Slashdot Mirror
Major Browsers Have JS Pop-Up Flaw
An anonymous reader writes "Secunia is warning that several popular browsers contain a vulnerability that could allow a phishing attack. 'The problem is that JavaScript dialog boxes do not display or include their origin, which allows a new window to open -- for example, a prompt dialog box -- which appears to be from a trusted site,' Secunia said. The browsers include the latest versions of IE, IE for Mac, Safari, iCab, Mozilla, Mozilla Firefox and Camino. Opera 7 and 8 are also affected but not 8.01."
Boy well, you just pop right up there, doncha!
Isn't this a dupe from half a year ago?
Too bad if it's just a symptom of the problem(s) just not being fixed yet...
"Good news, everyone!"
This is only a 'security flaw' in the same way that those banner ads that look like warning dialogs are...
Opera 8.01 was released June 18th.... (only a few days ago)
//tin-foil hat engaged
It is the only browser not affected....
And now this leaked out where reports can only say that one browser does not suffer from this issue.
Thank god I use Contiki!
The coolest voice ever.
...and they're not going to release a patch for it.
;)
And you *know* that if Microsoft says it's not a flaw, well, then, it mustn't be a flaw.
libertarianswag.com
Ever get rooked into going to a website with perpetual Javascript pompts? I love those.
The only way out of them is to kill your browser process outright.
This is a prime opportunity for mozilla developers to do a slight tweak to the prompts. a "kill all javscript for the rest of this session" button, etc.
It seems to have been forgotten, or deferred.
That'll solve the problem
Excuse me?
What do you mean Java Scripting is a feature?
[Fuck Beta]
o0t!
...then perhaps the flaw is in the user.
Very few sites, if any, will use JavaScript/child windows to request details. While I agree that some people are unaware of that, they probably ought to stay away from malicious sites to begin with.
My Linux - (L)ove (I)s (N)ever (U)tterly eXPensive
Ooh - isn't Opera one of those web browser thingies? :-)
Any fool can talk, but it takes a wise man to listen.
That's why I use NoScript with my Firefox.
to type inportant information into a popup they got whilst browsing some porn site or something.
sudo killall humans
To solve this problem, javascript multitasking must be disabled, only letting the current active window or tab having keyboard focus to run its javascript. Other tabs' scripts must not be disabled, but instead paused until they in turn receive focus.
It cracks me up, because they probably have an obsessive/compulsive, socially-maligned programmer within Secunia that just delights spending 16 hours a day trying to twist the browsers into doing what he wants. And then Secunia announces these flaws to save their reputation because nothing else is going on.
It's not even a bug.
; ;
/., stop supporting Opera FUD. Thanks.
It's advertising and FUD from those Opera guys. They are really getting boring.
- Opera adds a feature that shows the name of the site in the title bar in their last build
- Someone at Opera reports it (under a false name) as a security issue affecting every browser BUT Opera
- Slashdot runs one more article about the genious of this stupid paid-for, closed source browser.
That's not the first time it happens, nor the last one.
It corresponds to say.. running a browser, a spreadheet and say a game at same time and then getting a dialog box that is not identifiable saying "Do you want to save?".
Different problems of this sort will only raise as more and more applications are run as web based. Today it is popups that are not identified, tomorrow something else.
That's what happens when one doubts the infallible wisdom of Steve...
What I'm listening to now on Pandora...
Firefox has been working on it and Opera fixed it. Microsoft says they aren't going to fix it since it is a "feature". Even better, Microsoft's answer is for users to install XP SP2 and make sure the firewall is enabled. Beautiful...
Konqueror 3.2.1 here is affected.
My front door has a major flaw, in that con artist can walk up to it and claim they are from and officially federal agency and have an urgent need for me to help them.
Doors from major outlets, including those of Lowe's and Home Depot, are affected by this flaw. Our investigations have determined that this flaw has been known for years, yet the major distributors have not plans to release an update to correct the problem.
US Senator, C. Ritter has introduce legislation under the title "Omnibus Weak Nutz United", the OWN-U bill, that seeks to station a security agent to watch over every door in the case the occupants cannot determine that they are being conned.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
Yes, it is. (a leat version 3.4.0)
I know you're trying to be funny, but in most cases Mac OS X and Objective-C while using the Cocoa framework provide for a very secure environment. Mac OS X's Mach ancestory, which derives directly from BSD UNIX and from true UNIX itself, proves to be a very stable and secure base to build upon. Objective-C and Cocoa combines the security of Java with the speed of C. Together they form a very strong programmery layer that is nearly impenetrable.
Indeed, considering this problem affects so many different browsers, across so many different platforms, across so many different codebases, it is more appropriate to say that it is an error within the JavaScript specification and design.
Cyric Zndovzny at your service.
You really think most people end up on malicious sites intentionally?
why stop there? why not keep your computer turned off and locked in the corner? it's just asking for trouble by running scripts and executables all over the place.
when is microsoft going to patch their OS so it no longer runs any code?
i could live a little longer in this prison
"While I agree that some people are unaware of that, they probably ought to stay away from malicious sites to begin with." Because we all know the users can tell the difference between the real thing and the malicious site, unless of course your method of staying away has them disconnecting their internet connection.
People should stop developing with JavaScript. It's nothing but trouble.
