Slashdot Mirror
Mozilla: The Good And The Bad
Rui del-Negro writes "According to this article at The Register, six security flaws in Mozilla were posted to BugTraq last weekend. They have not been added to the official Mozilla vulnerability list yet. But details can be found here, here, here and here (phew!).
Finally, two other bugs were found, relating to loading GIF files (in several Linux browsers) and Mozilla's (JavaScript) implementation of onUnload ( ).
Are they trying to prove they can beat Microsoft at their own game..? Or is someone just trying to win a prize?" On a brighter note, Zerbey writes "From Neil's Place here is 101 Things Mozilla can do which IE cannot. Very interesting reading and an excellent resource for convincing stubborn Internet Explorer users why they should switch. This article was also reported at Mozillazine. I'm still waiting for NTLM auth to be implemented so we can switch over at my workplace, the only reason we still have to use Internet Explorer."
OK, 21669 to go :-)
Trolling using another account since 2005.
As of 1.2beta almost all of these are fixed. In general opensource is not a whole lot more secure than closed source (both are programmed by humans), they just are more open with information and quicker with fixes.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
"...resource for convincing stubborn Internet Explorer users why they should switch..."
Should be:
- Provides a better subjective browsing experience
If that's not true, you'll never win.If you read ALL the way to the end of the article you'll note that 5 of the 6 bugs are already fixed in 1.0.1 which has been out for a couple months now. I believe the sixth is already fixed in the 1.2 nightlies.
However, also according to the article on the register, most of these bugs are in Mozilla 1.0, which makes this kind of old news. Mozilla 1.0.1 was specifically advertized as a security bug-fix release, and has been out for quite some time.
What a fool believes, he sees, no wise man has the power to reason away.
Fortunately, these are shallow bugs that will be found by many eyes. I'm guessing I won't have to wait more than a few hours for a patch that fixes any of these either. And while IE exploits tend to be devastating, since Explorer is integrated into the whole Windows OS, these security holes in Mozilla will, at most, crash your browser, a minor inconvenience. All this proves is that Open Source is (still!) better than proprietary software. Keep up the great work, Moz team!
Karma: Good (despite my invention of the Karma: sig)
When you're on a Linux machine, Mozilla is a fine choice for web browsing. And it has some nice features like tabbed browsing that soften the interface somewhat, and some like javascript privilege control which make the web more tolerable.
HOWEVER, the Mac versions are basically unusable and the Windows version is hurting. Mozilla still sucks when good web browsers exist on that platform.
Cretin - a powerful and flexible CD reencoder
Comment removed based on user account deletion
Now, is there a 10 Things IE Can Do That Mozilla Can Not such as run ActiveX properly if at all so one can go to most msn.com sponsored sites such as MSN Chat? Or how about properly running the Java plugin so Yahoo! Chat doesn't crash after a few minutes. I'm not making this up. This happens everytime.
Believe me, like the rest of you, I love Mozilla, and I live by the tabbed browsing. But unfortunetly, there are a lot of things I do on the Internet that still force me to crawl back to IE.
Being a developer myself, I have a huge number of bugs that are reported to my team and I on a daily basis. While security is always a key concern, there is an entire process of validating a bug prior to adding it to an official bug list. An open source project, such as Mozilla, has to rely on the input of who know who for possible bugs, then also has to rely on a large number of volunteer developers to help validate the bug. Sometimes these processes take time.
Take the time to compare Mozilla's submitted bug report and their official bug list versus Microsoft's (that is if you can find a copy of it).
kha0z
Master of ImportChaos.com
How my favourite bug was turned into a feature is the best example I have of how easy it is to get off the track with big projects like this.
The bug got lost in several threads, flames and arguments about what IE does or does not do, until it was finally marked WONTFIX by a Mozilla demi-god. IMHO, they missed the point. There is a constant refrain in Bugzilla about whether something is "standard" or not.
From my experience, the argument about web standards is used to either fix or not fix something, depending on how someone feels about a problem.
Don't think it's a problem? don't fix it and say "it's not standard, so we won;t" or "it's not standard, but we break the standard everywhere where it makes sense". Some behaviour need changing? The same arguments apply.
I may be just whining here, but sometime I think the fact that Mozilla is a web browser is lost in the arguments. I still love Moz, but the fact that the right-margin jumps around on my otherwise fine HTML 4.x and CSS pages will always bother me.
-- clvrmnky
HOWEVER, the Mac versions are basically unusable
Mozilla start time on my G4/667MHz/1GB RAM Powerbook: 29sec (!?)
IE start time on same machine: 2sec
Omniweb start time on same machine: 1.5sec
not to mention that Mozilla hangs for seconds at a time quite often, and looks and feels clunky and bolted-together.
But what do I know. I'm just looking for anonymous gay sex.
Well, they may be more open about it, but IE has the advantage that when a bug/hole is fixed it takes a small download to fix it, ware with mozilla and 99% of other OSS progs, takes ether a complete re download to fix it, a download of a source patch then a recompile, or possibly even fixing the source yourself (assuming you know enough about the internals of the program to fix it)
Yeah, I suppose writing patches for WONTFIX and INVALID bugs is pretty much a waste of time. Idiot.
What a fool believes, he sees, no wise man has the power to reason away.
Another is seeing all those pr0n sites in your cookie block list.
-- clvrmnky
Yeah, imagine that, the Evil MS notifies customers that an update is avaliable, but the wonderful Mozilla organisation has people visiting the site looking for an updated version or patch. I know that my family at least finds that much easier because they have a deep interest in what web browser they use to browse the interweb...
If you're gonna complain about MS, at least use a valid argument, god knows there's a lot of them, but the kneejerk whining about MS being evil doesn't really do any good for anyone.
Wax-Museum Fire Results In Hundreds Of New Danny DeVito Statues
...the Mac versions are basically unusable...
How are the Mac versions unusable? I've been using Mozilla 1.2 beta on OS X for weeks, and it's working wonderfully. Extremely stable (hasn't crashed once), reasonably fast rendering, and the best standards compliance I've seen on any browser. It would be great if the overall browsing speed were improved, but as the browser I use on a daily basis, it's certainly usable even in its current state.how about some details on how "the Mac versions are basically unusable"? I've used them, so they're not *unusable*, and they perform pretty well; in fact, I know plenty of mac users who prefer it over IE.
