Slashdot Mirror
Mozilla VP Talks the State of Firefox
lisah writes "As Firefox downloads pass the 200 million mark, people are talking about how its security features stack up against IE7 and protect against malware. Mozilla VP Mike Schroepfer told NewsForge's Joe 'Zonker' Brockmeier that security will continue to be an issue 'for anything written in native code' but Mozilla intends to meet the challenge by including JavaScript 1.7 with the browser's 2.0 release. Schroepfer also talked about the timeline of future releases and offered just enough information to wet our whistles for 3.0."
It's spelled "whet." Either way the 3.0 stuff is interesting.
As long as people are running programs from administrator accounts, there will be far more security problems than there should be.
Maybe when Vista comes out (circa 2020 AD) and becomes widespread, this problem will be alleviated a bit. Those of us using other OSes (Linux, MacOS, etc.) are fine at the moment.
Registered Linux user #421033
As Firefox downloads pass the 200 million mark, people are talking about how its security features stack up against IE7 and protect against malware.
Protect against malware? They're bundling with it!
The theory of relativity doesn't work right in Arkansas.
And When Opera Becomes more Popular than Firefox we can all move back to IE : )a yer/index.php?id=9f72b0fbe5bde711a0696cac5b339a5e
http://www.thesecondchancemovie.com/_site/mediapl
Isn't that near Nevada? Or maybe Montana -- my geography's not good.
GetOuttaMySpace - The Anti-Social Network
Security is no longer a concern with the Firefox installs I've set up for various family members. Firefox updates itself now, painlessly and seamlessly, and often within a day or two of serious security alerts. I wouldn't be surprised if some exploit gets announced over the weekend and everyone is on 1.5.0.7 by Tuesday morning. That is still way better than Microsoft.
it's a blue bright blue Saturday hey hey
"It's not hard to remember the days when sites using JavaScript would function properly only in Internet Explorer or Mozilla/Netscape"
I must have missed these "days" they speak of. I can't remember a day going by without seeing a JavaScript error being thrown in ANY browser.
I can't wait until IE 8.0 comes out. And all the nice features that it will implement. Oh wait...
I think another sticking point here is that we not even know for certainty that Firefox 3.0 is in the works, but what things are mapped to go into it! Can MS speak the same on IE 8? I really think that IE is looking to get another butt-whoopin'.
We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
I hope Mozilla/Firefox can maintain security without adopting a restricted "protected" sandbox mode ala IE 7 on Vista. I use a simple HTML homepage stored locally on my PC and Vista's method decides to segregate it from other browser windows, making it near useless in its basic purpose. It seems like a lazy way out on the issue at the expense of convenience for the user.
Keep Firefox its own entity, don't copy this "feature" designed to bludgeon-patch IE's giant flaws.
Someone set up us the COM!
Badass Resumes
From TFA: Schroepfer also predicts that security will continue to be a problem "for anything written in native code," such as C and C++. For example, he notes that security problems caused by memory issues have evolved over the years; from stack-based exploits, to heap-based, to null pointer exploits.
From http://vsftpd.beasts.org/IMPLEMENTATION: The correct solution is to hide the buffer handling code behind an API. All buffer allocating, copying, size calculations, extending, etc. are done by a single piece of generic code. The size security checks need to be written once. You can concentrate on getting this one instance of code correct.
Can somebody please tell me, why are we still having this discussion?
Meme of the day: I browse "Disable Sigs: Checked". So should you.
Since one of the updates earlier this week I am getting some kind of memory leak problem with Firefox, suddenly its hogging resources to the point where I have to kill the process. Seem to remember this was an issue at some point in the past but I thought it was history. Anyone else seen this again over the last week?
Mention the Lord of the Rings one more time and I'll more than likely kill you.
I've downloaded Firefox myself at least 40 times. And not for every version, certainly not the first several releases. And not including the automatic updates.
If Firefox counts all those in the 200 million, there's probably less than a million people downloading.
--
make install -not war
But for some reason you give Apple a free pass.
Please, for the good of Humanity, vote Obama.
So subtract 14 or so downloads from the 200 million for the times I've gotten it.
Most of us geeks have gone through countless re-installs of our OS. So 200 millionn is specious.
"I have an odd craving to whisper about those few frightful hours in that ill-rumored and evilly shadowed seaport of dea
Try running Firefox in safe mode, it might be due to an extension you both use. If that doesn't resolve it, boot Windows in safe mode and try it again, as it might be caused by a software conflict.