Poppycock. This is nothing more than a typical knee-jerk reaction to a minor security flaw. Should we all stop using email because phisers can craft ones that look like someone elses?
Lots of sites use JavaScript very effectively. So many in fact, that it's rather difficult to make such a wild statement as "JAvascript is nothing but trouble." Google is a perfect example of a highly useful site with JS. For example, Maps and GMail both rely heavily on JS. In fact, most webmail sites contain JS. And without JS, you couldn't have neat stuff like this. (Login is test, test)
Javascript + Nintendo DSi = DSiCade
Have you ever used Objective-C? It's the SLOWEST compiled environment ever! And, because there's no garbage collection, etc, it's certainly no more secure than "raw" C (because all of C is legal in Objective-C). In many cases, Objective C is slower than Java becasue of it's "run-time" binding.
Best Buy can have you arrested
You are forgetting that the normal way in which browsers have presented HTTP authentication for years is in a popup window. I'd expect many people to have logged into legitimate sites with what appears to be a popup to them.
What's a "malicious site"? There have been worms and viruses that insert malicious code into whatever HTML they can access. Suddenly, the definition of "malicious site" includes the website of every organisation that is susceptible to worms and viruses.
man, thank god i am still using lynx.... I was worried when they said major.
Javascript is very useful to creating rich web applications that don't have to reload the pages. Seen Google maps or Gmail? How do you think they did that?
I agree that Javascript should not nessicarily be required to view content on a general website but properly used it gives a whole new dimension to web apps.
People give the guns and P2P analogy all the time here: they both have proper uses and improper uses and banning them, or not using them because they have improper uses makes no sense. How is Javascript any different?
The Anti-Blog
I know the Mozilla devs were talking about this a few weeks back on one of the lists. They said they didn't consider it a severe security issue yet, but were working on the engine so that popups would be tab and window modal. They've also added pieces to the plugin interface so that plugin developers (Flash and Java for instance) can honor Mozilla's popup blocking.
Currently, if you're popup blocking for all but trusted sites you should be relatively safe from this. It really is hard to prevent phishing attacks though. They attack the users judgement, which unfortunately tends to be the weakest link.
Actually, this attack doensn't work "well" with Firefox on Mac, which uses sheets to display JavaScript dialog (alert, promt, confirm). By tying the dialog to the window, it becomes visually obvious which window the pop-up belongs to.
Now why doesn't Safari use this? Seems strange Apple wouldn't use their own UI convention.
The only non-free browser, Opera, already has a fix for it.
What's your point?
I agree that this is an issue, but saying this is a vulnerability in the browser seems a little odd. It feels a little like saying that your email program displaying phishing emails is a vulnerability in the email program. I'm not saying that this isn't something that could be addressed by a change to the browsers, but the headline (and TFA) make it sound like the code in the browsers is faulty.
iCab recently passed the second Acid test.
The difference is that you can do lots of things on the web without client-side scripting while you can not do anything with an OS that does not run executables.
Linux is not Windows
If Secunia is reporting it, why not link directly to Secunia?
n _vulnerability_test
http://secunia.com/multiple_browsers_dialog_origi
I've never understood the reason to link to ZDnet first. Especially when we are all a technical crowd and can deduce the severity on our own.
In my own opinion, the security community has been really scrambling to find exploits and vulnerabilities since the release of Windows XP SP2, which, despite a lot of compatibility issues with common software, has been very effective in slowing down the growth of zombie networks. In short, Microsoft finally got something right, and those that are in IT security for the sole reason of bashing MS to make a buck, are having a hard time doing so.
This is a phising technique that can be used to get a username/password from like a credit card or bank website, but that's about it. You'd be hard pressed to get this to compromise a local machine, although I'm interested in what would happen if someone tried calling a local zone page (like a help file) and then executing the javascript from that page. There was a similar exploit that used this delayed tactic last year that Microsoft didn't fix for probably 3 months. It was a 0-day exploit too, it was found in the wild, spreading via IRC, before anyone reported the vulnerability.
You couldn't slashdot your server without JS? I doubt /. would have a problem with that one...
Linux is not Windows
(1) elinks
(2) lynx
And all this time I thought JS Popups were a flaw all by themselves.
Find coupons in Greeley
People should stop developing with JavaScript. How many of us have it disabled in our browsers? It's nothing but trouble.
I'd change that to: "People should stop creating websites that require JavaScript unnecessarily." Unless your application really relies on JavaScript (eg. GMail, etc) your web-app should degrade gracefully on browsers that either don't support JavaScript or where the users have exercised their right to switch the bloody thing off.
This is where the serious fun begins.
Open about:config . You'll probably have to type that, Mozilla won't follow it from an http: URL.
Key in dom.disable_window_open_feature as a filter.
Change the value for location to true. In Firefox, just double-click the false and it will toggle. Mozilla you need to edit it and actually type in all four letters of true. (But I'm happier with the Mozilla suite at the office, so I live with it.)
Change any other values to true that you feel like; I'd be inclined to do status, resizable, close and menubar at a minimum.
Now the location will be visible in any pop-up window.
So the very first thing the Moz group should do is default some of this stuff to true instead of pander to controlling webmasters who want to take over the user's computer. I mean false.
Bizzarely, this is the most sensible explanation I've read so far. I just can't believe that there is anyone who knows how to report a browser bug that would be so dumb to call this... well, a browser bug.