:)
Why do you say "the Windows version is hurting"? what problems do you have with it? For me, it works just fine and I prefer it over IE, even with the slower loading time, and even on my slow K62-400 with 48 MB RAM. I did say "for me", but in all truth I can't find any instances where it is "hurting".
Your final comment seems to imply Mozilla is not good, which in my oppinion is not true. Hey, we're all expressing our oppinions here, nothing more
Or you could go to "Edit" -> "Preferences" -> "Advanced" -> "Scripts and Plugins" -> and uncheck "Enable JavaScript for...Mail and Newsgroups".
Does IE let you do that? Why do you need JavaScript in Mail anyway? I won't even accept HTML email.
Text is fine. I get the content without all the cookies and graphics.
"History doesn't repeat itself, but it does rhyme." Mark Twain
Because Mozilla is open source, it's better than any other closed source alternative. I have only three reasons why I use it:
1. Smart Features -- not bloat-ware.
2. Tab Surfing.
3. No spyware or ads.
The information exchange is one factor of why open source is better, however, consider this as well: every decision you make adds to the total inertia of a project. Therefore, when you base a product on open source, you are creating a momentum that is going to carry on through your whole project. By saying, "Yes, we will listen to our public", you are also saying that you will like your public, and your public will like you in the end.
Microsoft has never done that. They put you on hold, put you off, ignore you and they do what they want. How long can they continue to take that stance in the face of an angry public?
Marshall Berman said it best when he said you can't slow progress or stop it. You can only guide it. He goes on to say that anyone who tries to resist change is going to pay the price in the end. Well I can't think of any other company that has resisted change as much as Microsoft has - especially recently.
One way would be to use the browser ID to add a little 'info' strip to the top of pages, specifically for IE users. It could be just a small one-line table at the top of pages -- maybe with a contrasting background to be noticeable, and say something like:
"Internet Explorer has several vulnerabilities that may allow others to take over your machine. You may want to apply fixes or try alternatives.
I can't find the link to the 'master list' of unpatched IE flaws, I had it bookmarked somewhere.. But I would imagine using the browser ID string the client sends to apache, this could be done in PHP or something similar. Yeah, it'd probably be a performance hit, but for anything but the biggest sites, it might work.
I've also noticed that some IE browsers appear to be sending the actual patch revision! Example:
217.81.215.xxx - - [06/Nov/2002:00:00:19 -0600] "GET / HTTP/1.1" 200 34629 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; QXW0339a; Q312461; .NET CLR 1.0.3705)"
Q312461 leads us to a MS Knowledgebase
article. I've no idea what the QXW0339a is, though.
Interesting. So one could go so far as to take the patch version off the browser ID string, check it against a database of strings, and return a comment that mentions the serious vulnerabilities affecting that version. I'd be happy to just run something that added a small tagline to the top of pages for all IE browsers, though. The more sites that did something like this, the more the word would get out. I think it'd be productive. :)
Someone you trust is one of us.
But, looking over the list of 101 things Mozilla does that IE doesn't, there are plenty of things that IE does, and has done for years. (It may not do them on Windows -- I have no idea.)
I can view cookies, block individual cookies, disable tooltips and a bunch of other things listed. I'd also argue that IE can be trivially installed and uninstalled and has a more complete, and certainly much more usable bookmark manager.
What I'm listening to now on Pandora...
As well as shift-mousewheel to navigate history...
Probably many more incorrect ones in there as well.
Only thing that Mozilla does that IE doesn't that bothers me is PNG and MNG support. I really wish IE would clear those two up.
In my experience, Mozilla 1.0.1 and 1.1 are pretty stable. (Don't expect the betas to be stable though, they're not meant to be, and often aren't)
Also be aware that Mozilla prefers to be installed into an empty directory. Installing one Mozilla over another is not supported, and can sometimes result in an unstable Mozilla install.
I've been using Mozilla for over a year now and for the life of me, I still can't access anything via. https. So, I have to open IE to do anything secure forms. I've read that I must do a complete install in order for this to work which I do, but still no dice.
Anyone have this problem?
Here's a link. On November 6, 2002, there were 31 security vulnerabilities in Microsoft Internet Explorer
The link is taken from: Windows XP Shows the Direction Microsoft is Going.. If Spanish is your native language: Windows XP muestra la dirección que Microsoft está tomando.
How very odd. I just used Redhat's up2date and received/installed the latest version of Mozilla that Redhat uses, and it is just as easy Windows Update. No compiling by me, it does it all for me. By the time my soup was warm (mmmm lunch...) I had a newer, safer version up and running.
The soup only took 5 minutes...
My experience: On Windows XP, Mozilla 1.1 is the best browser.
It's not the JavaScript language itself that differs between IE and Mozilla. It's the DOM, which is the data structure for accessing elements on the web page. Your friend is incorrect about Mozilla; it's IE that makes up its own DOM standards.
What a fool believes, he sees, no wise man has the power to reason away.
I've never walked into a Fortune 500 company and seen Mozilla running on a PC. Never.
Are you sure you're looking? Quite a few people at my company (it is in the Fortune 500) use it, and we're nothing special. It's not the majority of people, or even close, but certainly not zero either.
On a funny sidenode, while trying to use the link above:
"Sorry, links to Bugzilla from Slashdot are disabled."
How sad. You don't 'talk' to a support technician with Mozilla, but you can usually get in contact with the person who actually wrote the code that's giving you trouble. Personally, I find this preferable to sitting on hold, paying through the nose for phone support, and talking to someone who hardly has the technical knowledge to use a computer, let alone code a browser. Mozilla's problems and bugs are well-documented; IE's are well-hidden. Mozilla has an excellent secuity track record; IE's security track record can be seen by the seemingly endless stream of advirories and patchs.
