Slashdot Mirror

← Back to Stories (view on slashdot.org)

Thunderbird 2.0 Alpha 1, Firefox 1.5.0.5 Available

Posted by ryuzaki0 on from the yay-for-mythical-creatures dept.

nuyorker and hdm wrote to mention the new releases for Thunderbird and Firefox. hdm writes "This release of Firefox fixes 12 security holes, many of which can be used to execute malicious code. The Browser Fun project has provided an online demonstration of one of these flaws. This demonstration is capable of executing code on Windows, Linux, and both architectures of the Mac OS X platform; you're going to want to upgrade today!"

164 comments

  1. I upgraded already by Anonymous Coward · · Score: 0

    This made it to Debian Testing yesterday and Ubuntu this morning... slashdot's news pipeline is stalling :)

  2. Available? by fyrie · · Score: 5, Informative

    As in pushed out to you without asking you first. That was quite the surprise.

    1. Re:Available? by fyrie · · Score: 1

      FF 1.5.0.5 that is.

    2. Re:Available? by Anonymous+Crowhead · · Score: 5, Informative

      You can turn off auto updating in your prefs if you want.

      Preferences > Advanced > Update tab.

      Yeah, that kind of annoyed me the first time, but in retrospect it is good for the general public to have automatic be on by default.

    3. Re:Available? by smitingpurpleemu · · Score: 3, Insightful

      Yes, this smacks of what M$ does with its automatic update service and can be a privacy issue. But if they don't do this, the update will have a much smaller adoption rate and since they disclosed what security bugs they fixed, the hackers can easily exploit them on unpatched versions, of which there will be a greater percentage because people are lazy and don't update.

    4. Re:Available? by raitchison · · Score: 1

      Disabling auto-update in Firefox 1.5 is easy enough to disable.

    5. Re:Available? by nukem996 · · Score: 1

      I dont think its being pushed on you. When selecting auto update in the options that means that whenever Firefox sees an update it will download and install it. If you really dont want that just turn it off, infact I think you have to manually turn it on.

    6. Re:Available? by LunaticTippy · · Score: 1
      Disabling auto-update in Firefox 1.5 is easy enough to disable.

      Actually, you want to enable disabling auto-updates. Disabling auto-update is disabled by default.

      It doesn't bug me much. At least it asks if you want to restart firefox. It could easily be worse, especially with me having 15 tabs open and no autorestore extension installed (yet!)
      --
      Man, you really need that seminar!
    7. Re:Available? by rholliday · · Score: 1

      The update didn't surprise me too much, but restarting to no bookmarks did. At least it backs them up, but having to walk four people you convinced to use Firefox through repairing their bookmarks and Sage feeds and trying to explain why you have to do so isn't too much fun. :)

      --
      Xbox reviews.. We think they're funny.
    8. Re:Available? by RLiegh · · Score: 1

      I have a friend who has a complex list of nested bookmarks which he's built up over the last several years surfing IE, who me and another friend convinced to switch over to Firefox. He was absolutely livid when Firefox updated and ate said bookmarks, and he was ready to switch back until we accidently found the backup folder while poking around the install directory (which I copied it to the desktop for safekeeping).

      Yeah; 'isn't too much fun' sums it up about right...

    9. Re:Available? by kchrist · · Score: 1
      Actually, you want to enable disabling auto-updates. Disabling auto-update is disabled by default.

      Let me guess, you're the guy who wrote the installer for Redwall Firewall?

      To quote from the installer, "Choose YES to disable zeroconf network or NO to enable it". I've even got a picture.
      --
      Web consulting +
    10. Re:Available? by CastrTroy · · Score: 1

      I didn't lose any of my bookmarks. Is this a known problem? because I didn't experience it.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    11. Re:Available? by BauHound · · Score: 1
      --Disabling auto-update in Firefox 1.5 is easy enough to disable.--

      The above information is brought to you by the Department of Redundancy Department

      --
      I like my women like I like my coffee. In a burlap bag tied to a donkey.
    12. Re:Available? by cb0nd · · Score: 1

      I, for one, welcome our new auto-update overlords. =o)

    13. Re:Available? by aichpvee · · Score: 1

      Well I've got to tell you, I updated and I'm seriously considering switching back. For some reason 1.5.0.5 isn't taking the nsFilePicker hack to get the chrome file dialogs back on Linux, which leaves me with the complete garbage gnome dialogs. Forget being lazy, they keep making the newer versions crappier.

      --
      The Farewell Tour II
    14. Re:Available? by Anonymous Coward · · Score: 0

      Well the beauty of Firefox being FOSS is that you can just rewrite any of the code that you don't like!

      So don't just complain about it, DO something about it! The power is in your hands!

    15. Re:Available? by Anonymous Coward · · Score: 0

      Why not complain if its so grandly poobah perfect as some of you make it it to be. Firefox is still sluggish and a memory hog compared to Opera 9, Safari 2.0 and even yes...IE. Its got more issues with add-on than any other browser every time new versions are released. Its ridiculous. Its funny, If Firefox has these isssue folks will go out of their way telling people how to hack the app to make it work right or fix the problem, if the problem can be fixed at all. If IE has a similiar problem, (which it doesnt) you FF nut cases would be sreaming bloody murder.

    16. Re:Available? by aichpvee · · Score: 1

      That's the most bullshit argument ever. It is neither reasonable nor realistic to expect me or any other FOSS user to have the time and knowledge to fix GTK and then keep that updated while the GTK devs do their best to keep it fucked up. Nor is it reasonable to expect the same thing about firefox.

      Go troll someone else, moron.

      --
      The Farewell Tour II
    17. Re:Available? by LunaticTippy · · Score: 1

      Oof, that is deep hurting. I was making fun of the GP who talked about "disabling blahblah is easy enough to disable."

      --
      Man, you really need that seminar!
  3. So much for security... by SirTalon42 · · Score: -1, Flamebait

    Firefox and Gecko devs really need to take security much more serious. It seems like they're just trying to rely on the browsers being open source and keeping security just an after thought.

    1. Re:So much for security... by Chineseyes · · Score: 0

      Repeat after me "ALL software has bugs and security issues" you should be more interested in how long it takes to fix said issues not if they occur because they WILL occur, that goes for IE, firefox, opera, konq, and safari.

      --
      I think the invisible hand of the market has its middle finger extended

      --A wise old fart named SC0RN
    2. Re:So much for security... by Kesch · · Score: 5, Insightful

      Security holes were found. Security holes were fixed. I don't see a lack of attention to security.

      --
      If this signature is witty enough, maybe somebody will like me.
    3. Re:So much for security... by megaditto · · Score: 0, Troll

      Doesn't work in Opera :-(
      iexplore's BSOD large image hack does not work either
      I guess FireFox is more MS-compatible

      --
      Obama likes poor people so much, he wants to make more of them.
    4. Re:So much for security... by hritcu · · Score: 3, Interesting

      Probably this is a more general issue than just security. They should take the whole testing process more serious. Having millions of users it is not enough to ensure product quality, even if it helps to some extent.

      --
      If you don't fail at least 90 percent of the time, you're not aiming high enough. (Alan Kay)
    5. Re:So much for security... by Data+Link+Layer · · Score: 0, Troll

      They are concerned. 12 Security flaws were just fixed with this release, if you look at the previous change logs they have been constantly fixing security problems. Really, it would be close to impossible to make a browser fully secure from every type of vulnerability, especially free ones.

