Security-Updated Versions Of Mozilla Released

petabyte writes "As mentioned in this Mozillazine article, there are new versions of the Mozilla Suite (1.7.2), Mozilla Firefox (0.9.3) and Mozilla Thunderbird (0.7.3) available. They address 4 security bugs (linked from the Mozillazine article). Unlike Firefox 0.9.2, these can't be fixed with just a XPI upgrade, so you'll have to download a new binary and install."

Comments

Does this mean that . . .

[Anonymous Coward]

Due to Microsofts previous wealth of experience in fixing security problems, can it be true that their patching process is more effiecient than the Mozilla's?

Why otherwise would it be required to download an entirely new browser to fix a few problems?

Re:Does this mean that . . .

[scifience]

The 4MB size of the complete Mozilla browser is smaller than many of Microsoft's IE updates have been.

So, while you may have to re-download the whole browser, the actual file size is still smaller.

Re:Does this mean that . . .

[NeoThermic]

At 5MB for Firefox (on windows), its far smaller than the average IE 'patch', which normally are around 7 MB or so.

Also consider that this *one* new install fixes what would require from microsoft as *four* patches. (and god know how much time between each)

As a side note, I got 0.9.3 before /. announced it, and got a nice hefty 1500KB/s sustained over a 768bps connection. I would suggest those who want to find out about new releases before a lot of others sign up to mozilla [dash] announce [at] mozilla [dot] org

NeoThermic

Re:Does this mean that . . .

[irokitt]

Trying to download a 4.0 MB file after it's linked to on the front page of Slashdot is never an easy thing, dude.

Re:Does this mean that . . .

[red floyd]

If you FTFL (follow the f'ing links), you'd see that the Moz download is 12 MB (win32).

Re:Does this mean that . . .

[Anonymous Coward]

yes, but people love convienence. people are lazy, therefore programmers must take up the slack....updates only, please....

Re:Does this mean that . . .

[phrasebook]

smaller than many of Microsoft's IE updates have been

Name them.

I think you pulled that out of your ass.

Maybe if you add together all the small IE updates, it totals more than 4mb at Windows Update.

But anyway, I'm sure your post was 'Insightful'.

Re:Does this mean that . . .

[Frizzle Fry]

The 4MB size of the complete Mozilla browser is smaller than many of Microsoft's IE updates have been.

This becomes less true, though, when Firefox requires you to download the 4 mb browser an infinite number of times. Which seems to be what it wants, since when I start 0.9.3 it tells me that a new critical update is available and that update turns out to be... 0.9.1. (And of course, if I install that and launch it, it will tell me that a new update is available...).

Re:Does this mean that . . .

[red floyd]

FireFox, OTOH, is a 4MB download.

Re:Does this mean that . . .

[Anonymous Brave Guy]

The 4MB size of the complete Mozilla browser is smaller than many of Microsoft's IE updates have been.

Sure, but tell that to the poor guy who's using a 56k modem to download it, and has finite on-line time in a month before it starts costing him more. Not everyone has broadband, not by a long shot.

Even without that, the hassle of the updating process is just too much for your average user -- or even most power user geeks -- to put up with for long.

Re:Does this mean that . . .

[red floyd]

got a nice hefty 1500KB/s sustained over a 768bps connection

I'm impressed! How'd you get the 15,000x speedup?

[
for the math impaired:
1500KB/s = 12000Kb/s
12000Kb/s / 768bps = 15625.
]

Re:Does this mean that . . .

[NeoThermic]

Really? His ass must be very correct:

Internet Explorer 6 Service Pack 1

I quote:

Windows Me:
32 MB of RAM minimum
Full install size: 8.7 MB

Windows 2000:
32 MB of RAM minimum
Full install size: 12.0 MB

Windows 98 Second Edition:
16 MB of RAM minimum
Full install size: 12.4 MB

Windows 98:
16 MB of RAM minimum
Full install size: 11.5 MB

Windows NT 4.0 with the high encryption version of Service Pack 6a and higher:
32 MB of RAM minimum
Full install size: 12.7 MB

Windows XP:
32 MB of RAM minimum
Full install size: 12.0 MB

Thats just *one*, and its larger than the 5MB 0.9.3 release.

NeoThermic

Re:Does this mean that . . .

[Anonymous Coward]

He used the Windows accelerators listed here.

(They really do work!)

Re:Does this mean that . . .

[NanoGator]

"The 4MB size of the complete Mozilla browser is smaller than many of Microsoft's IE updates have been."

Maybe version updates. However, most IE fixes are a couple of hundred K. Right now, I have a cumilative update that's 2.8 meg that fixes a small handful of things. What you're suggesting would require a 4 megabyte download just to fix a typo in the credits.

"So, while you may have to re-download the whole browser, the actual file size is still smaller."

This would only be true under strange scheduling circumstances. On top of that, IE updates don't require an uninstall.

I easily prefer Firefox to IE, but this statement is misleading in a couple of different directions. Microsoft definitely has Mozilla beat when it comes to the efficiency of updates like this, whether you focus on just the size of the file or if you expand that out to the total end user experience.

Re:Does this mean that . . .

[NanoGator]

"At 5MB for Firefox (on windows), its far smaller than the average IE 'patch', which normally are around 7 MB or so."

Bullshit. There's a fix for an IE exploit. 365K. Would you want to reinstall your entire browser, just to fix that one little thing that you urgently want to get corrected?

Re:Does this mean that . . .

[Lord Kano]

It's teh new compression.

LK

Re:Does this mean that . . .

[markov_chain]

Even if he meant 768 Kbps it's not enough to get 1500KB/s! 1500KB/s is more than 10 megabits.

Speaking of download speeds, this is something I saw on a university link ;)

mybox:~> wget http://savannah.nongnu.org/download/avr-li
bc/rel eased/RPMS/i386/avr
-libc-1.0-1.i386.rpm
--00:06 :49-- http://savannah.nongnu.org/download/avr-libc/relea sed/RPMS/i386/av
r-libc-1.0-1.i386.rpm
=> `avr-libc-1.0-1.i386.rpm'
Resolving savannah.nongnu.org... done.
Connecting to savannah.nongnu.org[199.232.41.4]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 409,351 [audio/x-pn-realaudio-plugin]

100%[ 409,351
10.01M/s ETA 00:00

00:06:49 (10.01 MB/s) - `avr-libc-1.0-1.i386.rpm' saved [409351/409351]

mybox:~>

Re:Does this mean that . . .

[aslate]

Yes, but they're mostly the people that don't download pre 1.0 release browsers. Once this hits the 1.0 release, i can see it being far more likely to be using updates rather then re-installs.

Re:Does this mean that . . .

[sharkey]

Maybe if you add together all the small IE updates, it totals more than 4mb at Windows Update.

Of course they do! Name one IE update that's been smaller than 4mb. Millibits are pretty durn small, you know.

Re:Does this mean that . . .

[bigberk]

Trying to download a 4.0 MB file after it's linked to on the front page of Slashdot is never an easy thing, dude.

I'm mirroring a couple of the files. Please verify the md5sums yourself, though.

• FirefoxSetup-0.9.3.exe
• firefox-0.9.3-i686-linux-gtk2+xft.tar.gz

Re:Does this mean that . . .

[Teckla]

Maybe if you add together all the small IE updates, it totals more than 4mb at Windows Update.

I can download and install the full Mozilla package faster than I can reboot my computer every time there's an Internet Explorer patch.

That puts Mozilla ahead of IE, at least in my book. :)

Re:Does this mean that . . .

[H8X55]

Did you have examples of that? Not to go against the grain by defending MS, but i don't recall many IE updates that large.

But I use MS @ work - so i'm uncool anyway.

Re:Does this mean that . . .

[line.at.infinity]

Still, I was shocked to be getting 80 KB/s... I think they should also consider making bittorrent and/or magnet links available sooner in order to trim unnecessary costs.

Re:Does this mean that . . .

[MBAFK]

"...Microsoft definitely has Mozilla beat when it comes to the efficiency of updates like this..."

I agree with the gist of your reply but I think you are comparing apples and oranges in your last sentance. You contrast the method Mozilla - a stand alone piece of software uses for updates to an those of a vendor of an integrated OS Microsoft (Windows). It would be fairer then to look at the solution one of the major Linux distros uses and compare it to Windows update.

In that case say for Gentoo you can do "emerge sync; emerge mozilla" etc...

Re:Does this mean that . . .

[Anonymous Coward]

Win Firefox is 4.8 MB. Obviously, you're both exaggerating. Please grow up.

Re:Does this mean that . . .

[afidel]

80KB/s.... I just got 350KB/s. Man do I love my Adelphia cable modem service, $27/month and insane download speeds.

Re:Does this mean that . . .

[rainman_bc]

" IE 'patch', which normally are around 7 MB or so."

To quote a previous poster: "Name them".

Did you do the math in your head to get 7MB or so as an average? IIRC most patches (except service packs) are 1MB. More like 150k from what I recall.

Re:Does this mean that . . .

[KarmaMB84]

The suite is bigger and is really the one that would benefit from being patchable.

Re:Does this mean that . . .

[Powertrip]

So my question is who cares? So what if this 'update' requires you to download a new binary -- I just appreciate the fact that someone is fixing things. I'm sure a 'patch' would have been nice if it was possible, but if its a new binary i need then so be it.

At least we don't need to wait a Month (or months) for M$FT to fix IE...

Re:Does this mean that . . .

[Anonymous Coward]

Already someone else posted some examples. I think the security update's download size is a rather trivial argument. Mozilla is cool because of pop-up blocking, tabbed browsing, better page layout, PNG support, etc. and Firefox even has some more additional features despite being the smaller download. So the security update this time is 5 ~ 8 MB, big deal. The http download for me was an unbelievable 80 KB/s under a slashdot load. That's phenomenal.

Re:Does this mean that . . .

[wkitchen]

Thats just *one*, and its larger than the 5MB 0.9.3 release.

Except for the WinME version, it's about the same size as the full Mozilla suite.

Re:Does this mean that . . .

[Anonymous Coward]

I are not a programmer but I have a question. Wouldn't it be possible to use something like a "binary diff" program for updates? If not then why nott?

Re:Does this mean that . . .

[Anonymous Coward]

Well, you DID have to wait at least a month for Mozilla to patch its browser.

Re:Does this mean that . . .

[russint]

Well, I guess bigger download speeds = bigger penis. I got it at 1120KB/S..

Re:Does this mean that . . .

[gregorio]

Really? His ass must be very correct:

Internet Explorer 6 Service Pack 1

I quote:

Internet Explorer 6 Service Pack 1
Internet Explorer 6 Service Pack 1 (SP1) is the latest version of Internet Explorer and includes a full installation of the Web browser.

This is not a patch, not even a service pack, it's a whole browser package with happens to be updated with the patch you wanted. That's useful when... Well, you want a full install with that specific patch, without having to install the latest build.

Re:Does this mean that . . .

[Omestes]

I'm still just gonna stick with 9.1... For my purposes it ain't broke (quite), so I'm not gonna fix it. I figure I'm download about 50 installs of firefox now, which is a wee bit too many in my book. Though on the bright side, at this rate their going to be forced to come out with the whole number version, they're rapidily running out of decimals. :)

I am a poor schoe with a 56k, and the wiring in my apartment is so that I can't have DSL, and my 56k connects at 28k (if I'm lucky)... Firefox is 2 hours of my life then... :(

Re:Does this mean that . . .

[kwanbis]

don't be ignorant IE 6.0 is a 66MB download ...

Re:Does this mean that . . .

[kbranch]

... 2 hours? A 4.7 MB file (The size of the Windows Firefox install) at 3.6 KBps (28k) would only take about 22 minutes. A fairly long time, but hardly unmanageable

Re:Does this mean that . . .

[Captain Splendid]

Trying to download a 4.0 MB file after it's linked to on the front page of Slashdot is never an easy thing, dude.

Piffle. Took me all of 30 seconds on cable, no mirrors used.

Re:Does this mean that . . .

[mrmag00]

I don't see how people gripe at Microsoft's update process.

As far as desktop PCs go, it is considerably better. For example, I would have never known there was a new version of Mozilla out likely except for reading this. I have to manually grab a copy of the updated version on all my computers and install it instead of having windows prompt me saying it has downloaded the recent updates and is ready to install them.

In fact I kind of have trouble reccomending Mozilla to others because of this now that I think about it.

Re:Does this mean that . . .

[threephaseboy]

Care to back that up? Even on a system with IE 4.0 (win95 or nt4) IE6 (with SP1) was 25M

Re:Does this mean that . . .

[Anonymous Coward]

Well, when you have to provide updates as often as microsoft does you get pretty good at it ;)

Re:Does this mean that . . .

[petabyte]

No but if I still ran Windows I'd love to be able to uninstall that "Browser" you call IE ...

Re:Does this mean that . . .

[Anonymous Coward]

Just flat out fucking wrong. Another dumb slashdrone.

Re:Does this mean that . . .

[jlink7]

Way to point that out for the masses who couldn't have figured that out for themselves if they really cared (honestly, the information was posted in the parent of YOUR post.)

Re:Does this mean that . . .

[Aeiri]

I love Firefox as much as anyone else, but aren\'t you exaggerating a little by saying 4MB... It\'s showing up as 7.7MB on my computer.

Or are you talking about the Windows version? I don\'t know what size that is...

Re:Does this mean that . . .

[Viper233]

come on dude...
386to486.exe

Re:Does this mean that . . .