It's a shame that these Fortune 500 companies choose inferior products with inferior support on the basis that they're able to hear a human voice when there's some sort of problem; regardless of whether or not that human voice has the slightest understanding of the problem, the solution, or even the product.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
1. You can do this by writing a 12 line VB app that embeds the MSHTML COM control on separate tab controls. Some projects already do this. (Yawn)
5. uh, hit ctrl-H in IE6
7,8. Hold control, scroll mouse-wheel
17. IE does this
22. This can be set in IE
31. IE can do this
46. Is this a joke ?
77. I don't buy this. IE is a ship-component of Windows XP, and thus exists in 25 distinct locales.
97. This is just fanboyism. There is no substance here.
101. Got me there, champ.
These are just the things I know are crap off the top of my _head_. Why does fanboy shit like this make it to slashdot on such a consistant basis ?
My opinions are my own, and do not necessarily represent those of my employer.
I think Mozilla is in a position to really get innovation going again. Being a Web developer who started back in 1994, I remember first using Mosaic and Netscape back when features came so fast and furious that you really like progress was an everyday thing. I haven't felt that way lately (at least about Internet Explorer). So without further ado, here are some ways to innovate at a fundamental level, changing some things that should have been obvious.
First, making navigation buttons out of the link tags is great. But does Mozilla pre-fetch the "next" link, so that if I actually decide to go to the next page (likely), it comes up fast? WebTV has this feature. Makes the Web feel faster.
Second, why am I entering HTML tags into a plain text field? Where is the HTML text field? You know, a form object that comes with B, I, and U buttons, and allows me to visually format the text before sending (and which is delievered as standard, XHTML 1.0 compliant markup)? I've seen that Microsoft's new Web-based Outlook tools have this, but they use over 100k of JavaScript files to accomplish it. Shouldn't we just have something like this: <htmlarea></htmlarea>???
Finally, one of the things I've been waiting for is the ability to set images or other objects on angles. For example, if I wanted to have the slashdot logo appear as if it were on an incline, I might use CSS to specify the image display at -15 degrees. And if this were exposed to JavaScript, I could make some interesting animations. But I haven't seen this in CSS yet.
In short, I remember fondly when Netscape pushed the envelope -- I remember Andreesen adding the img tag, I remember Netscape implementing the file upload tag. I think some working demos of this stuff might help it gain acceptance, and give people a reference model to work from. Not to mention make Mozilla seem much more useful than Explorer.
My Greasemonkey scripts for Digg &
I've found that the Bugzilla for Mozilla, Newsgroup usefulness, and general web resources are better, or at least equal to, that of Microsoft. Microsoft has an edge with phone support but, I run 10 servers and 50 workstations, all running Microsoft with SQL, Exchange, NT, 2000, and more - and I've never had to call them. I won't.
I dread calling them. It costs money, immense amounts of time, and I would sit on hold just knowing I'd end up with a moron who would suggest that I try rebooting.
This notion that a software company must be responsible for it's software, so that someone can be held liable and can be counted on to help, is really just dependency and lack of personal responsiblity, and ultimately a crutch. MCSE means Must Consult Someone Else.
Perhaps Fortune 500 companies ARE Fortune 500 companies because they pass the task of software support and maintanence off to the companies that make the software, and focus on their core business.
But they're also the ones spending obscene amounts of money and time trying to understand Microsofts insane licensing policies.
They're spending time and money evaluating Microsoft's DRM moves, preparing to deal with the inevitable (some would say immediate) consequences of Microsoft's negative, condescending attitude toward it's customers.
They're the ones who woke up one day and realized they were renting software, not buying it, and that they have an evil landlord and can't do anything about it. They're just happy their investors also like Microsoft so that they percieve this dependency as a "strategic relationship". They're the ones subject to the whip hand.
I've never walked into a Fortune 500 company and seen Mozilla. I've also never let the public see me having sex. Neither of those means that it doesn't happen.
# Erik
Look.
Microsoft notifes us *when a patch is available*.
The Mozilla community notifies us *when a security flaw is found*.
Do you want to know about a problem when it is discovered, or after someone has already engineered a fix?
If your car was discovered to be prone to stopping dead on the highway and blowing up, you'd want to know before the manufacturer figured out how to make it stop doing that. You'd want to have the option of choosing to risk it, or parking the car and driving something else for a little while.
Now you know what activies are prone to security dangers, and can either avoid those activities or use another browser for a while.
...
I'm a bit flabbergasted by that argument. Is that support free? What do they do to help? Can you cite an example of a problem they fixed? Do you seriously need help to control the settings in IE?
I've never walked into a Fortune 500 company and seen Mozilla running on a PC. Never.
Fine. I have though, now what? :-)
I've been using Mozilla for over a year now and for the life of me, I still can't access anything via. https...
do you have the mozilla-psm package installed?
the https part of mozilla is often in a second package, maybe for export or something. if you
only installed the rpm for mozilla, you may still have to install the personal security manager part.
here's what rpm on my redhat 7.2 based machine shows for example:
[root@mouser root]# rpm -qa | grep mozilla
mozilla-1.0.1-2.7.3
mozilla-nspr-1.0.1-
mozilla-psm-1.0.1-2.7.3
mozilla-nss-1.0.1-
nautilus-mozilla-1.0.6-16
so, check to see if you can install the mozilla-psm package and https should be all set
here's the rpm -qi Description for mozilla-psm:
Description
The mozilla-psm package provides Secure Sockets Layer (SSL) support
for the Mozilla Web browser.
One way would be to use the browser ID to add a little 'info' strip to the top of pages, specifically for IE users. It could be just a small one-line table at the top of pages -- maybe with a contrasting background to be noticeable, and say something like:
"Internet Explorer has several vulnerabilities [bellaonline.com] that may allow others to take over your machine. You may want to apply fixes or try [opera.com] alternatives [mozilla.org].
My guess is it will get ignored just as quickly as the recent pop-ups that warn, "Your computer is broadcasting an IP address. Someone can use this information to attack your computer."
People who know better (or think they know better) will use Mozilla or Opera. Those who don't know, or more commonly, don't care, will continue to use the easiest way to access the web. Like it or not, IE is immediately available to the masses and it will be the first choice for those people for a long time.
If I can't do crap about fixing it, what should I do, stop using the www? What other browser is secure to use as a replacement? Lynx?
Yeah sure it's great to find out there's a bug, but, I'm gonna bet that 95% of users on the internet couldn't care less about what software they use as long as it gets the job done.