Akarsz Magyar Gentoo fórumot? Akkor
It cracks me up, because they probably have an obsessive/compulsive, socially-maligned programmer within Secunia that just delights spending 16 hours a day trying to twist the browsers into doing what he wants. And then Secunia announces these flaws to save their reputation because nothing else is going on.
I'm sure you are absolutely right. And hopefully he'll keep doing it because you there are crackers, phishers, and criminals out there who delight in spending 16 hours a day trying to twist browsers into doing what they wants. If Secunia is a bit obsessive in their red team activities against computers, then we can hope that they uncover exploits (and motivate patching or disabling of exploitable features) before they appear in the wild.
I, for one, welcome information on what computer software and features can or cannot be trusted.
Two wrongs don't make a right, but three lefts do.
this "vulnerability" is like saying a banking company has a security vulnerability because some peon is pretending to be the CEO
mod +1 next story please
People should stop developing with JavaScript. How many of us have it disabled in our browsers? It's nothing but trouble.
Wow! What a well thought out idea! Let's take it to the next level...
People should also stop using IE. It's proven to be full of security holes. But of course this is largely due to it's integration w/the underlying OS, so people should probablty also stop using Windows.
For that matter, the problems are all found in the same place: On the Intenet, so people should just stop using the Internet too. It's nothing but trouble.
But then again, the Internet's more or less only accessible with computers anyway, so let's chuck the computers while we're at it.
Really... People who make such blanket statements about Javascript, without really understanding what it is, it's pro's, as well as its cons, is really getting old. I'm surprised this wasn't followed up with a paragraph about how evil cookies are, and how they should all be disabled.
It may be possible for JavaScript to help evil-doers but it's up to the implementer of the Application using the engine to avoid that, not the language or its core developers. If every invention that could potentially be used for evil was struck down there would be nothing left. JavaScript can do plenty of good and the developers of the open source engines have gone out of their way to make it well documented, embeddable and extensible so you can add it to almost anything that needs a little help with a language parser. In fact, I myself have recently added JavaScript to the Asterisk PBX system to drive IVR and it works quite well without much concern for exploits. RES_JS for Asterisk: http://www.cluecon.com/res_js.html
How many of us have it disabled in our browsers?
Only the most paranoid of geeks, buddy. Average Joe has no idea what Javascript is. Hell, I was and currently am a part time web developer, and I'm not afraid of Javascript.
I don't respond to AC's.
My share broker's site used to use a Javascript popup for login, then resize the Window you'd opened it from to suit their page. It didn't work properly with the default security settings in Firefox, so I persistently complained about it until they provided an alternative login mechanism without any popups or resizing. The old login method is still there in the form of a big Login button on the left side of their front page, though why anyone would use it instead of the Username and Password boxes in the top right, I don't know.
I have done years of development on NeXT systems. You know, before it became the Cocoa that you kids play with today. It was blazingly fast on systems with 8 MB RAM and a 68040 25 MHz CPU. Hell, I'd love to see a fully GUI Java app run on a system like that. It just wouldn't be usable in the least. To claim that Objective-C is slower than Java is foolery of the highest degree!
While Cocoa does not yet use the garbage collection facilities of Objective-C, the GNU runtime does offer them.
But in short, this browser bug is not a result of Objective-C or Cocoa in any way. It is merely a problem with the traditional way of displaying JavaScript popups.
Cyric Zndovzny at your service.
It's advertising and FUD from those Opera guys. They are really getting boring.
; ;
:
- Opera adds a feature that shows the name of the site in the title bar in their last build
- Someone at Opera reports it (under a false name) as a security issue affecting every browser BUT Opera
- Slashdot runs one more article about the genious of this stupid paid-for, closed source browser.
You left out
- Flaw is reported to Secunia, the biggest bunch of publicity whores in the security industry.
- Slashdot regurgitates their press release without exhibiting any evidence of critcal thought.
yeah, nobody uses javascript popups for logins
No problem, just download the free version: http://opera.com/download. It has a 34 pixel high banner at the top which shows contextual Google ads. And Google is still considered "good" even by Slashdot readers, no?
Nicolas Mendoza
Prepare for MSIE 7
like it or not, the browser has become a vital platform for application development. unfortunately, client-side scripting is far more efficient than hitting the server every time the user interacts with a UI.
i could live a little longer in this prison
b) You can certainly use unsafe C contructs in ObjC, but ObjC provides (and encourages) safe, non-C constructs that address the vast majority of C problems. Unsafe pointer and buffer operations are rare in ObjC, because the language provides better alternatives.
c) "Many cases slower than Java" is the sort of unsupportable bullshit that people make when they're trolling. Yes, message passing is slower than virtual function calls (and Javas are [much,much] slower than C++s vcalls).
On another note, when will sites stop relying on freaking popup windows. Besided being blocked by many normal people, they are a real pain and always seem to have bugs associated with them. If you can't design your website to a full browser window, you shouldn't be designing websites!
-- these are only opinions and they might not be mine.
"Major Browsers Have JS Pop-Up Flaw"
..... They implement it! ;)
They sure do!
[alk]
Google is still good but Opera is still bad. Obviously!
I've gotta admit, these GNAA "articles" are actually starting to be funny.