[Anonymous Coward]

Perhaps it is lossy, too?

Re:Does this mean that . . .

[NeoThermic]

Care to explain why you've linked a `Security Update for Windows 2000`?

We are talking about IE here, not 2K.

As for a IE patch that is large?

IE6 SP1 - 8.7 MB to 12.7MB

IE5 SP2 for ME - 6MB to 17MB

Internet Explorer 6 SP1 Update: "HTTP 404 - File Not Found" Error Message When You Try to Visit Web Pages That Are Opened by JavaScript Functions in Frames or in Windows - 1.3MB

October 2003, Cumulative Patch for Internet Explorer 6 Service Pack 1 - 2.1MB

October 2003, Cumulative Patch for Internet Explorer for Windows Server 2003 - 4.2MB

October 2003, Cumulative Patch for Internet Explorer 6 - 2.5MB

Need me to continue? Or have I proved my point?

NeoThermic

Re:Does this mean that . . .

[Lord Kano]

Perhaps it is lossy, too?

Maybe it's LZip.

LK

Re:Does this mean that . . .

[__aaitqo8496]

"Bullshit. [microsoft.com] There's a fix for an IE exploit. 365K. Would you want to reinstall your entire browser, just to fix that one little thing that you urgently want to get corrected?"

well, you see, since microsoft has made IE part of the OS... you can't just "reinstall" it. that's probably a lot why MS has created a patch system.

fortunately for me, i can install firefox on my thumbdrive

Re:Does this mean that . . .

[NanoGator]

"We are talking about IE here, not 2K."

Yes, you are correct, I pasted the wrong link. I'm sorry about that

"Need me to continue? Or have I proved my point?"

Yes, you have made your point. However, I have a counter point to make. We're comparing two different things I believe. I was talking about individual patches, you're talking about cummulative updates in most of your links here. Even the big single one you show is 1/4th of the size of Firebird. (Mozilla? I keep getting the names confused.) Most of the quick fixes I've installed were tiny, well under a meg. When installing anew, I can download the one big cummulative update. Yeah, big download, but an occasional one. My point? Updating Mozilla via uninstall/reinstall for a simple fix isn't so efficient, never mind the drastically simpler interface IE gives you.

For the record, I'm not an IE zealot. I don't like it really. I'm an Opera zealot. That's a 4 meg install. I hate udpating it for similar reasons.

Re:Does this mean that . . .

[Anonymous Coward]

You windows fanboys are worse than the linux fanboys..

Re:Does this mean that . . .

[Anonymous Coward]

Maybe if they had programmed it correctly in the first place...

Re:Does this mean that . . .

[gangz]

I would disagree to that. Evaluating the merit of an update on the condition whether one needs to download the entire browser is unfair. Sometimes the APIs of the underlying libs change and that would mean relinking the dependant libs. In such a case, a simple overwrite might not work. I don't know the exact details, may be in this case it is required that you reinstall. Well, it is just a 5MB download ! But of course, one does need to give Microsoft the credit for being able to get the infrastructure for the security updates 'right'. May be they had few problems earlier on, but then, I think, they have set a precedent for such a mechanism.

Re:Does this mean that . . .

[rk87]

Bah. I don't need to update - my current version works just fine for me. And its not like I do anything important - only registered porn sites and online banking. Oh, by the way, my IP is 127.0.0.1

Re:Does this mean that . . .

[Anonymous Coward]

Try 16000 times Speed up....

Not to correct your maths, you were doing well, but...
12000Kb/s x 1024 = 12288000bps
12288000 / 768 = 16000.

Re:Does this mean that . . .

[acebone]

Juuuuuust like their operating system and their browser

(Posted from a Win2K box HAH !)

(But using Firefox 0.9.3 Double HAH !!)

Man I need sleep....

Re:Does this mean that . . .

[Anonymous Coward]

Too bad you can't do the same with IE. Oh, wait.

Re:Does this mean that . . .

[acebone]

> This would only be true under strange scheduling circumstances. On top of that, IE updates don't require an uninstall.

Neither does the Firefox update - I just installed 0.9.3 on top of 0.9.2

There HAS been some occasions where an uninstall was required - but hey, Firefox is 0.9.3 while IE is 6.0

I am however seriously miffed that NONE of the two will cook me breakfast yet, I expect Firefox to get that in the 1.0 release, while I've totally abandoned all faith in IE in all regards

Re:Does this mean that . . .

[acebone]

> Bullshit. [microsoft.com]

Wunderbar, and explanation to the link :)

Re:Does this mean that . . .

[ChaoticLimbs]

You have a small point, but if you look at the sheer volume of those tiny exploit patches, you're debating the difference between a mouse, a swarm of bees, and a hamster. Firebird's entire package is a mouse, a single IE service update is a rather fatty hamster, accompanied by a swarm of bees. Or, as you prefer, a swarm of bees accompanied by a fatty hamster.

Re:Does this mean that . . .

[vegaspctech]

Hooray! Math! That beats the heck out of the 'chocolate is better than strawberry' type arguments that seem to fill the page whenever, you know... MS v AE...

Anyway, minor correction...

1,500 KBps = 12,288,000 bps
12,288,000 / 768 = 16,000

...or...

1,500 kBps = 12,000,000 bps
12,000,000 / 768 = 15,625

Re:Does this mean that . . .

[Anonymous Coward]

Just so you know,
0.9.9 + 1 = 0.9.10
(Of course, hopefully they'll get to 1.0 before that...)

Re:Does this mean that . . .

[Omestes]

I download it, it actually took about 35-40 minutes...

Sometimes I exagerate...
I'm used to a T1, so this is SLOOOWWWWW....

Re:Does this mean that . . .

[Anonymous Coward]

Most people that act as Microsoft apologists are gullible, always looking on the bright side of dark, and probably scared of Open Source.

One thing further to add:

What's the point of Microsoft offering these 'small' patches, when there are plenty of other holes that it can't be bothered to fix?

If your boat is full of holes, and you plug up just a few of them, does that stop the water coming in?

Re:Does this mean that . . .

[nmg196]

Because that's NOT an update!!!

Read the very first line of that page:

Internet Explorer 6 Service Pack 1 (SP1) is the latest version of Internet Explorer and includes a full installation of the Web browser.

That's hardly an update is it?

"Internet Explorer 6 Service Pack 1" is the ENTIRE of Internet Explorer 6 with Service Pack 1 already applied. It has no prerequisites apart from Windows itself. It does not "update" anything - it's the entire browser - hence it's so big. Ie, if you didn't have Internet Explorer 6 and you installed the package you mentionned, you would then have internet explorer 6 with service pack 1 already applied.

Admittedly they should probably have named it "Internet Explorer 6 with Service Pack 1" or "Service Release 1" or something...

How you managed to get to +4 Informative with that load of propaganda I really don't know...

Re:Does this mean that . . .

[Anonymous Coward]

It's not the download size that I find irritating... it's the fact that If I don't uninstall the old version first, I'll have two versions of Mozilla showing up in my add/remove programs list in WinXP.

Re:Does this mean that . . .

[Anonymous Coward]

Kids these days. I remember when I used to download 400Mb DivX;-) rips over a 33.6kbps modem[1]. Took nearly 2 days..

[1]: Uphill, both ways!

Re:Does this mean that . . .

[Anonymous Coward]

for the math impaired:
1500KB/s = 12000Kb/s
12000Kb/s / 768bps = 15625.


What the hell is a Kelvinbyte?

Re:Does this mean that . . .

[Moloch666]

Too bad they block port 80 though. I think I would still rather have Comcast.

Re:Does this mean that . . .

[Anonymous Coward]

Poster: "The 4MB size of the complete Mozilla browser is smaller than many of Microsoft's IE updates have been."

You: "What you're suggesting would require a 4 megabyte download just to fix a typo in the credits."

You don't read so good do you.

Re:Does this mean that . . .

[wkitchen]

He drew a comparison only with Firefox. And since he didn't mention the size of the Mozilla suite or how it compares, the information I posted is quite clearly NOT in the parent post.

Whether anyone cares is up to them. I cared enough to check the size for comparison. Someone else might care too.

Re:Does this mean that . . .

[NanoGator]

"If your boat is full of holes, and you plug up just a few of them, does that stop the water coming in?"

Since not every hole is underwater to begin with, plugging the most urgent holes isn't a futile task.

Are we done using pointless mmetaphors?

Re:Does this mean that . . .

[John Hurliman]

You can, but since this would only be applicable to Windows where a binary is provided. Most distributions or individuals compile their own under Linux, and the architecture-specific compiling would make binary diffs impossible. It seems like the Mozilla team tries to find solutions that will work across all platforms for the most part.

Grumble Grumble

[(54)T-Dub]

I'm getting tired of the whole uninstall, delete, re-install, get plugins, import bookmars, set settings, get skins (optional) routine. I wish they would hurry up and fix the installer so that I could simply update the browser and save all my stuff.

Re:Grumble Grumble

[doofsmack]

I hod no problems just letting the installer overwrite my old Firefox directory. After it upgraded, all my extensions/bookmarks were still there.

Re:Grumble Grumble

[tabacco]

I just installed over it, and it worked fine.

Re:Grumble Grumble

[pythro]

hrrm i am just installing over the old instal is this bad?

Re:Grumble Grumble

[Sylver Dragon]

Just install over the top of your previous version, everything comes up and works fine.
</broken record>

Re:Grumble Grumble

[steeef]

Installing over the old version often works, but sometimes not.

If not, I usually save my plugins, delete the directory, install, then copy my plugins. My settings, bookmarks, and skins are all in my profile, and I haven't had to delete/recreate that in a while.

It sounds like you're just being too careful.

Re:Grumble Grumble

[jsebrech]

But there are multiple entries in the add/remove programs dialog on windows. Still, that's nothing a quick regedit job won't fix.

Re:Grumble Grumble

[clandestine_nova]

I can't say I think that's really a problem. I mean, I had to do it when upgrading from 0.8 to 0.9, but since then I just over-install.

Plus, it's a five meg download (at 300-500kB, no less), and bookmarks stay through versions, no matter what (in my experience, obviously).

Get over it, honestly. If you don't want to upgrade, that's fine - don't. While I do understand why you would want a better installer, that isn't the central point of a browser. Firefox consistently delivers an excellent browsing experience, and that's what they promise - not an excellent install.

Re:Grumble Grumble

[WankersRevenge]

I grabbed this from the Troubleshooting Mozilla guide.

From Point 14:

If Nautilus has been configured to use the Mozilla Gecko rendering engine, installing a mozilla.org binary on top of that may cause odd problems and conflicts. You should use the package of Mozilla supplied by your Unix or GNU/Linux distribution, as their version should work properly with their package of GNOME.

I have personally experienced problems where Mozilla refused to render anything secure (https) because I had overwritten previous Mozilla installations. There could have been other problems but I never noticed. I'd reccommend you just do a clean install (which means, an uninstall, then reinstall). There is no reason to tapdance in minefields unless you're a windows user. like me. :)

Good luck!

Re:Grumble Grumble

[doofsmack]

Good point. I never noticed that.

Re:Grumble Grumble

[Derek Pomery]

Even easier, symlinking /usr/mybrowser/plugins to /usr/mozilla/plugins and relinking on upgrade.
Heck, if you upgrade it yourself, it is as easy as aliasing
tar xvfz mozilla.tar.gz && cd mozilla && rm -rf plugins && ln -s /usr/foo/plugins .

Re:Grumble Grumble

[Chuck Bucket]

(Score:-1, Gentoo Fanboy)

Mod me as fanboy, I don't care, but this is solved with Gentoo. Is it perfect? Nope, but solves the above grumble, as well as a slew of other things that I enjoy over my 2nd fav Linux, Slackware (which is no slouch in it's own right...)

CB

Re:Grumble Grumble

[Trailwalker]

It takes me only a few moments to download and install a newer version, and get my stuff from extensionroom.mozdev.org.

Its a painless process, which I do about once a week since I like to use the nightlies.

No one is forced to move to a newer version. The older versions also work well.

Re:Grumble Grumble

[(54)T-Dub]

While I do understand why you would want a better installer, that isn't the central point of a [insert any piece of software here].

And now we come to the basic problem with the attitude behind Open Source development. If we ever want to get open source out of the geek world we need to be able to get this idea out of our heads. A simple installation is important. Someone should not need years of experience to install an OS smoothly. And any computer novice should be able to upgrade their software with the click of the mouse (maybe 2). I'm not saying we need to dumb it down, just put in a little bit more attention to ease of use/install/upgrade.

Re:Grumble Grumble

[SimplexO]

While all of these people say to just install over your old version, they would be wrong. Over time, old files start sifting through. One of the most common problems of not-uninstalling is your UA string stays on the old version, but your browser is definately the new version.

You'll want to take a look at bug 237727* to see that they are going to clear out some of the old files if you choose to reinstall over your old version. They have already done some good work on that bug for the next versions (FX 1.0PR and TB 0.8), but they just need to widdle down which files need to be wiped. I have faith that this'll be fixed by FX 1.0.

One solution was to automatically delete the entire install directory right before reinstall. This actually backfired when stupid users tried to install to "C:\Program Files\" and it wiped that folder clean. Oops.

* Bugzilla hates slashdot; copy and paste.

Re:Grumble Grumble

[Anonymous Coward]

I do something similar, but keeping plugins in /usr/local/lib/mozplugins

But this is the one thing that makes me hesitate to recommend moz to newbies who regard CLI as some kind of scary dark art. And as distros like Mandrake become more and more 'user friendly', CLI does become an 'expert' tool. Linux is no longer an 'expert' operating system where you can just safely assume any user is comfortable on the command line.