Geeks care about what software they use, geeks also make sure they have the latest version by visiting the sites now and then and by reading tech news, then it doesn't matter if they use IE, Opera, Mozilla, Netscape, Lynx, Mosaic or if they hold the ethernet cable to their tongue to read webpages, geeks will make sure to have the latest version and all relevant patches.
An insecure browser is an insecure browser, whether it's made by MS or not is irrelevant.
Wax-Museum Fire Results In Hundreds Of New Danny DeVito Statues
"Supports blinking text
You can make text blink."
*blink*
This is GOOD?
He also complained about Mozilla's vaunted "standards compliance." His exact words: "Mozilla invents its own standards, and it's the only one to comply to them."
For the most part, this is only true if your friend believes that the W3 is a subsidiary of AOL. Needless to say, it isn't, and in fact many of the standards which Mozilla follows (While IE only sorta follows) were written by groups that included representatives from Microsoft. A partial list of the (real, non-Mozilla invented) standards that Mozilla enforces can be found here.
Isn't javascript "write once, run anyware" kinda stuff?
It'd be nice, wouldn't it.
JavaScript is a Netscape invention, always has been. As such, Netscape did write its own standard and is the only one to comply with it. However, there IS a real standard known as ECMAScript that Moz and IE both do a reasonably good job of supporting. Unfortunately, this does not cover everything. ECMAScript can be thought of as defining the 'core' of what scripting on browsers is often used for.
Beyond the core are the areas of scripting that make up the buzzword-compliant DHTML (Dynamic HTML, a fancy way of saying JS, CSS, and HTML)
This is where cross-browser scripting gets hairy. The standards used for manipulating documents dynamically are collectively defined by the W3 as the DOM, or Document Object Model, which has many uses outside of HTML, but we'll stick to its HTML uses for now. Unfortunately, some of the more advanced elements of the DOM are still in a drafting phase, and as such are not ready to be used as standards. Meanwhile, browsers implement support in their own ways, lacking any sort of rules to adhere to. It's my hope that as these drafts are finalized into W3 Recommendations, that MS will include support for them as I know Mozilla will. Until then, browser detection will continue being a way of life for advanced client side scripting.
> It has much fewer bugs and still retains all the
> functionality needed to have a decent web
> experience.
Let's get real here. Dillo is great to browse simple stuff like local HTML documentation, and it's good for checking on the local news sites (when it doesn't choke on them too badly), but that's about all it's good for.
It has some sort of annoying cache bug that lets it get "stuck" (refusing to load a document whether you hit reload or not) on pages like Google's search results.
As distributed (version 0.6.6), Dillo doesn't do any kind of authentication or SSL. It also doesn't do Javascript/Java. So it has to be *very* casual browsing. It also doesn't print.
(I use Dillo myelf for viewing local copies of web pages I make for my students. This is mainly because it's so FAST.)
-- Rick
I recall reading about this; those bugs were fixed before the bugs were reported this weekend.
It's been a long time.
In particular, if I wish to have Spanish-language dialogues in Mozilla, I (as of a month ago) can not upgrade to Mozilla 1.0.1 because none of the volunteer Spanish translation teams [1] has updated their 1.0.0 translations to version 1.0.1; instead they chose to direct their translation efforts towards 1.1 and 1.2.
Compare this to AbiWord, which has a translation structure such that, if a given translation team decides that meeting girls at dance clubs is far more fun than spending Saturday night translating dialogues, the translations still work for new versions of the program. If any new dialogues appear, those dialogues will be in English until someone steps up to bat to translate them, but any unchanged dialogues remain translated.
IE has an edge here, since their translation teams are paid; guaranteeing that any formal release of IE will be translated in to all officially supported languages. The disadvantage to this is, if a given language is deemed by Bill Gates to not be worthy of translation, you have to use the application in English (or one of the other official languages).
This structure causes Mozilla 1.0.1 to have translations available in languages like Estonian (a beautiful language [2] which has about, as I recall, 2 million speakers) but not in Spanish (which has more native speakers than English--about 325 million).
OK, thinking out loud, it should not be too hard to set up a perl script which unzips a translation for a given version of Mozilla, compares the labels against the English version for a given later version of Mozilla, and then translates all of the labels it can; leaving the untranslated labels in English. This would be far more productive than posting to Slashdot; perhaps a Mozilla guru can tell me if a tool like this already exists.
- Sam
[1] There are three Spanish trnaslation teams: One for Latin American spanish, one for Argentinian Spanish, and one in Spain. The Argentian is the most active group right now.
[2] One of my linguist teachers is a native Estonian speaker; she once talked to us in Estonian to demonstrate a language learning technique.
The secret to enjoying Slashdot is to realize that it should not be taken too seriously.
the desire for standards compliance is so web designers can write their sites once and have it work everywhere, without having to worry about what browser the client is using...
however, your statement for using IE as a base for a standard is not only silly, it's stupid:
we've written an in-house webapp that only works on IE5.5+ (5.0 does NOT work, something in the DOM or javascript), and testing on IE6 i found using the javascript "prompt" command doesn't work and throws javascript errors -- but everything else seems to work okay.
so, for our in-house webapp, we require IE5.5SP2, because we can ( sidenote: i wanted to target mozilla). having a website on the internet cannot, for the most part, require any specific version of a browser. because they are all incompatible with each other... should we use IE3, IE4, IE5, IE5.5, or IE6???
so, which version of IE should we all use as the standard? and if you come up with a particular version, the penetration % is not nearly as high...
i'm rambling and responding to a troll... oh boy
...and my crotch started to burn. Is that bad?
Idiot.
Sure, IE has bug, Mozilla has bugs, Konqueror has bugs, Opera too, has bugs. Big whoop.
Yes, they need to get fixed, but don't get your panties in a knot if another (or several) bugs are found. They get fixed. We get a better browser as a result of this fixing. Yeehah. We all win.
The whole buissness over IE is just stupid. I, as a UNIX user can't use MSIE because my *nix boxen (except for my Mac OS X and SPARC/Solaris ones) can't even run MSIE. So I use something else. Moz is nice. Konq is also nice. I understand people thing Opera is snazzy. Hey I can browse the web! yippee. Get over it.