    6. Re:So much for security... by GigsVT · · Score: 1

      Yes it is a more general issue.

      Ignoring bug reports for 5+ years is a serious issue. Especially when it's something like "Mozilla and Firefox store your credit card numbers in plaintext by default"

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
    7. Re:So much for security... by GigsVT · · Score: 1

      That's not always true. You can write provably secure systems. I know that's missing the point, but you made "all" in capitals. :)

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
    8. Re:So much for security... by numatrix · · Score: 2, Funny

      Aww, you must feel so left out. How about the memory corruption bug instead which neither Firefox nor IE suffered from. Feel better now?

    9. Re:So much for security... by Sycraft-fu · · Score: 4, Interesting

      But that's what people give MS shit for, finding and fixing security holes. The attitude is that, had there been better design, the holes would not have existed in the first place. I've often seen it preached that OSS doesn't have the same problems since many eyes look at it and thus find all the bugs. That is, of course, not the case. I think the GP was simply pointing that out. some people feel like running Firefox is a magical security shield, that it doesn't have problem. Well, it does, they just don't seem to be getting exploited before there's a chance to fix them.

      Of course one has to wonder what will happen as it becomes more popular. Plenty of people installed it before it started auto updating. Not too long ago I came across a grad student's laptop that was still running a pre 1.0 version. They figured they were safe and there was no reason to update since what they had worked.

    10. Re:So much for security... by bcat24 · · Score: 1

      Huh? What are you talking about, the cache?

    11. Re:So much for security... by Lally+Singh · · Score: 1

      I suspect quite a bit of the complaint comes from both the pure number of holes and the ratio of found holes to fixed holes. The number of holes is related to the design of the software.

      --
      Care about electronic freedom? Consider donating to the EFF!
    12. Re:So much for security... by GigsVT · · Score: 1

      Form autocomplete is on by default and will save your credit card numbers and full information in plaintext, ripe for any malware to grab.

      Simply not storing form autocomplete on SSL forms would fix it.

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
    13. Re:So much for security... by The_reformant · · Score: 1

      to be fair i actually use IE and what people complain about is that it takes so long for security holes to be fixed

      --
      I have discovered a truly remarkable sig which this post is too small to contain.
    14. Re:So much for security... by Anonymous Coward · · Score: 1, Insightful

      I've often seen it preached that OSS doesn't have the same problems since many eyes look at it and thus find all the bugs.

      Must be a rosy freaking world you live in where ALL the bugs in software can be fixed. Do I give MS more shit than Mozilla? Considering they make a couple million dallars profit a DAY I'd expect a bit more from them. Besides which much of the problems with IE are based off of their Active X technology which people have said would be a huge security disaster from the very beginning.

      And yeah, Firefox is a big security shield because if I feel it is no longer secure I can UNINSTALL IT.

    15. Re:So much for security... by Pneuma+ROCKS · · Score: 2, Insightful
      But that's what people give MS shit for, finding and fixing security holes.

      Uhh... no. People give MS shit for finding and not fixing security holes. Since we're talking about browsers, I give you IE6, which hasn't received a serious overhaul in over half a decade and has proved to be an extremely insecure application.

      Microsoft has a history of leaving known (as in having exploits in the wild) security flaws unpatched. Some argue they do this because hackers can then reverse-engineer patches and create exploits of the bugs, but that logic is a bit dubious to me. If your software has security problems, they should be addressed. Period. And this is exactly what Mozilla does.

      About your last point, that's one of the key improvements in version 1.5. Updates are downloaded and installed automatically. Users will be up to date unless they specifically set it otherwise. Users of previous versions still have to upgrade manually, but I think in time most will.

      --
      Favorite quote: "
    16. Re:So much for security... by Omestes · · Score: 5, Insightful

      Actually people complain about MS finding and then NOT fixing security holes. Look at the update record of their browser, compaired to FF, Firefox has about a week to a month fix rate, MS has about 1 year to never fix rate. People also complain that IE is UNFIXABLE due to its dependance on Active-X, which basically gives malware a pass to the kernel.

      Firefox finds bug, fixes bug, no news here.

      I really have no qualms about Firefox fixing a bug, it shows that their on it. Nobody claims that OSS is bug free, or security risk free, since this is impossible, from closed or open software. Code is a complex beast, like the hydra, you chop off one bug/security hole, and you probably open up more. That is intrinsic in coding, and design. The difference is the flexability of OSS, where bugs are easily seen, and easily remedied.

      When the market share hits critical mass, things should get fun, though. But the openess of OSS still will keep it from reaching IE proportions. And shame on those who think that Firefox = security, the internet is still a bad place, no matter what you run. Good software is no substitute for intelligence, ever.

      --
      A patriot must always be ready to defend his country against his government. -edward abbey
    17. Re:So much for security... by MrNonchalant · · Score: 1
      Security holes were found. Security holes were fixed. I don't see a lack of attention to security.
      Unless, somehow, we were talking about Microsoft.
    18. Re:So much for security... by Morphine007 · · Score: 1

      But that's what people give MS shit for, finding and fixing security holes.

      No, people give MS shit because it can take them in excess of 6 months to release a patch after someone else finds the holes for them.... though if you look at the graph for 2005, it would appear that they are getting better at patching faster.... but your average linux program gets patched within days of a published vulnerability.

      --
      Oh god, that woman is John Romero!
    19. Re:So much for security... by Geoffreyerffoeg · · Score: 1
      Plenty of people installed it before it started auto updating. Not too long ago I came across a grad student's laptop that was still running a pre 1.0 version. They figured they were safe and there was no reason to update since what they had worked.
      I did the same thing (with my old laptop; the new one has a new version) because IIRC we were told we had to completely uninstall Fire$ANIMAL before we even thought of installing a new one. Who wants to uninstall and reinstall a browser every few weeks?
    20. Re:So much for security... by Anonymous Coward · · Score: 0

      Why not store form entries on SSL pages? That's what the "Remember this..." bits are used for. If you don't want it 'remembered', don't store it. I use this feature a lot, for non-sensitive information anyway. Not everything is critical... I'd think that the most common use of this would be username/password combos, which are already stored securely.

      Your suggestion is inelegant to say the least. A change in the 'Remember this information' pop up form to add a check box if you want the information stored securely would be much more worthwhile.

      Thanks for the idea though - I'd been meaning to pick up a software project to work on!

    21. Re:So much for security... by Chineseyes · · Score: 0

      You are correct but on the mozilla foundations budget I'm pretty sure thats not going to happen :)

      --
      I think the invisible hand of the market has its middle finger extended

      --A wise old fart named SC0RN
    22. Re:So much for security... by leighklotz · · Score: 1

      If I had a dime for every time I hit C-x C-s while writing a post...
      You need XKeymacs.

    23. Re:So much for security... by CastrTroy · · Score: 1

      But if you have malware on your computer, it's likely acting as a keylogger, so keeping your Credit card numbers encrypted would not help very much. Next time you typed it in, it would record it. Also, smart malware would read the values from all the text boxes appearing in your browser to try an capture values where were already stored by autocomplete. If it's displaying it on the screen, it's in memory somewhere unencrypted. It would just have to wait for the browser to make a call to it's unencryption algorithm, and then take the number.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    24. Re:So much for security... by GigsVT · · Score: 1

      Make sure to read the bug report about this before you go into it.

