Serious Vulnerability In Firefox 2.0.0.12

Oh, Not Now writes "Mozilla Firefox 2.0.0.12, mere hours old, is vulnerable by default to a directory traversal trick, via the view-source mechanism. Although mitigated by the NoScript plug-in, this is quite a serious bug — the default installation is vulnerable from the get-go."

Comments

* Stops download of newest Firefox *

[Doug52392]

Good thing I just read this, I was in the middle of downloading that version :0

What we can count on is that this bug will be fixed in a few days... maybe even hours, unlike all those Microsoft vulnerabilities that have taken months to fix :)

First post :

Re:* Stops download of newest Firefox *

[webmaster404]

Also, one thing that I have noticed about OSS bugs is that those severe enough to cause execution of code, there are very very few utilities to easily attack systems unlike their MS counterparts. Most OSS flaws are rarely exploited in the wild. The only thing that annoys me about them is that someone will surely come up to me on Monday stating how bad Firefox is because of this while blissfully ignoring all the flaws that Windows/IE has had for years.

Re:* Stops download of newest Firefox *

[De Lemming]

As far as I understand, versions before 2.0.0.12 are also vulnerable...

Re:* Stops download of newest Firefox *

[LiquidCoooled]

Why stop downloading it?
I cannot work out from the article whether older versions of Firefox are vulnerable or not.
If its an unfixed bug from previous versions you should continue to download.
Which would you rather:
have 20 known vulns in the wild (stay as you are),
have 1 known vuln wild (latest update).

Until we can be certain though, just click pause ;)

Re:* Stops download of newest Firefox *

[More_Cowbell]

You don't run NoScript? Personally I'm using 3.0 beta2 (the few bugs are totally worth the better memory management, IMO), but I would never dream of running any version without NoScript.

Re:* Stops download of newest Firefox *

[smittyoneeach]

Furthermore, there is a freely-available fix, which I pulled down and installed easily, has a look-ma-no-manual-needed interface, and a convenient means to tip the developers for a job well done.
Mad Propz.

Re:* Stops download of newest Firefox *

[croddy]

Oh, you make a good point. I always wondered what people were talking about when they went on and on about Firefox consuming tons of memory because I would look at mine and it would never look even remotely like what people were describing. Of course, it all makes sense now -- less crappy unnecessary javascript running, fewer memory leaks. I can't imagine web browsing without manually whitelisting scripts either.

Re:* Stops download of newest Firefox *

[sundarvenkata]

But but.....don't many eyeballs watch the mozilla codebase?

Re:* Stops download of newest Firefox *

[bunratty]

Sure, and some of those eyeballs wait until just after the release of a new version to announce they know of a security vulnerability just to draw attention to themselves. Open source does help security bugs to be found, but it doesn't magically keep the finders from blabbing to all hackers worldwide exactly what the problem is and how to exploit it.

Re:* Stops download of newest Firefox *

[More_Cowbell]

For memory leaks I was only referring to the difference between version 3.0 and any 2.0.x.x. Not sure at all, but I suspect that the huge memory consumption others reported and you did not experience was more to do with the total memory available on the system. Surely something must prevent Firefox form using more than x% of available RAM?

Re:* Stops download of newest Firefox *

[bunratty]

No, limiting the memory Firefox uses could cause sites to fail to work properly, especially on computers with very little RAM. The thing about the huge memory consumption is that very few users see it, and those that do cannot explain how others can see it so no one can investigate what the problem is or how to fix it.

Re:* Stops download of newest Firefox *

[Nullav]

the few bugs are totally worth the better memory management, IMO

Statements like this were exactly why I decided to switch to FF3 a month ago. Personally, I saw no improvement in regards to memory leaks; I'd end up with it clinging on to 200-300MB or so after an hour or two of normal activity (a dozen Wikipedia articles, a YouTube link or two, and perhaps messing around with one of those addictive sand games). Making it trim on minimize (something it should do by default) helped somewhat, but then it would slowly make its way back up to 70-100MB without me doing anything, with only one page, even about:blank, open. That and little annoyances like the new URL bar showing page history, rather than *gasp* URLs convinced me to drop FF entirely two weeks ago and switch to K-meleon.

Somehow, I just don't see FF getting any better in the near future.

Re:* Stops download of newest Firefox *

[Vectronic]

At the risk of being modded as FlameBait...

(http://www.mozilla.org/projects/security/known-vulnerabilities.html)
"Critical" ones marked with *

MFSA 2008-11 Web forgery overwrite with div overlay
MFSA 2008-10 URL token stealing via stylesheet redirect
MFSA 2008-09 Mishandling of locally-saved plain text files
MFSA 2008-08 File action dialog tampering
*MFSA 2008-06 Web browsing history and forward navigation stealing
MFSA 2008-05 Directory traversal via chrome: URI
MFSA 2008-04 Stored password corruption
*MFSA 2008-03 Privilege escalation, XSS, Remote Code Execution
MFSA 2008-02 Multiple file input focus stealing vulnerabilities
*MFSA 2008-01 Crashes with evidence of memory corruption (rv:1.8.1.12)

There's quite a few problems with 2.0.0.12, infact more bugs in *.12 than *.11

Re:* Stops download of newest Firefox *

[HartDev]

who really cares, I am gonna use firefox, not to many hackers are that good at getting into Linux Machines, and if I wasn't gonna use FireFox then I would use Opera. Cheers!

Re:* Stops download of newest Firefox *

[omeomi]

Making it trim on minimize (something it should do by default) helped somewhat

What you're describing has nothing to do with Firefox. Even if Firefox frees it's memory, that freed memory doesn't get reflected in the Task Manager until the program is minimized or you wait long enough...

More info: http://www.garagegames.com/blogs/4517/11311

"The Windows OS employs something like a memory cache for each actively running program. This cache may grow as the needs of a particular program require using magical algorithms Microsoft developers have produced for determining the optimal size for that program. For instance a program over the course of it's life time may require 20 megs of memory but occasionally needs to load data requiring allocations of up to 10 additional megs which is released seconds after it is loaded and processed. The Windows OS may determine then, that the memory cache for this program must increase from the base 20 megs to 25 megs instead. Looking at the Windows Task Manager then, you may see that this program is now using 25 megs of memory, even though currently, it may only be using 20 megs.

That is, the Windows Task Manager is reporting the memory cache allotment and not the memory allocated and used by the program. This is not the same as a memory leak. The program has little to no control over the memory cache allotment the OS has given it."

Re:* Stops download of newest Firefox *

[Rakishi]

Parent is an idiot or a troll, not informative.

To quote the link itself, where it is written in large bold print right above what was quoted (emphasis mine):
FIXED in Firefox 2.0.0.12

Re:* Stops download of newest Firefox *

[Vectronic]

You are right, my bad... I aparently skimmed over it too quick.

the Giant 16point header of "Known Vulnerabilities in Mozilla Products" kinda made me think that they were infact "Known Vulnerabilities in Mozilla Products"...lol...

However, depending on what angle you look at it from... *.12 could seems to either have more issues given that so many were fixed, OR... that the Mozilla team just didnt do much for the *.11 release.

Re:* Stops download of newest Firefox *

[Achromatic1978]

So, it's their fault, right? Funny, just reading their page alone mentioned how they'd already made mention of how this affects more than just extensions, but Mozilla ("What leaks? Show us a single leak!") developers shrugged, blamed extensions, and released, without fixing the core problem.

Re:* Stops download of newest Firefox *

[Compholio]

who really cares, I am gonna use firefox, not to many hackers are that good at getting into Linux Machines, and if I wasn't gonna use FireFox then I would use Opera. Cheers!

Yeah, plus (according to TFA) all they can do is traverse the install folder. Said hacker can have fun looking at all the plugins and blank password database in my ~/.mozilla/firefox/ folder all they want.

Re:* Stops download of newest Firefox *

[HartDev]

Nothing is safe anymore! Oh well maybe I will keep my social number in my drawer or something. Plus Opera is a pretty slick browser.

Re:* Stops download of newest Firefox *

[TransEurope]

Exactly the same what i thought.

Find bug.
Wait until the newest release cames out.
Profit - Worldwide attention for Mr. 0x0000000.

What a hero.

Re:* Stops download of newest Firefox *

[Apocalypse111]

I agree - and I like your sig! Reminds me of my own.

Re:* Stops download of newest Firefox *

[Eskarel]

NoScript isn't the solution to the problem. Javascript has a lot of good uses and is vitally important to the development of pretty much any page that isn't either just a flat file, or using way too much even less secure flash. Flat HTML pages are fine for certain applications, and server side technologies have their place, but if you want a responsive, interactive web page, then you need javascript.

Browsers have to ensure that their javascript interpreters are secure, and that they have ways to block, or make harmless most malicious attacks. If we just say "oh that's not important because people can just block scripts with noscript, then we don't get any further and we further stunt the growth of web technologies.

Re:* Stops download of newest Firefox *

[BeeBeard]

...but it doesn't magically keep the finders from blabbing to all hackers worldwide exactly what the problem is and how to exploit it. Unfortunately, the operative word is selling the exploits to hackers, as previously discussed on Slashdot.

Re:* Stops download of newest Firefox *

[compro01]

in which case you enable it when it is needed. i don't hear many people insisting firewalls are useless for the reasons you describe.

Re:* Stops download of newest Firefox *

[webmaster404]

What I was referring to, was there are little utilities available to help a script kiddy attack Firefox reliably compared to attacking IE or similar browsers.

Re:* Stops download of newest Firefox *

[Anonymous Coward]

I'll assume you meant "few utilities"
"little utilities" means "small utilities" where I'm from :)

I would say that was true in the past, but not so much anymore... maybe you meant the bots/trojans/etc built for windows and not the actual attack vectors themselves though. If you're talking about tools to command and control MS stuff vs OSS stuff, I'd agree MS is way ahead there still.

Re:* Stops download of newest Firefox *

[Anonymous Coward]

Don't blame Windows. I see the exact same behavior on Mac OS X and Linux. The sad fact is that Firefox leaks memory like there's no tomorrow.

Re:* Stops download of newest Firefox *

[Venik]

This depend on the proliferation of whatever OSS application you are using. If someone invests time into developing an exploit, they are more likely to go after bigger targets. Firefox is still a distant second in the browser race.

Re:* Stops download of newest Firefox *

[_xeno_]

I dunno what's started it, but I've had Firefox routinely hit 300MB of memory on my work laptop under Windows XP with about 10 tabs open in a single window.

To put that in perspective, that's more than Eclipse 3.4M4 WTP uses - which is a Java-based IDE with the web tools added in. In this case I've also added the database tools to that Eclipse install. In short - that Eclipse is a memory hog.

It still uses less memory than Firefox, and that's with NoScript installed...

On the other hand, on my Linux laptop, Firefox is up to only 100MB of memory. To establish some sort of baseline, the system monitor utility itself claims 5MB, so as much as 5MB of that are shared X and GTK+ libraries.

The memory leak isn't made up. I have to routinely restart Firefox several times a day to make sure that Windows doesn't start paging out Eclipse...

Re:* Stops download of newest Firefox *

[kungfujesus]

Have _you_ ever looked at the mozilla codebase? It's a mess, and it's no wonder that not many people are looking at it.

Re:* Stops download of newest Firefox *

[gaspyy]

Let me get this straight: do you honestly think that something being Open Source will magically protect you? I was going to mod you but there's no "-1 Naive".

There are enough malware targeted specifically at Firefox - I've seen them in action. The good thing with Firefox is that it gets patched pretty quickly, by the time an exploit has been written, hopefully we'll all have 2.0.13 installed.

Still, that's no excuse. It saddens me to say that the quality of Firefox (2.x.x branch) is steadily declining. It's slow, eating too many resources, and it crashes - on some sites it just constantly crashes. If it weren't for all the extensions, I'd dump it in a heartbeat and move to Opera.

Re:* Stops download of newest Firefox *

[asc99c]

I've been having a couple of problems recently when some sites are doing load balancing by redirecting me to an IP address directly rather than a named address which is making whitelisting them tricky. But like you, I just can't imagine browsing without adblock and noscript. The web looks a pile of **** in IE these days.

Re:* Stops download of newest Firefox *

[Buzzsaw5]

eh, ff 2.0.0.13 will be released before most people even have a chance to freak out over this non-issue.

Re:* Stops download of newest Firefox *

[bunratty]

If you see the quality of Firefox declining, you probably just need to create a new profile.

Re:* Stops download of newest Firefox *

[sticks_us]

That does it, I'm switching to w3m

(returns ten minutes later)

Ahh...how relaxing...

Re:* Stops download of newest Firefox *

[DrSkwid]

Results 1 - 10 of about 244,000 for shellcode linux

you fool

Re:* Stops download of newest Firefox *

[DrSkwid]

I never dream about running Firefox either, I try and make my dreams a bit more interesting

Re:* Stops download of newest Firefox *

[Anonymous Brave Guy]

Most OSS flaws are rarely exploited in the wild.

How do you know?

Re:* Stops download of newest Firefox *

[scooter.higher]

Yes, but I feel that "-1: Disagree" is wrong.

To facilitate the discussions we should be having here on /. it should be "+1: Disagree" so that we can respectfully disagree with each other and elevate the discussion so that more people can weigh in on the topic.

But I agree that a post in response would better serve the discussion.

Re:* Stops download of newest Firefox *

[Johann Lau]

There's a third angle to look at it from: those are simply the bugs fixed in .12, which does not say anything about how many are remaining, and also not that they "didn't do much for .11"... you skimmed to quickly and that's all :)

Re:* Stops download of newest Firefox *

[Foolhardy]

Modern CPUs implement virtual memory, which means that any given page of memory (the smallest unit of allocation, per the CPU hardware) may not be directly accessible. The OS can decide to move a page to disk to make room for other things, or implement a memory-mapped file. When that page is accessed, it causes a page fault, which the OS silently fixes by moving the page back into memory. The memory currently accessible without causing a page fault and OS intervention is the working set. The amount of memory allocated (i.e. the amount of storage reserved by the OS), and the working set can be different.

Linux implements a global working set. This means that when the OS decides that it wants to remove a page from its working set (i.e. swap it to disk), it pulls that page out of all the processes that are using it (since the page might be shared), writes it to disk and marks the page as free.

Windows NT implements a per-process working set. A page is moved out of the working set of a particular process, and when it's been removed from all processes (in case it was shared), it goes into the standby cache, a sort of limbo where the page exists both in memory and disk and can't be written to (this makes it possible for the page to be moved completely to disk or back into use without further disk access). Each process has a soft minimum and maximum working set that the memory manager tries to keep a process within. Memory heavy processes have their max working set automatically expanded.