Try K-Meleon. It's a stable, quick version of mozilla. It also has a nicer interface, IMHO, and is brutally easy to make skins for(which, as we know, is all a web browser is good for -- showing off skins! :) )
It's been a long time.
I was able to access it fine with Galeon. I'm also using Privoxy which may nullify whatever lame Javascript trick kept you from getting through.
If the software you are using has a security flaw with grave enough consequences, you should stop using the software.
Now, who can better evaluate whether a security breach is serious enough to stop me from using the software? Microsoft, or my organization??? Isn't this obvious?
And I don't come whining with the "users don't care" crapshit. I care. That's enough reason for Microsoft to release advisories when the flaws are found, not when they're patched.
If at first you don't succeed, skydiving is not for you
2) View source opens notepad. I want to be able to edit, save (without it downloading the damn thing again!), and whatever.
File --> Edit Page
What you're looking for is over here.
Of course, it's a proprietary solution. A much better option is to implement a similar editing tool in JS/DOM that works in both Moz and IE6+ (Maybe Opera 7 if it actually includes some respectable DOM support)
...but what if the bug is "fixed" by microsoft saying, "you need to upgrade to IE6"?
I'm sure there are security bugs in Mozilla that haven't been made public yet. That was the problem with the onUnload(). It was known about for a long time, but not until it became public did it get fixed.
The main reasoning seems to be that vendors should be able to protect their customers.
But what happened with the privacy leak recently found in Mozilla? Granted, it was a minor glitch, but it is nevertheless useful in studying how policy affects security.
Did it help end users that it was marked sensitive? Well, Netscape knew about the glitch when they shipped their browser, yet, they shipped it. On the other hand, the leak was patched shortly after the story broke, so the answer should be a clear "No!"
This is an example that it is not sufficient to have the sources open, you have to get some light onto the problems too.
Employee of Inrupt, Project Release Manager and Community Manager for Solid
The tipoff in what your friend says is "for IE". You don't design web pages "for IE", you design them according to the standards so that anyone using a standard web browser can use them.
Are your CDs designed for your brand of CD player? Is the television signal you get designed for your brand of TV? Is your friend's phone designed to work well with your brand of phone? NO! They're all designed to work according to the standards, so they all interoperate seamlessly. It's time for that to happen with the web.
What a fool believes, he sees, no wise man has the power to reason away.
Would you? If I decide to stop using the web, how will I find out when a patch is released if I don't have a browser? Call a friend and ask him to look for it, download it, burn to CD, come over, and install it... Or, I take the risk that nothing will happen, go about business as usual and patch when a patch is out. Guess which option 99.99% will opt for.
Wax-Museum Fire Results In Hundreds Of New Danny DeVito Statues
Alpha works in IE on the mac, then again that isn't really IE =) recently I found that most of the features I use that were lacking from IE (popup blocking, tabbed browsing and a few otheres) are taken care of by crazybrowser (www.crazybrowser.com), but I still use mozilla 99+% of the time. I guess the reason that I won't use IE even with crazybrowser is that there is no good email client with it. OE is horrible (on a fresh XP install I fired up OE6 because I hadn't yet installed mozilla and I wanted to check something, well I got my mail fine but the next time I launch OE it ate all my email! Never again.) Outlook proper is better but as a support professional I see it eat someones email on an almost weekly basis.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
I love Mozilla. I use it on Linux, on Win-XP and Win-2000. But there's a major bug with it on Win-XP that will not permit me to use the mail client and/or set extensive preferences. At random points, all of my email settings and preference (font, size, etc.) settings get wiped out and revert back to the default settings that come with the deal just after you install. I've tried various solutions to no avail, and even posted a problem record to their bugzilla setup that looked like it never even got a glance.
I think there is a newer version available - maybe that will solve my ills. I still use it as my main browser, though I like Galeon on Linux better - I haven't given Phoenix a try yet ...
AZspot
Like the subject says. Automatic updates are not a feature that will make people love MS over Linux. Even people who like MS would typically still prefer to decide for THEMSELVES when it's a good time to upgrade instead of having no choice over the matter.
Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.
If you want to send me 30 dollars per call, go right ahead and fire away.
It's been a long time.
I understand that it would PROBABLY tend to be be more readable, but on what authority can you make the statement that you know this is the case. You will only ever be able to see a very unrepresentative sample of closed source code. You can only see that closed source which is put out by companies you have worked for or are working for. That's what "closed source" means. So what are you comparing with to make the judgement that open source "tends" to be more readable. If you could make the comparasin with it, it wouldn't be closed source.
Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.
Isn't NTLM an proprietary authentication protocol? There are plenty of existing, secure, standard HTTP authentication methods that are already implemented in Mozilla. If we implement every proprietary extension that various vendors create, we're shooting ourselves in the foot, to say the least. If the Mozilla coders create NTLM authentication, it's like saying, "Go ahead and deploy Windows with IIS and proprietary authentication instead of Apache and OpenSSL, we support you!".
8. NEVER have i had this or heard of it happening
.exe files with a .jpg extension, as in foo.exe.jpg. Made it kind of annoying downloading patches for Dungeon Siege. :)
I had it happen to me back somewhere around 0.99. It always wanted to save
This isn't true. We don't tell users as soon as a security bug is found, which is probably actually a good thing. What we don't do well, as this Register article shows, is publicising the bugs that we have fixed, even after we've distributed the fix in new stable releases.
ctrl-mousewheel zooms the whole document, not just the text.
Number 23 on the "101 things mozilla can do that IE cannot." list was colored source viewing, with HTML syntax markup. This is NOT a win for mozilla, seeing as how in their attempt to add color highlighting, they screwed up the primary purpose of "view source" which is to try to determine what's wrong when a page isn't displaying right. Their color highlighting algorithm, whatever it is, tends to LIE about what the source looked like omitting things that it didn't understand.
Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.
There's a big problem with typeing "mozilla.org" and clicking on the big link that says "windows installer download"? I mean, how stupid of people do we have to allow for, anyway?
Last I checked, updating Internet Explorer required you to only upgrade IE, and required you to reboot after install. There isn't much of a comparison there.
Who is this Anonymous Coward character, how does he post so much, and why is he always such a whore?
I had this same problem running Mozilla 1.0.1 (Ximian version) even *with* mozilla-psm installed. Apparently this was a problem with the RPM rather than the actual software. I fixed it the dumb way, by upgrading to 1.1.