      The arrogance of the mozilla devs regarding this issue makes it likely your patch would be for naught.

      BTW - It does it automatically, without warning or asking you if you want to save the info. After my fresh install I said "sure ok lets try this form autocomplete" the first time I went on Google or something. Then later on I was typing in my credit card number on some site and Firefox popped a drop down showing my entire credit card number. I'm a programmer. If I got burned by it imagine how Joe Schmoe would handle it.

      Also you can't ignore public terminals. Yes in theory people wouldn't enter such things on public terminals, and the people setting them up would disable all that stuff, or wipe the user data every log out.

      But insecure-by-default is something that software in general is moving away from strongly. Trusting the end user to turn off dangerous options is not accepted as best practice anymore.

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
    25. Re:So much for security... by hkmwbz · · Score: 1

      Actually, that's just a normal crash bug and not exploitable.

      --
      Clever signature text goes here.
    26. Re:So much for security... by numatrix · · Score: 1

      Yeah, I know. I was just karma whoring for the funny mod-point. :-)

      I'll make sure to point that out to HD and try to prod him to find an exploitable one.

  4. Memory features by end15 · · Score: 3, Insightful

    Does anyone know if this latest release has gotten rid of some of the memory "features" that I've come to love in Firefox. I don't know what I would do if they got rid of them (other than have a smaller page file ;). Thanks!

    --
    All glory to the Hypnotoad!
    1. Re:Memory features by Durrok · · Score: 1

      Work's home page(plain text), gmail, digg, thottbot, and /. open in 5 different tabs = 71MB. Minimized removes a few KB. It's been opened to these tabs for the last 5 hours.

      Honestly not sure if this is better or not as this is the first time I have ever looked. Guess that's the advantage of having 2gigs of memory. :)

      --
      I keep telling myself I'm not the desperate type.
    2. Re:Memory features by Jboost · · Score: 1

      And how many (and what kind of) extensions have you got running?
      How many and what kind of sites (heavy graphic?) have you visited since you let the fox out of his cage?

      Seriously, keep middle-clicking next to a tab and see where your memory went.

    3. Re:Memory features by Durrok · · Score: 2, Informative

      Extensions: adblock, ietab, tabx, tabbrowser preferences, adblock filterset, flashblock, disable targets for dls, blockfall, and cards.

      Closed out of all tabs and was still at 60MB. Opened a new tab and closed the /. one, 50MB. Restarted firefox, 21MB. Went straight from plain text work page to /., this article, and replied to your post, 25MB.

      Time to go searching for those FF tweaking options again...

      --
      I keep telling myself I'm not the desperate type.
    4. Re:Memory features by Richard_at_work · · Score: 1

      14302 firefox-bi 2.7% 2:01:43 22 596 1245 164M 28.8M 136M 652M

      Second from last is RSIZE. Sucks.

    5. Re:Memory features by CastrTroy · · Score: 1

      Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.0.5) Gecko/20060719 Firefox/1.5.0.5

      Currently using 61 megs of memory, with 6 tabs, and scrolling through about 60 pictures in an online photo gallery to try to drive up the memory usage. Installed extensions include Reload Every, Video Downloader, DOM Inspector, Web Developer, and Talkback. Seems to me like there are no memory problems with Firefox.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    6. Re:Memory features by Anonymous Coward · · Score: 1, Interesting

      Try loading 10+ tabs that are loading a jpg, png, or gif image of 800x600 or more. I have noticed that if I leave firefox running for days at a time, with five tabs open it sits quite happy at about ~200 megs. Keep in mind, I run this PC 24/7 and don't close firefox; it closes itself (read: crashes).

      Not sure what extension causes it, it's kinda random.

      Anyway; load ten tabs of different things in each one (preferrably a different website in each), leave it running for an hour or so, then load one more tab, preferrably an image board. Open a new tab for 15 or so different images from that website in the same instance of firefox. This has caused my instance of firefox to jump from 200 megs up to 1.2 gigabytes, and the page usage is almost always the same.

      Firefox is on fire, baby. :-(

    7. Re:Memory features by ESqVIP · · Score: 1

      I know this will hardly solve all your problems, but IE Tab is known to leak memory.

      That's quite sad; it is a rather useful extension.

    8. Re:Memory features by west.to.east · · Score: 1

      http://kb.mozillazine.org/Reducing_memory_usage_-_ Firefox

    9. Re:Memory features by prockcore · · Score: 1

      Time to go searching for those FF tweaking options again...


      Maybe you should do a little research on how cached memory works first. Firefox will mark a page as unused.. and if the OS needs it, it will take it. However, if Firefox needs that page again (like, say, you hit your backbutton), it can pull it up without having to connect to the server.

      The memory is indeed freed.. the OS just hasn't bothered reclaiming it yet.
  5. And for those less on the bleeding edge... by PCM2 · · Score: 1

    ...I was pushed Thunderbird 1.5.0.5 earlier this morning, too.

    --
    Breakfast served all day!
    1. Re:And for those less on the bleeding edge... by mordors9 · · Score: 2, Informative

      Heh, since Patrick V. got it out on Slackware yesterday, I guess you must be talking about it.... finally Slackware considered bleeding edge....

  6. Firefox 1.5.0.5 by Anonymous Coward · · Score: 0

    Automatically recieved, downloaded, and installed. Automatic updates done right.

    1. Re:Firefox 1.5.0.5 by Vampyre_Dark · · Score: 0

      Except if it's IE 7.0, then the automatic download is bad because of introduced bugs.

  7. Only 12, huh? by Anonymous Coward · · Score: 0

    So, how many security holes does Internet Explorer usually see in a patch cycle?

    This is getting insane. I'm thinking of switching to Opera if only for the added security, greatly reduced memory footprint, and greatly increased speed. Only thing keeping me with Firefox is AdBlock.

    1. Re:Only 12, huh? by SirTalon42 · · Score: 1

      The newest version of Opera has built-in AdBlock.

    2. Re:Only 12, huh? by Anonymous Coward · · Score: 0

      But no filter set subscribing and it doesn't appear you can easily block content with a single right click. It also doesn't appear to support pattern-based blocks (it appears to be domain-based).

      If you can use those features, please tell me how - I've got Opera 9 installed already, and I've never noticed anything like AdBlock. Getting off the bloated wreck that is Firefox is definitely worth learning another interface, though!

      Well, since Slashdot is enforcing an excessively long time between posting for me, I might as well mention my dislike of how Firefox appears to be killing the OSS communities efforts at creating a stable, secure, fast browser. I know there's Konqueror, but I'd love to see a true open source effort on creating a standards-complaint, cross-platform browser. Firefox has sucked all the open source devs into this crappy, bloated, "browser-as-a-platform" thing.

      It's time for Firefox to die out, Opera to take its place, and the OSS community to start working on a browser that can compete with Opera. Mozilla has proven themselves incapable of doing it - the best features in Firefox are without exception created as extensions.