"That is, the Windows Task Manager is reporting the memory cache allotment and not the memory allocated and used by the program. This is not the same as a memory leak. The program has little to no control over the memory cache allotment the OS has given it."

Task Manager reports a process's current working set under the heading of mem usage. More pages allocated to the process may in fact be in memory in the standby list, but they won't show up in this count. Memory cached by the OS (e.g. standby cache, file cache, write cache) is not counted in the working set of any process, even if only one process is really using it. They show up as "System cache" in the performance tab, and some caches are double counted as "Available" because they can be discarded without disk access. When a process calls NtFreeVirtualMemory (the syscall for freeing private memory pages), the OS does not keep it in the process's working set. The working set is always equal or smaller than the sum of shared and private memory allocated to the process. If a process were to free all its private memory, and somehow unload all its modules and free its stack, the working set would go down to zero. A program has full control over what memory is allocated to it. It can't fully control how much of that memory is actually resident in RAM, though, and that's what is reported by Task Manager.

When you minimize a window, the Win32 subsystem sets the process's maximum working set to the system minimum, effectively moving most of its private pages into standby. Those pages will only come back into the working set as they're accessed-- it may take a long time for the working set to get has high as it was previously, and possibly never for memory leaks or unused caches. Firefox definitely implements some hefty caches.

In short: yes Windows implements a memory cache, but not for pages that have been freed.

Re:* Stops download of newest Firefox *

[Anonymous Coward]

in which case you enable it when it is needed.

This SIMPLY DOES NOT WORK for the vast majority of users. People want the web to work. They do not want pages to be subtly broken because you have disabled a standard feature that is only a security risk in 0.000000000000000000001% of cases. They do not want to be continually wasting time adding pages to a whitelist. Either your setup will have a way to blanket-whitelist everything, in which case most people will take advantage of that, or it will not, in which case most people will get fed up with it getting in the way and will use a different bit of software that doesn't contain pointless irritations.

i don't hear many people insisting firewalls are useless for the reasons you describe.

Not entirely sure what you're on about here. Are you referring to the irritating habit most software firewalls have of reminding you they exist by continually asking you whether such-and-such a program should be allowed to access the internet? If so, then there are big differences. Firstly, only a tiny proportion of applications want to access the internet, while the great majority of web pages want to use JavaScript. Secondly, those software-firewall alerts are pretty much useless: in general they just get dealt with like any other annoying dialog, by automatically clicking on "allow".

Trying to apply the same system to web browsing would be ludicrous. Your average user will reach the 4th "DANGER!!!1111!This page is trying to use JavaScript, which is normally totally safe and will greatly enhance your browsing experience, but there's an infinitesimally small chance that it might just possibly allow it to view the contents of your Firefox default profile. Allow or deny?" dialog before they give up and either switch the warnings off or just start automatically clicking "allow" every time. End result? No security gain, many users pissed off. Remind me what the point of that is again?

Re:* Stops download of newest Firefox *

[sticks_us]

This w3m is pretty cool.

You get your emacs keybindings, seamless integration with GNU pico for textarea typing, and images (you'll need w3m-img, available in your local repository).

No javascript, no flash...just pure bliss.
It's like lynx, only on steroids. It's like the web is pure and clean again.

Re:* Stops download of newest Firefox *

[bunratty]

No, there is no problem, as others here point out here and Mozilla developers confirm.

As for memory leaks, Mozilla developers have always acknowledged that there are memory leaks in Firefox, as there certainly are in all browsers. The thing is that it simply doesn't do any good to ask for "the memory leak to be fixed," as there is no one memory leak to fix. If you want a bug fixed, you should be prepared to demonstrate exactly which bug you are referring to (generally with a set of steps to reproduce the problem) so your request is not meaningless.

Re:* Stops download of newest Firefox *

[Anonymous Coward]

It saddens me to say that the quality of Firefox (2.x.x branch) is steadily declining. How so?

It's slow, It's as fast as any browser I've used.

eating too many resources This tired old argument? I've never experienced this nor have I ever seen first-hand anyone experience this. For anyone claiming to experience this I've not seen any evidence that they haven't done something themselves or haven't something wrong with their setup to cause this.

and it crashes I use Firefox quite extensively every single day for both business and personal uses and cannot recall it ever crashing. Not once, not ever. I've been using it since Firebird 0.6 and used many supposedly "unstable" nightly builds in earlier days. I trust it enough to use it during business presentations with clients rather than IE on which our applications have been most extensively tested.

If it weren't for all the extensions, I'd dump it in a heartbeat and move to Opera. I don't use any extensions (never seen one I've ever wanted or needed). Maybe that is the source of your issues. Though I have Opera installed, I see no compelling reason to use it over Firefox and see enough minor annoyances not to use it as my primary browser.

Re:* Stops download of newest Firefox *

[More_Cowbell]

Your ideas intrigue me and I wish to subscribe to your newsletter.

Re:* Stops download of newest Firefox *

[whitehatlurker]

As far as I can tell, this is "merely" an unpatched bug. The horrid way that this is reported is spreading FUD about a valid security update, which people should install. Of course, "noscript" is a handy plugin and would be a good thing to install after the upgrade.

Please note that Seamonkey is also being patched, something that people tend to gloss over.

Of course, Opera is also available for download, if you're wanting to avoid the bug that desperately.

Re:* Stops download of newest Firefox *

[adah]

What you're describing has nothing to do with Firefox. Even if Firefox frees it's memory, that freed memory doesn't get reflected in the Task Manager until the program is minimized or you wait long enough...

Minimizing it had no effect, and I waited long enough.

More info: http://www.garagegames.com/blogs/4517/11311

"The Windows OS employs something like a memory cache for each actively running program. This cache may grow as the needs of a particular program require using magical algorithms Microsoft developers have produced for determining the optimal size for that program. For instance a program over the course of it's life time may require 20 megs of memory but occasionally needs to load data requiring allocations of up to 10 additional megs which is released seconds after it is loaded and processed. The Windows OS may determine then, that the memory cache for this program must increase from the base 20 megs to 25 megs instead. Looking at the Windows Task Manager then, you may see that this program is now using 25 megs of memory, even though currently, it may only be using 20 megs.

That is, the Windows Task Manager is reporting the memory cache allotment and not the memory allocated and used by the program. This is not the same as a memory leak. The program has little to no control over the memory cache allotment the OS has given it."

This seems to me utterly wrong. If you try to allocate some memory and then free it without more allocations in between, you probably will see the memory change immediately—and I tested and can confirm this behaviour. However, if you allocate in small chunks (< 4 KB), and do not release them in order, you'll probably end up in memory fragmentation, and no memory can be returned to the OS.

BTW, I do not remember the memory problem occurs only in Windows—another proof this is a problem of Firefox instead of the OS. It seems to me one of the following will hold:

• Firefox has memory leaks; or
• Firefox calls the memory routines (malloc/free or the likes) in a naïve way—totally on demand instead of something like per-page allocations—and has memory fragmentation problems

I do not believe the OS is here to blame.

Re:* Stops download of newest Firefox *

[julesh]

It's slow, It's as fast as any browser I've used. You probably haven't tried using it on any machine older than about 2 years old. Firefox is quite unresponsive, particularly on javascript-intensive sites, compared to many other browsers, including Internet Explorer. Very long pages with lots of links cause it real trouble. Try this page. On my system (2.66GHz Celeron D, 1GB RAM) there's a ~10 seconds pause after the page loads before I can scroll or switch tabs, and ~3 seconds between clicking on one of the links and the new page starting to load. IE6 handles it pefectly.

I also don't think this is related to extensions. I'm not using anything unusual (popup alt attribute, tabbrowser prefs, flashblock, web developer).

and it crashes I use Firefox quite extensively every single day for both business and personal uses and cannot recall it ever crashing. Not once, not ever. I've been using it since Firebird 0.6 and used many supposedly "unstable" nightly builds in earlier days. I trust it enough to use it during business presentations with clients rather than IE on which our applications have been most extensively tested. I've rarely had crashes until 2.0.0.11, but I've had about 3 over the last 3 weeks. I think there's something wrong with this build.

Re:* Stops download of newest Firefox *

[HTH NE1]

This SIMPLY DOES NOT WORK for the vast majority of users. The slashdot effect notwithstanding, we are not the vast majority of users here.

You should try NoScript yourself before pontificating about preconceived flaws.

It must be Microsoft's fault

[Anonymous Coward]

LOLZ. Somebody, quick explain how this the evil M$ is responsible for this!!

Re:It must be Microsoft's fault

[Nazlfrag]

Well it appears they are attacking an MS box, by the Program Files part of the filename string. I doubt this would do much on a *nix box with proper access permissions set up. So yes, this is indirectly MSs' fault if theirs is the only platform vulnerable, which is likely.

Re:It must be Microsoft's fault

[Anonymous Coward]

Paydirt! You're apologist asshole of the day is none other than Nazlfrag. Take a bow dipshit.

Re:It must be Microsoft's fault

[nmb3000]

Well it appears they are attacking an MS box, by the Program Files part of the filename string. I doubt this would do much on a *nix box with proper access permissions set up.

Well then, let's see!

C:\>cacls "Program Files"
C:\Program Files
      BUILTIN\Users:R
      BUILTIN\Administrators:F

root@box:/# ls -l
drwxr-xr-x 2 root root 4096 Mar 19 2007 bin
drwxr-xr-x 69 root root 8192 Dec 4 11:40 etc
drwxr-xr-x 11 root root 80 Mar 19 2007 usr

Hmm, look pretty similar to me. Maybe that because it makes no sense if normal users cannot read and execute applications and their associated data? Program Files on Windows being readable by everyone has nothing to do with what is a Firefox vulnerability.

On the other hand I guess you're right. No "Program Files" directory on the Linux machine, it must be safe!

Re:It must be Microsoft's fault

[Nazlfrag]

You got me there, I wasn't very confident in my fingerpointing, and it turns out I was dead wrong. Thanks for the correction, I responded far too hastily to an ACs inflammatory remarks, and just ended up being just as inflammatory and devoid of content as the GP. Apologies to Billy G.

Re:It must be Microsoft's fault

[truedfx]

Maybe that because it makes no sense if normal users cannot read and execute applications and their associated data?

I hope you meant that the other way around. Normal users should be able to execute applications and read data. They don't have to be able to read applications or execute data.

I for one welcome our

[Anonymous Coward]

...buggy Firefox overlords. Or is that joke getting really, really, really old now?

Re:I for one welcome our

[techno-vampire]

In Korea, only old people make overlord jokes.

Re:I for one welcome our

[networkzombie]

Your sig is an advertisement. Do you know that it reflects poorly upon you and ruins the integrity of your posts?

Re:I for one welcome our

[techno-vampire]

Why?

Re:I for one welcome our

[networkzombie]

Because 1and1.com hosting does not have a very good reputation and you have just associated yourself with them through an endorsement. Do a Google search for 1and1.com sucks. Most 5,330 results are not happy with 1and1.com and I also think they suck. I have gone with a different hosting service because I had problems with them. That is why. My new hosting service is great, but I will not prostitute myself for them in forums.

Re:I for one welcome our

[techno-vampire]

So you don't like them. Fine. Don't use them. I'm quite happy with them and if I can get an occasional commission by pointing somebody their way, why shouldn't I?

Re:I for one welcome our

[irc.goatse.cx troll]

Because of the reason the grandparent post pointed out: it lowers your credibility. Both in that someone might try them due to your recommendation and get burned, or that they've been burned in the past and think "hey, this guy actually likes them? anything else he likes is probably just as bad"

As someone who got burned by them (had to threaten legal action to get them to stop demanding money and actually cancel my 'free' account), I know I wouldn't trust someone vouching for them. It's not like how some people got crappy xbox360's that died in a few hours and some people got perfectly fine ones, with 1and1 its more some people get fucked over intentionally and hard, and others just haven't gotten there yet.

Re:I for one welcome our

[techno-vampire]

Well, if you had a bad experience, I'm sorry. I've had nothing but good luck with them as have several of my friends.

Re:I for one welcome our

[Knuckles]

Do a Google search for 1and1.com sucks. Most 5,330 results are not happy with 1and1.com and I also think they suck.

I don't car either way, but Google has 11,000 hits for 1and1.com rocks. Just to show that your metric is pretty useless.

Damned it all

[Overzeetop]

Just before I opened this session, I had upgraded.

Oh, well, just one more unlocked door in the grass hut I call a computer.

Re:Damned it all

[Nazlfrag]

http://noscript.net/getit.

Re:Damned it all

[xSauronx]

ive been using noscript for months... great plugin, and one i wont go without.

Re:Damned it all

[Anonymous Coward]

Did anyone else notice that noscript is running scripts too? Remove noscript from the whitelist and read the message at the bottom of the screen. So I guess scripts are bad for everyone but noscript?

Re:Damned it all

[nacturation]

Same here. Fortunately, once the upgrade was installed it said:

"Over 10,000 people test Firefox every day to help keep you safe on the Web."

I'm feeling safer already.

Re:Damned it all

[Sancho]

Aren't Firefox plugins just Javascript? As I understand it, that's one of the major reasons that Firefox can get bogged down.

Re:Damned it all

[esaul]

While this vulnerability is quite alarming, NoScript is hardly the solution for your everyday "regular" users. Most people simply don't get it. Also, besides being a bandage solution, complicating my life by forcing an extra step for viewing almost every website, it does hardly quell my rancour that now that I had just compiled that version of ff for my pure64 system (and was, oh, so happy about it), I actually made myself more vulnerable.
Really, using NoScript is like having to test your gasoline every time before you fill up your car. None of my computers run Windows. Talk about being locked in to a monoculture! I am stuck, dependent, and at the mercy of the Mozilla foundation, since there be no better alternatives at the moment. My hat, certainly goes off to the developers, and kudos to them, but perhaps, WebKit will become a healthy competitor.

Re:Damned it all

[captnjameskirk]

They are written in Javascript but with special hooks that allow access to Firefox itself (e.g. creating new Firefox menu items, storing plugin settings between sessions, lots of stuff). The fact that the language is Javascript is not what causes the "bogging down", it's when a user installs many, many plugins. The same thing happens with IE when someone installs many, many toolbars or Browser Helper Objects. Don't overdo it and it's not a problem.