Finding God in a Dog
My wife's been running Mozilla 1.0 or so on a Mac OS 9.2 system, and while her computer has crashed a couple times while using Mozilla, it crashes equally as frequently using Internet Explorer. It's definitely useable on a Mac.
sign up to a security list. plenty of free, easy email readers that *are* secure. If you know that your browser has a problem, either get the patch or switch to something else temporarily. If neccessary, use lynx. :P
For me, it's nice to have an upgrade setup that doesn't require IE.
Who is this Anonymous Coward character, how does he post so much, and why is he always such a whore?
Could you give an example or a bug report that describes this problem?
What a fool believes, he sees, no wise man has the power to reason away.
Excellent poing, kalidasa. I was about to say the same thing, but don't have to now. If us IE-bashers were whining about bugs in IE 5.000 that were patched in 5.01, or *gasp% 6.X, we would get yelled at.
Summary: There are securtity bugs in older versions of mozilla. As of now they are patched! Crap-ola! : )
Who is this Anonymous Coward character, how does he post so much, and why is he always such a whore?
I cut and pasted the link and read the whole thing. You're wrong, they're right.
Hello? HTML 101. The page width, and any other physical attributes of the output device, are unknown and unknowable. That's the entire point to the abstraction involved in HTML, as opposed to .pdf or something. You don't even have to have a screen to parse html to, the end user may well be using a reader. The entire point to using HTML is to mark up the content in such a way that the browser can then determine how to best present it.
Seriously, people like you are killing the web, choking it to death with your bullshit 'I'm a designer' attitude and it really pisses me off. People worthy of the title 'designer' in any field know enough to educate themselves about a particular media before they use it, but for some reason 'web designers' seem to almost universally feel that it works the other way around, that the media should adapt itself to their goals. It's like whining that charcoal needs to be fixed because it doesn't allow you to use colours.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
So you can't add attachements using a W3C standard browser because the company that owns the mail site, also owns a competing browser. sounds like a legal problem to me. PS - fake Hotmail into thinking your using IE, and your problem should be solved. There are ways to do it, IIRC, just google for it.
Who is this Anonymous Coward character, how does he post so much, and why is he always such a whore?
user_pref("capability.policy.default.Window.onunlo ad", "noAccess");
[take out the space]
I love the fact that security bugs are made public. I can decide whether to implement a workaround, disable a functionility, switch to an alternative, or wait a few days for the binaries to come out for my distro.
Sure Mozilla may offer some neat "underground" type features but the one thing it doesn't do is offer the ability to talk to a support technician on the phone when it won't work properly.
You make a very good point. It certainly does reflect my experience to date.
Practically speaking, IT managers are a cautions conservative bunch, and when they rollout a product to the desktop they
- want,
- are willing,
- expect,
- and are suspicious if they don't have to
pay money for a deep bench of support.In fact, that conservative view on making sure things are stable is why most companies are no where near the level of XP deployment that MS is trying to push onto them.
However, I think most Fortune 500 companies are like mine: mere mortal users don't talk with tech support at Microsoft or, heaven forbid, the actual programmer at Microsoft.
No, our support calls get culled and binned. When and if a local tech decides that it's a problem with say, IE, then he logs it with Microsoft. And we pay for that privilege.
Whether Microsoft does anything about the problem is a whole other matter. While we have gotten genuine concerned support on some occasions (not for IE, for Exchange), other times you get:
- "that's not really a problem"
- "that's an extension"
- "we know about it already; it's fixed in the next Service Pack coming out RSN"
and where there's not a competing vendor for support that has the same kind of access to the source code. If we're unhappy with our support contract for Internet Explorer, then it's not like there's another choice.With Mozilla, support outfits are going to have to compete based on how well they perform in a competitive environment - anyone and everyone has direct access to source code.
Mozilla support companies won't be able to rely on contracts that are artificially fattened, based on some exclusive access to the source code.
IT organizations are getting pretty tired of paying big bucks to MS and feeling as if they have absolutely no choice in the matter.
Mozilla gives them a new choice that they haven't had until very recently.
Being cost conscious, I think they'll look into it.
"Provided by the management for your protection."
I worked at a wave pool as a lifeguard. Some of the lifeguards that had worked there longer mentioned one year they had a "rescue contest" to see who could save the most people.
That year saw more "rescues" of people to whom the description of "swimmer in trouble" only fit loosely, if at all. To win the contest the lifeguards would jump in to rescue anyone who could even loosely be interpreted as drowning.
The contest got canceled. Why? All of the 'rescues' were creating a paperwork overload and a perception of a dangerous enviornment - while doing nothing to make the place actually safer.
I predict the same thing for the mozilla bug contest. Lots of submissions, lots of work to process and order the submissions, some negative publicity, and at the end of the day, few additional bugs are found.
Maybe the state's highest function is to grind out insoluble problems. (Zelazny, Hall of Mirrors)
If they posted something off the point, you should've said, "Hey, in this case of standands compliant code, Mozilla is misrendering it because of the flow changes."
Instead you went off on a tangent. I've always hated IE's default scroll bar crap, being a person who never got on the IE train (the entire browser feels wrong.. the way it refreshes, etc.. it's a horrid caricature of browsing).
If Mozilla has an internal reflow which doesn't properly trigger when a page which is valid and standards compliant is viewed, that is a bug. File it as such, with that wording. When you sit and see 20,000 new bugs in your mailbox after coming back from a weekend somewhere, you will often times lose track of specifics, and bmark bugs as invalid based on the poor summaries people tend to write.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
This is odd to me. Since Mozilla hit 1.0, I've been creating pages for Mozilla first, then checking them in IE and they always come out right. This is partly because IE makes lots of assumptions to cover up bad code (such as not closing tags). While that might seem nice, it really is a band-aid solution that only makes the application unnecessarily large and encourages bad practices.
m l) doesn't lend you a whole lot of credibility in terms of web design knowledge. Anybody who has a Geocities Wrestling fansite (created with Yahoo pagebuilder no less) is going to have a tough time finding an audience to talk to about proper web design.