    3. Re:Only 12, huh? by SirTalon42 · · Score: 1

      From what I know Opera supports using the same filter sets as the adblock extensions for firefox. Also the Konqueror in KDE 4 will be natively cross platform (linux, windows, os x, *bsd, solaris, and many others). Konqueror also has had built in adblock as well for a while now (uses same filters as firefox to).

    4. Re:Only 12, huh? by Anonymous Coward · · Score: 0

      Well I prefer modularity to completeness. An extension messes up -> just disable it, or try to find a fixed version. No hacking/setting of obscure prefs necessary.

  8. Hardened seems to block it by Slyder · · Score: 1

    I tried the demo on my system (an up-to-date Gentoo w/ Firefox 1.5.0.4). It didn't work. I use the hardened sources w/ the hardened USE flag, so that may have something to do with it.

    1. Re:Hardened seems to block it by Shawn+is+an+Asshole · · Score: 2, Informative

      The online update only works if you use the offical binaries. Also, your user account has to have write access to the installation directory (or do it as root, but you should never run a browser as root).

      --
      "It ain't a war against drugs.it's a war against personal freedom" --Bill Hicks
    2. Re:Hardened seems to block it by Slyder · · Score: 1

      I wasn't referring to the update, but the demo exploit. A stable ebuild of 1.5.0.5 isnt even available yet.

    3. Re:Hardened seems to block it by Anonymous Coward · · Score: 0

      1.5.0.4 on windows xp sp1 the online demo doesnt do anything here either

    4. Re:Hardened seems to block it by GnuAge · · Score: 1

      I was using the official 1.5.0.4 tar.gz Firefox & Thunderbird binaries on Debian Sarge, otherwise I'd probably still be mucking with some stripe of FF 1.04 and TB 1.02 which I believe are still in the Stable repositories. And I was rather surprised to see that 1.5.0.5 was installed on both programs this morning.

      As root I decompressed the installation files in to /usr/local/ subdirectories and I don't use any programs that automagically update the system every night like YUM can or whatever (U)buntu uses. I'm running these Mozilla programs as a regular user. How can they just update themselves without even asking me for a / password? If I've monkied with the preferences to allow the programs to update themselves I certainly didn't do it as SuperUser. I don't know if I'll be able to sleep tonight.

  9. You know it's true. by systemic+chaos · · Score: 0, Troll

    Ugh. Security holes? Malicious code? I knew there was a reason I switched to Firefox. This just proves IE is worthless.


    Oh wait, this is about firefox?


    Ummm... Hooray! Firefox is even more secure now!

    1. Re:You know it's true. by Teckla · · Score: 4, Insightful
      Ugh. Security holes? Malicious code? I knew there was a reason I switched to Firefox. This just proves IE is worthless. Oh wait, this is about firefox? Ummm... Hooray! Firefox is even more secure now!

      First, whoever rated you insightful should never be allowed to moderate again. Sheesh. You're trolling, pure and simple.

      Second, Microsoft makes one billion dollars in profit every month. In my opinion, they should be held to a higher standard.

      Third, you're grossly misrepresenting most Firefox users, who don't expect Firefox to be perfect.

      Fourth, Firefox is a safer browser to browse the web with, whether you like it or not.

    2. Re:You know it's true. by Anonymous Coward · · Score: 1, Insightful

      Second, Microsoft makes one billion dollars in profit every month. In my opinion, they should be held to a higher standard.

      First off, no they don't. They come close to it, I'll give you that, but not it's not quite a billion.

      Secondly, the Mozilla Foundation make MILLIONS OF DOLLARS every - who knows what. They aren't saying. (Because they're the Mozilla Foundation and not the Mozilla Corporation so they don't have to. But it's estimated to be somewhere in the order of $70 million.)

      So, when you realize Microsoft makes far more products than just IE (including Office, the XBox, various games), both Mozilla and Microsoft are likely using roughly the same amount of resources to secure both browsers.

      Third, you're grossly misrepresenting most Firefox users, who don't expect Firefox to be perfect.

      Perfect? No. I expect there to be rendering glitches and other errors. I expect there to be some bugs.

      I ALSO expect there not to be a good 10 critical security flaws (which, according to other commenters, weren't all actually fixed in this release) being found every couple of months.

      We're up to somewhere around 40 critical security vulnerabilities found since Firefox 1.5 was released. Critical in this case means "can run arbitrary software without user intervention". The number of security flaws found in Firefox is, to most users, quite troubling.

      Fourth, Firefox is a safer browser to browse the web with, whether you like it or not.

      Safer than IE? Sure, I'll buy that.

      Safer than Opera? Definitely not. (There are currently 3 unpatched known vulnerabilities in Firefox, compared with none in Opera.)

      Safer than Safari? Safari has 2 unpatched flaws, both of which are rated "not critical".

      Safer than Konqueror? Konqueror has only one unpatched vulnerability (rated "less critical").

      So, Firefox may be safer than IE, but it's less safe than basically every other browser on the market other than IE.

    3. Re:You know it's true. by Overly+Critical+Guy · · Score: 1
      Second, Microsoft makes one billion dollars in profit every month. In my opinion, they should be held to a higher standard.


      Meaning that OSS should be held to a lower standard? Why is that, and what does that say about OSS exactly?
      --
      "Sufferin' succotash."
  10. Finally! by angrytuna · · Score: 4, Informative

    I have really been waiting for this build of Thunderbird. It finally includes message tagging, which is something that I've been wanting natively in Thunderbird for a long time. Tagging now also apparently works with IMAP connections, although at least some users are having some problems with that feature. (Bug #344290).

    --

    It is a solemn thought: dead, the noblest man's meat is inferior to pork.

    1. Re:Finally! by WuphonsReach · · Score: 1

      How is it at dealing with large volumes of e-mail now? I subscribe to 50 heavy traffic mailing lists and the 1.5 version is very slow. Even when it's not retrieving mail, it seems like it takes forever to allow me to select messages in the inbox (which only has 30 messages).

      (All of my mailing lists are in their own folders, with sub-folders where I move the previous year's messages to to make the main folders smaller. Still I have around 4GB of e-mail in my Thunderbird profile folder.)

      --
      Wolde you bothe eate your cake, and have your cake?
    2. Re:Finally! by Cyn · · Score: 1

      Do you ever compact your folders? It's not on by default, so it's possible that your inbox is actually chock full of TONS of messages, but 99.9% of them are flagged for deletion and are hidden.

      right click your inbox and select 'compact this folder'.

      more details, and instructions for automatic compaction:
            http://kb.mozillazine.org/Compacting_folders

      --
      cyn, free software and *nix operating systems enthusiast.
    3. Re:Finally! by WuphonsReach · · Score: 1

      Hmm... spent the half hour and compacted all my folders (4.5GB down to 3.3GB for the profile).

      Thunderbird 1.5's UI is still slow at selecting messages. Click on a message in the message list and it takes half a second for TB to highlight the message. Then there's the issue that rules are not always moving messages to the proper folders.

      It's all CPU-bound utilization.