I hate grammar Nazi's.
So I should download a browser that very few people use which will tempt me with targeted advertisements to spend money I don't have and likely not display things properly, and I should do this because it will allow me to see the URL in javaScript popup windows? Am I missing something here?
Mods: Do you disagree with me? Go ahead and mod me down. Meta-mods will sort it out. Good luck!
Yeah! How could anyone be that stupid? I mean we're all taught from the moment we're born that it's not safe to login to something via a popup window. Even my grandma could tell you that.
Doesn't it make you feel good to know that our freedoms are protected by politicans, lawyers and journalists.
It's not what you have, but how you use it. Slow programs can be made in any programming language. Since Objective C is a superset of C, there's no reason that performance-critical section of code need to suffer any more overhead than a C function call. In many cases, this can be done without even replacing your method with a C function, by way of holding a reference to the method's selector, which allows you to avoid the method-lookup overhead. For sections of your application that are not "hot", there's no need to do this. The performance that you desired was within your reach without changing your language of implementation.
The "cue the foo posts in 3, 2, 1..." posts will commence with no subsequent foo posts in 3, 2, 1...
I tried it out on Konqueror 3.4.0 and it is also affected. The only minor change is a blank popup window opening together with the javascript query.
Hack your mind out of its sandbox.
What features of GMail really rely upon Javascript? Labels? No. Search? No. 2GB space? No. I can't think of any reason why GMail should require Javascript. People turn a blind eye because Google are so popular, but Javascript isn't exactly their strong suit. GMail could degrade gracefully, but they didn't bother.
A dialog box is 'owned' and drops down modally on top of the window that 'owns' it.
A new window is a new window and opens below (if there's room) and to the right (if there's room) of the requesting object window regardless of the amount of gadgetry on it (like title bars, buttons, window styles.)
Its always possible to fool somebody and they'll possibly be fooled into revealing their personal data, but eventually the problem will take care of itself hen these people and bust-ass broke and smothered in spam.
There's only so much people can do with a stateless environment. This would be a problem regardless of the language used (both computing & human), the browser used or the platform used (both hardware & software.)
At some point, people will realize this and stop trying to do the impossible.
Transactions are 'transactions'. That means that they have a 'commit point,' which means that they need a state engine which runs from the beginning of the process to the end of the process.
And yes, it CAN be done over the internet over a secure connection. But the control has to shift to the transaction machine while the transaction is going on. Neither you or anyone else should never be able to spawn a new GUI window while the transaction is happening.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
I'm going to insist on strong programmery layers in future, particularly the nearly impenetrable ones! :D
...a problem was discovered and Opera got it fixed quickly. So now you're complaining? :-)
Coder's Stone: The programming language quick ref for iPad
These security flaws do not seem to affect Lynx as often. I rarely have a new terminal "pop-up" while browsing with Lynx.
One ring to bind them - should probably have more fiber and less rings in their diet.
he problem is that JavaScript dialog boxes do not display or include their origin,
I can assure you that even if they did contain their origin, it would still not make much of a difference--most users wouldn't bother to look.
Maybe what we need is a secure web standard, something that runs only over https, uses strict XHTML, dispenses with JavaScript, pop-ups, frames, and popups, and is used for banking and similar applications. Preferably, that should be a separate browser.
Just followed your link - what a superb plugin. I need Javascript for a Web application but hate it on most sites.
Thanks for posting the link!
1000s Warcraft Gold while you sleep
No. You should do it because it's feature rich, has very intuitive mouse gesturing built in, has one of the fastest and most accurate rendering engines out there, and is IMHO just plain nice to use.
;-)
And you should probably see someone about that whole 'not being able to resist advertising' thing.
The gift of death metal does not smile on the good looking.
Lordy...
Gmail requires Javascript?
No problem logging into gmail from Firefox with JavaScript disabled, just a "For a better Gmail experience, use a fully supported browser" blurb at the top, and fonts were different than usual.
I get phishing attacks using techniques similar to this all the time. Being somewhat of a security guy, I always click the link and take a look at the techniques that particular phish is using. Lately, a lot of them have spoofed address bars (using javascript) that try to cover up the real address bar with something like "https://paypal.com/login.html". The interesting thing is that Firefox doesn't display the spoofed bar at all. It usually doesn't look very good in IE, since it uses absolute coordinates to position the spoofed bar, and if you have any extra toolbars, it won't show up in the right spot.
Assume I was drunk when I posted this.
Amazing how a small team (is it even more than one person?) can do this, yet all the people working on Firefox/Mozilla can't.
I use a Mac for a reason... *ducks*
Now, wait a minute. Isn't this just sensationalism? To me, a vulnerability is an buffer overflow, or something real. This is just generally bad design. Essentially, they are saying a window that doesn't show where it is from is a vulnerability in browser software? In that case, nearly every windowing system (Windows, X, Aqua, etc) have this 'vulnerability'. It's not hard to pop up a window that on the surface appears to be part of another app.
So again, explain to me how this is a vulnerability. I think MS said it right when they said:
So, even if this is a vulnerability that merits a software change in browsers... which I don't believe is the case... The only real solution is annoying text/windows/popups telling the user 'This window was popped up by Frame7, beware'. Which, they will ignore anyway. Look at the history. Users just hit OK.