Re:Damned it all

[DrSkwid]

On our guest account comp. I turn on "Allow top level sites by default", that's a kind of band-aid because I'm not being dragged over to the terminal every 5 minutes but is some protection from xss.

The worst they can probably do is wipe /home/guest, and this exploit will allow r/o access to /home/guest/.mozilla

I boot the terminals over AOE from a disk image anyway so there's not much to lose.

Re:Damned it all

[shokk]

Sorry, I missed something. When did Microsoft acquire Mozilla and introduce bugs into Firefox?

Re:Damned it all

[Anonymous Coward]

The Firefox user interface is "just Javascript" depending on how you want to think about it. I think what the other AC was talking about was the noscript webpage which shows 23 's blocked if you remove their site from the whitelist(it's in there by default).

Re:Damned it all

[The1Genius]

... and keep in mind that this vulnerability exists in IE7, IE6 and IE5 - and hasn't been patched by Microsoft in 5 years...

Payload

[milsoRgen]

So my I understanding is that this vulnerability can be used to read the host computer, and...

Other issues can emerge also, this is only a short-hand proof of concept. I'm just curious if this could be eventually exploited to actually alter data on the affected host?

Re:Payload

[Schraegstrichpunkt]

Why bother? If a script can read stuff (e.g. your Firefox password list, your cookies file) from the host computer and send it back to a remote machine, you're screwed.

Re:Payload

[Anonymous Coward]

My understanding is that you can only read the Firefox directory, which is NOT where your cookies, etc are stored, well atleast on my pc...

Re:Payload

[HappySmileMan]

My understanding is that you can only read the Firefox directory, which is NOT where your cookies, etc are stored, well atleast on my pc... It says Directory traversal, which means if "view-source:resource:///example.txt" reads "file:///C:/Program Files/Mozilla Firefox/example.txt"... Then by my understanding, "view-source:resource:///../../Windows/system32/example.txt" reads "file:///C:/Program Files/Mozilla Firefox/../../Windows/system32/example.txt" (or more directly "file:///C:/Windows/system32/example.txt")

If you aren;t able to do this and move up directories then it isn't, AFAIK "directory traversal".

Re:Payload

[Flaming_cows]

Firefox doesn't parse identifiers like . and .. in URIs that refer to local data. And view-source properly blocks file:// access.

Re:Payload

[jrumney]

And view-source properly blocks file:// access.

Not if you type it in the URL bar. I can't seem to get the resource:/// hack to work from an http:/// page though, so I'm not sure about whether file:/// gets through under the same circumstances.

Re:Payload

[caluml]

Do as I do, and run Firefox as another user.. Then all it can read is stuff I've saved from the web, and cache, cookies, etc. Not great, but not as bad as being able to read my normal user's data.

NoScript

[bazald]

Why isn't NoScript just a mandatory extension at this point? It seems like it would be pretty unobtrusive with default settings at a slightly reduced paranoia level.

Re:NoScript

[milsoRgen]

Why isn't NoScript just a mandatory extension at this point? I wouldn't be surprised if it becomes a part of the browser (or something like it), just as pop-up blockers of yore have been incorporated.

Re:NoScript

[ilikepi314]

Because most are not educated how to use it properly yet. It's terrific, but I know firsthand from trying to introduce it to people that they ignore it, realize many of their websites are broken, then I say "Well, you can allow certain websites you visit with this little button" -- they then promptly pick "Enable Globally" (or simply whitelist every single site they ever visit), and it has no effect.

So instead of teaching people security, it just teaches them "Security is annoying and breaks everything, what's teh point?" and they want to use it less.

Re:NoScript

[Firehed]

How would it work at a slightly reduced paranoia level? There are, I suppose, for options: block everything, block nothing, block off-site scripts, and only allow trusted scripts (somehow including a database of checksums of widely-deployed, known-safe scripts like Google Analytics' urchin, jquery, Amazon affiliate stuff, and... that's all that comes to mind). Foreign scripts aren't going to cause any damage unless the site itself is vulnerable to XSS attacks - malicious websites aren't likely to off-site the scripts. A database of the known acceptable scripts would be so minimal that it would defeat the point, especially as so few of them are of any benefit to the site visitor. Unless a built-in NoScript were to block specific functions in Javascript that could be used for malicious purposes (anything other than strict DOM manipulation, I suppose), it wouldn't do much good - and breaking half the JS on a site is probably going to be much worse than breaking everything.

Re:NoScript

[mrsteveman1]

If it became part of the browser, 3 things would happen: Idiots would scream and cry about being forced to use it, it would integrate better making it more effective, and vulnerabilities like the one referenced here would be a non-issue for a much larger percentage of the user base.

Seriously, running every script a page stuffs into a browser should not be the default, and it should not take an extension to fix it.

Re:NoScript

[calebt3]

NoScript would be a bit too much for n00bs to grasp. Maybe integrate it but turn it off by default? On a similar note, I would not mind integration of Adblock Plus.

Re:NoScript

[93 Escort Wagon]

Why isn't NoScript just a mandatory extension at this point? It seems like it would be pretty unobtrusive with default settings at a slightly reduced paranoia level. Well, to tech-savvy users this would be true; but unfortunately most users aren't even marginally tech savvy. It doesn't matter if NoScript puts up a clear, unambiguous giant flashing red sign that says "This site will have reduced functionality because we're blocking some scripts from running. Click here if you really want to run all these scripts" - based on past experience, most people will just be positively flummoxed and won't have the foggiest idea why some sites are now "broken".

The thing is, looking at it from the designer/developer end, most users seem to want the functionality Javascript provides. My job largely consists of designing "intranet" apps for a university department. With forms, the end users want the ability to click a button or link to add extra fields when necessary. They want web-based calculators that figure out totals and percentages automatically. They like little explanatory pop-up boxes that define terms for them if they don't already understand what it means. They prefer drop-down menus that change, based on choices made further up the form.

I realize that NoScript actually allows white-listing for situations like this (just like IE does for ActiveX, God bless 'em) - but I don't have much confidence that non-technical end users will understand, even with training. Making NoScript or a similar tool the default will end up meaning significantly more of my time being wasted dealing with support calls - after all, if the web's broken you don't call the desktop support people, you call the webmaster, right?

(BTW is Firefox 3.0b2 or b3 vulnerable?)

Re:NoScript

[punissuer]

Have you noticed how often NoScript gets updated? I wouldn't quite call it unobtrusive, especially since NoScript likes to make your browser open a tab to the NoScript site after an update. Really, how hard is it to prevent execution of javascript that didn't come from a site that's been whitelisted? I now use AdBlock Plus instead.

Re:NoScript

[punissuer]

Seriously, running every script a page stuffs into a browser should not be the default, and it should not take an extension to fix it. Agreed. Also, one would hope that a script whitelister from Mozilla wouldn't need to be updated every three days or so.

Re:NoScript

[SleepyHappyDoc]

It's mandatory for you and I, sure, but I've had so many people act all shocked when they use my computer, and discover they need to 'turn on' scripting to use whatever stupid site they want to look at. That's one of the many things that makes my computer 'suck' compared to theirs.

Re:NoScript

[milsoRgen]

On a similar note, I would not mind integration of Adblock Plus. Shhhhh! Once sites learn more and more people are blocking ads, they are going to move on to an even more insidious manner to deliver screaming, moving obnoxious hobbknobbery to our computers...

Re:NoScript

[SJS]

... (somehow including a database of checksums of widely-deployed, known-safe scripts like Google Analytics' urchin, jquery, Amazon affiliate stuff, and... that's all that comes to mind)

Why is everyone in love with checksums?

Disk is cheap. The amount of scripting I should trust is small.

So cache the *actual* scripts... and then use those as keys into what scripts are actually run.

That is, when you first hit a website that tries to run a script, capture all of the script functions and fragments, and indicate to the user how many un-approved scripts are on this page. The user than has the option to say "Trust this set of scripts" (like noscript now), or "Let me look at these scripts."

And this is where the fun can begin.

The browser can present to me a list of script functions and fragments, each with a "allow", "deny", or "remap" option. Allow is just that -- allow that script function or fragment to be run as-is, temporarily or for that page, machine, or domain. Deny is just that -- deny that script function or fragment, again, for that page, machine, or domain.

For remap, however, I should get a little two-window/textarea display (top/bottom, left/right, don't care, should probably be the user's choice), one read-only (the key) and the other editable. I can then edit the second chunk of code as I please -- stupid client-side verification, gone, replaced with "return true;". Code that disables a feature, deletes information from the display, and so on and so forth... gone. The test for browser/os versions... gone. Bugs become fixable. (Sure, I might introduce bugs, but that's my own fault, and it's my browser anyway.)

Most folks wouldn't ever use "remap" in this way, but that's okay. The ability is there, just like most folks don't compile open-source programs from scratch. That's not the point... if they wanted to, they could.

The next step is to share remapping libraries, like people are sharing greasemonkey scripts now. I could get a call from my mother about how some website is broken to how she'd want to use it, and I can go look at the web-page, fix it, export my changes to some convenient archive, drop it on to my webpage, and then send the url to my mother, who can click on the archive, and have the browser ask "Do you want to install this?", click "Yes", and all is well in the world.

Sure, some websites will take steps to make every bit of client-side scripting unique for every connection. They'll obfuscate their code, randomize the variable names on a per-session basis, mess with the structure... and now you KNOW those websites are hostile and malicious and should be treated as such.

Don't bother with checksums, that doesn't put any power into the hands of the users. Track code, and allow for client-side replacement of code. Allow end-users to share their code-replacement libraries. We can kinda-sorta do that now with plugins and greasemonkey, but that's tricky and error-prone and tedious. Let the computer solve the problems that are tricky, or error-prone, and especially the problems that are tedious!

Re:NoScript

[calebt3]

I now use AdBlock Plus instead. Adblock Plus blocks most ads, but not many scripts. NoScript blocks all scripts that I want it to, but doesn't block all ads. So I find it best to use both.

Re:NoScript

[pipatron]

So because you decide to use the browser as some sort of generic code execution engine and GUI for your own hacks instead of writing your programs to run as a real application like everyone else, people browsing the web should remain a target for javascript abuse, bloat and exploits.

I can't say I agree.

Re:NoScript

[EvanED]

Why is everyone in love with checksums?

Disk is cheap

But bandwidth, less so.

There's also a copyright issue. If the noscript people start distributing Google's gmail scripts, they leave themselves open to a cease & desist letter or a lawsuit. Distributing just a hash makes it easier to argue that.

If it didn't come with a whitelist it would be much better, but then even fewer people would use it.

Sure, some websites will take steps to make every bit of client-side scripting unique for every connection. They'll obfuscate their code, randomize the variable names on a per-session basis, mess with the structure... and now you KNOW those websites are hostile and malicious and should be treated as such.

It does seem likely, but it's not completely given that dynamically-generated scripts are malicious. You could think of putting some identifying information (a session ID) into the script somewhere, or something like that. (Google uses generated scripts (variable names replaced by a single letter and stuff like that) to save bandwidth, though I bet they do that offline then serve it statically.)

(That said, the hash-based version is subject to the same problem.)

Re:NoScript

[93 Escort Wagon]

So because you decide to use the browser as some sort of generic code execution engine and GUI for your own hacks instead of writing your programs to run as a real application like everyone else, people browsing the web should remain a target for javascript abuse, bloat and exploits.

It's not 1994 anymore. People don't just work on their own discrete data sets living on their own desktop computer now. People use webapps because the information is often centralized in places such as MySQL databases, and numerous different people need read and/or write access to it for differing reasons depending on their job function.

The "real" applications (gotta love that required platform lock-in, btw) you talk about would still need access to that centralized data. So you pick your poison - do you provide direct access to that central data repository for a wide number of computers, or do you limit access just to connections from a web server (which is then open to that wide number of computers)? Personally I'd rather keep as much insulation as possible between that back-end data and the rest of the world.

Re:NoScript

[Anonymous Coward]

The fuck? You'd put Urchin on the whitelist?

I mean, short of outright system-compromising code, that's like target #1 for blocking right there.

Re:NoScript

[metamatic]

See my .signature.

Re:NoScript

[metamatic]

They like little explanatory pop-up boxes that define terms for them if they don't already understand what it means.

You mean like the HTML abbr and acronym elements, only reimplemented in JavaScript for no good reason?

Re:NoScript

[the_womble]

Exactly, the average users reaction would be: Internet Explorer (or "the normal internet" as I recently heard it called) works on this site, Firefox does not, so Firefox is broken.

The minority who can cope with those sort of settings can manage to install an extension.

Re:NoScript

[thejynxed]

Easy fix for the issue you mentioned...

In about:config, you put noscript.firstRunRedirection into the filter box. Modify the boolean from true to false. Restart FireFox.

No more NoScript Update page. Enjoy.

Re:NoScript

[Anonymous Coward]

Hmm... sounds just like Vista.

Re:NoScript

[10101001 10101001]

I think you're missing his point. He isn't arguing against server side webapps. He's arguing against client side webapps. The former can do things like access databases (validating input and isolating the actual database) while the latter doesn't really improve on that situation (you can't trust a client to give valid input and if you did, you'd effectively removed a lot of isolation). Sure, there are a lot of people who would prefer a lot of the niceties that comes with javascript (a more malleable interface and sanity validating come to mind), but the GGP just doesn't feel that those extras are worth the security risk and so javascript shouldn't be a necessary step in functionality. I can't really say I disagree with him, if for no other reason that javascript doesn't necessarily exist everywhere, so a website that wants to be most accessible would have to make a non-javascript version anyways.

Re:NoScript

[linzeal]

And sites would stop writing senseless amounts of scripting. Some blog sites have scripts from over 10 different sites on a single page. Myspace is the worst, and it is the only way I can communicate with some of my old friends.

Re:NoScript

[SJS]

Why is everyone in love with checksums?
Disk is cheap

But bandwidth, less so.

Yes, but if you're enabling scripting, you've already downloaded the scripts. If you're downloading replacement recipes, that's a single-time effort. I'm NOT advocating that a browser should go to some other site to check to see if it should replace the current web-page's scripts... that would be wasteful of bandwidth.

There's also a copyright issue. If the noscript people start distributing Google's gmail scripts, they leave themselves open to a cease & desist letter or a lawsuit. Distributing just a hash makes it easier to argue that.

Good point; getting mixed up in the copyright debate is not something that will help this. URL + function name + hash would be sufficient identification for the "key", especially if the hash was generated from some tokenized representation that could handle formatting changes, comments, and variable renames.