Re:Grumble Grumble

[clandestine_nova]

Don't take my words out of context. I'm all for Linux being easier to install - hell, I'm for all software being easier to install -, but as it is, Firefox is pretty fucking simple. It doesn't take any command line, unpack, make install or anything of that nature. You might have to download a new binary, a new 5mB binary. Not a big deal.

I do think, however, that a better installer could be developed that had universal application. But then, people don't think "Hey, I'm going to make a revolutionary installer!", do they?

Re:Grumble Grumble

[DarkEdgeX]

If you install over an old version it's been my experience that the user-agent and other settings don't get updated for whatever reason.

I'll confess, updating should be painless for Firefox/Mozilla, but it's not.

Re:Grumble Grumble

[Anonymous Coward]

" I'm getting tired of the whole uninstall, delete, re-install, get plugins, imp...bitch...bitch...bitch"

Well, not a perfect solution...but have you tried mozbackup?

http://backup.jasnapaka.com/

It makes upgrades much less painful, at least for me (and it might help you close your cry hole).

Re:Grumble Grumble

[Kupek]

If I remember correctly, I then need to go and re-download and configure the extensions I'm using. That's a pain in the ass. I think Firefox is a great browser, but this is something the developers need to fix - and I have confidence that they eventually will.

Re:Grumble Grumble

[Kris_J]

Bugzilla hates slashdot; copy and paste.

Or use a proxy that blocks your referrer URL.

Re:Grumble Grumble

[Harbinger_Of_Sorrow]

No, you don't need to re-download, just disable them and re-enable them, and they will work

Re:Grumble Grumble

[eliasen]

You don't necessarily need to re-download your extensions. If you're running the Mozilla installer, it will give you a screen that says something like "the installer will now delete any third-party extensions you have installed to eliminate incompatibilities."

There's a "skip" button there at the bottom. Skip this step, and your extensions remain intact.

There is occasionally a problem with all extensions working correctly (thus the point of this step,) but I've seen that problem rarely lately.

Re:Grumble Grumble

[Anonymous Coward]

This works sometimes, but other times it causes very bizarre and unreproducable bugs. RTFM

Re:Grumble Grumble

[CNeb96]

Well first I agree with you completely and second I think our prayers may have already been answered.

A new checkin to the Firefox branch appears to have enabled exactly what we where asking for.

Bug 253220 Description

Implement proper software update that replaces the running instance of Firefox
with a newer version, can add add on components, apply patches, etc.

CVS Checking comment from Ben Goodger from today
"253220 - better software update - in place software update, etc etc. glory!"

Re:Grumble Grumble

[Anonymous Coward]

Blah Blah Blah.. Install, open program, browse Web.. Now move along...

Re:Grumble Grumble

[Darkangael]

many of those distros do this for you, and even restore the symlinks when you update. I know at least Gentoo does it. The only thing that annoys me when updating in gentoo is that it doesn't do it for my search plugins.

Re:Grumble Grumble

[bustersnyvel]

I just type "emerge mozilla-firefox" and it'll upgrade. What has a change of binaries to do with you personal settings in your homedir?

Re:Grumble Grumble

[acebone]

Me neither too... but that's because I never use it (yup - I am on a Win2K box)

Re:Grumble Grumble

[Val314]

you dont have to remove your profile. just delete the firefox folder (or uninstall it) and reinstall the new version.

Re:Grumble Grumble

[kersch]

i don't get your problem..
you just download the .zip file, delete the content of the mozilla folder except the plug-in folder, unzip the file and done.. (at least on windows it works this way)

i wished updating of other applications would be that easy..

hf, hans

Re:Grumble Grumble

[not_a_product_id]

I use it on my Win2K box at home (very happily)

Re:Grumble Grumble

[Anonymous Coward]

Unfortunately for a browser trying to kick IE out of the market, that's *not* considered easy. Is Grandma Mae going to have any idea how to do that? No. She will know that the browser appears to be broken and probably go back to IE.

Re:Grumble Grumble

[shellbeach]

Bugzilla hates slashdot; copy and paste.

Or type "about:config" in your address bar, search for "referer" and set "network.http.sendRefererHeader" to a value of 0 (zero).

Works like a charm :)

Re:Grumble Grumble

[normal_guy]

Agreed...on Linux you get to add the recreation of scripts necessary to launch mailto: links, etc. Anyone know the easiest way on Linux?

Re:Grumble Grumble

[sdburns]

Try putting your installs in a directory such as "Mozilla Firefox" & not Mozilla Firefox\Firefox #.#.#\

Re:Grumble Grumble

[parksie]

However, Gentoo becomes... interesting, when you decide to change USE flags after the initial install, such as to add GNOME support (I went from -gnome to gnome, ended up breaking Evolution and requiring a reinstall).

I find it works near perfectly for me, but it has its downsides (usually it's a sign of potential trouble when libtool gives its message about linking to .la files being non-portable, as with KDE and Evolution, etc.).

Re:Grumble Grumble

[DarkEdgeX]

*slaps self*

I went and installed it over my existing installation and everything updated-- user-agent and all. It was my experience in previous versions that installing over an older copy didn't update those critical settings (and in the case of AdBlock, seemed to require plugins to be reinstalled), but going from 0.9.2 to 0.9.3 was painless.

I hope it went as well for everyone else.

Re:Grumble Grumble

[jsebrech]

Installing into the same folder doesn't work. I had entries for Mozilla Firefox 0.9, Mozilla Firefox 0.9.1 and Mozilla Firefox 0.9.3 in my registry when I cleaned it out yesterday, all installed into the same folder. Personally I consider this an installer bug, but I understand the firefox team's priorities are a little different right now.

RPM's ?

[Anonymous Coward]

Any idea where to get RPM's ?

Re:RPM's ?

[r00zky]

from your distribution

Re:RPM's ?

[jiawen]

In my experience, you don't need RPMs. Just download the .tar.gz file, unpack it in some nice folder, then run firefox.bin. You don't actually need to install it, you just run it from that script. In my experience, that is.

0.9.?

[asd-Strom]

If things keep going this way we end up with 0.9.55 or seomething. They should think about some patching systems..

Re:0.9.?

[rmcii]

Or they might just change the numbering to Mozilla/Firefox 2004 SP4 or XP SP2

Re:0.9.?

[Anonymous Coward]

It just means that the development is proceeding at ...Warp Speed.

Bada-Bing!!!

Sorry, couldn't resist

Re:0.9.?

[Anonymous Coward]

If this were being pushed out be you average software company, Firefox would already be at 9.0 and counting.

Re:0.9.?

[NineNine]

Well, it doesn't really matter. The installer for 0.9.3 says "0.9.2". Who fucking knows what version you're using? Just uninstall, reinstall, setup everything again. Oh yeah. And do this daily.

Re:0.9.?

[Anonymous Coward]

And do this daily.

Oh, please do do that. At least it keeps you occupied.

Re:0.9.?

[geomon]

Oh shit... I'm laughing so hard I think I'm going to pass out!

What a fucking dickhead you are. Nothing related to Linux gets posted before you find a way to run a fucking stake through it. What the fuck is your problem?

Oh, I know. It is the wonderful uptime of your webserver.

How did you keep it running through all 13 days? That's fucking amazing!

BWAHAHAHAHAHAH!!

Bullshit

[Anonymous Coward]

The vast majority of IE updates have been = 250 kb.

libpng

[HungWeiLo]

According to the forum, a libpng vulnerability also just happens to crash IE.

Re:libpng

[Anonymous Coward]

According to the forum, a libpng vulnerability also just happens to crash IE.

If this is the case and MS is willing to patch, it might(?) be a great opportunity to implement a full working png alpha channel support for IE.

It does this already

[karji]

Yes

Re:It does this already

[(54)T-Dub]

First, for these preview releases it is strongly recommended that you uninstall any previous version of Firefox first [emphasis not added]. Installing over the top of an older version may cause unpredictable problems. If you install over the top of an older version and want to file bugs, please do a clean install into a fresh directory before doing so.

From here

Last time I tried to install over an existing installation i seriously regretted it. Took me 3x as long to get everything worked out. So now I uninstall first.

Re:It does this already

[EvilBudMan]

--Last time I tried to install over an existing installation i seriously regretted it. Took me 3x as long to get everything worked out. So now I uninstall first.--

I've installed the last few updates over the existing ones and have only seen the 503 error on /. Also, if I had too many tabs loading at once Firefox would crash, but both of these problems mysteriously disapeared even before I updated to 0.9.3.

Re:Firefox

[gerf]

I suggest we tell the Mozilla Foundation guys to buy some OReilly security titles and read up, and come back with something that's actually not buggy

Hi, welcome to Firefox beta .93

Anyway, do you think that FF/Moz should take the Windows route and refuse to acknowledge vulnerabilities, and simply hope they pass by with no one else noticing? Please, think a little bit before posting a comment.

Re:First Post!

[_spider_]

Sorry people, it was just an urge and I feel really stupid now, so I'm sorry!

Anyway, I am really glad to see this. I work at an ISP, and deal with a lot of these ad/mal/viral-ware that gets onto IE despite our best efforts. So, we have been deploying Mozilla Fire(something) and Thunderbird programs - and PEOPLE LOVE IT!

What makes them happy - makes me very happy!

Re:slashdot still refuses to render in firefox

[Valtor]

Well I don't know about you, but the 503 errors are gone for me.

How about...

[Bun]

...they make an installer that will upgrade the older versions and keep all your plugins/settings? I've got a multiple list of Mozilla versions in my Add/Remove Programs box...very annoying...

Re:How about...

[jalefkowit]

Agreed that this is annoying, but you can fix it if you're not afraid to get into the Registry.

In Regedit, go to this branch of the Registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cu rrentVersion\Uninstall

... and you'll see a key for every entry in your Add/Remove Programs menu. Just delete the keys for the old versions of Firefox/Thunderbird and they will disappear from the menu.

The Firefox/Thunderbird installers seem to assume that users will always uninstall before they install a new version. I know that I for a long time was not doing that, which (oooops) made Add/Remove Programs a mess until I figured this Registry trick out. Hopefully Moz.org will make the installer smart enough to do this on its own soon...

Re:How about...

[Lehk228]

thanks i also had the problem with firefox versions stacking in add/remove programs

Re:How about...

[Anonymous Coward]

Not only that firefox/thunderbird installer leaves multiple entries in Add/Remove programs, even if uninstalled, leaves a trail of crap in the registry for every version

Re:How about...

[ViolentGreen]

I wish mods would look at the timestamps before they declare something as redundant. This was posted a whole 7 minutes after the first post on the installer that I see and 12 minutes after the article was posted.

Re:Firefox

[niteice]

However, those 3 Firefox holes were fixed faster than the 1 IE hole. Mozilla releases patches as soon as they've fixed the problem. Microsoft? They wait until Wednesday night. If a problem is fixed on a Thursday, and it's something already exploited, then most people affected (the clueless windows users) are basically screwed.

Mod parent up.

[hot_Karls_bad_cavern]

i know it'll be an unpopular one about these parts, but: yeah, i'm with you bro. i should only have to click "Upgrade" on the Moz page to get the newest browser. Bitch and moan all you like, that's the way it should be: an icon in the corner: "upgrade now"...you can ignore if you like, you can build from source if you like, but me? Hell, just get me a new browser now....when i click. Yeah, yeah, save me all the "but, if it's just click and go and the security and the users and malware pages"...save it. Code against that, let me upgrade on the fly (restart okay...reboot not-okay) with a click. Tough to do? Hell, look about at the OS that this browser runs on (for the most part at this time): click and do for 'em eh? Not that much to ask. Give 'em a, 'no thanks, i'll do it the hard, trusted, but sure way' button. i'm not banging that in any way...hell, with some packages that's the only way i'll trust 'em. Moz is a safe bet: give us s 'click an' go to the newest version' button k? Yep.

Re:Mod parent up.

[(54)T-Dub]

Here here. And their "handy" little update notification in the lower right corner has never worked for me. It is constantly telling me that I have to upgrade to version 0.9.1 (which I'm running). Even now it still says the same freaking thing.

Don't get me wrong, I love Mozilla and open source. But it's those little things that developers hate coding that get to me sometimes. Don't even get me started on a Linux install.

Re:Mod parent up.

[Gadzinka]

Well, it kinda works this way already.

apt-get update
apt-get dist-upgrade

PS ;)

Re:Mod parent up.

[halowolf]

These mumblings on what I do is for the Windows version of Mozilla only, and I don't have many themes or plugins installed. There is no warranty on the information I give and I recommend backing up both your Mozilla profile and Mozilla program directory before doing what I do. This is what I do myself so that I can restore anything that may get damaged.

I use Mozilla NOT Firefox but what I do for upgrades is this (and I do not loose my installed plugins, Orbit theme and settings). My memory is a little vague on the exact details, but if you can install Mozilla then you can handle the fine details yourself. :)

I do choose to uninstall Mozilla first using its uninstall option from the Windows Add Remove Programs. When prompted to delete everything from the mozilla.org directory I decline to do so, this leaves behind the components you have installed yourself.

I then install the new version of Mozilla, and it picks up all of my settings, installed plugins and the like using my profile, which is the default one.

I've been doing this since about Mozilla 1.3 or 1.4 and I have not had any problems following the process, but perhaps I'm just lucky :)

Re:Mod parent up.