Mozilla doesn't invent its own standards - why don't you look at the HTML code generated by MS Word if you want to see invented standards! Look at IE's "page transitions," which seem to exist only to alert you that the web "designer" found a "really cool feature" in FrontPage.
Lastly, Java was intended to be "write once, run anywhere." JavaScript was originally a Netscape extension in the browser wars which MS picked up on, and has now become ECMAScript.
And frankly, your url (http://www.geocities.com/scotthallexpress/Bio.ht
I really hate signatures, but go to my website.
At least we know about them, and are able to fix them unlike with IE.
sPh
yes, patches makes life easier when upgrading, but how about when you put a new system together. geez, now you gotta download patch on top of patch to get it all fixed up. don't forget one!
i like the fact that when i download the latest mozilla, that's it! nothing more to do than install and go.
Ahhh, the tired standards bandwagon... Here we go again...
developers can finally just write according to web standards and know their websites can work for more than 99% of users
Here's the clue: you can do that now. You code for the browser that has the 99% market share. Like it or not, that browser is InternetExplorer. With a fraction of a point in market share, the Mozilla-based browsers can only follow, and try to duplicate the IE experience, "standard" or otherwise.
Though we here don't seem to acknowledge it, real end users don't give a rat's ass about "standards". They just want to get their work done. Preaching about how a browser, which many claim has an inferior user experience (e.g support for "non-standard" stuff like flash, or whatever), fully supports some-incomprehensible-acronym standard is a losing strategy.
Please don't mention standards again. IE is the standard.
Hey, Windows users, there is no such thing as "forward" slash, there is only slash and backslash.
I've never walked into a Fortune 500 company and seen Mozilla. I've also never let the public see me having sex. Neither of those means that it doesn't happen.
I used to use Mozilla all the time at a largish national phone company. Coincidentally, there was also that time at the beach...
Dewey, what part of this looks like authorities should be involved?
Does IE let you do that? Why do you need JavaScript in Mail anyway? I won't even accept HTML email.
First of all, IE is a web browser, not an e-mail client.
Second, I get a little yellow bar that says "This HTML message contains script, which Outlook cannot display. This may affect how the message appears."
Satisfied?
What are you doing, throwing undefined variables at the prompt function?
I have no idea what you're doing to the poor prompt function on IE6, but it's works just fine on all our machines, our customers machines, etc.
Seriously, Maybe you should post the offending snippet of code so we can tell you what you're doing wrong.
"Communism is like having one [local] phone company " - Lenny Bruce
I also use http://ttcplinux.sourceforge.net/tools/stunnel to use SSH via HTTPS, because the firewall here doesn't forward anything other than HTTP and HTTPS, but allows HTTPS to any port. Go figure. Type "gg:firewall-piercing-howto" in any Konqueror URL to get more information.
Home Page
IE has this too, though in a separate download. Probably makes more sense, ma and pa probably aren't gonna debug that game that you screwed up your coding on.
Utility for debugging JavaScript.
ahh so thats what that does.
But when you persist in complaining, you remind me all too much of people who put notices up that their sites are "best viewed" on a particular OS/browser/version/resolution/color depth, and that's hallmark bad web design.
They missed out a feature that I found extremely useful and find it annoying that it's not there in pre-1.2 Mozilla, which is Ctrl-Shift-F takes you straight to your defined search engine (which is Google if you have a clue).
#exclude <ms/windows.h>
Steven N. Severinghaus
Unfortunately, what you say is not quite true. While most of the six bugs on BugTraq were fixed in Moz 1.0.1 or 1.1, there is still one outstanding. And bear in mind that 1.1 is actually the current version of Mozilla. There's a beta out of 1.2, but I tried it and reverted to 1.1 when lots of basic stuff broke (and from other posts on this thread, I am far from alone). So in fact, there are security bugs in the current version of Mozilla, and they are not yet patched.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Here's your undeniable rebuttal: there are still security flaws in the current version of Mozilla.
Would you like to take a quick look at the code, and point out where to fix the remaining one of these six bugs, which is still in 1.1? I'm sure they'd be grateful to receive your patch.
Now, me, I like Moz. I use it in preference to IE most of the time, though I keep the latter around because Moz is too picky for its own good sometimes. I've even taken a look at the source code to see whether I might be able to help out, and one of these days I may submit a patch or two if no-one else has gotten there first.
However, having done that, and speaking as a guy who writes software for a living, I can promise you that most people who use Moz could not just go fix such a bug if they wanted to, even with the source code available to them. And bear in mind that the user base of Moz is likely to be considerably more technically competent than the average PC user.
Most development on big open-source projects is still done by a very small group of people, with a second layer of enthusiastic volunteers who are prepared to spend the time learning enough about the overall framework to get into it and write the patch they want. It takes a very significant amount of time invested before you can do this, which is why most people never will. Anyone who hasn't gains no benefit from the open-source nature of the product, as they are still dependent on third parties for both the code, and assurances about its security and robustness.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
IE is effectively the standard for end-users, at present, yes. However, it very much is in the interests of those users for the developers to get standards compliance out there, simply because the current standards allow those developers to do way more than IE's hacks. If you're talking about improving the user experience, you have to talk about letting developers use the cool tools instead of writing hacks to get IE to behave itself, and only write the damn thing once, so they can spend the rest of their time improving usability and such.
Also, note that IE's 9x% market penetration is only if you count all its currently popular versions, each of which behaves very differently in some key areas. You cannot write one page in "IE HTML" and expect them all to display it correctly. That kinda defeats the whole "you should write for IE" argument without further ado.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
The one you mention about not saving the address is annoying as hell, I agree. Here are a couple other pet peeves of mine that I really wish they'd fix...
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
My favorit
My favorite bug is wh
My favorite bug is when mail cras
My favorite bug is when mail crashes whenever I tr
My favorite bug is when mail crashes whenever I try to sen
My favorite bug is when mail crashes whenever I try to send a message
It's 10 PM. Do you know if you're un-American?
It seems to be hit and miss, but for some people, basic functionality like saving downloaded files seems to be messed up. My guess is that there is/was a bad build around somewhere on the beta site, and a whole chunk 'o stuff doesn't work in that build. I'm sure they'll fix it before 1.2 is released, it just means that some of us who'd like 1.2 features now can't have them yet, which is a shame if we're going to go bashing IE about security flaws. ;-)
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
That seems quite logical to me. And it's exactly what Mozilla does. If you dislike that, it's your prerogative. But it's not a serious issue to a lot of people, the Mozilla developers included.