If it didn't come with a whitelist it would be much better, but then even fewer people would use it.

Yah, the first thing I do with noscript is to eviscerate the default whitelist. I thought we learned that "default on" configurations were a bad idea in the 90s, but I guess each generation has to relearn the lessons of the past the hard way.

It does seem likely, but it's not completely given that dynamically-generated scripts are malicious.

If enough people presume that dynamically-generated scripts are malicious, they will be. Consider web-bugs -- they CAN be innocuous, but nobody I know of (aside from the marketing weenies) considers them anything but underhanded.

At a minimum, if you DO trust a site that dynamically generates a unique script every time you connect, you should at least have a way of finding out without having to "view source" every time to hit that website.

Re:NoScript

[STrinity]

If you want a browser that doesn't use Javascript, get Lynx.

Re:NoScript

[ratbag]

Disk is cheap. The amount of ...

Disk is not cheap in a laptop, either in financial terms or in space/heat/power terms.

Re:NoScript

[pipatron]

People use webapps because the information is often centralized in places such as MySQL databases

So? There are a multitude of libraries for java, perl, python etc, to connect to mysql databases.

The "real" applications (gotta love that required platform lock-in, btw) you talk about would still need access to that centralized data.

Yes, the browser uses the system calls for connecting to the server, as much as other networked applications as all the networked games in existance, all ftp clients, etc. The platform lock-in would only happen if you would write it to be locked, not if you would write it in one of the languages mentioned above.

Re:NoScript

[kramulous]

I was with you until

... known-safe scripts like Google Analytics ... WTF? Since when is it safe that a script will track my usage and interaction? Never mind google using it so they can 'tailor' the ads that I see. No thanks. I have noscript specifically to stop this sort of intrusion.

Re:NoScript

[Alcoholic Synonymous]

I actually BLOCK google-analytics.com for serving up CASE AND POINT unnecessary scripts to my browser. It is both THIRD PARTY and add NO RELEVANCE to the first party content. Finally, why would I want to give Google any information about my page views? I feel no obligation to reduce myself to a demographic stereotype for which they sling up advertisements that will probably annoy me, or at worst offend me. Even just for security purposes, should Google's DNS get hijacked, servers compromised, or the local hosts file modified, trusting a world wide silent running script that is seen by millions every second is every hackers dream come true.

Yes, the first thing I do when install NoScript is to remove all of it's generous default allowances.

Re:NoScript

[Stan Vassilev]

If it became part of the browser, 3 things would happen: Idiots would scream and cry about being forced to use it, it would integrate better making it more effective, and vulnerabilities like the one referenced here would be a non-issue for a much larger percentage of the user base.

Seriously, running every script a page stuffs into a browser should not be the default, and it should not take an extension to fix it.

No, actually scripts are supposed to be safe and run in a sandbox. There are plenty of legitimate sites where you'd enable the scripts only to find out the site was hacked and used to spread malware.

Throwing hundreds of prompts at the user at every step of the browsing process are not the solution you're looking for, in fact, I'm surprised this what the Slashdot crowd supports.

Let's put things in a different context:

If UAC became part of Windows Vista, 3 things would happen: Idiots would scream and cry about being forced to use it, it would integrate better making it more effective, and vulnerabilities like the one referenced here would be a non-issue for a much larger percentage of the user base.

Seriously, running every script a page stuffs into a browser should not be the default, and it should not take an extension to fix it.

This is what you suggest after all, UAC for browsers. Be gone popup ads, and welcome the endless warnings and security dialogs...

Re:NoScript

[MollyB]

>they then promptly pick "Enable Globally"

For single-user boxes, this is true. However, "Enable Globally" can be removed in NoScript/Options/General if you set up the machine for other folks in your circle/family who'd never dream of changing settings even if they knew how...

Faint hope, I realize.

Re:NoScript

[xubu_caapn]

You could say that about a number of extensions. That's the point of Firefox, you add what you need/want and nothing else. NoScript is a pretty powerful tool, and a lot of people probably wouldn't find it necessary. It could also be confusing for a number of users. Sometimes websites have 5 or more scripts running from 5 different sites. A lot of users wouldn't know which would render the page properly, and it'd be a serious nuisance to a lot of people if they had to refresh a page 5 times for it to look right.

Re:NoScript

[rasputin465]

If it became part of the browser, 3 things would happen: Idiots would scream and cry about being forced to use it, it would integrate better making it more effective, and vulnerabilities like the one referenced here would be a non-issue for a much larger percentage of the user base.

I agree. Although the first point could be mitigated by allowing the user to disable noscript. Or do you mean "idiots" in the sense that they would be unable to figure this out?

Re:NoScript

[owlnation]

Why isn't NoScript just a mandatory extension at this point? It seems like it would be pretty unobtrusive with default settings at a slightly reduced paranoia level.

No. People should have a choice. It's also important that Firefox begins to slim down and stop the feature bloat that is slowly developing.

While I understand the benefits of NoScript. I used it briefly and found it just far too intrusive to be useful -- which is a reflection on the fact that many websites are running stupid pointless scripts that no-one needs -- especially the big corporate content ones. Any such site is rendered useless by NoScript, and it is a pain to have to have to keep whitelisting them.

The core issue is still IE. All the bad practices that bad developers have used all stem from coding for IE, or historically therefrom. Most Corporate content websites are still written in some form of Microsoft CMS or coding, they are still using ActiveX, or redundant Flash, or pointless javascript. They are big, slow, and irritating to use.

It never ceases to amaze me that huge corporations like Google and Apple have proven beyond any shadow of a doubt that Less is More, and Less is much more successful.

And yet every other big website is cluttered with 10,000 dropdown menus, flashing graphics and other such inane practices. Everyone hates this. It's clear as day, and yet the bad practices continue...

Re:NoScript

[Anonymous Coward]

this is a really fucking cool idea

Re:NoScript

[PReDiToR]

God save us all from creature feep.

While you're at it, why not put AdBlock Plus in there and FlashBlock and Greasemonkey and Fasterfox and GMail Notifier and ...

Some people don't want everything included in the distribution, some developers don't want to have to make all those things work with every release and compile they do of test builds.

AutoUpdate of things you choose to install works just fine, and the people who build the add-ons make sure they work without having to work for MozFoundation.

Re:NoScript

[ThomasLB]

NoScript is still being updated several times per week. I don't think they'll incorporate it until it's a little more stable.

Re:NoScript

[Zaiff Urgulbunger]

Then again, you might say that a browser should render [X]HTML + CSS by default, but provide the JavaScript interpreter as an extension. I'm not saying thats a good idea, but I'm just making the point that adding the ability to selectively run JS is not really such a bloat inducing feature!

While you're at it, why not put AdBlock Plus in there and FlashBlock and Greasemonkey and Fasterfox and GMail Notifier and ...
Oddly, you could argue that AdBlock/FlashBlock and NoScript cover the same ground and therefore *could* reasonably be included by default... perhaps with a dumbed down interface. Then, if required, provide an enhanced interface by extension.

Re:NoScript

[Just Some Guy]

Disk is cheap.

I've read Slashdot on an Eee PC, a Nintendo DS, and a cellphone. Many new web-capable devices are a little slim on client-side store.

Re:NoScript

[CNeb96]

You forgot the 4th, it wouldn't be upgraded nearly as often as the current maintainers upgrade it. Noscript is updated all the time. Firefox needs a hybrid approach include extensions by default AND allow them to be independently updated separately from the main release, they don't do that currently for any extension.

Re:NoScript

[Anonymous Coward]

Indeed, FF has had selective JavaScript blocking (Advanced button) for quite some time (1.5?) disabling pop-unders, window resizers, context menu stealers, and those damn status bar scroll texts. Adding a few more check boxes wouldn't be a big curve for the user to grasp.

But a lot of people would wonder why the hell a chunk of sidebar menus and drop-down navigation stops working. "YUR SITEZ BROKE! MAH BROWSERS DA BEST!"

Re:NoScript

[metamatic]

Read the request. The feature's already there, I'm just asking for a workable UI.

Re:NoScript

[TheLink]

Quote: 'The browser can present to me a list of script functions and fragments, each with a "allow", "deny", or "remap" option.'

Did someone's aunt or uncle solve the halting problem recently?

How can you expect users to reliably and _correctly_ make piecemeal decisions on what can or cannot be done?

Have templates of sandboxes. Deny the unsafe/unnecessary actions by default.

I've submitted a feature request to ubuntu and suse on this. I think I've even suggested it to apple.

Re:NoScript

[HalAtWork]

If what you're suggesting would work, training users to acknowledge or whitelist appropriate actions, then UAC would probably be considered a great security feature.

Re:NoScript

[VGPowerlord]

Agreed. Also, one would hope that a script whitelister from Mozilla wouldn't need to be updated every three days or so.

Aw, I was going to mention this, but you already did. :(

Re:NoScript

[Firehed]

I said it's safe, not useful for the viewer (though I'd argue that if the webmaster knows what s/he's doing, the analytics data will improve future visits to the site). As far as I'm concerned, it's just sophisticated server logs - it's not as if I'm losing privacy.

Re:NoScript

[Cruxus]

I hate to disagree with pretty much all of Slashdot (as their collective opinion is again and again proven most wise), but I tried NoScript and found it to be too much of a pain, so I promptly uninstalled it. The risk relative to the benefit is frankly pretty low. I'd rather not examine the JavaScript of each and every site I visit to determine whether it is "safe." JavaScript is meant to be a sandboxed language; we should improve the design to further minimize security risks and not resort to reactive paranoia.

Re:NoScript

[Anonymous Coward]

It wouldn't be such a bad idea to implement something like that in the browser if it had an option to subscribe to a community maintained list of blocked sites similar to the way adblock plus is set up. Upon installation, an option to subscribe to one of a few various lists--or no list--could be selected and then off they go. I have no problem setting up my own list, but I know some less patient people who don't quite get the way it works and will just turn it off completely when it starts to annoy them. IMO that sort of behavior could be avoided by a community maintained list which required very little effort on their part.

Re:NoScript

[lhorn]

I would prefer scripting whitelist in browser, but have not found any.
I am running IceWeasel with no (known to me) clientside scripting,
the preferences menu has checkboxes for popup windows and image loading,
both with a list for me to specify exceptions like my bank or Slashdot.
There is no such thing for Javascript, just the tickbox which remains off most
of the time. Please do not tell me I have to write my own browser preferences
or trust NoScript, which last time I checked ran JavaScript...

Re:NoScript

[SJS]

Disk is not cheap in a laptop, either in financial terms or in space/heat/power terms.

Sure it is.

My old laptop had a 30GB disk (I still have 9-10GB free), and my new laptop cost a third less, and came with an 80GB disk. Believe me, compared to what it used to be, disk is cheap, in financial, space, heat, and power terms. And it is only getting cheaper.

Plus, nothing in my scheme required that you disable scripting for all websites; if you want to run wide-open and trousers-down, that's your business; no additional disk space required.

The problem is that those of us who would like a LITTLE more sanity in our browsers don't get that choice. We can disable everything, or we can use the crude approximation of assurance with tools like NoScript and Muffin, or we can give up and turn everything on and pray really hard every night that nothing bad will ever happen to us.

Just how much Javascript do you download and run in a day, if the disk requirements for my little scheme are significant? Or is your objection a knee-jerk reaction to the "disk is cheap" meme?

Re:NoScript

[SJS]

How can you expect users to reliably and _correctly_ make piecemeal decisions on what can or cannot be done?

I don't. I expect the technically advanced users to do so. I expect the technically mediocre users to play around with it. And I expect the technically unsophisticated users to download pre-packaged "adjustments" from trusted communities and repositories, or to ignore the whole thing and just blindly trust everything.

The point is... they have a choice. Just as we say they have a choice with open-source software -- they can, if they choose to, and have the expertise, examine and modify the source code; the fact that they may not be able to do so reliably does not diminish the value of open-source software.

Further, given that technically astute folks could easily "fix" broken scripting, we could avoid some of the more egregious obnoxiousness that comes from arrogant developers. Client-side authentication would be a favorite target, but right after that would be client-side checking of browsers and/or operating systems (don't you get annoyed when a website checks for your browser and tells you that you must upgrade to IE7 or better?), and all sorts of brain-dead scripting tricks.

Eventually, when the client-side inanities prove to have no actual effect, we can hope they'll just go away. Instead of putting a test in the script to verify that only $developers_favorite_browser is being used, a developer would just write the script, test it on a couple of mainstream browsers, and let the user communities for the less-popular browsers "fix" the scripts. Ideally, good fixes could be rolled back into the production scripts, leading to better code all around, and perhaps websites that work without javascript being enabled at all.

I would not expect my parents to inspect the code. I would like the ability to check out websites that are giving them grief, and devise a set of patches for the lame/broken/stupid scripts, and thus ease their pain. Lessen their annoyance. Maybe give them something cooler than what's on the stock website.

Have templates of sandboxes. Deny the unsafe/unnecessary actions by default.

So far as I'm concerned, it's all unsafe and unnecessary. And yet, deleting or disabling those actions causes a bit of grief -- not on the better class of websites, that degrade gracefully -- to the point where it seems that a lot more websites are dealing with the problem of "your website sucks without scripting enabled" with "test for scripting, and then berate the user if they won't enable it".

So I don't see how better or different sandboxes would help. Perhaps I'm misunderstanding your point.

Re:NoScript

[SJS]

I've read Slashdot on an Eee PC, a Nintendo DS, and a cellphone. Many new web-capable devices are a little slim on client-side store.

I really (seriously) wonder why such devices ship with Javascript functionality anyway. Wouldn't a simple malicious script kill 'em dead?

For example, wouldn't

<script>
while ( true ) { alert("Bye bye"); }
</script>

or

<script>
var a = "let us fill up memory";
while ( true ) { a = a + a + a; }
</script>

kill such a device dead?

Re:NoScript

[Just Some Guy]

I presume they have resource limiting mechanisms, just like their larger cousins.

yahoo or mozilla

[erat123]

Maybe microsoft should have looked into mozilla instead of yahoo...

reason to switch to IE

[Anonymous Coward]

well that tears it.... the apocalypse is nye!

Fixed is hours!

[skelator2821]

Yes this is not good BUT! It will only take them hours or a day at most to patch it.. You IE-6 users waited for months if not Years and then the only reason M$ released patches and tried to act like they were really supporting their users was because they were starting to get Serious competiton again.. Don't believe me? just Google it.

Re:Fixed is hours!