      --
      Wolde you bothe eate your cake, and have your cake?
  11. Exploit this? by aersixb9 · · Score: 1

    How would a person use this flaw to run a keylogger or other virus on a person's system? Is it possible to do this with this bug? I autopatched when the new version came out, but the behavior of the test site, with firefox crashing and the hard disk making the hard disk reading/writing noise, I've seen before the patch on some nonreputable websites...how bad could the damage be, and do I need to reformat? (NAV doesn't detect anything, but NAV never detects anything, including my homemade virii/keyloggers)

    1. Re:Exploit this? by SirTalon42 · · Score: 1

      Arbitrary shell code can be run on the system for many of the exploits. So it would be trivial for an attacker to infect your system with pretty much any program they want (though they may have to make the shell code download the executable to your system first if theres a limit on how much they could run at once).

    2. Re:Exploit this? by aersixb9 · · Score: 1

      How exactly would a person go about doing this? What is the shell code to download an executable to a system and run it?

    3. Re:Exploit this? by giorgosts · · Score: 1

      I wonder.. The demo tries to create a file in /tmp. So how would that change unix permissions? the file, even if it can be changed to executable, can not be installed and only has the permissions of the (limited) user..

  12. thank goodness by Anonymous Coward · · Score: 1, Funny


    my Sinclair ZX81 isn't exploitable
    take that! YUO L00ZER HAX0RZ

    1. Re:thank goodness by Durrok · · Score: 1

      I think there may be a difference in "can't be hacked" and "who the hell would bother".

      On a more serious note along those lines, FF and Thunderbird are finally getting enough marketshare to grab the attention of spammers and virus writers. We should rejoice on it's success and how quickly it was patched instead of "oh noes there actually are security flaws in FF!" If you want more security, switch to a more obscure browser (just make sure it isn't just an IE wrapper). Sure, you will lose a lot of functionality but that is the trade off we all have to make currently.

      No matter how secure or how quickly companies patch their products you will still never be able to get rid of the biggest security flaw of all: Users.
      Click here for free pr0n!

      --
      I keep telling myself I'm not the desperate type.
    2. Re:thank goodness by ScislaC · · Score: 2, Funny

      Hmmm... I think that pr0n link is broken.

      --
      ART on dA
  13. The only difference for security... by r_jensen11 · · Score: 1

    ... between Windows and the other OS's is that generally, the average user for Windows has full admin privs. while the average user for Linux and OSX browse the internet with significantly less privs.

    1. Re:The only difference for security... by bigtreeman · · Score: 1

      As I've said before a hacker doesn't need extra privileges
      to grab your passwords or collect data from you
      or delete all your personal files
      or otherwise mess with you personally
      forget deleting your vi executable, they don't give a toss
      about vi, they only want your money or mess with your head.
      I see this as a long term problem never properly addressed by Linux.

      --
      Go well
  14. How fast is Java on the ZX81? by Anonymous Coward · · Score: 0

    I know Java must be available because Java is WORA.

    1. Re:How fast is Java on the ZX81? by Anonymous Coward · · Score: 0

      It's really quite fast. You can boot up your zx81 JVM before bed and in the morning your apps will be ready to run at LIGHTNING SPEED! Once they're all in memory and JIT compiled to native machine code.

  15. !trolL by Anonymous Coward · · Score: -1, Offtopic

    tha+t has Grown up

  16. about:config by The+MAZZTer · · Score: 2, Informative

    URL: about:config, filter for: memory, adjust relevant options. -1 for capacity indicates automatic.

  17. Crash, you say? by kchrist · · Score: 1

    When, oh when, will I learn to not click on things that say "Clicking this may crash your browser"?

    I am running 1.5.0.5 (thanks, Firefox auto-updater thingy!), so it couldn't execute the test on my machine, but that didn't stop the browser crashing.

    --
    Web consulting +
    1. Re:Crash, you say? by Anonymous Coward · · Score: 0

      I tried it on konqueror/kubuntu 6.6 just to see what it did.

      A window saying to the effect.. OS notsupported.. trying anyway.
      It spent several seconds allocating memory (about 2 GIGs).
      It went away.

      Info for your use, I realize the test was for Firefox. I just wanted to see.

  18. Mozilla has fixes within days, what more do u want by VGfort · · Score: 0

    unlike Microsoft who takes weeks, months, years...

  19. Non-portable exploit code by kchrist · · Score: 1
    My favorite part of the exploit JavaScript reads:
    if (! shellcode) {
        alert('OS not supported, only attempting a crash!');
    Clearly, this needs to be maintained by the Debian team so it supports all 33463562 platforms known to man.
    --
    Web consulting +
    1. Re:Non-portable exploit code by jZnat · · Score: 1

      When they say "Universal Operating System", they mean "universal". ;p

      --
      'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
  20. Doesn't work by Man+of+E · · Score: 1

    I just tried the exploit demonstration page, and it doesn't seem to do anything. Using Firefox 1.5.0.5 on Mac OS X. Any ideas?

    --
    Ceci n'est pas une sig
    1. Re:Doesn't work by Anonymous Coward · · Score: 0

      Well, that's why - the exploit was fixed in 1.5.0.5.

    2. Re:Doesn't work by Anonymous Coward · · Score: 0

      I have osx 10.4 and the latest firefox 1.5.0.5 that auto installed a day ago. That test page does freeze up everything with the color circle spinning away. I guess the page makes me force quit firefox so in a way it did crash my browser.

      I've noticed lots of pages do this, especially when they have an embeded windows media file. Oh well

  21. Bon Echo by Vexorian · · Score: 1

    Seems that the really old Bon Echo (firefox 2 alpha) version I am using isn't vulnerable, that's weird

    --

    Copyright infringement is "piracy" in the same way DRM is "consumer rape"
  22. "Help" - "Update Firefox" - "Click". Done. by mxs · · Score: 0

    No lengthy and buggy "WGA" product check neccessary.
    No advanced computer knowledge neccessary.
    Browser restart is required, operating system restart is not.

    (this is in the case of a Windows user).

    Turnaround time from the reporting of http://www.mozilla.org/security/announce/2006/mfsa 2006-45.html to a fix deployed : 1 day.

    I'll leave the comparisons up to others.

    1. Re:"Help" - "Update Firefox" - "Click". Done. by Tourney3p0 · · Score: 1

      Plus it's not fixed. The browser still crashes, but at least it doesn't execute a program.

  23. a problem with firefox installs by doom · · Score: 4, Interesting
    Would anyone want to hear a semi-relevant complaint about Firefox? There's some major suckage in the installer as far as Linux is concerned. If you make the mistake of trying to put the new version of firefox where the existing version is, it's entirely too easy to end up blowing away an entire directory -- e.g. your "/usr/bin".

    Try to imagine writing a shell script that would cheerfully do a cd /usr/bin; rm *. Can you? Now look at this bug report: bug 234479

    One of the programmers (Andrew Schultz) can't imagine any way of dealing with version skew problems outside of completely erasing the installation directory in order to start from scratch.

    1. Re:a problem with firefox installs by TheDarkener · · Score: 1

      I think it'd be safe to say that if you're doing a manual (I.E. not 'apt-get' / RPM equiv.) install, you should KNOW if you have multiple versions on your computer. You should further know that doing a manual install into /usr/bin is "universally stupid" (Thanks, Fruit Loops).

      --
      It is pitch black. You are likely to be eaten by a grue.
    2. Re:a problem with firefox installs by ZorbaTHut · · Score: 2, Interesting

      That's a good point. I'll install Firefox into /usr/local/bin instead. I'm sure that won't delete any important files.