[cortana]

Too bad the firefox in Sid is still 0.9.1, and it looks like Sarge will be released with 0.8. :)

Re:Mod parent up.

[sharkey]

t is constantly telling me that I have to upgrade to version 0.9.1 (which I'm running).

Mine does the same, I however, am running 0.9.2 :D

Re:Mod parent up.

[Anonymous Coward]

That's "hear, hear." Think of the children. Please.

Re:Mod parent up.

[line.at.infinity]

Try this, which says:

Specifically...
Browse to 'about:config'.
In the filter box type 'update'.
Double click 'update.app.updatesAvailable' and change the value from 'true' to false.
Restart Browser.

Worked for me.

Re:Mod parent up.

[Anonymous Coward]

Don't tell us that Debian is going to backport security fixes to a beta-release. :P

Re:Mod parent up.

[Kris_J]

Why don't you just install over the top? I've been installing the new version straight over the top of the old version since around 0.96.

Re:Mod parent up.

[halowolf]

Earlier on I was installing over the top, but I was ending up with a bunch of redundant files, most noticebly multiple instances of the Gecko engine. After looking in the mozilla.org directory again, things seemed to of changed a bit since the earlier days so now its mostly habit I suppose.

When I did clear out all the old files and put in a fresh install of Mozilla I did notice that Mozilla did seem to run faster, but perhaps that was because it was a version upgrade. I wouldn't rely on my anecdotal evidence on that. I think it was around 1.5 I did my first fresh install.

Basically I don't want to have any redundant files being left behind during version changes which is why I uninstall before installing a new version, and to give Mozilla the greatest chance of working per upgrade that I do.

Re:Mod parent up.

[acebone]

I remember downloading Mozilla (Seamonkey?) back when it was more a proof of concept than anything else. We were in a cellar working with ughh... ASP and hooraying this new thing, while at the same time worrying if it would ever be able to take on IE on merits.

Now a days 'auto-update' is a prime concern ? And Firefox is not even 1.0 yet ?

Re:Mod parent up.

[Knuckles]

Big deal, it will probably be a week until 0.9.x is on backports.org

Re:Mod parent up.

[Thunderbird1]

I'm afraid. I'm afraid, Dave. Dave, my mind is going. I can feel it. I can feel it. My mind is going. There is no question about it. I can feel it. I can feel it. I can feel it. I'm a... fraid. Good afternoon, gentlemen. I am a HAL 9000 computer. I became operational at the H.A.L. plant in Urbana, Illinois on the 12th of January 1992. My instructor was Mr. Langley, and he taught me to sing a song. If you'd like to hear it I can sing it for you.

Re:Mod parent up.

[Threni]

> Now a days 'auto-update' is a prime concern ? And Firefox is not even 1.0 yet ?

More accurately, nowadays security is THE prime concern, so something which facilitates that is more important than hand cranking the HTML renderer or whatever.

Re:Mod parent up.

[XemonerdX]

while at the same time worrying if it would ever be able to take on IE on merits.
Don't worry, as far as vulnerability goes, FF will never be able to catch up to IE.

Re:Mod parent up.

[Per Wigren]

That's "hear, hear." Think of the children. Please.

You think that's a bad typo? Check the pictures on THIS page.. Some religios fanatic morons doing a small demonstration outside a gaycafé in Stockholm during the Pridefestival... LOL

Re:Mod parent up.

[wagemonkey]

How much are you paying the devs to do what you want?.
You could always start hacking the source to provide this feature and submit it yourself...

Re:Mod parent up.

[ginbot462]

I learned something on Slashdot today. I'll have to mark the calendar.

Re:Mod parent up.

[at_slashdot]

Mod parent up!
Good piece of info.

IMHO Firefox should come with this 'on' by default and have a link in Menu to this config page (something like 'advance setup').

FireFox Release Notes

[Lord Crc]

I might be dafter than a regular brick, but I can't see that the FireFox Release Notes mentiones what is actually new in this release?
Oh well... perhaps I'm just weird for wanting to know what's new in this sub-release.

Re:Firefox

[Anonymous Coward]

You miss the point.

It's still a buggy, insecure application written by the same people who have a rep for writing buggy, insecure applications before.

Time of fix does not matter if you have thousands of errors, and fix them asap, but the competitor (IE) has one error and it takes a week to fix.

That, and incorrect rendering of Slashdot. And fake GUIs with Firefox.

Re:First Post!

[enjoilax]

I would imagine people like it because they can customize it to however they like.

Thats why i switched... Plus Tabbed browsing.

Re:Firefox

[Justus]

Yeah, Firefox beta, right up there next to Mozilla 1.7.2. Just keep talking about how it's all 'unfinalized, buggy beta software' and I'm sure you'll convince a lot of people to stop using Internet Explorer.

That being said, I'm glad to see the bugs being acknowledged and fixed, even if I don't personally agree with the way some of these bugs have been handled.

Could this work with Firebird?

[Sarcasmooo!]

I still have Firebird 0.7 (I'm lazy)

I would've upgraded by now, but I don't want to have to redo all my settings and junk.

Re:Could this work with Firebird?

[dolmen.fr]

Settings are stored in your profile. Not in the program directory.
AFAIK, uninstall doesn't remove your profile.

However extensions and plugins (Flash, Acrobat...) are at risk if you accept to remove the Firefox directory at uninstall end.

Try again if 0.9.3 for Windows didn't work earlier

[sakyamuni]

The timestamps in the 0.9.3 release directory show that the Windows binary has been updated.

Got the supposed 0.9.3 for Windows earlier today, which didn't work. Process appeared in task list, but no window came up. Also, any place the version number appeared, it was still listed as 0.9.2. With the caveat that I don't know how those folks do their releases, I'll say that with the proper automation, that oops-i-forgot-to-increase-the-version-number snafu should never happen.

The actual vulnerabilities

[Anonymous Coward]

Copy & Paste, Bugzilla hates us:

http://bugzilla.mozilla.org/buglist.cgi?bug_id=251 381,249004,250906,253121

• Importing false CA certificate leading to error -8182 (perm DoS), especially exploitable by email
• null (%00) in filename fakes extension (ftp, file)
• new libpng buffer overflow vulnerabilities
• lock icon and certificates spoofable with onunload document.write

IE catches shit for 2 out of the 4 bugs.

libpng buffer overflow - a lot of bitching goes on around here with regards to "OH M$ EVEN HAD AN OVERFLOW IN BMP HANDLING IN IE!!!"

null (%00) in filename fakes extension (ftp, file) - Variation of this got IE in trouble...

Re:The actual vulnerabilities

[Lehk228]

and bitmaps are alot simpler than pings

Re:The actual vulnerabilities

[black mariah]

Is this supposed to be an excuse? I sure as fuck hope not. "It's HARD. Don't blame US if we fucked it up."

Re:The actual vulnerabilities

[Anonymous Coward]

Remember to get the space out of the URL

...cgi?bug_id=251 381&...
_________here ---^

Re:The actual vulnerabilities

[Anonymous Coward]

How do you possibly figure that? Windows Bitmaps can contain all sorts of bit depth and compression schemes as well.

Re:The actual vulnerabilities

[sharkey]

Apples to oranges. Comparing bitmaps to pings makes no sense.

Re:The actual vulnerabilities

[Anonymous Coward]

Major difference:
- IE vulnerability: you hear about it on /., in other media, and a month or so later (if at all) there appears a fix.
- Mozilla vulnerability: Mozilla foundation announces "we found a vulnerability and have a fix for it" where it is also the first time I hear about it.
And in the rare case it is in the press before there is a bugfix, the fix will be there before the ink is dry.

Wouter.

Re:The actual vulnerabilities

[tepples]

I stopped shooting for bad jokes when I learned that Slashdot users don't get karma for +1 Funny anymore. You and I both know that Lehk228 was looking for these bitmaps and these pings.

Re:The actual vulnerabilities

[Anonymous Coward]

You didn't read the comment. Microsoft gets criticized for being so stupid as to have a buffer overflow in bitmap handling, or the %00 null character exploit. They DO get criticism for not fixing it, but I don't have a problem with that criticism.

Re:The actual vulnerabilities

[Nerull]

Don't blame them, blame the libpng devs. IE crashes with the exact same exploit, just like Moz did. http://www.graphicsmagick.org/libpng/beta/samples/ bigw.png 9.3: "This image cannot be displayed because it contains errors." IE 6: Internet Explorer has encounted a problem and needs to close. We are sorry for the inconvenience.

Re:The actual vulnerabilities

[Nerull]

Don't blame them, blame the libpng devs. IE crashes with the exact same exploit, just like Moz did.

http://www.graphicsmagick.org/libpng/beta/samples/ bigw.png

9.3: "This image cannot be displayed because it contains errors."

IE 6: Internet Explorer has encounted a problem and needs to close. We are sorry for the inconvenience.

Bah, properly formatted version, and a link while i'm at it.

Re:The actual vulnerabilities

[Anonymous Coward]

Inaccurate.

Try reading SecurityFocus for a change. These vulnerabilities have been known for a while. On the null character byte, the Mozilla foundation was notified about a month ago, they just didn't respond until now. This is pretty typical behavior by the foundation.

Similar behavior to Microsoft, no? Actually, it is somewhat worse behavior. Microsoft at least will fess up to the vulnerability (they ARE slow on getting a fix.) The Mozilla foundation likes to pretend it doesn't exist until they have a patch.

Y'think that maybe the IE vulnerabilities get a bit more press because over 90% of the people use it? As opposed to the 3% who use Mozilla?

But hey, if you are OK with security by obscurity, knock yourself out.

Re:The actual vulnerabilities

[nwbvt]

"IE catches shit for 2 out of the 4 bugs. "

Is that really the standard we want to hold Firefox to?

Re:The actual vulnerabilities

[ResidntGeek]

Security by obscurity is OK the way they use it, which is to keep the vulnerability from being widely known and exploited until they have a patch. It's only unacceptable when it's the only security.

MAC OSX Complains

[OlivierB]

While this is not a showstopper, can somebody explain me why Firefox for mac ever since 0.7 has a problem with Expose feature? IE one can se a small window attached to the main window?
Also, why is it we cannot search the bookmarks in the sidebar wihtout crashinf the whole application?

Small annoyances but we are getting awfully close to 1.0 and still no sign of improvement.
Safari is catching up in terms of speed and is looking ever more appealing!

Re:MAC OSX Complains

[line.at.infinity]

> Also, why is it we cannot search the bookmarks in the sidebar wihtout crashinf the whole application?

I also get this on my Windows box. I thought maybe my profile files were causing the problems, and that using a new profile might solve the crash occurances...

Re:MAC OSX Complains

[bdaehlie]

The way Mozilla does windowing, it creates an invisible root window. You can see that it exists without expose by trying to apple-tab through pages. So far the developers have not found a way to redo the windowing system so that this invisble window is no longer necessary. Its been there since the NS 4.x days I think. I bet if you use FF 0.7 on a box with expose you'll see it there too.

Re:MAC OSX Complains

[geek]

My problem is that NONE of the themes other than the default work on OSX. What's the point in a cross platform browser if it's gonna be this screwy? Camino would be much better if it had adblocking. I'll just stick to Safari and PithHelmet I guess.

Re:MAC OSX Complains

[nxg125]

Well, Firefox 1.0 on OS X will be delayed a bit from the other platforms to clean up some issues such as this. The Expose thing you mentioned has been written up in Bugzilla (copy & paste the URL to see the bug.)

Re:MAC OSX Complains

[login.pl]

The problem with themes on the Mac is known. You can get some decent Mac-compatible themes at http://mozthemes.tk/.

Re:MAC OSX Complains

[justMichael]

Camino would be much better if it had adblocking. I'll just stick to Safari and PithHelmet I guess.

This is why I use Junkbuster as opposed to relying on a browser based system.

No matter what browser I decide to use Safari, Moz, Firefox, Camino or IE (shudder) I get the same filtering rules.

I tried Privoxy, but I found that for some odd reason it really slowed down local PHP scripts and since I use my PowerBook mostly for development I went back to Junkbuster.

Re:MAC OSX Complains

[Anonymous Coward]

If you're looking for a Mac browser, how about Camino 0.8? Same rendering engine as Firefox, but a Cocoa native frontend.

Yes, there are some things in Firefox that have no UI equivalent in Camino, and that irks me at times. But I use Camino as my main web browser, and I'm very happy with it, thank you very much.

Re:MAC OSX Complains

[sbszine]

My problem is that NONE of the themes other than the default work on OSX.

That's due to this bug, which mangles any cross-platform theme using native scrollbars. (You'll have to cut and paste the link, as Bugzilla fears Slashdot).

Re:MAC OSX Complains

[Calroth]

I could be mistaken, but I think that window is there so you get a menu bar. On every platform except Mac OS X, Mozilla has its own menu bar for each window. The Mac is different: it has one menu bar for the entire application. The small window is there so that when no windows are open, there's still a menu bar on the Mac.

Re:MAC OSX Complains

[wolruf]

See http://bugzilla.mozilla.org/show_bug.cgi?id=223779 for Exposé.
There's a recent patch for Mozilla http://bugzilla.mozilla.org/show_bug.cgi?id=223545

Re:MAC OSX Complains

[ViolentGreen]

I've never had that problem with themes. I don't use many though. I use FF on windows and linux. I stick with safari on OS X though. It has little features that FF doesn't.