[BasharTeg]

You gotta love Firefox apologists. They can turn a complete failure on behalf of Firefox development and release engineering into a discussion about how Microsoft is horrible and IE fails.

You're living in the past. Everyone knows IE6 was horrible. I'm running IE7 under protected mode. If you're going to talk shit, at least talk shit about current software. People who spend their time talking about how Windows 98 crashed a lot, IE5 and 6 were really insecure, and IIS 5 was the fastest way for a computer to get hacked on the net, are really starting to sound tired and sad. When we're running Windows 7, Internet Explorer 8.0 in Protected Mode, and IIS 7.0 on Windows Server 2008, fools like you are still going to be apologizing for every bug in by bringing up bugs from Microsoft products 5+ years ago.

And even if IE6 was the most horrible browser ever and they waited for "moths if not years" for patches, how does that make this Firefox vulnerability any better? If IE6 is so bad, why is it your example for trying to minimize this Firefox vulnerability?

Microsoft products are getting better. Deal with it. Quit living in the past.

Re:Fixed is hours!

[Anonymous Coward]

>Microsoft products are getting better. Deal with it. Quit living in the past.

So are realplayer's products, but you don't see anyone telling anyone to install them.

Re:Fixed is hours!

[Anonymous Coward]

Microsoft "products" (software is not really a product anyway, that's a marketing lie) still don't work on my Linux system. Why should I give a fuck about them?

Re:Fixed is hours!

[tubapro12]

It's hideous Fred, they all sit by him to look good...

-Forgotten someone

Re:Fixed is hours!

[Anonymous Coward]

Dude, are you on crack?

Re:Fixed is hours!

[Anonymous Coward]

I prefer to stick with bugs I know how to fix, I can't say I have the money or balls to go out and blow money on bigger bugs than my dinky little roach motel is capable of handling. :P

(Especially considering I literally cannot even afford to put gas in my car to go apply for a job.)

Re:Fixed is hours!

[LordLucless]

While I have to develop for it, I'm going to bitch about it. IE6 is still alive and well, and making up a significant proportion of site hits. It's still a piece of crap, and I still have to take it into consideration when I'm developing. Granted, the flaws I care about are rendering rather than security, but complaining about IE6 is most definitely not "living in the past".

Re:Fixed is hours!

[Anonymous Coward]

Hmmm...not a product. If you're trying to say what I think you're trying to say, you're using the same old tired lame-ass argument that software is 'Intellectual Property' and should not subject to patents, copyright, etc. etc. etc.
Really? What about books? Should we use the same argument? I can almost bet that you think music should be free also.
I'd bet that a long list of 'intellectual' items could be put into that 'non-patentable/non-copyrighted' category.
What would you pay for? What do you think should be patentable?
Do I think some things should be free? Yes. Especially research (or any product for that matter) that's paid-for with public money.

Now, if software is developed with public funds then it better be available to all!

Re:Fixed is hours!

[DMoylan]

> Everyone knows IE6 was horrible. I'm running IE7 under protected mode. If you're going to talk shit, at least talk shit about current software.

well in their defence more people still use ie6. so they are talking about current software.

http://www.w3schools.com/browsers/browsers_stats.asp

at my job it is split about 90% ie6 v 10% ie7 for internet explorer users. thankfully the number of ie users is dropping as more switch to firefox. ie7 has speeded up that switch as many hate the interface.

but to be on topic firefox has a serious bug. i expect it will be patched in a day or so. firefox is good at that.

> Microsoft products are getting better.

only because they have serious competition from firefox, apache etc.

> Deal with it. Quit living in the past.

i don't live in the past i use linux and mac osx.

Re:Fixed is hours!

[zsau]

As someone who uses Linux because I was able to customise it to be exactly compatible with the way I think, and so I'm unable to run Internet Explorer or IIS, I have to say you make an excellent point.

To everyone else: Do you remember before the browser wars, when Netscape was the big, bloated dominant player and Internet Explorer was the fast and light competitor which needed to prove itself (even if it did so by cheating)? Do you remember the time between the wars, when Internet Explorer was buggy and insecure? Now we are in the second browser wars and Internet Explorer is trying to compete. And it's a good thing. The Mozilla foundation cannot afford to sit on their laurels or Firefox will be the also-ran that the Mozilla suite is. Never hold yourself to someone else's standards: Be the very best you can be, and it'll always be better.

And be grateful for it — we on Linux pretty much have no choice but Firefox (or Firefox-based browsers) if we want a vaguely native, somewhat integrated system (well, there's Konqueror if you use KDE but it's not up to the same level as Firefox and Internet Explorer). There's no competition, no choice, and no reason for Mozilla to focus their development effort over on this side of the fence. And we suffer for it, with form widgets that don't look right and menus that don't work properly.

Re:Fixed is hours!

[Anonymous Coward]

Umm, can anyone say "Opera"?

Re:Fixed is hours!

[value_added]

When we're running Windows 7, Internet Explorer 8.0 in Protected Mode, and IIS 7.0 on Windows Server 2008, fools like you are still going to be apologizing for every bug in by bringing up bugs from Microsoft products 5+ years ago.

So ... you're dismissing the long and tiresome history of Microsoft's security record by stating that the next version of Windows, IE, etc. will be the most secure version ever?

Normally I don't use inflammatory terms like "apologist", but in this case, I think the characterisation is appropriate. If there's anything tiresome in the matter, it's not those who take the opportunity to point out the history, but those who repeatedly insist that doing so is somehow unfair, undeserved, or worse, somehow not relevant.

Re:Fixed is hours!

[Anonymous Coward]

OK, IE 7 on Vista has some extra damage mitigation features.

They wouldn't have helped for this particular problem. There was no security hole, nothing is malfunctioning, no part of the system is accessing data it shouldn't be. Aside from having already thought of and worked around this exact bug, there is NOTHING that could have been done in terms of process or technology to prevent this from occuring in the first place. Exactly this kind of bug can, and probably does exist somewhere in IE7.

However, there is no security issue here. You can only read files from inside Firefox's own installation directory, you can only read them by including them as JavaScript files, so a non-JavaScript file will break. You can not, despite the article's claims, read out any user settings, or leak any information. You can read out the DEFAULT settings, but they're already well known. No modifications can be made, there's no information disclosure, and there's certainly no possibility to cause the browser to do something it's not supposed to.

In other words, Microsoft wouldn't consider this a security issue, and wouldn't patch it. Not publicly, anyway.

Re:Fixed is hours!

[jonabbey]

I'm a Firefox user on both Windows and Linux, but I think you unfairly downplay Konquerer. Konquerer has benefited from its common source base with Safari, and actually does better in some ways (Acid 2 test?) than Firefox 2.x does.

Props to the Konquerer team, I say.

Re:Fixed is hours!

[Blakey Rat]

No, his point is that when the new version of Windows or IE comes out, you don't go back and re-evaluate whether it is, actually, the most secure version ever. IE7 is really good.

Re:Fixed is hours!

[Runefox]

Yeah, but the problem is that IE7 is even more horrible than IE6, both on a usability standpoint and a web development standpoint. The former, because it's implemented sweeping changes in the UI that are frankly confusing to users used to the old IE5/6-style interface, and a lot of compatibility was broken between IE7 and IE6 (Quickbooks for one... Ugh). The latter because, let's be realistic here, while better than IE6's (and ironically, this is IE6's greatest strength), IE7's standards compliance blows. It renders pages almost completely differently than Mozilla, Safari, Konqueror and Opera, and can you perform specific fixes easily in IE7 by doing things like "xx:yy ! important; xx:yy;"? No, IE7 incorporates the ! important flag. Can you do a nonstandard "xx:yy; _xx:yy;" hack? No, it, as it should, ignores that. No, you have to get it with a script (usually server side, requiring more resources on the server, and if not, then Javascript, but what about all the NoScript nuts in this discussion who would no doubt turn JS off outright?), detect the browser version, and output dynamically based on whether it's IE7 or something else, which is a pain in the ass, especially when IE fights with the other browsers over where things should be placed and what size they should be, even if exact pixel values are used. There's no excuse for this, I'm sorry.

The only other problem with talking about IE7? Nobody I know cares about IE7. We still ship systems out from my workplace with IE6 on them, and leave it up to the user to install IE7, simply because it causes issues with web apps and even some programs, not to mention the headache when some Win98 user on his first XP machine all of a sudden can't find the "File" menu of his shiny new browser. IE6 is still very much in play on the internet, and IE7 is only really gaining ground at this point because it's now a critical update, not even requiring a valid XP license any more, not to mention it's the only way to go in Vista, which is pre-loaded on most new machines nowadays anyway.

If anything, Microsoft products aren't getting better at all, though I think the outlook is good for IE8 and Windows 7 (mind you, I was optimistic about Vista and its promised new features, virtually all of which except Aero and the Sidebar were canned). I personally feel, as someone who deals in this software on a daily basis, that Windows Vista, Office 2007, and IE7 are extremely weak forays into new UI designs that frankly aren't efficient nor pretty, and the same could be said of their performance. I could go on and on about Vista, and yes, it has its high points ("Find a Solution" is awesome functionality), but IE7, for me, is a total flop. Office 2007 is the same; I can't understand why, aside from "just because", they would change the interface so dramatically that anyone with familiarity with Office 2003 wouldn't be able to sit down and just do some work like normal. Even the key commands and shortcuts are different, and let's not get into the DOCX format. So instead of innovating (adding new features, expanding on old ones, etc), they basically crippled one of their main software suites. I personally believe all of this to be because of pressures from Apple and their departure from the "standard" UI design style, but none of this is really relevant.

I think that if they're going to make these sorts of changes, they may as well drop everything they've already built, create a completely different platform and code base for their products, and start from scratch, like Apple has done. It seems to have revitalized their OS, given the rabid fanboyism that surrounds it, so maybe Microsoft could stand to gain from it, too? It's not as though they have anything to lose - People will continue to buy their software regardless, if Windows ME and Vista are any indication.

Re:Fixed is hours!

[Mr Z]

A wise person once said to me: "When Coke and Pepsi fight, who loses? Royal Crown."

When #1 and #2 fight, invariably #3 loses.

--Joe

Re:Fixed is hours!

[zsau]

Oh indeed; and once it uses Webkit natively (instead of backporting Webkit changes into KHTML) it'll be even better faster. The problem with Konqueror is the user interface; it lacks a lot of features I take for granted, like combining multiple downloads into one window and session saving/restoring functionality, but also it has way too many options, and there's just no integration between it and my desktop (no surprise, it's KDE and I'm not).

I seriously think that Webkit will change all of this and make me a happier person. Already I can run Gtk+-Webkit browsers, although the ones I've played with so far are far from stable.

Re:Fixed is hours!

[Kalriath]

Never, EVER use W3Schools as a definitive source for browser stats. It even says right on that very page that their results are from their own logs and not representative of the internet at large.

You invalidate your entire argument when you quote W3Schools as a source.

Re:Fixed is hours!

[Anonymous Coward]

> If you're going to talk shit, at least talk shit about current software.

Would this be a good time to bring up all those recent ActiveX flaws, then? :]

Anyhow, it's been ages since I've seen any Firefox flaw that couldn't be mitigated by NoScript, which I use constantly with the minimum permissions I can manage.

Re:Fixed is hours!

[syousef]

Microsoft products are getting better. Deal with it. Quit living in the past.

Do you mean like Vista unable to copy files (unless you have thousands of years to spare?), Vista's inability to restore it's own backups (something I've also experienced 1st hand), FSX all but killing 3rd party development by providing a buggy ever changing moving target as a release platform?

The reality is IE6 was so bad and so many people complained that MS had to respond in some way. IE7 incorporating tabs and a few new security features 3 years after other browsers added them is nothing to be bragging about.

Do you print your slashdot posts and take them to MS interviews or do you just show your MS boss your posts once a week?

By the way, I'm on Firefox apologist. I believe Firefox lost the plot long ago - forced upgrades combined with incompatible extensions, security vulnerabilities, an inability to diagnose virii and spyware that target Firefox. The only conclusion that anyone can come to is that the software industry is a mess. Buggy releases and insecure applications are the norm. In exchange for features we'll never use, glitzy interfaces that are inefficient and make no sense, and DRM we're told makes a computer "trusted" when in reality it's designed to police everything we do, legal or not, we get ever increasingly complex software that can't get core functionality right.

Trying to pick which browser is best under these circumstances is like 3 rednecks sitting around beer in hand trying to pick which pig is best in a horse race. Hell HTML and scripting is so badly screwed up that to complete the analogy the race track is made of quicksand and rotten cheese.

Re:Fixed is hours!

[Anonymous Coward]

>Microsoft products are getting better. Deal with it. Quit living in the past.

Vista.

Re:Fixed is hours!

[Anonymous Coward]

You could use Opera or Konqueror instead...

Re:Fixed is hours!

[lancejjj]

You're living in the past. Everyone knows IE6 was horrible. I'm running IE7 under protected mode. If you're going to talk shit, at least talk shit about current software. People who spend their time talking about how Windows 98 crashed a lot, IE5 and 6 were really insecure, [...] IE6 is current software. Its utilization is quite substantial, and is not comparable to the utilization of Windows 98 or IE5.

According to my service's traffic, about 40% of IE users still use IE6. And the most recent NetApplications survey agrees (43% of IE usage).

I speculate that IE6 usage is so high because many corporate web services require IE6 - Microsoft's upgrade to IE7 caught many foolish IT departments owners by complete surprise, despite IE7's very long and public gestation period.

Furthermore, IE6 is still supported by Microsoft. It is not "obsolete".

Re:Fixed is hours!

[Anonymous Coward]

While you're right this shouldn't be about IE, you're wrong that IE6 is living in the past.

My company has enterprise customers still using IE6 across the entire organization. For us the past is now, dealing with terrible CSS hacks, Javascript incompatibilities, and old win2k computers that can't handle larger data sets in a browser with any speed.

Welcome to the future it, it is sooo 2002.

Re:Fixed is hours!

[Anonymous Coward]

the only reason they are getting better is because they can't get any worse :)

Re:Fixed is hours!

[Anonymous Coward]

All right, so this is the deal, I wake up, check on slashdot and I find only utter BS.

A news story about a "serious" vulnerability in firefox 2.0.0.12 , well, the vulnerability doesn't affect only 2.0.0.12, it is not serious AT ALL, some moron tagged it haha. And this idiot on the parent post got +4 insightful.