      The problem isn't "it deletes files when you install it into /usr/bin". The problem is "it deletes files that it has no business deleting". It's a reasonably common mistake that never takes more than a few days to get fixed once it's reported. Except, apparently, in this case.

      --
      Breaking Into the Industry - A development log about starting a game studio.
    3. Re:a problem with firefox installs by gatzke · · Score: 3, Informative

      I personally like to install firefox / mozilla / whatever in /usr/local/application or /opt/application and include version numbers

      /opt/mozilla-1.3

      /opt/mozilla-1.4

      /opt/mozilla-1.5.2

      So you get the old version installed and kept as well.

      Then I get into /usr/bin and soft link the application there

      cd /usr/bin
      ln -s /opt/mozilla-1.5.2/bin/mozilla ./mozilla

      Sometimes I keep the old version as a softlink as well

      ln -s /opt/mozilla-1.4/bin/mozilla ./mozilla.old

    4. Re:a problem with firefox installs by Anonymous Coward · · Score: 0

      What installer ? Mozilla.com hasn't shipped a Firefox or Thunderbird installer since the 1.5 versions came out. All the linux builds are simple gzipped tarballs.

    5. Re:a problem with firefox installs by John.Thompson · · Score: 3, Informative

      There's an installer for linux? :-)

      Seriously, I just use the tarball. I unpack it, then "mv firefox firefox-1.5.0.5" and "ln -s firefox-1.5.0.5 firefox" so that I retain the old installation (just in case) and automatically point users to the new location. Before I update I just have to delete the sym-link before unpacking the tarball.

  24. Re:Oh boy by qbproger · · Score: 1

    For those not aware, thunderbird spam filter can use a little work. I've found a WONDERFUL extension that does just that... www.spamato.net for those interested.

    --

    - Joe
  25. Still not fixed. by werdnapk · · Score: 2, Interesting

    I have version 1.5.0.5 installed on my windows machine and the online demo still crashes my browser. I will await version 1.5.0.6. :)

    1. Re:Still not fixed. by amrust · · Score: 1

      Same here.

      No calculator was executed, but my Firefox footprint shot through the roof.

      --
      VOTE!
    2. Re:Still not fixed. by qsqueeq · · Score: 1

      When they say "Clicking the button below may crash your browser." They really meant it :(

      --
      www.qsopht.com ~q
    3. Re:Still not fixed. by Anonymous Coward · · Score: 0

      I use firefox 1.5.0.3 on Linux, nothing happened when I clicked the button. It said attempting to create metasploit and nothing more, I could just continue browsing as usual.

    4. Re:Still not fixed. by John.Thompson · · Score: 1

      Just install the "NoScript" extension and only the sites you autorize will be able to use javascript.

  26. Firefox Portable 1.5.0.5 & 2.0 b1: Works on US by CritterNYC · · Score: 3, Informative

    Portable Firefox is now Mozilla Firefox - Portable Edition (or, Firefox Portable among friends) and a new version has been released. This new version sports some handy new features, including: CD support (aka Firefox Portable Live), partial update support, in-place upgrade support, full compatibility with Wine running on your favorite *nix distro, and more. It's available in three different versions: 1.5.0.5 for everyday use, 2.0 Beta 1 for testing the latest Firefox beta and 1.0.8 for web developers to test pages against. Full details are on the Firefox Portable Release Page.

    --
    Portable versions of Firefox, GIMP, LibreOffice, etc
  27. It was NOT 1 day! by SirTalon42 · · Score: 2, Insightful
    No, if you go to the ZDI link at the bottom it shows you this:

    Disclosure Timeline:

    2006.06.16 - Vulnerability reported to vendor
        2006.07.25 Vulnerability information provided to ZDI security partners
        2006.07.26 - Digital Vaccine released to TippingPoint customers
        2006.07.26 - Coordinated public release of advisory


    So it was REPORTED to Mozilla on the 16th. Mozilla ANNOUNCED it on the 25th. Sorry it wasn't one day. Still kicking the crap out of IE updates... but thats not saying much.
  28. I was going to post earlier... by Urtica+dioica · · Score: 4, Funny

    but my Firefox crashed. :(

    1. Re:I was going to post earlier... by ultranova · · Score: 1

      but my Firefox crashed. :(

      Every firefox version beyond 1.0 crashes randomly on me. That's why I haven't updated and propably won't, either.

      And of course I'd have to get new versions of all the extensions I'm using...

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

    2. Re:I was going to post earlier... by LordSnooty · · Score: 1

      My Firefox rarely crashes. Your computer is broken. Also, since a few versions ago, most extensions changed to be enabled by default when the browser is upgraded. I suggest you upgrade. :)

    3. Re:I was going to post earlier... by ultranova · · Score: 1

      My Firefox rarely crashes. Your computer is broken.

      I use Linux and hibernation and typically have about a hundred or so Web pages open at once. Firefox 1.0 crashes once every few months. Any newer version I've tried crashes every few hours. Since no other program has a problem, not even the same programs earlier version, I find it hard to believe that the problem is in my computer and not in Firefox.

      Sorry, but "rarely" is not good enough for my use - it must be "almost never". I'd say "never", but Firefox being a C program and thus subject to memory leaks, buffer overflows and other such memory management problems propably makes that an unfeasible goal.

      Also, since a few versions ago, most extensions changed to be enabled by default when the browser is upgraded.

      But will they also work ?

      I suggest you upgrade. :)

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

  29. Watch out when updating by Espectr0 · · Score: 1

    This release is buggy. The "dom inspector" and "livetalk" extension (the ones that come with firefox itself if you choose to install them" get disabled when updating due to incompatibility with the new version.

    However, at work the update went file, so i dont know what exactly triggers it.

    --
    Open Source Java Web Forum with LDAP authentication
  30. MLB.tv broken by Anonymous Coward · · Score: 0

    Just an fwi for anyone updating, after downloading this MLB.tv video appears to be broken. No idea why, the video just doesn't show

  31. Re:Firefox Portable 1.5.0.5 & 2.0 b1: Works on by Guy+Harris · · Score: 1
    Portable Firefox is now Mozilla Firefox - Portable Edition (or, Firefox Portable among friends)

    Portable Edition? I thought Firefox was already portable - it runs on Windows, various UN*X+X11 combinations, and OS X, right?

  32. Works on Firefox 1.5.0.3 Running in Ubuntu Dapper by zintzun · · Score: 1

    It created the file /tmp/METASPLOIT

  33. But I thought IE was the bad one. by singingjim · · Score: -1, Redundant

    Oh yeah, FF is SO secure. Just more proof that if hackers want to hack, they'll find a way. It irks me when I see those Mac commercials about not getting attacked by viruses. The more popular FF became the more the script kiddies had a reason to F with it.

    --
    Terrible karma and aiming lower, which in this environment of one-sided reason, is higher.
  34. How soon they forget. by ShagratTheTitleless · · Score: 1, Funny
    For Shame! For shame.
    It may be disowned, but we love it all the same!
    Seamonkey! my monkey! with your logo all of blue...
    You're updated like the fox, yet no mention of you.
    Your fatal flaw; the reason no one cares:
    Failure to steal any IE market share!