The one that makes a huge difference for me is it's method of handling address bar history. On firefox if I type "sla" and want it to autocomplete with the "shdot.org," I'll get a bunch of stuff like this "http://slashdot.org/comments.pl?sid=116821&op=Rep ly&threshold=1&commentsort=0&tid=154&tid=1&mode=th read&pid=9884943." Apparently there is a feature in Safari that keeps track of how often the page is visited and gives me what I am looking for. This is a wonderful feature. I expect FF will have it eventually.

I also like being able to change tabs with the arrow keys instead of the ctrl-tab. It's also better integrated with the rest of the system then firfox is. Firefox integrates jsut fine with XP though. I do wish Safair had the depth of options that firefox has though.

non-article-reading-mods at it again?

[Anonymous Coward]

Huh? This isn't very off-topic. One of the vulnerabilities that this version of Mozilla fixes is related to libpng

1.7.2 messed up my prefs

[ClausCCC]

I did the uninstall install routine and everything was borged: I couldn't close tabs, was unable to go back one page and the context menu was gone. Took me really, really long to fix this manually.

Re:Try again if 0.9.3 for Windows didn't work earl

[LiquidCoooled]

I just installed 0.9.3, its listing inside the installer as 0.9.2 still.

Your right about automation, even InstallShield can do it!

About time!

[MMC Monster]

After all, this security flaw was announced to the public hours ago! Next thing you know it, they'll say that the patch doesn't support Win/386, or something. :-(

The four vulnerabilities...

[Joey7F]

249004 Importing false CA certificate leading to error -8182 (pe...

# False certificates aren't really an exploit

250906 null (%00) in filename fakes extension (ftp, file)

# fake extense aren't exploits

251381 new libpng buffer overflow vulnerabilities

# okay that is an exploit

253121 lock icon and certificates spoofable with onunload docume...

# that is not an exploit either

I think they should be more like bugs. I think Mozilla is just trying to play it safe. Ironically by them "being up front" they may end up driving people away from the browser...

--Joey

Re:The four vulnerabilities...

[Anonymous Coward]

I'm not sure anyone has said they were all exploits - they are all security bugs.

The false certs thing is a DoS - it can corrupt the local certificate setup so that real certs don't work any more.

Sites being able to spoof the lock icon and present a certificate that belongs to a different site isn't an exploit, but it defeats signing - means the user can't know if they're sending their password or credit card details to the wrong site.

Re:The four vulnerabilities...

[black mariah]

Are you fucking stupid? Every fucking one of those is EASILY an exploit, not of code but of the user.

Fake certificates help in all sorts of scams. Spyware, eBay scams, whatever. "Oh, this is signed by Macromedia. It must be safe!"

Fake extensions. We've all seen the results of simply adding a .jpg before a .exe, and how much shit does MS take for THAT one? Like it's their fault that people are fucking stupid enough to double click on 0wnyourcomputer.jpg.exe. Faked extensions are worse, because they don't even have the fucking .exe at the end.

Lock icon spoofable. So you go to a site you THINK is secured, but it turns out it isn't. Happy funtime on your credit card!

Not all exploits are code-based, not all exploits are related to software.

Re:The four vulnerabilities...

[FryGuy1013]

#250906 null (%00) in filename fakes extension (ftp, file)
# fake extense aren't exploits

Except this would allow text files (on your hard drive) to be parsed as html files (and get the javascript associated with them). However, it's not earthshattering as it would be in IE because if it were IE, it would get extra "local zone" permissions. The only addition of permissions in moz is being able to link to other file: locations.

# 251381 new libpng buffer overflow vulnerabilities
# okay that is an exploit

However, this exploit also happens in IE, so it's not a Mozilla specific bug. Score one for Mozilla for getting it out faster than M$.

#253121 lock icon and certificates spoofable with onunload docume...
# that is not an exploit either

Yes it is. Check out the second test case in the attachments of the bug. Phishing would be very easy if this bug was not quashed as fast as it was.

Re:The four vulnerabilities...

[jesser]

Except this would allow text files (on your hard drive) to be parsed as html files (and get the javascript associated with them). However, it's not earthshattering as it would be in IE because if it were IE, it would get extra "local zone" permissions. The only addition of permissions in moz is being able to link to other file: locations.

Not true. A local HTML file loaded in Mozilla can read all the .txt, .html, and .xml files on your drives. See my page, Security tips for users.

Re:The four vulnerabilities...

[FryGuy1013]

That's what I said.. "The only addition of permissions in moz is being able to link to other file: locations." By link I don't just mean . can link too, and since they're the same "zone", you can read their innerHtml, which usually contains the contents of the file.

"Local Zone" in IE means you get access to a lot of ActiveX objects that aren't allowed in web objects, like ADODB.Stream, which can actually *write* files to your hard drive.

Re:Firefox

[satoshi1]

Firefox, thousands of errors. IE, one error. Do you still have some of whatever you were smoking?

Re:Firefox

[niteice]

You miss my point. I'm basically saying that when there's a Mozilla/FF bug, you get your update, and most Mozilla/Firefox users are smart enough to update it. With IE/Windows, it may be a very long time before a user applies the patch, if they ever do. And then they complain when "windows doesn't work right."

Re:slashdot still refuses to render in firefox

[PinkFreud]

http://slashdot.org/comments.pl?sid=116638&cid=987 7985

This would appear to clear up after removing the old cookie slashdot sets.

Re:And?

[NeoThermic]

>>What the initial poster was talking about was a motherfucking update, NOT a service pack.

Since when is a service pack not an update?

Update:

1. Information that updates something.

2. The act or an instance of bringing something up to date.

3. An updated version of something.

Now. Please. Tell me how a Service pack doesn't count as an update?

NeoThermic

Re:Stop Making Excuses For Them

[Anonymous Coward]

That was a lame troll.

Linux installer bug

[FunkyRat]

I downloaded the linux installer version (firefox-0.9.3-i686-linux-gtk2+xft-installer.tar.g z)ked from the Firefox page and itself seems to have a little bug:

** (firefox-installer-bin:3120): WARNING **: Invalid UTF8 string passed to pango_layout_set_text()

It winds up with an incomplete installation. However, if you just download the gzipped tarball without the installer from here and untar it over your old firefox directory you should be just fine.

Re:Linux installer bug

[bach37]

I had no problems with the Linux installer, on Mandrake 10.0 and Suse 9.1.

Re:Linux installer bug

[Azureflare]

I had no problems either. I got the pango error but that's not really an "error" as such, just a warning. Running firefox 0.9.3 right now after the install and everything works flawlessly.

I really like the firefox installer; I haven't had to restore my backups of my profile or a previous version of firefox ... ever.

Guess windows users get the short end of the stick, reading various other posts about windows woes.

Re:Linux installer bug

[Croaker]

Hmm... I used the installer, and Firefox seemed to install OK... except that it segfaults when you try to run it as anything but root... it spews out a bunch of lines saying "*** loading the extensions datasource" then segfaults after bitching that it cannot open the default config file.

Re:Linux installer bug

[Azureflare]

Ugh, that sounds horrible... I hope you have backups =/

Personally I use backuppc for day to day backups (it works wonders! I love the new version).

Here's the website: http://backuppc.sourceforge.net/

I actually talked to some people on IRC and it looks like I'm one of the lucky few who never has to do anything special; apparently others have to run firefox first as root, then they can run as normal user from there onwards. Your problem sounds worse however.

BTW when I install firefox, I install to a completely new directory (there are no other files there) and I symlink a folder to the new folder, e.g. I symlink mozilla-firefox to the directory mozilla-firefox-0.9.3. I do have to copy over all my plugins from the old firefox but that's not too hard, and I haven't had a corrupted install yet. Do most people just install over the existing firefox? I'm not willing to test it o_o.

Link on Firefox page is incorrect

[Short Circuit]

Use this link instead: http://ftp.mozilla.org/pub/mozilla.org/firefox/rel eases/0.9.3/

Re:And?

[Anonymous Coward]

Mainly because a service pack is not the norm, it rolls all previous updates into one package. A more useful comparison in this case would have been a TYPICAL download for a security update i.e. in the 250kB range.

Re:Try again if 0.9.3 for Windows didn't work earl

[Short Circuit]

When I looked at the link on FireFox's home page a few minutes ago, it was still pointing at 0.9.2. Thus my post above about an incorrect link.

I hope they don't mod you down as redundant.

Re:Firefox

[Lehk228]

yes and firefox is a sub 1.0 "technology preview" while IE is version 6 and still buggy and insecure.

payment for finding critical bugs

[cipher uk]

i wonder if the people who uncovered these bugs qualified for the $500 payment or if it contributed to them being found.

Re:payment for finding critical bugs

[Anonymous Coward]

Not all security bugs are critical. Of this batch of four, the only one I'd say qualified as critical was the libpng buffer overflow. The others are all just "the user could be tricked into doing something dumb without quite as many warnings as they'd usually get". Mozilla security flaws tend to be not-so-important, which is often forgotten because IE flaws are always "remote attacker takes total control". See http://secunia.com/product/1481/ and http://secunia.com/product/11/ for more information.

If I were Mozilla.org, only the libpng guy would have gotten any money, but I believe the award system was implemented AFTER this bug was found. Sucks to be him.

Re:payment for finding critical bugs

[mindfucker]

They should give him the reward anyway.

The guy who found and reported the libpng vulnerability is an author/maintainer of libpng. Maintaining core libraries like libpng is a mostly thankless job that all the big commercial distros profit off of while the maintainer (usually) doesn't make shit.

Re:payment for finding critical bugs

[Anonymous Coward]

So you're encouraging the authors of core code to put difficult-to-find exploits into their work, and then report them for profit?

Re:payment for finding critical bugs

[Anonymous Coward]

> Maintaining core libraries like libpng is a mostly thankless job that all the
> big commercial distros profit off of while the maintainer (usually) doesn't
> make shit.

Uh...welcome to the Open Source model. Optional poverty, coming soon to a desktop near you (well, maybe not so soon...)

Except nobody's making these excuses

[Anonymous Coward]

So what are you getting sick of? None of the posts made before you are making these statements that you are supposedly seeing so many of that you are getting outraged over it.

Re:Except nobody's making these excuses

[xeon4life]

If it really is necessary to point out to you, then I'm getting sick of comments like:
"At 5MB for Firefox (on windows), its far smaller than the average IE 'patch', which normally are around 7 MB or so."
"IE catches shit for 2 out of the 4 bugs." ...and...
"Anyway, do you think that FF/Moz should take the Windows route and refuse to acknowledge vulnerabilities, and simply hope they pass by with no one else noticing? Please, think a little bit before posting a comment."

Thank you,
Xeon

Re:Except nobody's making these excuses

[Anonymous Coward]

I'm getting sick of comments like those that have "I'm getting sick of comments like" in their first line.

Re:Firefox

[Anonymous Coward]

Come on guys, the cert. problems were legacy Netscape 4.x problems. This goes way back. Programmers in the ninetys created bugs too.

Re:Firefox

[Spad]

It's only the 5th, I'm sure IE will have caught up and overtaken Mozilla by the end of the month.

Re:Firefox

[gerf]

Touche'. Although I've never thought of Moz at V1.0 to be usable enough to make into my main browser anyway. Hopefully FF1.0 will be really really redicuosly good working.

However, it's my opinion that FF >> IE, in so many respects as to be overwhelming. I was having a conversation with someone the other day about FF extensions, and how they do so many cool things so easily. How will IE ever be able to catch up? It seems like anything for IE with the usefullness of the FF/Moz extensions (10k - 100k), requires a 20x larger download and another program that needs to run constantly (i.e, pardon the pun, a program that uses more resources and is a pain in the arse.) Even if IE makes tabbed browsing possible, and blocks pop-ups as they claim, it will never ever catch back up.

x86_64 anyone?

[bani]

looks like the mozilla binary builds for x86_64 havent been updated yet.

Re:Firefox

[dustinbarbour]

Slashdot not rendering properly is not a problem with Firefox, rather a problem with the non-standard codebase of Slashdot.

That's not the problem.

[Trillan]

I use an invisible root window in my application as well. Many applictions use invisible windows, and they do not foul Exposé at all. Exposé will not show an invisible window, nor will it show an offscreen window (which is frustrating to me, as I have several tools that try to remember where windows were last displayed even on smaller monitors).

I really do not know what Mozilla is doing, but it is not that simple.

Re:And?

[Fancia]

Mainly because a service pack is not the norm, it rolls all previous updates into one package. A more useful comparison in this case would have been a TYPICAL download for a security update i.e. in the 250kB range.

But this Mozilla release rolls several fixes into one package. Surely it would count as a service pack, not a single update?

Why does Thunderbird use IE???

[mslinux]

When I goto 'Help' -> 'Release Notes' on Thunderbird's text menu bar, IE opens... why is that? This occurs even though I've disabled access to IE in the WinXP 'Set Program Access and Defaults' section.

Re:Why does Thunderbird use IE???

[YetAnotherDave]

Well, you should browse to bugzilla.microsoft.com and enter a bug report against XP.

If you tell them about the problem they'll hurry to solve it, I'm sure...

Re:Why does Thunderbird use IE???

[Anonymous Coward]

I haven't used Thunderbird, I use Mozilla SeaMonkey, so I could be wrong. But my gut instinct is that you may have IE set as your default browser. Check and see whether IE or Firefox is the default.

one thing to note

[dwgranth]

Yeah, i see a lot of people on this list complaining about Mozilla having so many patches... dang, at least they put them out there... also im sure the opensource nature of mozilla/firefox lets many eyes see the bugs... while in IE there could be millions of little goodies that could be exploited and we would never know. I'm just impressed that the coding team has fixed the bugs so quickly. Yes.. they do need to build in a better patching mechanism.. but every project has a few growing pains.