With stories like this, I could call myself a security firm and publish vulnerabilities like this every hour on the hour. Then I too, could write scary papers that put fear into the masses for no reason.
Wow, sounds like the United States.
Keith
And this is a troll because?... Someone got careless with the mod stick, I think.
Not to wander too far off topic, but the REASON the ads are there is because they generate a revenue stream. In other words, people spend money on the items that are advertised to them.
If 'not resisting' advertisements was really some sort of affliction, then advertisements would not be an effective method for generating business.
And with regard to opera: being a web developer, I use it about as often as our customers use it -- often enough to make sure the site will work properly. I develop on IE and FF because that's who has the market share. If Opera takes over, rest assured I'll jump right in.
Mods: Do you disagree with me? Go ahead and mod me down. Meta-mods will sort it out. Good luck!
I want a window manager that draws lines between parent/child windows, parent/child processes. While we're at it, how about one that lets me click one window, then drag all the windows in the group as one, maintaining relative position? Yeah, I want to drag windows around, and save their positions with the window manager, then open that state with a single click on a desktop menu. While we're at it, I want the groups to include arbitrary windows from multiple apps. So I can open a "workplace", and immediately begin working in a familiar environment. If this works, how about letting me drag a line from any window to another, piping STDIN/OUT/ERR between processes? If I can minimize the windows into icons, my window manager is now a visual programming environment. Which, to come full circle, could let me as a user tell by looking which info is tainted by which untrusted windows and datapaths, including innocent-looking JS popup windows.
--
make install -not war
Who still uses javascript popups for responses? That reminds me of the old sites that would pop up and say "please enter your name" and then the webpage would show your name... "Welcome fred durst" Now i just cancel those boxes... infact they should delete that function all together in javascript.
Clever signature text goes here.
In the latest news, a security flaw has been revealed in all known browsers. The vulnerability is a weakness in the veracity-sensor code. Apparently information provided and displayed to the user does not have to be true. Unfortunately, this means millions of users are being tricked into...
You don't have to insist on them. You can just use Objective-C and Cocoa today. Or even GNUstep, if you don't want to purchase or cannot afford a Macintosh. You'll get all of the programmery layers you wish, and top level security.
Cyric Zndovzny at your service.
THIS, is precisely why I continue to use Mozilla over an of the other browsers (and contrary to popular "opinion", Mozilla is NOT the same as thing Firefox. Mozilla excels in speed, features, and granular configurability).
I know, I know, I must be new here. But it was a very short article, and right near the bottom it says this (bold text is mine):
"Once these things are discovered, there's a rush as everyone tries to fix the problem," Christen Krogh, Opera's vice president of engineering said.
Krogh also pointed out that Secunia had rated the vulnerability as "less critical."
"This could fool some users into giving out some data to a site that wouldn't otherwise be able to get that information. But it doesn't seem like the most important issue," Krogh said.
So what does this tell us?
- The folks somehow blaming Opera for this announcement obviously didn't read past the first couple of paragraphs of this very short article.
- The folks who are saying "JavaScript is bad" obviously didn't read... okay I'm sure they just saw the word "JavaScript" and went off from there anyway. Hey, guys, enjoy your static black text on white background pages - and we'll see you in the unemployment line. Any ideas on how to manipulate the DOM without JavaScript?
- While I agree MS shouldn't blow this off, they're probably still busy patching some of those more critical problems.
- Once again, end user education is probably the answer.
#DeleteChrome
Is what ever happened to their "one million download challenge", which promised that the CEO would swim from Norway to the USA? There was briefly mention of it on their site, but now... nothing.
Meh... I guess I shouldn't have expected much...
Place sig here.
I thought Safari fixed this many months ago, with a change whereby the JS alerts come down in the form of sheets attached to the window/tab to which they correspond? I could swear there was a /. piece on exactly this.
Or maybe I'm clued out and this is something different?
-b
myselfmusic
My browser crashes nearly once a day due to that extension. It's buggy, but it's still worth having it installed.
The global economy is a great thing until you feel it locally.
Ah, the evil Opera! I get it.
Asa? Is that you? Why are you posting as an AC?!Clever signature text goes here.
c) "Many cases slower than Java" is the sort of unsupportable bullshit that people make when they're trolling. Yes, message passing is slower than virtual function calls (and Javas are [much,much] slower than C++s vcalls).
What is that, fight FUD with FUD? Typically in languages like Java a virtual method is first emitted as calling a handler instead of the actual method, which goes back and re-writes the call site with a C++-style virtual dispatch table. So really only the first invocation with a given type is slower, and also after loading a new class where affected tables are cleared and constructed again at the next call. This trick is also how languages like Smalltalk and Python can acheive respectable performance despite being completely dynamic.
Microbenchmarks will say the C++ virtual method is faster since in these small codes the compiler often will inline several possibilities as branches instead of jumps, so you are not really comparing virtual method performance at all but rather the optimization of eliminating the call entirely. And on this optimization Java typically kicks the crap out of C++ in real programs. For example, if you have calls A->B->C->D->E with a huge for loop at A, Java will optimize the whole thing as one huge block and eliminate 4 method calls per iteration. Getting C++ to do this is very difficult... you usually have to *know* this is the chain of calls to inline and, if the calls are used elsewhere, make separate copies that are inline / not inline or the application size will explode.