    Seamonkey 1.0.3 - http://www.mozilla.org/projects/seamonkey/releases /

    --
    Sometimes at night I imagine the darkness is filled with horrible things with too many teeth, like Julia Roberts.
  35. Foxprint by Anonymous Coward · · Score: 0

    No calculator was executed, but my Firefox footprint shot through the roof.

    Business as usual then?

    I keed! I keed!

  36. 1.5.0.5 is already in the Ubuntu repository. by Sartak · · Score: 1

    I was surprised to find that when I used apt-get upgrade a few hours ago, Firefox was upgraded to 1.5.0.5. This was before I even knew it was released. Kudos to whoever is managing Firefox for Ubuntu!

    1. Re:1.5.0.5 is already in the Ubuntu repository. by zintzun · · Score: 1

      Really ? can you show me your sources.list file ? I don't get the upgrade yet.

    2. Re:1.5.0.5 is already in the Ubuntu repository. by jZnat · · Score: 1

      And here I was thinking I'd have to stick with 1.5.0.4 for a while. To be honest, I only use Firefox for porn right now, and it'll stay that way until Mozilla decides to support KDE correctly.

      --
      'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
    3. Re:1.5.0.5 is already in the Ubuntu repository. by ultranova · · Score: 1

      To be honest, I only use Firefox for porn right now, and it'll stay that way until Mozilla decides to support KDE correctly.

      Well, luckily it's well suited for that role ;).

      I guess some people really love their browser, and not in the platonic sense...

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

  37. Re:Firefox Portable 1.5.0.5 & 2.0 b1: Works on by aslate · · Score: 1

    Portable Firefox runs on a USB drive without leaving anything on the computer that you're running it on. It allows you to take your edition of Firefox to any PC (Not sure if it has to be Windows based, probably) and run it without any problems, with your favourites and extensions. I really loved this when i was in school and used different computers in the IT room.

    It's also optimised to require very little read/write cycles to your USB drive seeing as they do have a limit. It's also a smaller install.

  38. But they don't by Sycraft-fu · · Score: 1

    The best example would be the XUL exploit. Long fixed, but even longer on their bug list. The basic attitude was "There's no demonstration it's a real problem so we don't need to worry." Wasn't until someone released a proof of concept exploit (you may remember it, made front page Slashdot) that they finally got around to fixing it.

    For that matter there are still non-security related bugs that persist such as the cliboard bug. Someitmes Firefox will just refuse to copy text. Best as I can figure out it's not realising that there's text selected, even though their clearly is. the system clipboard is still functioning correctly, just FF has problems. It's documented in a number of different reports on Bugzilla and has been around since as long as I've been using Firefox, still no fix.

    I'm not trying to give FF shit here, I think that's it's a fine product. I certianly like it more than IE hence why I'm typing this post in it right now. However it is not this haven of security and their fix rate is nothing I'm particularly impressed with. Being OSS doesn't really seem to have changed things. After all, it's still people behind it. Some bugs are hard to deal with and thus get left to languish (like the clipboard bug) some aren't fun to fix and don't seem important and thus are ingored till someone proves otherwise (like the XUL bug). Bug just happen because, regardless of how many people look at something, it's just hard to write unerring code, espically if you want to keep a reasonably efficient release schedule and to run on all kinds of different platforms.

    All I'm saying is that when FF fixes a list of bugs, there are those that are too inclined to herald this as a great thing with OSS, even if many of the bugs were things that should have been looked at earlier. When MS fixes a list of bugs, there are those that act as though they suck and the only reason there were bugs in the first place is their closed source methadology.

    1. Re:But they don't by Omestes · · Score: 1

      Understood, I didn't mean to seem harsh, or like a Firefox booster (its so hard not to be after years of bosting it to my friends and fam as the best thing since sliced bread).

      I could list a ten pages of major beefs I have with Firefox (the memory "feature" is number one, followed by the fact that it still just sucks on a Mac), but it does seem that, as far as fixing goes, it is the best out there. Perhaps Opera is better, but who knows what goes through their heads.

      Part of the problem, come to think of it, might be the OSS idea of "fix it yourself", which seems to be almost gone in the Moz camp, but it must still have left a scar.

      --
      A patriot must always be ready to defend his country against his government. -edward abbey
  39. Re:Oh boy by davros-too · · Score: 1

    Thunderbird spam filter needs more than a little work - it just doesn't block spam effectively. I recently installed Cactus spam which is turning out to be the best spam filter I've ever used.

    --
    In theory, there's no difference between theory and practice; in practice there is.
  40. Didn't work for me with version 1.5.0.4 on Gentoo by Psycosys · · Score: 1

    It did do a heck of a job at making my system fairly unusable but it seemed to want to use all of my gig of swap space before it could create /tmp/METASPLOIT. I killed the process before it got that far but I think I would have done the same thing in any other situation where Firefox was making my machine unusable. So anyway it didn't seem to be fast enough to work for me.

  41. Duck and Cover! by Anonymous Coward · · Score: 0
    If you want more security, switch to a more obscure browser (just make sure it isn't just an IE wrapper).

    Endorsing security-by-obscurity on /.? What do you do for an encore, juggle sweaty dynamite?
  42. For those of you who prefer .zip packages... by StupidKatz · · Score: 1

    Firefox 1.5.0.5 .ZIP package.

    The links are usually posted here, but 1.5.0.5 hadn't been posted there yet.

  43. It feels faster... by rdean400 · · Score: 1

    I don't know if it's an illusion or not, but 2.0a1 feels faster than 1.5.0.5.

    1. Re:It feels faster... by WuphonsReach · · Score: 1

      How well does it perform when loading multiple background tabs over a slow net connection?

      (My biggest complaint about the 1.5 firefox code is the constant waits while a background / non-active tab talks to the DNS and web servers. The whole reason taht I loaded the tab in the background was that I knew it would take a minute to load and render...)

      --
      Wolde you bothe eate your cake, and have your cake?
  44. It crashed Epiphany... by byteframe · · Score: 0

    on Dropline Gnome 2.14.2.

  45. Firefox 1.5.0.6 quick release to fix streaming bug by colfer · · Score: 2, Insightful

    Looks like Firefox 1.5.0.6 will be released very quickly to fix a bug in some streaming media links in 1.5.0.5. Specifically, Windows Media ".wmv" when called using "mms://", maybe real using "rm://", does not work. Breaks streamining video links on http://mlb.com/ Release candidates for Firefox 1.5.0.6 are already on the way.

  46. Firefox ? How about Seamonkey? by Kanasta · · Score: 2, Interesting

    Wonder why Seamonkey gets close to nil attention here, thinking ./ users would want the extra functionality/control of Seamonkey over FF's pretty face.

    ALways wonder why if both use Gecko, FF supports horizontal scrolls while SM doesn't. Plus touchpad zoom 'just works' in FF and even IE, and 'just doesn't' in SM.

  47. Very Deja Microsoft experience by redtail · · Score: 3, Interesting

    Just the other day I updgrade to 1.5 so I can use an extention. Unknow to me that turns on automatic updates. Turn my box on today and am told update is ready. Grumble, OK. Enter endless loop of Firefox unable to complete update (because I don't run as admin). Can't EVEN LOG OFF. Have to kill firefox from process list. I guess I'll run IE for an hour to feel better about Firefox again.

    --
    Redtail
  48. Thunderbird by Anonymous Coward · · Score: 0

    A new Thunderbird release? Does this one have any strings attached?