Unlike IE, you don't have to be an administrator to install or update Firefox. Just unzip into any directory you want and it will run happilly,
And it will auto-update happily too as long as you can write to the Firefox install directory..
> Firefox also seems to be a huge memory hog,
_ Firefox
See this article:
http://kb.mozillazine.org/Reducing_memory_usage_-
It will tell you how to recude memory usage and also points you to an extension which you can use to track down extensions that leak memory: http://dbaron.org/mozilla/leak-monitor/
Get this... my biggest gripe with firefox is that when i click on the address bar... it doesn't highlight the url. I have to select the whole thing and delete it to enter another address. On a laptop with a touchpad, this is miserably annoying.
There must be a setting for this, or an extension to fix it, but while that might help me (and please do direct me to it), I have at least one friend who hasn't switched to firefox for ONLY this reason.
You're going about this the wrong way. You may forget to run a program as a lesser user, and I have limited faith in the sysinternals app from having things "break out" and run as the regular user. What you should be doing is running select applications that need more priveledges as super user, and be logged in as a limited user. This is how almost all linux/non-windows operating systems are set up.
Waffles rock.
Having restricted-write access to binaries on a system is not to enhance secrity or protect you from keyloggers. It is to ensure ease of use fo rthe sysadmin, who doesn't haver to worry about what version of $FOOBARSOFT you are running.
/usr/bin or in $HOME?
Case in point? If you download *any* trojan app and runit in Linux, it can install a keylogger. All it has to do is add it to your ~/.bashrc, or ~/.xinitrc, or any number of other KDE or Gnome auto-start locations. Boom, you are exploited, and unless you fully audit your machine daily you'll never know it.
Having root-only writeable executables does *nothing* to protect you. I mean, where is your most important data ? in
It's there to help sysadmins, not to protect users from their own stupidity.
With the new version of Firefox, 1.5.0.5 and .6, Firefox is once again the most unstable program in common use.
Version 1.5.0.4 was quite stable. Now the CPU hogging bug is back!
"Can somebody please tell me, why are we still having this discussion?"
MOD PARENT UP!!!!
I've been hearing about buffer overflows almost all of my long life! Let's have the OpenBSD (secure by design) people write one routine for buffer handling for each language and make everyone use it. Save people from boredom and frustration.
"Anyone else seen this again over the last week?"
YES!!! See this comment: Firefox is the most unstable program in common use.
Could you please stop spamming? Thanks.
find the option or enter into the filter:
and set it to true. This is one of the first things I change. I never understood why the default option is not to select all...
being vague is almost as cool as doing that other thing...
Lets just be honest for a moment, IE is the dominant web browser as it is preloaded on 90% of the worlds PC's before they are sold.
As a web developer, clients are generally only interested in what their site will look like under IE. Even graphic designers who use Macs only ever check what the site will look like under IE for the Mac. (Or maybe IE for the PC when it looks shit on IE for the Mac and we explain why).
Mozilla is working long and hard to try and make some inroads into this. And the best thing they can do is make their browser replicate the way IE renders pages. (Piss poor rendering quirks and all).
I have had 2 or 3 clients over 3 years who have actually cared what their site looked like under mozilla / firefox. And this is out of hundreds of different sites I have built in that time. I have never had one client even care about Opera. So if it passes the acid test or whatever, who cares? Certainly not anyone who wants to make any money out of the web. Just a few geeks who still behave like kids and scream to be in some elite minority.
Now I do not like this state of affairs, but I am also a pragmatist who realises that the only thing that stands a chance of making any inroads into the browser market is firefox. So I honestly think that regardless of which is the better browser the best thing to encourage a more diverse web, with more sites optimised for a more general platform rather than just IE would be if the Opera devs just packed it in and started contributing to mozilla / firefox. Maybe when we have two browsers with 50%/50% market share things would change but not now.
Have any web developers out there ever been asked to produce a commercial site with Opoera in mind? I would love to hear some real positive responses but I fear I will be disapointed.
I dont read
Latest update is bugged.
Clicking links wont work anymore.
Mitchell Baker, Mozilla's "Chief Lizard Wrangler" cited the company's install base at 40m-50m in an interview a couple of months ago.
link
Mozilla intend to make their browsers more secure by using a newer revision of javascript? Javascript is the security problem, don't take my word for it, go and read the Mozilla security page yourself. A good proportion of javascript on the web is totally unneccesary so why don't they ship with javascript disabled by default?