What the hell is happening to slashdot? Is it becoming a frigging tabloid? I am growing tired of BS like this. I am relieved I didn't see any opera troll post getting mod points else I would explode, come on slashdot! You can do better than that.

Re:Fixed is hours!

[DMoylan]

fair enough, how about a different survey.

http://upsdell.com/BrowserNews/stat.htm

it also warns against taking the numbers as verbatim but it is using 5 sources. this is a problem with browser market share. how can you tell a good survey? how can you correct for browsers reporting as something else?

the numbers from this site aren't much different than the other survey. what do you work at? how often do you see ie6? hell i've seen ie4 and ie5 in the past month on old servers. within the last 18 months i've seen win3.1 on a laptop. those are exceptions but ie6 is still very very common.

Re:Fixed is hours!

[Anonymous Coward]

If that was true then John Edwards would be ahead of Hillary and Obama.

Re:Fixed is hours!

[Anonymous Coward]

Erm... How is that? When Hillary Clinton and Barack Obama fought (#1 and #2), John Edwards lost (#3).

Re:Fixed is hours!

[zsau]

It's very hard to find out when you reply if you're Anonymous; in general I don't know that they're there.

Any case, I run Opera reluctantly at the moment because it's the only browser I can get to work (due to a temporary problem). Its attempts to integrate into the desktop are so bad that I won't even credit it with a criticism; pretty much everything to do with look, feel or behavior needs changing aside from the very basic fundamentals (like putting "Cut" in the "Edit" menu — they do get some things right). It even is abnormal and strange under Windows — if they can't be bothered caring about their major platform, there is simply no chance of them pretending about minor ones.

Re:Fixed is hours!

[Anonymous Coward]

Do you remember before the browser wars, when Netscape was the big, bloated dominant player and Internet Explorer was the fast and light competitor which needed to prove itself

No. I remember keeping an old Netscape 4.7 for a long time, because IE sucked big time. When they finally got around to make a moderately usable IE 6.0, Firefox was getting close to stable.

When was this fast and light Internet Explorer you're talking about?

Time to see if Konqueror fixed the damn flash bug

[gambolt]

I've been using Iceweasl because the flash problems in Konquer were driving me nuts. You don't realize how much flash is on the web until it stops working.

I sure hope it's only this version...

[WiglyWorm]

Hopefully the Firefox 3 beta is not affected by this, that's what I've been running since Beta 2 came out. Anyone know?

Re:I sure hope it's only this version...

[tetromino]

It looks like Firefox 3 Beta 2 is vulnerable. The proof of concept from the article works on FF3b2 on my machine (Linux i686).

Re:I sure hope it's only this version...

[Ingenium13]

The latest nightly is significantly better than beta2. I recommend just installing Minefield and let it update every day. Or you can just disable automatic updates and only update it when you're going to restart the browser anyway.

Re:I sure hope it's only this version...

[tetromino]

Guess what, the latest (2008-02-09) Minefield build is also vulnerable to the exploit proof of concept...

or just visit sites you trust

[hcmtnbiker]

That's right, back to the drawing board with this one. In the mean time you can either use another browser, or install the NoScript plugin to mitigate these issues. Or you can take the first step like you always should, and not visit sites you don't trust. Vulnerabilities always exist, betting that the developers will find them before someone else can exploit them is not a smart thing to do. Visiting only sites you trust will keep you away from people who want to compromise your computer 99.99999999% of the time, it really is the best thing you can do it terms of browser security.

Re:or just visit sites you trust

[Beryllium Sphere(tm)]

>Visiting only sites you trust will keep you away from people who want to compromise your computer 99.99999999% of the time

Assuming that the sites you trust haven't been compromised, this still leaves out the serious problem of attack code inserted into advertising.

Re:or just visit sites you trust

[dedazo]

Funny, I used to say the same about most IE vulnerabilities, but it wasn't a very popular argument back then.

Re:or just visit sites you trust

[11223]

Or you can take the first step like you always should, and not visit sites you don't trust.

Ever use an open 802.11 access point? Ever been redirected to a legalese page before being allowed onto the internet? Now what if that page had the exploit in it? For added fun, imagine the hotspot isn't malicious but there's an attacker on the network using a rogue DHCP server to feed you a bogus set of DNS servers.

People assume that their web browser is a trusted execution environment. Vulnerabilities which affect the browser are worth caring about for that reason.

Re:or just visit sites you trust

[Anonymous Coward]

Yes, that's brilliant. There's a whole universe of information out there, billions of web sites with everything from useful documentation for work to tips for work around the house, but I should restrict my browsing to the thirteen web sites I know and trust just to keep my computer safe.

No thanks. I'd rather trust my browser, or take the risk. There's too much good stuff out there to wall it all off because of concerns about security.

Re:or just visit sites you trust

[Anonymous Coward]

Mind explaining to everybody what magical mental ability you have that allows you to determine what pages can't be trusted simply by visually inspecting them?

Seriously, how did this get modded insightful? "If you don't want your browser to be hacked or exploited, only go to pages made by nice guys!" What the fuck kind of a dreamland are you living in? That's like telling going to a third-world country with abandoned mine fields and yelling out "if you don't want to lose your legs, don't walk anywhere with them!"

Re:or just visit sites you trust

[Anonymous Coward]

who says you trust sites that have advertising

Re:or just visit sites you trust

[Anonymous Coward]

Or you can take the first step like you always should, and not visit sites you don't trust. How come this explanation is never sufficient for critical IE bugs?

Re:or just visit sites you trust

[saleenS281]

If the sites you trust have been compromised, no script isn't really going to help now is it? People tend to whitelist sites they trust...

Re:or just visit sites you trust

[m.ducharme]

Yeah, sites that have advertising suck! *looks up* oh, wait...

Re:or just visit sites you trust

[STrinity]

Or you can take the first step like you always should, and not visit sites you don't trust.

If I'm googling something, how can I tell which search results are trustworthy sites and which aren't?

Re:or just visit sites you trust

[Anonymous Coward]

Your advice is somewhat.. stupid. How would you know whether to trust the site or not if you never visited it just once? The other answer to your post gives you the second hint why it's stupid.

Re:or just visit sites you trust

[McDutchie]

Visiting only sites you trust will keep you away from people who want to compromise your computer 99.99999999% of the time, it really is the best thing you can do it terms of browser security.

This is mostly correct. Unfortunately this fact also, tragically, completely kills the WWW as it was envisioned. The basic idea was that anyone could publish websites and you could jump from site to site by free association just by clicking hyperlinks, and not even have to be too bothered which exact site you're on. (Does anyone even remember the term "websurfing" anymore? Does anyone remember how revolutionary it was?) Now we have to warn end users not to click on links unless they trust them, which means they can never visit a new site because you cannot trust what you don't already know. Governments and corporations admonish the people to practice "safe browsing" and websurfing has become "promiscuous" and dirty like unsafe sex. Malware has thus reduced the WWW to nothing but another set of corporate-controlled interactive television channels. RIP.

Re:or just visit sites you trust

[Anonymous Coward]

Assuming that the sites you trust haven't been compromised, this still leaves out the serious problem of attack code inserted into advertising. Hence, M$ big push to become the sole ad server for the web AND the push for "Web 2.0".

Re:or just visit sites you trust

[WindShadow]

I love suggestions like "don't visit sites you don't trust," it sounds so much better than "don't ever go anywhere new to get information on the Internet."

I must have missed it, where is the site which lists all the other sites I can trust? Oh, I can't go there, I don't trust it. Advice like that doesn't even work in a business environment, going to sites to get vendor information, standards, and documentation is a vital part of specifying, ordering, installing, and maintaining vendor supplied hardware and software. Disabling javascript is about as practical. if you can't use a site you can't do anything useful with it.

Who cares? Use Opera

[Finallyjoined!!!]

's much better :-) Less bugs, more enjoyment. Heh :-)

Re:Who cares? Use Opera

[FudRucker]

Opera is closed source so you have no idea what vulnerabilities are in it...

Re:Who cares? Use Opera

[Kjella]

Neither do you with Firefox, if you count both known and unknown vunerabilities. Sure, I know yesterday there was X bugs and today X-1 bugs (unless they've added some new ones) but since I have no idea what X is, it hardly matters. Even if we knew, it's be hard to say if it's because they've got few bugs or aren't looking for them or tagging them as such. In the end you look at their track record and see how many public and serious expoits there are, if it's a swiss cheese that keeps getting hacked it's crap, if not it's good because hackers don't hold back for PR reasons. So far I'd say Opera has a very good track record...

Re:Who cares? Use Opera

[ZzzzSleep]

I'm just waiting for 9.50 to finally come out of beta...

Re:Who cares? Use Opera

[bunratty]

In the end you look at their track record and see how many public and serious expoits there are, if it's a swiss cheese that keeps getting hacked it's crap, if not it's good because hackers don't hold back for PR reasons.

I see Opera users claiming that Opera is secure using this very reasoning all the time. On the other hand, Secunia says not to use its data to compare the security of browsers. Can you find even one security researcher that says this is a valid way to determine the relative security of browsers?

Re:Who cares? Use Opera

[whitehatlurker]

You could say the same about InternetExplorer, yet people seem to find a lot of holes in it. Yes, MS IE is used by more people, so the "more eyes" thing can be invoked.

The point you should also look at is that Opera, as a company, has had a stellar record in fixing holes once they have been discovered. I don't think I have seen a better response time for any software product.

Who is to blame?

[Colourspace]

Must be Microsofts/Googles/Apples/SCO's fault. Delete as applicable.

nifty trick

[Deanalator]

It makes me happy that this type of vulnerability is what we call serious these days. If you remember, just a couple of years ago microsoft was downplaying the WMF vulnerability. It was not considered "critical" because the target needed to manually visit a malicious website for the attacker to take over the target machine.

While this is a really neat find, and I am glad that it will be patched pretty soon, I don't think it is quite at the level of "sky falling" etc. From what I understand, an attacker that can execute javascript in your browser has the ability to read any file in the targets mozilla directory. This worst that I think an attacker could do would be to grab your stored password file. While this is definitely something to be concerned about, the headline had me pretty worried :-)

Re:nifty trick

[Anonymous Coward]

Actually they can't even get your stored passwords. They can only get files in "C:\Program Files\Mozilla Firefox\" which consists of nothing related to stored data, except for the greprefs folder, which isn't even YOUR preferences. From the looks of it, it's what a default Firefox profile gets stuck with. So, this is a pretty lame exploit, definately not serious, you can't access outside of the Mozilla Firefox directory from the looks of things.

Trojan?

[4D6963]

Would that be why I caught a trojan right after installing that version and browsing sites of questionable trustworthiness?

Re:Trojan?

[Anonymous Coward]

No.

As an aside, the article is linked to at the top of this page. It explains.

saved passwords

[robo_mojo]

Does anyone still think that it's a good idea to permanently store your passwords in your browser?

Re:saved passwords

[DigitAl56K]

Yes, although only in conjunction with something like Firefox's master password to encrypt them.

This brings up my greatest grip with Firefox: If you visit any site that you have stored a password for and you have a master password set, the damn thing pops open a request for any page that contains a password field. Take Slashdot or Digg, for example. If I'm browsing either of these sites almost every page I open requests a master password. You can turn off form auto-fill in about:config (not very end-user friendly), but then Firefox seems to have no method at all for causing the stored passwords to be filled in the page, unless I'm missing something. All in all, Firefox has some issues when it comes to password storage.

Do you have a better way to store all your passwords?

Re:saved passwords

[j.sanchez1]

Do you have a better way to store all your passwords?

Try Secure Login.

Re:saved passwords

[Nazlfrag]

There's this thing called carbon-based memory I use from time to time. Efficient, portable, unfortunately it is easily broken by Johnny Walker and co.

Re:saved passwords

[EvanED]

For things like Slashdot and other dumb web forums? Yes. The convenience trumps the security risk. For my bank and school email accounts? No. But I didn't do that before anyway.

If you're asking "does anyone still think that it's a good idea to have the browser be able to store your passwords", the answer is definitely yes.

Re:saved passwords

[Non-Huffable Kitten]

I really like this one: https://addons.mozilla.org/en-US/firefox/addon/3282 (Password Hasher)

Re:saved passwords

[QuickFox]

almost every page I open requests a master password. The first time you get this prompt, regardless whether you want to log in on that particular site or not, enter the master password. Once you've done that, the prompt won't pop up again during that session with Firefox. From that point on, all sites with a login will be filled out, but not submitted unless you click the login button on the web page.

At least that's how it worked last time I checked (but that was some time ago).

You should probably leave at least one Firefox window open all the time until you're done for the day, to avoid ending the session and then starting a new session, giving you a new prompt. But if you leave your computer and other people can access it, you should probably close all Firefox windows, so other people don't use your Firefox session to log in on your accounts.

Of course you should never let Firefox remember important logins like your bank.

Re:saved passwords

[IdolizingStewie]

Exactly. Bank, online shopping, and primary email account passwords are stored in KeePass or in my head. Those are important. My Slashdot, Facebook, and junk email account passwords are stored in Firefox, because I got tired of typing them in every time and frankly I don't really care if they get stolen.

Re:saved passwords

[DigitAl56K]

Yes, but that is a bad workaround, because now any kind of exploit enabling code execution can still gets access to the entire password list, thus defeating the purpose of the master password. After all, if it weren't for remote exploits, machines with only a single local user wouldn't need a master password.

Re:saved passwords

[DigitAl56K]

I don't know about you, but I have registrations at dozens of sites, which means I can either:

* Use the same secure password at many and remember it, placing my trust in the security of others who I've never met
* Use many easy to remember and thus weak passwords
* Store my passwords somewhere. The browser makes sense, since it can conveniently enter them, and assuming it had a good master password implementation it should be secure.

However, per my previous post, Firefox's master password implementation is seriously irritating, to the point that I don't enable it except when serious exploits are announced and remain unpatched.

Re:saved passwords

[DigitAl56K]

THANK YOU JESUS! .. well, based on your account name, it could be you! I mean, you could be he. Or.. whatever. Thanks! ;)

Why don't they make Firefox work this way in the first place? Seriously...

Re:saved passwords

[DigitAl56K]

Very interesting. That does not solve the issue with Firefox's master password prompting, but it is a very interesting idea for creating passwords, assuming that it uses a strong hash algorithm.

Re:saved passwords

[niklash]

Try the Secure Login Add-on, it just might be what you are looking for.

https://addons.mozilla.org/en-US/firefox/addon/4429

Re:saved passwords

[PReDiToR]

Or you could use the incredibly good PasswordHasher extension.