Re:one thing to note

[Anonymous Coward]

also im sure the opensource nature of mozilla/firefox lets many eyes see the bugs... while in IE there could be millions of little goodies that could be exploited and we would never know.

If this is the case, then how come there was a recent bug that the Mozilla team had kept from the public for 5 years without fixing (or mentioning)? If you really think that so "many eyes see the bugs" of open source, then what were they looking for in those 5 years? Sure doesn't seem to me that your argument makes much sense based on things such as this.

Re:one thing to note

[Anonymous Coward]

This is insightful? No... This is moronic.

The exploits have all showed up on security mailing lists for a while now. There just hasn't been a response from the development team until now.

HELLO!!! THEY AREN'T FIXING THE BUGS QUICKLY!! They are refusing to acknowledge the bugs until they find a fix. Same shit, different vendor.

Anyone managed to build 1.7.2 from source?

[jbuhler]

I grabbed the 1.7.2 source tarball and configured as usual (Linux/gtk2, disabled everything but the browser), but there appear to be some files missing. The build first bombs when trying to create nsBuildID.h (missing the Perl module Moz/Milestone.pm, which I assume is part of the developers' environment). If I hand-copy nsBuildID.h.in to nsBuildID.h, it then bombs later because a variety of the needed Makefile.in files are missing (there are a bunch of warnings about this during configure).

I tried grabbing the 1.7.2 release directly from CVS, but the same problems occur. Anyone have any better luck? Was there an FM that I forgot to R? I had no problems building 1.7 from source by the same procedure.

Re:Anyone managed to build 1.7.2 from source?

[Anonymous Coward]

1.7.2 source tarball is really broken.
http://bugzilla.mozilla.org/show_bug.cgi? id=254346

Gentoo

[mroch]

"...so you'll have to download a new binary and install."

Not on Gentoo, you insensitive clod!

Re:Gentoo

[PeterPumpkin]

Gentoo doesn't have an ebuild yet for 0.9.3.

Re:Gentoo

[mattkinabrewmindspri]

hence the "Not on Gentoo, you insensitive clod!"

Re:Gentoo

[mroch]

mkdir -p /usr/local/portage/net-www/mozilla-firefox\
cp /usr/portage/net-www/mozilla-firefox/mozilla-firef ox-0.9.1.ebuild /usr/local/portage/net-www/mozilla-firefox/mozilla -firefox-0.9.3.ebuild
ebuild mozilla-firefox-0.9.3.ebuild digest
emerge mozilla-firefox

ought to do it... (It's compiling now for me)

Re:Gentoo

[mroch]

Oops, make that

mkdir -p /usr/local/portage/net-www/mozilla-firefox/files
cp /usr/portage/net-www/mozilla-firefox/mozilla-firef ox-0.9.1.ebuild /usr/local/portage/net-www/mozilla-firefox/mozilla -firefox-0.9.3.ebuild
cp /usr/portage/net-www/mozilla-firefox/files/* /usr/local/portage/net-www/mozilla-firefox/files/
ebuild mozilla-firefox-0.9.3.ebuild digest
emerge mozilla-firefox

Re:Gentoo

[PeterPumpkin]

I suppose...after properly adjusting your tinfoil ski mask, of course ;)

Re:Gentoo

[petabyte]

Ironically I'm a gentoo user, and considered making a statement like that when I submitted the article (but didn't want to be that guy). I actually got the news of the new version by watching the converstation in #gentoo-dev about work on the updated ebuild.

Re:Gentoo

[mroch]

What did they say about the ebuild? It seems to be working for me with the one from 0.9.1.

Re:Gentoo

[Anonymous Coward]

Even "funnier" is to have to download 33,149 kB for a security patch.

Gentoo needs NOW a patch system, they should have a look on xdelta.

Re:Gentoo

[Rich0]

If you are running gentoo on amd64 you probably will want the binary install.

Firefox still crashes when the autocomplete code is triggered when running 64-bit. It's been this way for a while now...

There's also the issue of flash being 32-bits, but that is hardly Mozilla's fault. It would be nice if they made a 64-bit build of their browser with talkback enabled - right now 64-bit users haven't had much luck tracking down the source of the problems...

UI Spoof Not Fixed

[Anonymous Coward]

I noticed 0.9.3 doesn't fix the UI Spoof using XUL mentioned a few days ago... Could this mean what I think it means....

Re:UI Spoof Not Fixed

[Anonymous Coward]

There are hidden prefs (about:config) that you can set to make it so that a web site can't turn off the navigation bar/statusbar/menu bar so what you would infact see is a double menu. The only problem is setting those screws up popups.

Re:UI Spoof Not Fixed

[Anonymous Coward]

My local Mozilla mirror (which updates every 6 hours) has a different FirefoxSetup-0.9.3.exe (and MD5SUMS file) than what is currently on ftp.mozilla.org. Looks like they updated it after release. How nice of them.

Re:UI Spoof Not Fixed

[Anonymous Coward]

Yes, it means that Mozilla has chosen Ease-Of-Use (unrestricted XUL) over Security (signed XUL, whitelists, prompts).

Re:UI Spoof Not Fixed

[Anonymous Coward]

I noticed 0.9.3 doesn't fix the UI Spoof using XUL mentioned a few days ago... Could this mean what I think it means....

Yes.... FireFox is your father.

Re:And?

[Anonymous Coward]

Not really, the Mozilla update only fixes four problems

Automatically checking for updates

[asmellysock]

Does the "Periodically check for updates" feature work in Firefox? It has never in the past informed me of an update, and even now when I manually check by selecting "Check Now" it currently tells me no updates are available.

Re:Automatically checking for updates

[mbennis]

type: about:config in the adress bar
In the filter box type : update
Double click update.app.updatesAvailable and write true.
Close and start firefox

(Off-Topic) Default Text Zoom Feature?

[Teckla]

An extension is available for Firefox that I'm desperately wanting in Mozilla. It allows you to set the default Text Zoom for all new windows and tabs.

Does anyone know if this is possible in Mozilla?

Re:Firefox

[Anonymous Coward]

Hi, welcome to Firefox beta 0.93

Best comment ever.

yeah, and unattended installs too

[illogic]

While we're on the topic of bashing the Mozilla installers, let me complain that unattended/silent installations of Firefox/Tbird are completely broken. The installer's config file promises to allow silent installs, but in practice it pays no attention to that option. Silent installations are necessary for deployment to lots of systems with proper settings and without user intervention.

The only ways I can see to accomplish a silent install are either:

• rewrite the installer so it actually does work (pain in the ass)
• or use the .zip version and completely re-implement the install process in a batch script (even more annoying)

This is another one of those "enterprise" necessities that the developers seem not to have figured out.

Re:yeah, and unattended installs too

[puddpunk]

And you should be deploying pre-1.0 software in an enterprise environment?

Here's your sign.

Re:yeah, and unattended installs too

[Bachus9000]

For my unattended installs I always configure the browser as I like (plugins, extensions, etc) and then zip up the Firefox directory (I use 7-zip compression, but anything will work). During Windows setup I just incompress the directory and Firefox is ready to go. Sure, it would be nice if the installer worked as it should but it is certainly still possible to install Firefox silently. :)

Re:yeah, and unattended installs too

[numark]

Well, considering that they're already up to 0.9.3, it seems that the Firefox/Thunderbird team doesn't have much time to get the silent install working. It'd be nice to have it working well before 1.0, instead of just including it in the 1.0 version and letting people have beta-quality installers in what's supposed to be a stable version. Something like silent installation is going to take quite a bit of testing in many different situations before it gets stable.

Re:yeah, and unattended installs too

[Anonymous Coward]

Convert zip to .exe, set it up to run once on user's login. Simple, works well here.

Neither do Mozilla Updates

[cnelzie]

I have never uninstalled Mozilla to run an update. Why waste the time? It overwrites and updates any setting changes while keeping your preferences and profile saved up very nicely.

Again, why waste the time in uninstalling just to move up to a newer release of Mozilla?

Four and more

[tepples]

The new Mozilla Firefox release fixes four security problems and all the other bugs that have been fixed in the aviary branch. Microsoft, on the other hand, hasn't published fixes to IE's layout engine since 2001.

Re:Four and more

[Anonymous Coward]

Most of this argument relies on consistent time frame, with each point of view adjusting it according to his or her arguements, for instance, I could say having been a firefox user since the .8 version and updated every say .02 release that I would have downloaded about 30Mb of data to get to the current state of where we are today.

Conversely, including the last service pack of IE, there have been a total of approx 20Mb of data downloaded.

But this all sidesteps the issue that in order to fix four security bugs, one MUST download a new version of a browser, which is NOT good policy.

Re:Four and more

[citog]

Maybe out on a limb here, but I prefer downloading a new version where security fixes are required. Security fixes need to be right, and right first time. Patching doesn't alway guarantee that.

Re:Four and more

[mnemoth_54]

Windows Update was deployed not just for IE fixes, but for Windows and everything that comes with it. Without it, general issue OS service packs balloon in size, because they need to contain every fix, not just the ones that apply to you. IE benifits from this distribution system, but MS would not have deployed it for something as small as IE alone.

Moreover, Mozilla hasn't reached the threshold to really consider an update system, since it's still under heavy development, but we may see one by the time it hits 1.0.

Re:Four and more

[Anonymous Coward]

the patching system for IE must work because MSFT keeps using the incremental patch system. It shouldn't be necessary to download a whole browser just to fix some security bugs. I'm not saying IE is a better browser, I just have to say it's update system is better.

Re:Four and more

[Myen]

Actually, I believe 0.9.3 (and 0.9.2 before it, 0.9.1 as well) were branched from the previous point release and are missing things that are on the aviary branch. As in, aviary branch nightly the day before 0.9.3 release had more fixes in it.

(I wish they'd start using a binary patcher or something... Or at least use an auxilary app that would uninstall, reinstall and open the new version for you, instead of having to do this manually)

Re:Four and more

[Jugalator]

Patching doesn't alway guarantee that.

Why not? What is the difference?

Yes, you need to remember to include everything in the patch, but same goes for the stand-alone binary.

Re:Four and more

[citog]

Patching has more dependencies than installing a binary. With something like IE you have an accumulation of patches sometimes on top of each other. The effect can be chaotic - are we sure all patches were applied and applied correctly? A patch is a sticking plaster until a unified release or service pack is issued, IMHO.

Re:Four and more

[citog]

I would say its update system is more convenient rather than better per se. If you are to deliver the patch as a replacement piece of source code then I have more faith in the ability to control the end result.

Uninstalling Mozilla: force of habit

[tepples]

I have never uninstalled Mozilla to run an update. Why waste the time?

I'm in the habit of uninstalling the previous Mozilla suite because I remember when Mozilla changed profile formats from nightly build to nightly build, and anybody who submitted a bug report had to delete the profile first.

For $500...

[Anonymous Coward]

A few random security flaws found. Imagine if it was worth thousands of dollars to you to find and exploit these flaws so you searched and found them months ago as part of your full-time work...

Re:For $500...

[MikeCapone]

A few random security flaws found. Imagine if it was worth thousands of dollars to you to find and exploit these flaws so you searched and found them months ago as part of your full-time work...

I don't have to imagine it; we can see how well it works with microsoft products.

They have paid programmers so there is no exploits and flaws in their software, right?

RPM is RealAudio?

[tepples]

You wrote in a wget dump:

=> `avr-libc-1.0-1.i386.rpm'
Length: 409,351 [audio/x-pn-realaudio-plugin]

I didn't know RealNetworks invented Red Hat's package format.

Re:Firefox

[g0qi]

No you idiot. Firefox has a Gecko engine, which has been around from the days of Netscape.

So a sub 1.0 technology preview is using rock-solid technology tested and maintained over the last decade.

Version numbers don't mean shit.

Offtopic: Regarding HTTP Header OS sniffing

[tyrione]

How come it is when as a Linux user I visit the Firefox, Thunderbird or Mozilla distribution top pages the web developers were smart enough to test for my OS via the HTTP headers but not smart enough to at the very least put a Linux friendly, scaled-down screenshot of these applications on the front page along-side the Download for Linux and Tux Penguin icon?

Instead I get to see that butt-ugly XP look for screen shots to the right of Firefox the browser reloaded.

Re:Offtopic: Regarding HTTP Header OS sniffing

[Anonymous Coward]

"How come it is when as a Linux user I visit the Firefox, Thunderbird or Mozilla distribution top pages the web developers were smart enough to test for my OS via the HTTP headers but not smart enough to at the very least put a Linux friendly, scaled-down screenshot of these applications on the front page along-side the Download for Linux and Tux Penguin icon?"

I didn't know that Linux users were so resolution challenged that they need "scaled down screenshots" or such complainers about artistic matters. They made a browser for your OS, can't you cut them a tad bit of slack instead of complaining about a webpage screenshot that they have not got around to updating to a dynamic image for BOTH Windows AND Linux? Oh wait look at the masses of Linux users saying, "He's just a complainer with crappy hardware who doesn't represent us." Thanks guys I almost got you confused.

Re:Offtopic: Regarding HTTP Header OS sniffing

[PeterPumpkin]

Yeah, I'm running at 1600x1200. I always thought those images were too small ;)

And, from a marketing standpoint, taking screenshots with XP just makes sense, because that is the most commonly used OS right now.