Ultimately Java is slower than C++ for two major reasons: mandatory array bounds checks and mandatory garbage collection (where C++ can allocate a million homogeneous objects in one malloc it takes a million new's in Java). Java can also be slower at some really tight codes (like codecs) because it does fewer really costly optimizations and doesn't allow embedded assembly statements. But for virtual call performance and new/delete on heap it simply destroys C++ wrt performance.
and GC has little to nothing to do with the relative security of C and Java (theres some obscure security flaws related to misuse of buggy versions of malloc(), on the other hand there's obscure flaws related to abusing the GC scheme to bypass Javas typesafety.
Uhh, no and no. The Java flaws have been in the bytecode verifier, which has nothing to do with the GC, and in the class loader which allowed access to classes that it shouldn't have (applets allowed to use packate-private classes). All of the known Java security flaws have been fixed, whereas malloc flaws remain because they are a side effect of the functioning of malloc. So you get a buffer overflow or uninitiated pointer in C++, Objective C, or C and you are potentially very screwed. These are impossible in Java, so yes, it is much safer by design. The reality is that most Objective C programs will be relatively safe. C++, C? Not so much, it really depends more on the skill and hard work that went into them to prevent security holes.
If you can hack the commercial website and replace their page with yours, why would you need this phishing technique? Just have their server-side script send the username/password to you directly.
Karma: -2147483648 (Mostly affected by integer overflow)
If you have a visual rather than a list as a search engine then it can stop all Java Pop-Up activity. It can stop anything because it scans each page. Try it out. It's on download.com free. http://www.download.com/ViewFour-com-ViewSmart/300 0-8022_4-10406154.html?tag=lst-0-18
Here is a description...
ViewSmart by ViewFour.com is Web-based software that visually displays search results found in Google, MSN, eBay, and other search/e-commerce engines in a multi window environment (2-50). By visually displaying results you get to see your searches rather than having to click back and forth through them. This slick new method of searching the Web also removes the potential dangers of surfing the NET. The software scans each Web page prior to displaying it and stops all hidden and or malicious files from being automatically downloaded without your knowledge. If a page fails the scan, a large red border and stop sign will appear around the window. This means you are protected from contracting viruses, adware, spyware, and other forms of malware while surfing the Web.
Version 2.94 improves malware scanning engine.
You should do it because it's a better browser overall. Obviously it's up to you to decide if you feel it's better by enough to make it worth the adverts, but I do.
I am trolling
Due to sheets you can clearly see the window the JavaScript dialog belongs to.
Stuff that. Google maps doesn't work in my browser, so the benefit I see from it is, if anything, negative (because it discourages people from working on good map pages)
I am trolling
I keep clicking the "OK" in your message, yet no virus scan has started. Do you have an .exe I can run instead?
Sure, just turn on your TV and wait for the stopsign spyware commercial.It must be Windows. It needs half a gig of RAM and a hardware-accelerated graphics card just to run Solitaire.
What features of GMail really rely upon Javascript?...I can't think of any reason why GMail should require Javascript.
(Disclaimer: I've looked at GMail, but haven't really used it... for reasons that will hopefully become clear)
From our perspective, you're almost certainly correct. Numerous apps have shown that it's possible to create a webmail app using basic HTML and server-side code. But GMail isn't exclusively for "us", it's also for "normal" users, who like/need nice, fast, slick functionality. In fact, I'd go further and say that GMail isn't really for people like me at all: I'm happy with the hand-crafted Fetchmail/Postfix/Courier-IMAP/Evolution system I normally use for email - hugely impractical for my grandmother, but exactly meets myneeds.
Additionally, and this me being slightly sneaky, GMail (by which I sneakily mean email-on-the-web, not email-from-Google) does degrade without JavaScript: it degrades to SquirrelMail or similar! (I apologies, that's a specious argument).
Back on-topic, for the kind of application Google were building with the GMail project, yes, they could have used my preferred approach of building a server-side app and then enhancing it with client-side code. But it's a beast of an application, GMail, and it's understandable, albeit annoying, that Google chose not to. There's no such excuse for smaller applications (eg. form validation) where some moronic developer decides everyone uses javascript and makes it so that (a) the form won't submit until it's been validated on the client-side, and (b) if you manage to be crafty and get the form to submit, the application falls over because there's no server-side validation.
This is where the serious fun begins.
It's not a troll if it's true.
I had to disable webwasher in order to see this "vulnerability".
Oops, I saw a unintentional pop-up, first one on my computer in years.
To everyone else it's more like sour grapes. Boo hoo, Mozilla didn't fix it first, so it must be a conspiracy...
Clever signature text goes here.
You seem to be confusing graceful degradation with highest common factor design.
Graceful degradation is when a page offers the "nice, fast, slick functionality" by using Javascript, but still works when Javascript is not available. Developers who know what they are doing can easily write code that works in both situations.
You seem to be arguing against highest common factor design, which is when you don't use a feature like Javascript unless you know it's going to be available to all of your users. I don't think that's necessary and I certainly wouldn't advocate it.
As somebody else pointed out, Google have since added an extra interface to GMail for non-Javascript users, but this isn't graceful degradation any more than having a separate text-only version of a website is graceful degradation.