Re:saved passwords

[Anonymous Coward]

Use a combination. What's wrong with "234jlsjs@@/." for /., "234jlsjs@@F" for Fark, and "234jlsjs@@D" for Digg? You can use something totally different for "Important" sites, such as your bank or whatever, but this sort of system can take care of your casual login needs.
That's just different enough that they won't hash the same way, and still easy to remember. Obviously it's not "as secure" as using a randomly-generated string of (a-z,A-Z,0-9, and punctuation) but it's good enough for everyday use and sure beats the hell out of having it lying around somewhere.

Re:saved passwords

[tacolicker]

Set a 'Master Password' for the passwords in Firefox and then use the 'Master Password Timeout' extension. I keep all of my passwords in a PwManager database, but storing website passwords in Firefox is convenient since it's used daily (I only reference the PwManager database for rarely used ones).

Re:saved passwords

[WindShadow]

It depends on how valuable they are... I don't store my financial access passwords there, but if somneone stole my password to use a newspaper archive, I think I could survive. In many cases sites have user/pass requirements but knowing the password would get you nothing you don't have by creating a free account of your own.

For information with no value I have no problem using the password storage, although I don't use IE or Firefox (or Windows) so I'm safe from the pros who target the mass market. ;-)
I certainly don't want to have to type in the password for my mail client every ten minutes when it checks mail, updates my RSS feeds, etc. I don't even want to type it once a day, so it's a trade-off between productivity and security. It's possible to be so secure that you get nothing done, or to be so obsessed with going through the motions that you waste the time without getting the security benefit.

Exactly! That's why I use Internet Exploder

[Anonymous Coward]

I use "Internet Explorer version 7.0" from a company called "Microsoft Corporation". I would recommend trying it out.
It seems to render most web pages accurately and is moderately fast. Yes, I know, it IS slower and uses WAY more memory than the two other dominant browsers (Firefox and Opera), but the company does seem to have a lot of programmers working for it, has been in business for a while, and seems to have some staying power. The company's CEO, a man by the name of "Bill Gates" seems to have his wits about him and seems to have invented a good thing here. I urge people to try it out. The only thing is, that the browser only seems to be available for a small number of available Operating Systems.... namely "Microsoft Windows" and also a small number of "Macintosh OS Ten"... and doesn't seem to be available for the mainline Linux OS, but perhaps they are working on it.

TDz.

Re:Time to see if Konqueror fixed the damn flash b

[solafide]

Where do you have to go that needs flash? I specifically use 64-bit Epiphany without flash so I don't have that load for the minor benefits. It's cheifly used for advertising, as far as I have observed, and video. For video, it's not that hard to fire up 32-bit firefox with flash when I do want to watch them. Why do you need flash so?

Re:Time to see if Konqueror fixed the damn flash b

[Kjella]

Well, bug and bug. Short story for those that don't know: Macromedia released a new version (r115) that relied on some functionality currently only in Firefox, but not in typical versions of Konqueror or release versions of Opera. This broke all the distros, including all old supported distros because Macromedia doesn't let repositories host old versions. Last I checked the possible solution was a big backport. Development versions of Konqueror (for hardy heron in my case) and Opera 9.5 supports it, but this is quite simply forced obsolesence on Macromedia's part.

Firefox 3b2

[Anonymous Coward]

Is Firefox 3 Beta 2 also vulnerable to this exploit?

What all.js contains

[nonpareility]

The file they're reading from in TFA (all.js) contains a portion of the default Firefox preferences, not your current settings. There may be other ways to exploit this problem, and web pages definitely shouldn't be allowed to read any file from your computer, but the proof of concept isn't as bad as they say it is. The majority of your personal information is in your profile directory (under Application Data on Windows), not the program directory.

Corporate sites

[Overzeetop]

There are quite a few corporate sites which incorporate flash to "enhance" their site, and there are some sites which won't even let you in unless you pass the flash-only home page. If you don't have flash, they don't want your business. (At least, that seem to be the opinion of the web IT staff, I haven't contacted corporate to see if they agree with that assessment). As for examples, Bath & Body Works used to be that way (I emailed them, they are no longer flash-limited...I don't believe those two things are linked, though). Rainforest Cafe is another. BBW didn't get my business back then, and Rainforest missed out on a dinner guest recently - I couldn't find their location, and couldn't use my mobile browser to get to their page. Will they care that they probably lost less than $100, of course not. But it certainly would have been nice if they wouldn't have had a "no flash, no service" sign out front.

Re:Corporate sites

[EtoilePB]

But it certainly would have been nice if they wouldn't have had a "no flash, no service" sign out front.

Yup. We all have Flash disabled and can't install it at work, because the overlord office in Europe doesn't understand that it's not just for YouTube. We're starting to have serious trouble using travel booking sites, hotel booking sites, and restaurant booking sites (all of which are legitimate and frequent uses of our PCs for our business) because of this. A HUGE percentage of them don't have a single no-flash page left. Many of them don't even generate a "you need Flash to view this site" message; they just come up blank. Or the page frame (borders, margin -- whatever) will come up but you can't get to any content.

It's driving me nuts. Part of the reason I spend so much time on Slashdot is because around here, there's still Actual Text that I can just plain damn read.

Re:Corporate sites

[GentlemanRogue]

If you don't have flash, they don't want your business. (At least, that seem to be the opinion of the web Marketing staff, I haven't contacted IT to see if they agree with that assessment).

There, fixed that for ya...

huh?

[jelle]

Doesn't look like a vulerability to me. So it can read files in /usr/lib/firefox, but those are just the standard files from the firefox package. User configuration and stored passwords etc are not stored there... It still can't get to $HOME/.mozilla...

Re:huh?

[Shippy]

It's still a vulnerability. It's allowing something that shouldn't be allowed. Does that mean people will take advantage of it and exploit it a lot? Not necessarily, but it's still a vulnerability.

Re:huh?

[jrumney]

It depends. Is the vulnerability in the view-source: method, or have the developers just not bothered to protect resource:/// since, as you say, it is all standard stuff that people can get by downloading firefox themselves? The way the exploit code has been posted, it is difficult to tell, because you need a javascript file that consists of lots of calls to a single function so you can override that function to print out the parameters instead.

Re:huh?

[Riddler Sensei]

Well it concerns ME greatly since that's where I hide all of my super free internet porn. Can you imagine the embarrassment if my mother actually used this exploit and found my copy of Asian Anal Sluts 7? Developers, fix this bug NOW!

Re:huh?

[psydeshow]

It's not a vulnerability, it's a feature of the browser.

View source. As in, view the source code of this open source project. There's nothing in that directory that isn't in the files you download from Mozilla.

How is this a serious security problem?

[Anonymous Coward]

I'm confused, how is this a serious security problem? All it allows is reading files from the Firefox application directory, which isn't exactly sensitive data, since you can get the exact same files from just downloading Firefox from Mozilla's website. Your prefs, passwords, etc. are stored in your Firefox profile, which lives outside the Firefox application directory, so they *are not* accessible via this trick.

Pretty bad timing ...

[Sepiraph]

I literally just switched to Firefox yesterday from Opera, but even with this bad news, I'm going to stick with Firefox. Extensions are just too good a feature in a browser.

Re:Pretty bad timing ...

[ShnowDoggie]

No Scripts! Try it. From what I am reading, this add on will protect you.

is this yet ANOTHER

[Anonymous Coward]

WINDOWS program vulnerability? Sure looks like it. Why isn't this made clear in the headline or summary then? How about the microsoft/mozilla stealth alliance make TWO names for the two different programs, or would that be giving away the crown jewel secret that's been hiding in plain sight even larger and more blatantly than the old SCO Microsoft stalking horse? How many times do we have to see a windows vulnerability ascribed to the entire mozilla package called "firefox" on an alarmist headline? Is it really so hard to rename the linux version to something else? Oh it is? "Too confusing" even though they really are two different programs? OK, then maybe could the article submitter or editor append the word windows or Microsoft to the headline to differentiate it? Call it by its real name, which is the Microsoft Windows Mozilla Firefox Browser version whatever, then go on to outline the new vulnerability.

Re:Time to see if Konqueror fixed the damn flash b

[KTheorem]

You can install KMplayer to get around it. It takes a few more steps than normal, but it works (and from my subjective experience is much faster running than the normal nspluginviewer way). Here are instructions for doing it: http://mikearthur.co.uk/?p=171

Scare mongering

[Anonymous Coward]

gre is constant data. This report is FUD.

Firefox is open source; anyone who wants to view view-source:resource:///greprefs/all.js can just as easily load http://mxr.mozilla.org/mozilla1.8/source/modules/libpref/src/init/all.js?raw=1 it has the same content.

all.js is *not* user data, it's *public* app data. Your preferences are stored in prefs.js which are not exposed by greprefs.

Re:Scare mongering

[CNeb96]

>all.js is *not* user data, it's *public* app data. Your preferences are stored in prefs.js which are not exposed by greprefs.

A firefox developer agrees with the above poster (or possibly since its anonymous could BE the above poster difficult to tell ;-).
http://shaver.off.net/diary/2008/02/10/view-sourceresource-vulnerability-does-not-expose-personal-information/

http://en.wikipedia.org/wiki/Mike_Shaver

Your 'Ron Paul Facts'

[Anonymous Coward]

Each and every one of those makes me think even more highly of them. While the page you link to tries to cast them in an evil light, most are States Rights issues. He just wants the Feds to stay out of it.

Re:Your 'Ron Paul Facts'

[Anonymous Coward]

dude, you just blew my mind.
Maybe Ron Paul is the one to help wipe out browser vulnerabilities!

Update the title... NOW.

[Anonymous Coward]

Seriously, this title should be changed now (get rid of "Serious"), and a "!serious" tag added. The author of the article is an asshole who just waited for this release to fear monger and gain some attention. This bug exists in previous versions, this is not a new issue. The fact is, 2.0.0.12 fixes issues from previous issues, and does NOT introduce this "new" bug.

You should still upgrade. You are already vulnerable to this "attack" without it, but you can at least gain some new fixes for other issues.

You know, we're trying to promote open source software. To scream that firefox has a "serious vulnerability" when it in fact doesn't is IT treason.

Re:Update the title... NOW.

[Anonymous Coward]

Oh blow it out your ass. The Linux/Open Source zealots here do the same exageration-of-the-truth grandstanding when security issues with Microsoft or Apple arise. Learn to take what you dish.

Re:Update the title... NOW.

[Anonymous Coward]

Carl, just suck it. You're a hack no better the n3td3v. In fact, you're lam3r than that shit.

Doesn't matter what browser you run

[LingNoi]

Doesn't matter what browser you run, if you let anyone execute whatever code they want on your own machine via your browser it's the equivalent of running that trojan.exe you just downloaded from Messenger.

Is there a NoScript for IE 7 and Opera?

Re:Doesn't matter what browser you run

[Petrushka]

Is there a NoScript for IE 7 and Opera?

For IE7, I have no idea. I doubt it. In Opera, it's built in.

(... BUT in Opera, enabling scripts for a specific site requires navigating through various sub-menus and five to eight mouse-clicks. And if the site uses cross-site scripting, as do most video sites for example, it could take anywhere up to a couple of minutes to investigate which sites you need to enable scripting for.)

Re:Doesn't matter what browser you run

[Anonymous Coward]

Opera comes with a Disable JavaScript option. In addition, you can limit the browser to restricted JavaScript functionality.

Re:Doesn't matter what browser you run

[whitehatlurker]

For Opera, you can disable scripting (and Java and plugins) globally (F12) and turn them back on for specific sites (with right-click "Edit Site Preferences"). Many of the things that add-ons are used for in Firefox have similar functionality out-of-the-box with Opera.

How come?

[dreamchaser]

How come when there's a security hole in an MS product it gets the 'haha' tag, but if it's an OSS project it doesn't?

Re:How come?

[Anonymous Coward]

Since it's so much less often, I guess it took the taggers by surprise.

But mostly, it's just to piss you off.

Re:How come?

[dreamchaser]

Oh it doesn't piss me off. I was just making a point that you helped me make :)

I use Firefox btw.

Re:How come?

[HazE_nMe]

With a UIN as low as yours I will go ahead and assume that you are not new here.
Perhaps in your old age you forgot what site you were on?

Re:How come?

[LBArrettAnderson]

It's there now. As soon as I saw this article I tagged it as haha, but I'm pretty sure that my tags are meaningless now. Back in the day my tags would show up even if I knew that no one else was tagging it the same, but I think Taco or someone disabled me on the back end since I am pro-microsoft.

Re:How come?

[Anonymous Coward]

Because OSS projects in general hasn't spent years boasting about how much much faster and reliable and more secure their latest and greatest products are? I assume you don't remember the "the fastest and most stable system yet" marketing Microsoft were using for... windows 95? OSS generally doesn't promise you heaven on earth, but it does tend to remove the smelly stuff when it hits the fan letting you sit there with shit in your face until they decide to care.

Re:How come?

[shird]

Because one is by MS and the other by OSS. Slashdot users prefer OSS over MS so they laugh when there is a hole in a MS product, but are embarrassed by a hole in an OSS project.

Re:How come?

[Anonymous Coward]

Because we hate Microsoft.

Re:How come?

[Anonymous Coward]

Whose side are you on?

Re:How come?

[db32]

I see the haha tag. Are you just upset that it didn't get the haha tag fast enough? Anyways, I don't think any vulnerability itself deserves 'haha' so much as the company that waves its hands and says "there is no bug here" or creates very bizarre ways of bug counting to get the numbers tell there story. On any given security issue if IE and Mozilla both had an identical issue and they were both identified at the same time, how long do you think it would take before Mozilla patched compared to IE?

Re:How come?

[jamesh]

If we could tag posts, yours would be tagged 'youmustbenewhere'.

Re:How come?

[Anonymous Coward]

do'h. Epic fail in editing. "fan rather than letting"

Re:How come?

[Joe Jay Bee]

OSS projects in general hasn't spent years boasting about how much much faster and reliable and more secure their latest and greatest products are?