AND, this guy would be bitching if he's using GNOME, and they took a screen shot in KDE. AND this guy would be bitching if they took the screen shot in KDE with Keramik, and he's using KDE with Plastik. "Standard Linux Desktop Look" aren't words you find together very often.

Easiest of upgrades

[whovian]

That was what an update should be!

Upgraded from 0.9.1 to 0.9.3. Didn't have to fiddle with turning off extentions or re-downloading them and reconfiguring them this time. Continues to use the same .mozilla directory. The only nit to pick was that search plugins aren't stored in userspace, but copying them over is trivial.

Re:Easiest of upgrades

[Anonymous Coward]

You shouldn't have to uninstall before installing the new version.

Where are the Changelogs?

[Codeala]

Where are the Changelog? From the website, you only know there is a new version for these three apps, but there is not description of what has been changed since the last version?

I remember that for every release there used to be a link to the Changelog with details on all the new changes since the last minor update (eg v1.6.1 to v1.6.2). Is the new site/design just too "user friendly"?

(After some browsing I did find a link to an *external* website with change details, but can't find it again now... @_@)

Re:Where are the Changelogs?

[VGPowerlord]

The Mozilla 1.7.2 Release Page has a link to the bugs it fixes.

Reality check, please.

[Lexomatic]

Firefox is still pre-version 1.0 at the moment, so people should be expecting these sort of updates.

Prior to 0.9, Firefox was only being updated ever few weeks, with each release holding many fixes since the last release. I think the increase in releases has mainly been due to the fact that in the last month or so the user base of Firefox has gone up dramatically.

I am sure this has put a lot more stress on the Firefox dev team because now people are starting to rely on their browser to be as good as IE and with whole organisations now looking at using Firefox over IE, the pressure must really be on to make sure it lives up to expectations.

Once Firefox hits version 1.0, people will get real shitty if it has bugs and security flaws, so the more they fix during 0.9.+ the better. Until then, I am happy to keep downloading it, daily if needed.

Re:Reality check, please.

[Anonymous Coward]

And that applies to the non-beta Mozilla (version 1.7.2) how, exactly?

Re:Reality check, please.

[Anonymous Coward]

ive noticed a lot of new users recently too. this has no empirical value, but anecdotedly you might find it interesting:

http://forums.whirlpool.net.au/forum-replies.cfm ?t =223040

Re:Reality check, please.

[Anonymous Coward]

Firefox is still pre-version 1.0 at the moment, so people should be expecting these sort of updates.

I wish people would bear that in mind when they try and switch people over from other browsers though. You can't have it both ways - either it's in beta, in which case switching people over is premature, or it's not in beta, in which case bugs like this are unacceptable.

Re:Reality check, please.

[Anonymous Coward]

I am sure this has put a lot more stress on the Firefox dev team because now people are starting to rely on their browser to be as good as IE

No, we're relying on our browser to be better than IE. And, in general, it is!

Re:Firefox

[VGPowerlord]

However, those 3 Firefox holes were fixed faster than the 1 IE hole. Mozilla releases patches as soon as they've fixed the problem. Microsoft? They wait until Wednesday night. If a problem is fixed on a Thursday, and it's something already exploited, then most people affected (the clueless windows users) are basically screwed.

Keeping in mind that today is 2004/08/04...

Critical Bugs fixed in Mozilla 1.7.2/Firefox 0.9.3/Thunderbird 0.7.3

Bugzilla Bug 249004: Importing false CA certificate leading to error -8182 (perm DoS), especially exploitable by email
Patch v7, adjusted for OS/2: patch, 2004-07-27 16:44 PDT

Bugzilla Bug 250906: null (%00) in filename fakes extension (ftp, file)
Prevent creation of ftp: URI's with nulls in them: patch, 2004-07-29 11:19 PDT

Bugzilla Bug 253121: lock icon and certificates spoofable with onunload document.write
Final patch for checkin (trunk): patch, 2004-07-27 17:25 PDT

Major Bug Bugzilla Bug 251381: new libpng buffer overflow vulnerabilities
combined set of fixes: patch, 2004-08-03 14:09 PDT

Now, read those dates again for the critical bugs. Then note the day of the week. 3 Critical bugs were fixed on Friday, but not rolled out until... here's the real kicker... the next Wednesday.

...and before you say it, I've used Mozilla since 0.8, and finally moved over to Firefox and Thunderbird earlier today.

Re:Firefox

[Anonymous Coward]

Hmmm..

Keeping in mind that today is 2004/08/04...

IE 6 still had a major exploit in it for months and M$ sat on it and did nothing. Only last week, the update came out to patch it. And I shouldn't use the term patch, since it was more or less a bandaid.

(http://www.securityfocus.com/bid/10473/info/)

Lets check the dates (keeping in mind, the date was when it went public). The exploit was issued on June 6 and the rollout was July 31. WOW.. Nearly 2 months till that was patched.

So before trying to accusing Mozilla of sitting on some know problems.. Why don't you look to your friends over at Redmond. They really take the cake when it comes to sitting on known problems.

Re:Firefox

[Anonymous Coward]

Actually, it was a bug in Firefox. Search for bugs with Slashdot in the summary and at least 5 votes.

OT: Re:RPM is RealAudio?

[threephaseboy]

On a lot of stock systems the offending line in mime.types is:
audio/x-pn-realaudio-plugin rpm
and should be:
application/x-rpm rpm
I have not come across any realmedia files with the .rpm extension in the wild.

Re:Firefox

[Anonymous Coward]

Anyway, do you think that FF/Moz should take the Windows route and refuse to acknowledge vulnerabilities, and simply hope they pass by with no one else noticing?

Ahh, you mean like this?

http://it.slashdot.org/article.pl?sid=04/07/31/0 03 7210&tid=154&tid=128&tid=172

I'm sorry I dont know why I brought it up actually, I mean the guys at Mozilla only knew about it for 5 years.

Get the news first...

[MagicFab]

One way to keep updated about Mozilla releases and developments in many different areas is by subscribing to one of the developer mailing lists:
http://www.mozilla.org/community/developer-forums. html

MozillaZine.org also does a good job of summarizing the development, but it's almost always 2-3 days late.

For the true cutting-edge lizard in you, there's always the feedhouse:
http://feedhouse.mozillazine.org/

And of course it has RSS feeds.

For those of you wanting to know when specific bugs have been fixed, I find the "edge" websites to be most simple to read (although not thorough):

The Rumbling Edge (for Thunderbird):
http://weblogs.mozillazine.org/rumblingedge/

The Burning Edge:
http://www.squarefree.com/burningedge/

Saddly, there is no information about the releases almost a day after they have been out on http://mozillaeurope.org/en/ ... I wrote a note this morning but I imagine they are submerged.

Enjoy!

Problem with Proxy

[v1x]

This version broke something related to the proxy configuration. I can no longer authenticate myself at any website using saved passwords if I use my university proxy server. :(

Re:Firefox

[Stevyn]

What? Version numbers don't mean anything. Closed source version numbers seem to be based on a marketting department and open source version numbers seem to be based on some geeky lingo. Firefox may be at 0.93, but the underlying technologies have been in development for years.

It's a great browser and I use it on windows at work and linux at home, but just because it's version 0.93 doesn't mean I can bitch at microsoft and appologize for mozilla.

Re:Security Bugs!

[FatTux]

You thought wrong, pal. Programs bigger than Hello World that are also bug-free are rare, if they ever exist. The advantage of FOSS is the development model that allows peer review, so bugs are quickly fixed. The FOSS model may be not perfect, but can generally attain a better security record than proprietary solutions.

Letting People Know

[MournsForHumans]

What I find odd is that despite this release being focused on patching security vulnerabilities there's no noticable mention on the web site of the importance of this update. I leave my home page set to the FireFox page in hopes that there will be a clear message saying if there's a need to upgrade, but the page itself only says 0.9 -- and I'm fairly confident that the average user isn't going to figure out the difference from the front page (which now says 0.9.3, but how many users are aware of what version they're using?) It wasn't until I read slashdot that I was made aware of the release of this security update, and who knows if something could have happened since then?

While I don't expect a windowsupdate.com for Mozilla, being that a main criticism of users is their failure to keep software updated why don't the developers make it more clear that an update is even present?

Re:Letting People Know

[codemachine]

Actually it would be really nice to have a windowsupdate.com type site for mozilla. In fact, it'd be nice to have such a site or program for all 3rd party software on Windows, so that each program doesn't have to have its own update tool.

At least having Cygwin, Gaim, OpenOffice.org, Mozilla, etc. all updating from the same utility would be nice.

firefox .msi

[danZenie]

i closed my eyes and prayed for one. then i blew out the candles. get ready to do some terminal hopping :(

Mozilla 1.7.2 and Slackware 10

[FatTux]

Just tried Moz 1.7.2 and the anti-aliased fonts were gone (maybe build options?). Furthermore, I've faced some segfaults when browsing Slashdot. Reverted to Slack 10's original Moz 1.7.

My 2 cents.

Re:Mozilla 1.7.2 and Slackware 10

[MikeCapone]

Just wait until Patrick adds a Slack package of 1.7.2 to Slackware-current and get it off a mirror.

Re:Mozilla 1.7.2 and Slackware 10

[catscan2000]

It sounds like you need to enable xft at configure-time. Do `./configure --help` for more info. You will probably need xft-devel or whatever the appropriate -devel package is.

"you'll have to download a new binary and install"

[Stonent1]

But I use Gentoo you insensitive clod!

Also updated BugMeNot plug-in/extension (v0.4)

[antdude]

See its home page.

Version MisMatch Alert.

[technix4beos]

The windows version listed for download at the FireFox product page is not the same as the windows version listed on the main download page.

Just a heads-up to everyone rushing to download without checking. The mozilla.org web guys might want to fix that too.

Cheers.

Re:Firefox

[Anonymous Coward]

At least one of your numbers is off.

Bug 250906 has was reported to the Mozilla foundation on 11 Jun 04.

link:
http://www.securityfocus.com/archive/1/36 8739/2004 -07-11/2004-07-17/2

Unfortunately this still doesn't fix the render

[Tim_F]

problems that Firefox .9.x has had with slashdot. It seems that the side menu bars randomly overlap the main page content. It really looks ugly.

Re:Unfortunately this still doesn't fix the render

[angrykeyboarder]

hummm. I've never noticed that..

& I'm running Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3 Mnenhy/0.6.0.101

Re:Unfortunately this still doesn't fix the render

[Anonymous Coward]

Win98? Sick bastard.

Switch to WinXP finally (and don't forget to update it with SP2, which will be released very soon).

Re:Unfortunately this still doesn't fix the render

[The One KEA]

It's not supposed to. The changes needed to fix that are too intrusive to be inserted into the Aviary branch.

If you want fixed Slashdot, go and get a trunk nightly build.

Re:Unfortunately this still doesn't fix the render

[Anonymous Coward]

Quick fix: Increase the font, then decrease again, and that'll force the page to be re-rendered and displayed properly.

Re:Unfortunately this still doesn't fix the render

[angrykeyboarder]

It's actually not my computer. Mine (temporarily out of service) has Win2k. I'd have XP Pro but I can't afford it right now.

Gee Whiz, mozilla has bugs?

[Anonymous Coward]

Well whatta ya know. Non IE browsers aren't infallible.

Thought of this?

[TheApocalypse]

On top of that, IE updates don't require an uninstall. It would be a waste of the millions of dollars and the years of court battles to have IE uninstall just to have for an update?

Its not that hard

[gad_zuki!]

Granted, I'd like to see a patcher/updater that works, but this is still sub 1.0 software.

Rename current firefox directory.

Install firefox.

Copy plugins folder to new install.

Load firefox.

That's it. Your bookmarks and settings are in your profile, NOT in the install directory.

Some plug-ins will need to be reinstalled.

Check your filetype settings

[MachDelta]

1: Control Panel -> Folder settings
2: File Types tab
3: Find (NONE) URL:HyperText Transfer Protocol
4: Click Advanced
5: Select the open action, and hit Edit
6: In the application used field, it should say something like "C:\Mozilla Firefox\firefox.exe" %1, or whatever your FF directory is.
7: Make sure Use DDE is checked, but clear the DDE Message field (it might have a %1 or something in it).
8: Hit OK twice.
9: Repeat steps for (NONE) URL:HyperText Transfer Protocol with Security
10: Give it a whirl, Thunderbird should now launch Firefox instead of IE.

It WFM anyways. :)

Re:(Off-Topic) Default Text Zoom Feature?

[lombre]

change the default font size

Edit -> Preferences
+ Appearance
+ Fonts

Auto Update

[Anonymous Coward]

The main executable for firefox is ~6MB... It would seem to me that this is not a very efficient method for updating the program. Perhaps they'll design the next version with modules that can be updated more efficiently by smaller downloads?

Anyone know why the version information for the file for 0.9.3 lists 0.9.0.0? Right click firefox.exe and then properties then version tab.

IE has an executable of a few KB (WinXP).

Re:Auto Update

[chx1975]

a few KB? what about mshtml.dll, a 2+ Mbyte DLL... iexplore.exe is small, 'cos it's not much more than a dummy dll loader.

Re:Auto Update

[Xyl3ne]

Is it really hurting you to download a that much? I'd rather deal with it then use that insecure POS, IE.

Re:Auto Update

[Phred T. Magnificent]

> IE has an executable of a few KB (WinXP).

And an almost 2.5 MB mshtml.dll, and a 1 MB mshtml.tlb, and...