Instead they chose to do all the work once, and then do all the work again for a slightly less fancy version. I wouldn't have chosen to waste my time developing two versions instead of one degradable one, but I guess it's Google's prerogative to waste their time how they see fit.
While they are at it, I hope they add the ability to mask password characters in a javascript input popup.
"Journalist"
What I highly friggin overused term.
s'wut i sed.
c) "Many cases slower than Java" is the sort of unsupportable bullshit that people make when they're trolling. Yes, message passing is slower than virtual function calls (and Javas are [much,much] slower than C++s vcalls).
Pot...kettle...
Next week: Firefox 1.0.5 released, to patch security problem. Next year: Microsoft releases new version of IE to fix multiple vulnerabilities discovered throughout 2005.
Nothing to see here. Move along.
The writeup claims that Camino is affected; it is not, since it uses OS X sheets to present javascript dialogs. The dialog is attached to its parent window, which makes it pretty difficult for people to get confused. ;)
Thank you, hkmwbz. You really are a regular clown in any vaguely Opera related article's discussion, aren't you?
For the info about who reported the vulnerability--thanks. That does make the conspiracy theory seem less likely.
For totally missing the bigger point--also thanks, I would have expected no less from you based on your past posts.
The behavior described is not a bug. As countless others also pointed out, it is at best a design flaw. So calling it a bug, or a vulnerability, or anything else along those lines is just really really mind-numbingly dumb.
But I guess to an Opera zealot it's all the same so long as Opera "fixed" the "bug" first.
Akarsz Magyar Gentoo fórumot? Akkor
Java has it's uses, like any other programming language, along with it's disadvantages. C++ is very flexible and powerful (it supports several programming paradigms, appart from object oriented programming, for instance), but this comes at a price. Java seems rigid, very demanding on resources, and controlled to a large degree by Sun (witness the difficulties to get Sun Java running on *BSD). Yeah, there is the GPL version, but it's not up to par yet...
With a one person team, there are no flamewars, no questioning of decisions, no team meetings, no politics; frankly, no bullshit that's often accompanied with open source contributors having differing opinions.
The fellow behind iCab simply has to sit down, design and code. That's it.
A very streamlined process if you know what you're doing.
Error 407 - No creative sig found
I'm waiting for the vulnerability alerts based on site content.
ALERT: All major browsers are affected by a critical issue whereby a site's claims of having the lowest price may not be true. Affected users may pay higher than market prices for goods.
Slashdot runs one more article about the genious of this stupid paid-for, closed source browser
That is so stooooooopid it always seems to be either a step ahead of the competition (this is a perfect example) or releases fewer security updates faster than the competition (fewer because it's already a step ahead).
The Luddites were ahead of their time.
What exactly are you basing this on?
Opera 8.01 has been out for more than a WEEK.
If anything, Secunia is a whore for Firefox. They have reported 3, 8, 9 vulnerabilities are 1 advisory before. So when someone looks at the graphcs for Mozilla, they'll see something like 2 advisories for a month, which is misleading, instead of 10 vulnerabilities.
If you look at the number of VULNERABILITIES for Firefox 1.x alone, there are 39 vulnerabilities, 6 of which are unpatched.
If you look at Opera 8.x, there are 5 vulnerabilities with 0 unpatched. If you include Opera 7.x, there are (I believe) 41 for 7.x and 5 for 8.x.
Now, 7.x has been out for a lot longer than Firefox 1.x (at least a year and a half longer). Not only that, if you include Firefox 0.x, it's 39 for 1.x and 77 for 0.x
This is fact. Just check www.secunia.com.
Google is your friend: http://www.opera.com/swim/
so you don't have to login twice, which would make some people suspicious
Nah, just forward the assumed correct information to yourself and forward known incorrect info to the real server. That way the (l)user just assumed they did a typo on their password, and will have no problem reinputting the information.
i'm running firefox 1.0.4 and the secunia test didn't work for me. i noticed that there was a brief flash of the 'firefox has blocked this popup' just after i clicked the link, just before google appeared... so i allowed popups from secunia and then it DID work.
so is this only an issue for sites that you have specifically allowed popups from? ie. sites you probably trust anyway?
"if i'd known it was harmless, i'd have killed it myself"
And without JS, you couldn't have neat stuff like this. (Login is test, test)
I didn't look at it too carefully, but that page crashed my browser (Safari).
I'm not sure what the real purpose of that page is, but buyer beware...
I'm not sure if it's compatible with Safari. I know FireFox/Mozilla works. Basically, it's a complete Web Desktop/Remote Management tool. You can download a copy for your own system here. Note that I'm unaffiliated with the product. I'm just happy to finally have a replacement for the long-defunct WebOS.com Desktop. :-)
Javascript + Nintendo DSi = DSiCade
From the Google maps FAQ:
Google Maps currently supports the following web browsers:
Javascript (ECMAscript) is a W3C standard. I believe Google follows that standards aside from hacks to get it to work in IE of course.
Your complaint would be valid if Google was targeting one browser (IE) or using/creating propriety extensions. They aren't. So if your browser fails to follow a published standard, that's your browser's fault.
The Anti-Blog
So in other words... they filmed a couple of their people splashing around in the water for a bit, punctured the raft, and came up with a "dramatic" story :)
:P
Nice big PR grab....
Place sig here.