But to reiterate, what you apparently want is to control the user agent; rather than understand the quite logical reason why this behavior happens and adapt to it, you wish to dictate the UA behavior and have it conform to you. This is, in my mind, a serious no-no of web development.
I've grown used to typing 'google' and hitting ctrl + enter and having the http://www. and .com added automatically. I really miss it when using Mozilla. Is there a comparable function?
Mozilla is my main mail client now, on Windows XP, and that never happens to me. Maybe I'm just lucky, or maybe there is some other issue at work here, but I thought I'd share that.
Has anyone EVER phoned Microsoft for tech support for IE? "Hey I was having a problem because IE kept crashing so I just picked up the phone and talked with their cheif engineer! Problem solved in just two minutes!!" Yeah right.
I've never walked into a Fortune 500 company and seen Mozilla running on a PC. Never.
I see far more Chrylsers in the parking lot at work than Ferraris. That must mean Chryslers are better.
there's no way I'll stop using IE until there exists the equivalent of the Google toolbar for Mozilla. I don't know if I could function without it.
I could not justify my existence if I were a turkey farmer. Would I terminate myself? Undoubtably, yes.
102.) If you don't like Mozilla, you have the option of uninstalling it.
Why would I want to have IE on a dedicated database server box?
Cheers,
Jim
-- My Weblog.
Being able to associate external applications with mailto: and news: I prefer my email client and my newsreader. The corporation, I work for, paid for the email client they use, and would never consider using a browser that would not use their preferred email client. This really affects the usability of the product. They will have to add this feature if they want us to adopt mozilla or Netscape for use in the business world.
Get a free ipod.
I REALLLLY wish the guy(s) who wrote the article had at leat used ie a couple of times in their lives. This is exactly the thing that makes M$ say us OSS supporters are full of crap.
... all the rest are too technical. but i see it supports the tag ... WOW ! and PNG transparency ...
IE is not all evil, i use moz, opera, and ie when making sites, but usually i browse with ie. I like it. Sorry.
2) is this really good? some sites use popups to show important information, when it only blocks popup ads call me, otherwise i will still use hosts.
3) IE does it on closing windows and setting 3rd parties cookies
4) IE provides a list of all links in a document and all images in a document in a separate window (d/l ie powertoys)
5) CTRL-I
7) CTRL-wheel
8) fixed size is fixed for a reason (hence its name)
11) see 4
16) when clicking add to favourites, check the "make avail offline box" it works in reality, not in theory
23) The edit button is configured automatically with your HTML editors, dreamweaver, Homesite, TopStyle and SlickEdit currently in mine. So no notepad.
25) ie has this, error by error (tools, internet options, advanced, inside the browsing cat)
26) ie has a debugger, its a POS but its there. (same place as 25)
27) Ie does the same but it searches the web for that term (maybe part of the powertoys) currently using yahoo in mine (dont use it so i dont know if you can change this or not)
30) clck the search button then on customize, you can even choose an array of searchers.
31) ie does this since 3.0
32) ?? which ones use it ?
33) you must be joking if you think this is good.
34) ie does this since 5.0
36) ie does this since 4.0
38) autocomplete its there since 5.0
41) view source? so it uses notepad... takes 1 sec to open it.
44) ctrl-wheel changes font size, ctrl-shift goes back & forward
46) comes preinstalled (ok, not a good point, but what's easier than that). Its installed off the net if you dont have it.
49) mac has ie too so it is cross platform.
I got bored
nt
It's called choice
You can also go to Edit : Preferences : Navigator : Internet Search and set your default search engine to Google.
Then type your search criteria into the address bar and hit the Search button; you'll get the Google results.
101. Giant lizards are cool
Much more exciting than a blue e.
I know plenty of ravers who would deny that - some have probably even seen giant lizards after a few too many blue e's....
Baz
I just typed in "cnn" and ended up with http://www.cnn.com/
i refer you to:
( slashdot is a blocked referrer, so no links)
bug 159450
bug 95735
bug 152701 (fixed on trunk)
bug 157646 (fixed on trunk)
bug 164695 (fixed on trunk)
bug 171274 (fixed on trunk)
all of which are 'permission denied'
which almost always indicates a security issue.
see http://bugzilla.mozilla.org/show_bug.cgi?id=1.2
Use my userscript to add story images to Slashdot. There's no going back.
since most filing systems don't save mime types more or less impossible.
You'd need end to end mime typing e.g. ftp that supports mime types.
thank God the internet isn't a human right.
And again, you are trying to control the user agent.
The actual HTML file had links in it that looked like so: href="foo.txt", but the view source displayed them with a fake space in the quotes like so href=" foo.txt". Since we were trying to debug why the link wasn't working at the time, this apparent extra space led us on a wild goose chase.
Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.
Ok, I'll let you get the last word in.
Err. Maybe not.
Ok, you win. I'm am trying to control the user agent. In fact, I'm trying to control all user agents, including the one you are using right now.
Seriously, I'm not missing anything, trust me. I've gone over this one-point-two million times, it feels like (once in the bug posting, once here). I'm not alone here. For every sane and logical argument you have for this decision, there are others with just as many sane and logical arguments counter to yours. You will ust never convince me that an applicaton control should effect the flow of content in this manner. It'll never happen.
I understand why this is happening, I just don't agree with the solution. I, in fact, don't have a solution, but probably would have chosen one of the other poor solutions.
This is one of those things we will have to just agree to disagree on.
Jim, the horse is dead.
-- clvrmnky
I've never understood when people talk about speed. On an 866 MHz Pentium III with Intel motherboard, loading a new instance of IE just took 3 seconds. Loading a new instance of Mozilla took 2 seconds.
Since Moz has tabs, I don't need to load a new instance. I can load a new tab in under 2 seconds.
It's essential, when running a Windows OS, to have plenty of memory. 256 MB is good for Windows XP. The virtual memory of Windows XP, for example, is very poor quality. Taking info off the hard disk is slow in any OS.
Make sure your hard disk is defragmented.