Re:Auto Update

[WuphonsReach]

IE has an executable of a few KB (WinXP).

That's because everything resides in DLLs. Go back and look at the size of the old IE4 downloads. IE 4.01 was a 55MB download. IE 5.5sp1 was a 61MB download.

Now figure that IE6 is even more bloated, except that most of it came with the operating system so you don't see it.

This is silly.

[BrokenHalo]

Even on a 56k dialup line, the 8Mb download (firefox linux binary) wouldn't take that long to download. Roughly 20 minutes IIRC. I don't know about you others, but that's a small price to pay for security.

So what's the big deal? Oh, and BTW mozilla.org have some fairly kickass servers, well able to stand up to a slashdotting.

Re:This is silly.

[fuzzix]

Even on a 56k dialup line, the 8Mb download (firefox linux binary) wouldn't take that long to download. Roughly 20 minutes IIRC.

Haven't been on dialup in a while, have you? You could realistically expect to at least double that time for most dialup users.

whoops a better formatted version.

[FryGuy1013]

Err that's what I get for not using preview.. Better:

That's what I said.. "The only addition of permissions in moz is being able to link to other file: locations." By link I don't just mean <a href>. <iframe> can link too, and since they're the same "zone", you can read their innerHtml, which usually contains the contents of the file.

"Local Zone" in IE means you get access to a lot of ActiveX objects that aren't allowed in web objects, like ADODB.Stream, which can actually *write* files to your hard drive.

Re:whoops a better formatted version.

[jesser]

Ahh. I'm used to "zone" being broader than "same-origin context". For example, slashdot.org and squarefree.com are both "internet zone" but can't read data from each other.

While local files loaded in Firefox are more powerful than they should be, local files loaded in IE are much more powerful than they should be, like you said.

Re:"you'll have to download a new binary and insta

[angrykeyboarder]

Dubya is an ignorant, arrogant, insenstive, war-monger. Anybody But Bush!

Re:Firefox

[spacefight]

Did you even try Mozilla 1.0 etc at all?

Mozilla on Windows (since the then called Milestone releases) and for more than 18 months on Linux has been my main browser over all for years. It was "usable enough" since the beginning - otherwise I wouldn't have used it.

Hmmmm

[AdmV0rl0n]

During the recent Ject issue, I looked into trying to rip out IE. I have like 120 machines to look after, I don't have the money to active directory, and I have certain limits. I'll use psexec but even so, its a long tedius job maintaining 120 machines.

Now, getting back to IE, yes, I did look at ripping it out. Not so easy on XP Pro as any user who signs in gets linked to the program in default. I could banjax the progam directory, and stop it being used that way, but if I do that, I believe I can still call windowsupdate.com via an explorer window. I presume however, that anyone using the same method uses the same cuplable browsing that impairs IE. Thus I'm not really solving the problem, just fending it off until the users get smart.

In terms of Mozilla and Firefox, sadly I have to say the security failure regarding :shell: made me rather glad I had'nt committed a massive workload in the name of switching to a new bugwridden, secuirty glitched browser.

Today, I'm told if I had rolled Mozilla, someone's just committed me to a whole sale re-roll out just because they can't patch, they have to fix it in a new install.

I've said it before, I'll say it again, doing this to me just puts me right off even contemplating it. Next week, watch out, the next Mozilla issue will rear its ugly head.

I sadly have to put aside the OSS/MS stuff, because whatever I put out there has to work, and its not about Ideaology, I do not care about Ideaology. Mozilla is a fine effort, but the security side leaves much to be desired. One is hard pushed to claim that its a quantum leap in browser security.

AdmV

Re:Firefox

[God! Awful 2]

Hi, welcome to Firefox beta .93

As if the term "beta" really means something to an open source project. Netscape released beta-quality software and gave it a new version number. I guess what you're saying is that Firefox should take the opposite approach... just remain at beta forever and you can lower people's expectations.

-a

Speed

[Anonymous Coward]

Now if only they'd fix the tremendous slowdown on big pages I'd be a happy camper.

Re:And?

[nmg196]

> Since when is a service pack not an update?

Since it includes the ENTIRE browser and doesn't update anything perhaps?

"Internet Explorer 6 Service Pack 1" is NOT a service pack - it's the ENTIRE of IE 6 PLUS service pack 1 and doesn't require IE 6 to install. It's not an update because it doesn't update anything - it's the whole installation of IE6.

Perhaps you should have read the VERY FIRST line of the linked page before posting.

actual problems

[Anonymous Coward]

While you all complain about installers:
http://www.auscert.org.au/render.html ?it=4273&cid= 1

and

http://www.auscert.org.au/render.html?it=4273&ci d= 1

are the actual problems.
Will someone please point out that Firefox 0.9.3 DOES NOT SOLVE all of these problems!!

Looks like one up for IE6, today....

Re:Firefox

[Anonymous Coward]

Yes, and not a single one of these bugs are Gecko bugs. What was your point?

Re:"you'll have to download a new binary and insta

[Anonymous Coward]

Well I guess there's no chance of Bush being an admitted War Criminal during Vietnam, what with him being too busy going AWOL from the National Guard.

I can't fathom how you Bush fanboys can possibly consider Kerry's war record as a negative point when Bush The Deserter doesn't even have one, the fucking pussy ass mommas boy!

It should be easy to..

[gosand]

Granted, I'd like to see a patcher/updater that works, but this is still sub 1.0 software. Rename current firefox directory. Install firefox. Copy plugins folder to new install. Load firefox. That's it. Your bookmarks and settings are in your profile, NOT in the install directory.

Yep, sounds easy. I'll bet it wouldn't be too hard to CODE then.

I never understood why some coders will not take these "simple" things and just put them into the damn installer.

Re:Does this mean that . . . nothing

[Anonymous Coward]

IE is just so much more than the base FireFox. For example vb scripting, ActiveX controls and support. And not to forget... the ms java stuff.

Re:And?

[FubarPA]

Yes, but the problem is IE is already installed into Windows. Therefore, it's technically an update.

Re:Try again if 0.9.3 for Windows didn't work earl

[Apathetic1]

Installing over a previous version can cause problems. Delete the installation directory before you install the new version and it should work fine. Bookmarks, Themes, and Extensions should all be stored in your profile directory and won't be touched. You'll probably have to reinstall plugins, however.

Yippie

[Anonymous Coward]

Have they fixed the bug that repeatedly asks me to upgrade to version 0.9 (even though I am running 0.9.2) every time I open the damn thing? I've let it do the "upgrade" about a dozen times - but the version always stays at 0.9.2 and it always gives me the upgrade notification when I open the browser.

Re:And?

[nmg196]

Only in the same way that if you have Netscape 4.71 installed, then Netscape 6 is an "update". Even though a Netscape 6 installation includes every single file needed to run Netscape 6 and doesn't reference a single file from the 4.71 installation.

I'm not going to argue about it - I think everyone realises that the original post was wrong in the context in which it was said. The poster didn't realise that his large "update" was actually the whole of IE6. He probably thought it was just a service pack.

Re:Firefox

[gerf]

Actually, I think it was more the feel of it. I really don't like the netscape-style toolbars, for example, or the load time on this old box I use. I'm sure it was a fine fine product sir.

Re:Does this mean that . . .HARDLY

[krayfx]

t'was a cinch downloading the entire browser in the case of firefox. but i do agree, the problem with MS is much more serious, they have many more issues to handle- since the browser sits tightly intergrated with the OS there might be host of problems, and the patched approach it has to be. thier footprint for the IE 6 was large above 20 MB - i guess with many other bits and pieces.

Re:(Off-Topic) Default Text Zoom Feature?

[Teckla]

Thanks, but that's not quite the same thing.

Sessionsaver + Qute

[ahaning]

I previously had Mozilla Firebird 0.7 installed on Windows 2000. I've tried to migrate to Firefox befoew, but certain things (like Sessionsaver sessions and the theme) didn't work/look proper[ly].

For those that don't know, Sessionsaver can save tab /window sessions so that they come back up after closing and re-opening the program. It's really nice when you have 15 tabs that you have the way you like them and accidently close the window. Qute is the Firebird theme and the most popular on the themes site.

Previously, all of my settings for Firebird were kept in C:\Documents and Settings\%username%\Application Data\Mozilla\Phoenix\ and there was a file in \Mozilla\ called pluginreg.dat.

I have always downloaded the .zip files and put them where I want them, so if you install using an installer, YMMV.

Here's how I got my settings back with the Firebird theme and all of my tabs back open. There's no real haX0ring involved here, but in the case that any one wants to do this, this is what worked for me. (Gripes to follow.)

Download Firefix 0.9.3
I downloaded and unpacked the Firefox zip file for Windows (ftp://ftp.mozilla.org/pub/mozilla.org/firefox/rel eases/0.9.3/Firefox-win32-0.9.3.zip).

Load Browser, Migrate Settings
Then, I loaded the browser and it prompted me as to whether or not I wanted my old settings migrated. I did, and selected the default options. The browser loaded and my homepage and network settings were there (YES!).

Download and Install Qute
Now, I liked the way Firebird looked and the way my tabs were saved by the Sessionsaver 0.2d extension. So, I went to the Themes manager and clicked Get More Themes. I downloaded and installed Qute. Then, in the Themes manager, I selected the Qute theme and clicked the Use Theme button. It didn't show up in my browser window right away, but I figured "maybe it needs me to shutdown and restart." So, I wasn't too worried.

Download and Install Sessionsaver 0.2d
Then, I googled for "sessionsaver", and got lucky. I installed the Sessionsaver extension. In the Extensions manager, it asked me if it wanted me to install it to my user preferences folder. It suggested that this way, it wouldn't have to be reinstalled when I upgrade the browser. I know that's not true, but I said yes, anyway. I loaded up an extra tab and a window to see if it would load them back up the next time.

Restart Firefox
Much to my surprise (and excitement), Firefox didn't open back up with my test windows and tabs, but my old Firebird session!

I went through this process again (making sure to remove my \Mozilla\Firefox folder and any added files and the program folder made when I unpacked the zip file), just to make sure I wasn't crazy.

Now, for the things that annoy me:

1) The Qute theme isn't EXACTLY like it was in Firebird. The buttos are shinier or something. I may write to the designer or search around for an older version if I can, but I'm going to live with it for now.

2) The Extentions, Themes, and Downloads windows suck up tons of CPU time when I move my mouse cursor between the panes and in and out of the windows. WTF?

3) The Download manager. I personally preferred the old progress windows from Firebird. I know there's an extension to allow me to use external programs for downloads, but I really did like those little windows. At least give me the choice of using the manager or the windows. The one function of this that I do like is t

Re:Sessionsaver + Qute

[Anonymous Coward]

I should add that after installing the Sessionsaver extension, it DISAPPEARED from the Extensions manager, but it still works.

Would be nice if the code acutally builds

[Anonymous Coward]

I've once again, run into one of the classic free/open source software problems, that seem to plague even the larger projects like mozilla.

I run Debian linux on a PowerPC mac, and it's not at all easy to find pre-built binaries for my architecture and platform combination. "No worries," I say to myself, I'll just grab the source code and build it myself (which I was able to so successfully for the 1.7 release, and am running at this very moment). Well, the released 1.7.2 code does NOT build, even with the instructions on the project's UNIX build pages. I checked again, but to no avail.

Moz developers, I know you all have quite a bit on your plates, but sometimes it wouldn't hurt to do a clean build, from about-to-be-posted source and instructions, to make sure all that's being released is actually fit to be released...

Re:Firefox

[Anonymous Coward]

Yeah they are totally screwed. What the fuck are you thinking?!?!

The majority of all security holes are patched and then publically disclosed. The adob.stream was a rare occurance and I may even fault the idiot who released it before contacting MS first.

Last I checked Mozilla is separate from the OS. Patching it has no effect on the rest of the operating system. IE on the other hand needs to be tested throughly to be sure it doesn't suddenly break 1 of 234347 apps. You'd know this if you actually used Windows.

Re:"you'll have to download a new binary and insta

[stor]

Hey, check it out dude:

Gentoo fan page

=)

Cheers
Stor

Miguel's Views

[NauPru]

The fact that Miguel is an excellent coder does not suddenly make him into someone who has good judgement. Check out the links on the bottom of his homepage .
I realize that this has nothing to do with his work or with the validity of Mono (which, as a .NET developer, I think is a cool project), but it's pretty sad that such a smart person could have such one-sided and ignorant political views. That film he links to at the bottom is even more of a propoganda film than Michael Moore's latest... The trailer with sad music and a billion shots of children made me want to throw up, and Miguel called it "must see".

Divide that by 100...

[Anonymous Coward]

and get my dl speed right now. And some people are wondering why I prefer being an Anonymous Coward..

Re:Mod parent down

[Anonymous Coward]

Here here.

It's "Hear, Hear" you nit.

Re:Try again if 0.9.3 for Windows didn't work earl

[sakyamuni]

Excellent, that did it. Thanks for the tip, GIR!

Switching to MSIE

[Anonymous Coward]

I've had it with the two recent FireFox issues. I thought it was good software. Back to IE i go.

Re:"you'll have to download a new binary and insta

[Stonent1]

Enjoy it when he gets reelected.

Re:Firefox

[gerf]

No, i was mocking the parent post that got modded down to oblivion.

Firefox 0.9.3

[Richard Brandshaft]

The New York Times logon does not work with Firefox 0.9.3. It worked with 0.9.2; I didn't change anything on purpose when I installed 0.9.3 over it.