I don't know howto write extensions for Firefox, so I can't try this myself, but I am wondering, can't you just disable the javascript popup features? I'm sure you could do this using GreaseMonkey.
Firefox already has a built-in popup blocker anyway, shouldn't it cover all javascript popups?
Even if firefox is vulnerable, get this excellent extension and solve your problem. Happy browsing!
Google isn't coding to standards. That's shown by the fact that they introduced support for opera and safari separately when they were already supporting mozilla/netscape. They're using various nonstandard extensions, different ones for the different browsers they support.
I am trolling
I'm pretty busy right now working on something else. So if someone can post something that works the way I'd like, that would be great. And if someone else working on something similar wants to incorporate my suggestions, that's good, too. And if someone just sees my request, and realizes that they're not the only one who wants these things, too, then they might get started. Or someone might point out something that did those things, but sucked. Open source development is a process, with code an artifact, but not the only part that matters.
--
make install -not war
It was all in good fun. Anyone who takes it seriously needs to take a step back and reevaluate their thought process.
OmniWeb 5.1.1b2 loads "www.google.com" and gives me the pop-up, but the very top line of the pop-up reads "www.google.com.secunia.com". That's a pretty strong hint that the pop-up isn't really from Google.
:|
Unfortunately, I didn't see OmniWeb mentioned in the Secunia advisory; I guess we don't have enough market share.
I didn't look at it too carefully, but that page crashed my browser (Safari).
Thing is, Safari is pretty buggy, at least compared to the Mozilla browsers. Sometimes the page works just fine in Safari, sometimes it crashes and burns. I have no idea why, but no Javascript code should ever be able to crash a browser. Thus, Safari bug.
It just opens a small window that's sufficiently small to be obscured by the dialog box. But this is old news, it's been an issue since Netscape first added target="_blank" and javascript. Though as I recall, they were smart enough in the old days to prevent the newly opened window from being really small. They also prevented it from being moved off-screen. Don't know if that's possible these days or not.
Here's a hint: No current browsers follow the standards perfectly. Simple, standards-compliant code will work across most browsers, but as soon as you do anything more esoteric (which Google most definitely need to do), you run into the limitations of the partial implementations that most browsers use. Mozilla is the best of the bunch at the moment. Safari is catching up, but has some way to go yet. Opera is lagging behind. Konqueror I have no experience with, but it's a fair guess that it's no better than Safari.
IE, of course, is in another race entirely.
Other mapping sites manage fine with standard stuff. I don't know if google's doing something more advanced, from my point of view google maps is definitely less advanced because all it shows me is a blank page.
I am trolling
Other mapping sites suck horribly compared to Google Maps, too. That's not the issue I was talking about, though. I was saying that your claim that Google wasn't coding for standards was non-sensical.
Thanks to QuickTabPrefToggle, I see the actual URL of http://www.google.com.secunia.com/tests/origin_spo of.php
Also, middle-clicking for a new tab (which is how I almost always surf) bypasses the attack altogether.
Nothing to see here. Move along.
Was there ever any doubt that it is simply impossible to swim from Norway to USA?
They're not coding to the standards, because if they were it would work in my browser (there's no way it would work in all those other browsers they list but not mine if they just coded to standards). They're coding to individual browsers one at a time.
I am trolling
and of course very, very alpha...
but at least it won't crash safari - and the column view is the best display for directory-structures anyway.
http://lixlpixel.org/webfinder/
(actually i think it works only in Safari so far)
OK, I'll spell it out for you: Your browser is not following standards, thus standards-compliant code will not run correctly on it. None of the others follow standrads either. Thus, you HAVE to code for specific browsers to get anything to work. Get it now?
No, my browser is following the standards, their site isn't.
I am trolling
I have always worked around this in IE by pressing control-N to re-open the window in a normal browser window that shows me the address.
I'm not sure if there is another workaround for the Firefox related browsers, but a control-N only opens a blank window -- I can do that by reclicking on the IE-icon, or typing a web-addr into the "Address-bar" on Windows. It'd be much more useful if it opened a new window with duplicate context. I'm
always using that feature when using Google. I have Google set to open results in a 2nd window. Often, I want to keep one or more result windows open -- and Google re-uses the original 2nd window it popped open. Pressing control-N, gives a dup of the result, freeing the "2nd window for re-use by Google. Another use -- sometimes a site opens a 2nd window of a fixed size. Unfortunately site designers haven't gotten the concept of "DPI". Even though the text is enlarged because the OS recognizes the DPI setting, the sites don't resize windows, widgets, frames, etc. Thus text gets cut off or is unreadable. Easy workaround -- just re-open the window and resize it.
Firefox and related don't seem to have this ability. I consider it a security risk as well as it being usability unfriendly to those using higher DPI screens. Is there a workaround for Firefox and related browsers?
If there isn't a workaround for Firefox/Moz/Safari/Netscape, I'd say that
was a valid security complaint. It's even worse that this security risk
is "old news". So much for fast security fixes w/open source.
-l
Have you ever written any real Javascript code and tried to run it on your browser? If not, shut the fuck up already, because you have no clue what you are talking about.
No, but I was looking forward to watching him try :)
Place sig here.
Is it just me, or are other Firefox users experiencing frequent crashes when applying NoScript to Web sites? Is this a bug or a safety feature?
Goddamned kids! Get off my lawn!