ultimately a crutch. MCSE means Must Consult Someone Else.
Perhaps Fortune 500 companies ARE Fortune 500 companies because they pass the task of software support and maintanence off to the companies that make the software, and focus on their core business.
But they're also the ones spending obscene amounts of money and time trying to understand Microsofts insane licensing policies.
They're spending time and money evaluating Microsoft's DRM moves, preparing to deal with the inevitable (some would say immediate) consequences of Microsoft's negative, condescending attitude toward it's customers.
They're the ones who woke up one day and realized they were renting software, not buying it, and that they have an evil landlord and can't do anything about it. They're just happy their investors also like Microsoft so that they percieve this dependency as a "strategic relationship". They're the ones subject to the whip hand.
I've never walked into a Fortune 500 company and seen Mozilla. I've also never let the public see me having sex. Neither of those means that it doesn't happen.
# Erik
the desire for standards compliance is so web designers can write their sites once and have it work everywhere, without having to worry about what browser the client is using...
however, your statement for using IE as a base for a standard is not only silly, it's stupid:
we've written an in-house webapp that only works on IE5.5+ (5.0 does NOT work, something in the DOM or javascript), and testing on IE6 i found using the javascript "prompt" command doesn't work and throws javascript errors -- but everything else seems to work okay.
so, for our in-house webapp, we require IE5.5SP2, because we can ( sidenote: i wanted to target mozilla). having a website on the internet cannot, for the most part, require any specific version of a browser. because they are all incompatible with each other... should we use IE3, IE4, IE5, IE5.5, or IE6???
so, which version of IE should we all use as the standard? and if you come up with a particular version, the penetration % is not nearly as high...
i'm rambling and responding to a troll... oh boy
Like the subject says. Automatic updates are not a feature that will make people love MS over Linux. Even people who like MS would typically still prefer to decide for THEMSELVES when it's a good time to upgrade instead of having no choice over the matter.
Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.
Isn't NTLM an proprietary authentication protocol? There are plenty of existing, secure, standard HTTP authentication methods that are already implemented in Mozilla. If we implement every proprietary extension that various vendors create, we're shooting ourselves in the foot, to say the least. If the Mozilla coders create NTLM authentication, it's like saying, "Go ahead and deploy Windows with IIS and proprietary authentication instead of Apache and OpenSSL, we support you!".
No, write the damn code. That's what software freedom is about. You've missed the entire point.
Sadly, this is easier said that done. Simply getting into the Mozilla project is difficult at best--I myself have tried and failed, and no longer subscribe to the notion of "writing the damn code yourself."
Can we blame them for being ineffective at responding to new coders? Probably not. Mozilla is a massive project, and the people who keep tabs on that sort of thing most likely have more urgent things to do than respond to every newbie who offers to help out. On the other hand, the "write the code yourself" argument is arrogant and lazy, because it's not really an option for most people, even if they are willing to help and experienced coders. A better response would be that there are other things with higher priority which need doing first.
Additionally, as has been pointed out before, complete feature patches written by people who managed to get in to fix their "pet bug" often go unapplied for months. PNG alpha support under Windows (or was it Linux? I don't recall specifically) was an example for this--the patch was there for months, and the feature was continually ignored as it accumulated votes, until someone finally decided to put it in.
In the future, you may want to consider being a little bit less snide about people posting feature requests. Feature requests give a project direction, by allowing the coders to get a feel for what people would like the product to be like. Scoffing at them is intentionally ignoring the requests of your audience.
You don't have to shout, I can hear you just fine.
Seriously, you are making my exact point. This is why designers will use relative widths to ensure their content can be rendered nicely in a variety of interfaces.
My assertion is simple: the existence or non-existence of a height scrollbar should not change the relative width of the viewframe. The scrollbars belong to the application, and not the content. I don't know any designer or user who expects a scrollbar to cause a reflow of the contents, shortening or lengthening all responsibly stated relative widths by X pixels.
You are right: designers should expect the width and height to change. This why we have used percentiles to describe relative widths to make sure things flow nicely, regardless of the interface. Having a situation where the width changes on arbitrary changes to height is, IMHO, plain stupid.
Anyway, if the history of that bug, and the conversation threads here say anything, it's that this is not one of those cases where anyone is concretely "right" or "wrong". This is a usability issue, and I would challenge the Moz team (or anyone else) to submit this behaviour to a battery of real usability tests. If it was determined that the majority of users and designers don't mind how a good number of existing pages render, then I'd reconsider.
Until then, I'm not convinced.
-- clvrmnky
I don't know how you are getting that from me. I'm the last to say I want an absolute width, and have made that clear several times. I am using percentiles to describe CSS objects which are floated left. This is pretty generic. I am not flaunting anything. I have no problem with the width changing if the container the text is in, or near, changes.
I can't put it any plainer: I object to the scrollbar, which is an application widget, counting as any width in the viewable contents of a page. If it was anything else, I'd be agreeing with you, but it is a scrollbar. I do not consider the scrollbar a CSS object around which I must flow my content. If you do, fine. This is what the bug is essentially about. Some agree, some don't.
It's pretty common to build a site with a common navbar across the top. If some of those pages happen to have a maximum height above the viewport, and some that do not, navigating between the pages does two major things:
1. Causes the right margin to jump by however many pixels the scrollbar is set to
2. Causes the hyperlink that the mouse pointer is currently under to move away from the pointer
This last is especially insidious. UIs where gestures cause controls to move away from the the pointer are just bad.
From a usability standpoint, I cannot agree that this is not a problem. Scrollbars are part of the chrome, and not the content. Gestures shouldn't move the UI around in unexpected ways. An interface that encourages this behaviour is flawed.
The first item just makes Moz look unpolished unfinished. It's a graphical browser, for crying out loud! It should look good.
It should be easy for designers to develop simple pages that do not violate good usability. It should be easy for Mozilla to render standards-compliant pages in a friendly manner.
Mozilla is the only browser that does this, AFAIK. This is not a user agent issue. It is an application issue squarely in the domain of the Mozilla presentation code. Just because we can access the application chrome with a URL doesn't mean we should, in this case.
Just to make it clear, I am not trying to establish an abolute size. I am not trying to enforce a particular width. I am objecting to 60% + 20% in a simple CSS property that is changing because of an application control, and not content. I have no problem with reflows being forced due to content changes. Scrollbars are not content. If you must disagree with me on this, so be it. Please do not conflate my issues with usability with any type of fixed or absolute positioning.
-- clvrmnky
Yes, I'll just wave my little magic pixie stick (and quit my day job) so that I'll learn how to write software. You do realize that not everyone knows the inside and outs of programming! This whole "write it yourself" philosophy is such crud ... people like you must try to remember that there's more then one kind of computer user.