  49. Until it is time to move on by revengance · · Score: 1

    While a lot of people are inclined to bring back the debate of IE vs FF, from a user point of view, it is as simple as we will change when something better came along. Say if something better than FF comes along, has relatively small memory footprint, lesser security problems, and other benefits, I am sure that a lot of people will be using it.

    1. Re:Until it is time to move on by Anonymous Coward · · Score: 0

      http://www.opera.com/

  50. Wow by Anonymous Coward · · Score: 0

    Damn... potential cross platform exploits. Seems like Firefox is creating their own browser monoculture... and a multi-OS one at that. It's a shame they didn't take the time to program it securely the first time.

  51. tbird - LDAP still lacking MAJOR feature by dino213b · · Score: 2, Interesting

    After reading the 'what's new' for the a-release and its bug fixes, it still boils down to one thing: Thunderbird still can't let you add address book records using LDAP. I was hoping this issue would get resolved soon enough but no dice. Someone, PLEASE tell me how wrong I am. I beg you!

    This is frustrating because in my experience, Outlook is such an irrational piece of software when it comes to IMAP/LDAP and Thunderbird (to me anyway) only provides a superior IMAP portion. Still does wonders for me but how would a small office synchronize their address book otherwise?

    Luckily there is a Thunderbird plugin that performs that trick by using regular files -- SyncMab.

  52. Firefox 1.5.0.5 vs. 2.0xx vs. Mozilla Suite? by billstewart · · Score: 1
    Ok, so the fixes are in 1.5.0.5. Does the 2.0 release candidate alpha/beta/etc. have the same vulnerabilities, and are they fixed, and (less likely) does Mozilla Suite have them?

    It's getting to be time to update my Mozilla Suite anyway - is 2.0xx cooked enough to use, or is it better to go to 1.5.0.5 and wait for 2.0 final to update again?

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  53. C - Cyclone by John+Nowak · · Score: 2, Interesting

    When are we going to stop writing large programs in C? For small things where potability is critical and lines of code are low, C can be a good choice for a certain class of application where low-level access and/or high efficiency is needed. However, with something massive like Firefox, it isn't possible to keep tabs on things. The result is a number of security holes surfacing constantly -- Not an ideal situation. Why not move to a more secure language like Cyclone? Programmer portability in such a situation is high and entire classes of bugs would disappear. The performance penalty would be minimal.

    Why aren't more people using such language? Why not use Cycling, or even higher level languages where they can reduce lines of code and keep things more maintainable in less performance critical sections? I can only attribute it to laziness and blubism:

    "As long as our hypothetical Blub programmer is looking down the power continuum, he knows he's looking down. Languages less powerful than Blub are obviously less powerful, because they're missing some feature he's used to. But when our hypothetical Blub programmer looks in the other direction, up the power continuum, he doesn't realize he's looking up. What he sees are merely weird languages. He probably considers them about equivalent in power to Blub, but with all this other hairy stuff thrown in as well. Blub is good enough for him, because he thinks in Blub." - Paul Graham

    1. Re:C - Cyclone by Ant+P. · · Score: 1

      You're going to port the 150 or so megabytes of Mozilla sourcecode to one of these obscure untested languages? Great!

      If not, STFU and let the real programmers do their job.

    2. Re:C - Cyclone by John+Nowak · · Score: 1

      I wasn't suggesting we port a massive existing codebase. The fact that the source is 150 megabytes (if that is actually the case) is quite telling though...

  54. Subject Cut Off, Ends with "Works on USB & CD" by CritterNYC · · Score: 1

    Sigh. It would seem the Slashdot website lets you type more characters into the Subject field than it actually uses... which is just plain odd. The full subject line of that comment was:

    Firefox Portable 1.5.0.5 & 2.0 b1: Works on USB & CD

    --
    Portable versions of Firefox, GIMP, LibreOffice, etc
  55. Bad architecture by jopet · · Score: 1

    Unfortunately they missed the chance to supply a well-documented and easily usable API (that would not require you to be a seasoned XUL/Javascript/Thunderbird programmer) for the spam filter functionality. I am sure that this would have motivated many more people to contribute spamfilter "plugins". There a *lots* of people and groups out there who have worked and still are working on spam filtering. The Thunderbird designers failed to create an infrastructure that would have motivated them to make their stuff work with Thunderbird.

  56. Safer Browsers by Vexorian · · Score: 1

    What makes firefox safer than IE is that its developers do worry about vulnerabilities and try to fix them ASAP . Unlike IE which can keep a vulnerability for years.

    --

    Copyright infringement is "piracy" in the same way DRM is "consumer rape"
  57. New Firefox by John.Thompson · · Score: 1

    I tried the demonstation exploit with the new Firefox-1.5.0.5 on linux and it still managed to crash the browser (but only after I told NoScript to allow javascript from metasploit.com). What I noticed happening was an attempt to create a file on /tmp (which failed) followed by dramatic memory use increase until it crashed. So perhaps a little more work needs to be done on this.

    BTW, Thunderbird-1.5.0.5 is also available now.

  58. iCard? by metamatic · · Score: 1

    Does it finally include vCard/iCard support for the address book?

    --
    GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
  59. Restricted Account by Anonymous Coward · · Score: 0

    If you are using a restricted account -- like you should -- then nothin will be pushed or forced onto you system.

    You'll have to switch to an administrative account, and then manually trigge the update, or download he whole install.

    (p.s. I am talking about Windows)

  60. Local maildir? by clambake · · Score: 1

    Does Thurderbird read local maildirs yet so I can get off of Evolution?

  61. Firefox/Mozilla/Gecko has other problems... by argent · · Score: 1

    I've worked with good programs written in C, and bad programs written in C or C++. The Mozilla code base is not one of the good ones. I went into it once to try and chase down a proxy problem, and I ended up giving up... I couldn't figure out the call tree from entering a URL through to the proxies being applied to the actual connection.

    Maybe it's better now, I don't know, I don't really care. Because on top of that the whole design of Firefox has gone down the same path as Internet Explorer (though, hopefully, not so far), with the same components responsible for evaluating trusted and untrusted objects. I originally believed that they had followed the same design as KHTML and created a sandboxed rendering engine that had additional components (I/O slaves) embedded when it knew it was dealing with trusted objects. Instead there have been many bugs that could only have occurred if an untrusted object was being checked for trustedness at run time. I suppose they had to do that to implement the XPI installer so you could install components directly from web sites.

    Which is, of course, a bad idea to begin with.

    I would love to be proven wrong, and I wish there was a good KHTML-based browser for Windows, or at least a good Gecko-based browser that didn't use XUL or anything like it.

  62. What about Camino? by argent · · Score: 1

    I tried the test page and it popped up a dialog indicating that someone was trying to start a shell on a high port, and the browser hung.

    Is Camino vulnerable to an exploit or just a DOS?

    Where is Camino 1.0.3? :)

    1. Re:What about Camino? by argent · · Score: 1

      Looking at the code... I probably didn't let it run long enough. It likely takes a while to allocate an array that big in Javascript on a Mac Mini. :)

  63. Re:Oh boy by JamesGecko · · Score: 1

    Hmm. Maybe I'm just lucky, but it seems to work quite effectively. A lot better then Evolution, at any rate.