No, but Slashdot and a significant percentage of the OSS community has.

list of files that can be read (win32)

[Anonymous Coward]

lol, serious stuff 300: file:///C:/Program%20Files/Mozilla%20Firefox/ 200: filename content-length last-modified file-type 201: .autoreg 0 Mon,%2005%20Nov%202007%2016:16:28%20GMT FILE 201: AccessibleMarshal.dll 13952 Fri,%2008%20Feb%202008%2019:42:30%20GMT FILE 201: LICENSE 30869 Thu,%2026%20Jul%202007%2002:39:20%20GMT FILE 201: README.txt 177 Thu,%2026%20Jul%202007%2002:39:20%20GMT FILE 201: browserconfig.properties 232 Thu,%2026%20Jul%202007%2002:39:26%20GMT FILE 201: chrome 0 Fri,%2008%20Feb%202008%2019:42:39%20GMT DIRECTORY 201: components 0 Fri,%2008%20Feb%202008%2019:42:39%20GMT DIRECTORY 201: defaults 0 Fri,%2028%20Sep%202007%2022:59:30%20GMT DIRECTORY 201: dictionaries 0 Fri,%2028%20Sep%202007%2022:59:30%20GMT DIRECTORY 201: extensions 0 Fri,%2021%20Dec%202007%2011:21:24%20GMT DIRECTORY 201: firefox.exe 7655024 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: freebl3.chk 476 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: freebl3.dll 200829 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: greprefs 0 Fri,%2008%20Feb%202008%2019:42:40%20GMT DIRECTORY 201: install.log 28197 Fri,%2021%20Dec%202007%2011:20:32%20GMT FILE 201: js3250.dll 456808 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: nspr4.dll 161392 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: nss3.dll 378472 Fri,%2008%20Feb%202008%2019:42:36%20GMT FILE 201: nssckbi.dll 271984 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: old-homepage-default.properties 112 Thu,%2026%20Jul%202007%2002:39:26%20GMT FILE 201: plc4.dll 34424 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: plds4.dll 30320 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: plugins 0 Fri,%2008%20Feb%202008%2019:42:42%20GMT DIRECTORY 201: res 0 Fri,%2028%20Sep%202007%2022:59:27%20GMT DIRECTORY 201: searchplugins 0 Fri,%2028%20Sep%202007%2022:59:30%20GMT DIRECTORY 201: smime3.dll 112232 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: softokn3.chk 476 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: softokn3.dll 254060 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: ssl3.dll 132712 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: uninstall 0 Fri,%2008%20Feb%202008%2019:42:48%20GMT DIRECTORY 201: updater.exe 132232 Fri,%2008%20Feb%202008%2019:42:38%20GMT FILE 201: updater.ini 709 Fri,%2019%20Oct%202007%2013:36:24%20GMT FILE 201: xpcom.dll 13416 Fri,%2008%20Feb%202008%2019:42:39%20GMT FILE 201: xpcom_compat.dll 73848 Fri,%2008%20Feb%202008%2019:42:38%20GMT FILE 201: xpcom_core.dll 422000 Fri,%2008%20Feb%202008%2019:42:39%20GMT FILE 201: xpicleanup.exe 73336 Fri,%2008%20Feb%202008%2019:42:39%20GMT FILE 201: xpistub.dll 12400 Fri,%2008%20Feb%202008%2019:42:39%20GMT FILE

or not

Re:Time to see if Konqueror fixed the damn flash b

[gambolt]

Unfortunately, too many sites use it for navigation and crap like that. The wire image viewers for most major newspapers use it. Embedded media in various blogs, etc.

Memory Usage / No Script

[milsoRgen]

It uses a lot of memory at times for me personally, but well within reason. 200mb max (4-6+ hour session) with 2gigs RAM. Not wholly unreasonable. I seem to recall, tho certainly can't say definitively, never seeing it top 80mb on another box I have with 512mb.

I've been using Noscript for a while now, and personally it hasn't really effected my peak memory usage for better or worse. I also have constant access to CPU/Memory usage percentages through my G-15 keyboard's display, so I tend keep an eye on that more than most people.

Re:Memory Usage / No Script

[Mr Z]

On my box it's currently taking around 450MB. I usually kill it when it gets to around 700MB. Maybe it's because I use GMail and Yahoo! Mail open all the time?

Re:Memory Usage / No Script

[Decado]

Right now my firefox is using 171MB of memory. The page on which I am editing this post is the only page open and this is the only browser instance running. It is, in short, an utter joke how much memory firefox hogs.

Re:Memory Usage / No Script

[Symbolis]

On my box it's currently taking around 450MB. I usually kill it when it gets to around 700MB. Maybe it's because I use GMail and Yahoo! Mail open all the time?

Madness.

Mine's sitting at 68MB as I type this.

No tweaking of any sort. Just now hit 70MB

Run NoScript, too.

Re:Memory Usage / No Script

[Mr Z]

Well, I do have over 30 tabs open across 5 windows, and I leave it open 24/7.

Re:Memory Usage / No Script

[Starayo]

I remember, back in the 1.5 days, I had memory leaks. I'd have firefox using 400mb+ of memory. Come 2.0 though, the problem was fixed for me, and I haven't seen it rise over 100mb on my two computers since.

Re:Memory Usage / No Script

[Mr Z]

How many windows / tabs do you tend to have open, and how often do you restart the browser? Also, what OS?

Here's the output of ps on my 64-bit Ubuntu 7.04 box, running Ubuntu's Firefox package:

im14u2c 2527 6.1 11.2 987640 454116 ? Sl Feb07 176:30 /usr/lib/firefox/firefox-bin

The first number suggests Firefox is taking nearly 1GB, but 512MB of that is just the X mapping my video card, I think. The second number shows it clearly taking around 450M.

--Joe

Re:Memory Usage / No Script

[Starayo]

I ran it on windows XP, and ubuntu when I was still using it (went back to windows because I started gaming again). I had no leaks on either OS.

I usually have at least four tabs open, often ten or more.

I tend to leave my browser open for days or weeks at a time, only closing it when I have to rarely restart my computer. :\

Re:Memory Usage / No Script

[Anonymous Coward]

That's not X mapping your video card. The Firefox process is independent of the X server process.

The first number is the virtual memory usage. The second number is the resident usage. What that means is that Firefox is in fact using nearly 1 GB of memory. However, about 500 MB of that has been paged out (ie. not stored in physical RAM, but on disk).

That's a clear sign of a pretty serious memory leak. The fact that so much of that data is paged out shows that it's not being used frequently. More specifically, Firefox has lost track of the fact that it had allocated that memory at one point. Thus it's no longer used, but since it hasn't been returned to the OS, it's still taking up swap space, even if it luckily isn't wasting physical RAM.

Re:Memory Usage / No Script

[Mr Z]

Well, ordinarily I'd agree with you, but a freshly started Firefox with no open pages already has all that mapped memory that's not part of the RSS. That seems odd. Maybe it's all the libraries it has mapped. Indeed, looking at /proc/<pid>/maps, only about 530MB of the over 1GB it currently has mapped is writable. The rest of the pages are mapped read-only or no-access.

In fact, there's a whopping 396,472,320 of pages with entries like this in /proc/<pid>/maps for Firefox. Entries that look like this:

2aaab0c62000-2aaab0c98000 r-xp 00000000 03:02 5458533 /usr/lib/libnspr4.so.0d
2aaab0c98000-2aaab0e97000 ---p 00036000 03:02 5458533 /usr/lib/libnspr4.so.0d
2aaab0e97000-2aaab0e9a000 rw-p 00035000 03:02 5458533 /usr/lib/libnspr4.so.0d

Aha... That appears to be some largish dead-zone between the read-execute code area and the read-write data area. That's the missing 400M. (Well, the sum of all those no-access maps.) And here I thought it was a shared memory segment w/ X. Thanks for forcing me to take a deeper look. I learn something new every day.

--Joe

Re:Memory Usage / No Script

[argiedot]

I don't disagree that Firefox takes lots of memory sometimes. However, if you had lots of tabs open and then you closed them so that this is the only page, then perhaps it's storing those tabs to restore them in case you do Undo Close Tab or whatever.

Re:Memory Usage / No Script

[Decado]

Ok, assume 10 pages cached, about 1 megabyte of data each (in fact they are a lot smaller than that). What is it doing with the other 130 megs?

Re:Memory Usage / No Script

[bunratty]

The Mozilla developers somehow estimated that each cached page takes about 4 MB. That's because it's caching the DOM and uncompressed images, not the files themselves which are cached in the disk cache. There's also many other caches, code, loaded plugins, fragmentation, and almost certainly some memory leaks, too. The only way to tell if Firefox is using more memory than it "should" is to compare memory use with another browser, performing exactly the same steps in each browser from the moment you start it. Nearly every time I try that, Firefox uses less memory than other browsers.

Re:Memory Usage / No Script

[HTH NE1]

I also tend to have as many as 20 tabs open, but usually only one window. I find I have to kill -9 firefox daily when it suddenly decides to eat up 100% of processor time. I've had it take three or more seconds to render an additional line of text on a site when scrolling when I didn't kill it at the first sign of trouble.

Thanks

[FrozenGeek]

Thanks to the OP. Just (less than 5 minutes) before I read the article, I'd upgraded to the latest version of Firefox. NoScript is now installed.

Possibly another bug?

[cbiltcliffe]

Something else weird that happened to me when I upgraded:

I've got Firefox as my default browser on XP, and after the upgrade to 2.0.0.12, all of a sudden IE showed up as my browser at the top of my Start menu. When I went into the control panel to "set program access and defaults", Firefox doesn't even show up as an option. WTF?
It's still installed, as it's in the programs folder, and it runs fine....also doesn't as me if I need to set it as default, so it still is, but Windows has completely lost the fact that it's a browser.

Anybody else have this happen?

Re:Possibly another bug?

[milsoRgen]

I don't quite grasp what happened to you specifically, but in order to get Firefox back to the top of your start menu...

Right click on your task bar, select properties > Click on the Start Menu tab > Click Customize > On the General Tab, select Mozilla Firefox from the drop down menu in the 'Show On Start Menu' section.

Re:Possibly another bug?

[cbiltcliffe]

What happened to me was that Firefox was the default browser, but IE was showing at the top of my start menu in the "Default Browser" location. Firefox didn't show up in the Program Defaults thing in the control panel, so I couldn't change it back. It also didn't show up in the spot you suggested. I had already checked there.
As far as Windows was concerned, IE was the only browser on the computer, but http:/// URLs were to be opened by firefox.exe, which isn't a browser, just-so-we're-clear-on-that-point-thankyou.
Bizarre.

Anyway, I fixed it by setting IE to be default browser, then starting Firefox, at which point it asked me "Do you want me to be default browser?"
Clicked yes, and it's back in my start menu.

Normally, I'd blame Windows for this type of thing, as they're typically SWBs (Stupid Windows Bugs). But this happened at the exact same time I upgraded to 2.0.0.12, so I figure it's got to be related, somehow. Of course, it could be something to do with the odd combination of extensions I've got installed.....

You new here?

[ZxCv]

Are you seriously asking this question?

Are you at all surprised that, here on /., security vulnerabilities in MS products are always much more severe and worthy of ridicule than those in open source products?

Phew

[insanechemist]

As an web developer I thought this meant MY web server directory - maybe it does? Sounds more like the directories on the client. I guess in any case its windows based - but perhaps autoupdate should be turned off on all OSes.

Hogwash

[Anonymous Coward]

No vulnerabilities have been shown.

The "PoC" lists only the user's DEFAULTs. Every Firefox installation has the same fucking defaults, and they are no secret.

There is no directory traversal vulnerability either; you can only load the DEFAULT INSTALLED FILES, which are the same for all fucking users, and are obviously no secret.

Firefox is too large to be secure

[Morgaine]

This isn't a problem just with Firefox, but with all full browsers today (the various midget text-mode ones excluded).

Any non-trivial program contains bugs and vulnerabilities proportional to its size, and the relationship between size and inherent problem-count is probably a lot worse than linear. This is true for all programs and all systems, but it is especially true for monolithic ones, and to a very large extent the main body of modern browsers is quite monolithic. Even the plugins load into the same address space in most cases, although there are exceptions to this in the browser world.

The present situation is not good, and everyone is familiar with the consequences of it: the web browser is by far the most crash-prone of all applications present in our operating systems today.

Is there a solution to this on the horizon? Not at present, because developers in all the most popular programming languages almost always implement monolithic systems (because the languages encourage it and the courses teach it), and are highly adverse to extreme modularization. Again, there are exceptions, but they are rare.

We are living in a bit of a Dark Age in this area currently, and I don't forsee any change within the next five years at least.

Re:Firefox is too large to be secure

[ultima]

This isn't a problem with monolithic-vs-modular software -- Firefox is fairly modular as far as software goes. These problems are design logic problems -- the problem is not the implementation (as is the case with a buffer overrun) but with the logic behind the implementation.

One could argue that modular software is a bad thing because of the unintended or poorly-understood side-effects of modules. For example, take sudo -- there are many commands that can spawn subprocesses that allow a user to use sudo to obtain root access. While sudo itself seems like a nice modular way to allow grant specific, restricted superuser powers to normal users, the complexity of the submodules (any command the user is allowed to run) means it can be intractable to ensure that a user couldn't turn restricted superuser powers into full superuser access.

Rigorous mathematical models can be used to ensure these kinds of problems go away -- but you have to impose severe restrictions on the tools used to develop software to use these models. But these kinds of tools are used in certain industries, like aerospace, where the need for robustness so far outweighs the costs (so far I have not heard of anyone getting killed as the direct result of a firefox crash).

Still, there are ways -- for example if you run Firefox in a virtual machine where the virtual machine has no access to privileged information, then neither does Firefox. The logical integration of that level of security at the application level is the capabilities-based security, and you can prove that applications have no access to privileged information, or that they have access to a minimal, well-defined set of privileged information. Mainframe-style systems, SELinux and Java all can work like this.

Re:Firefox is too large to be secure

[Anonymous Coward]

Firefox is not modular at all. It's a terrible mishmash of C++, JavaScript, and XML. XPCOM is a mess to work with, and the prime cause of many of the security issues and other bugs that Firefox has faced. At least some of the Mozilla developers realize this, and that's why they're moving away from it for Firefox 3.

Re:Firefox is too large to be secure

[Anonymous Coward]

Firefox isn't modular at all. OK, someone else already pointed that out. What they neglected to mention was that all those extensions and themes and everything just dump all their crap into who gigantic global namespace.

At its core, Firefox is a JavaScript application. Yes, really. XUL, which creates all the UI in Firefox, works like a sort of specialized HTML for GUIs. If you've worked with CSS, HTML, and JavaScript, you'll be able to pick up XUL really fast. (This is an oversimplification, but it gets the idea across. OK, pedants?)

In any case, each Firefox window acts just like a webpage - it contains a "window" object, a single DOM, and a single JavaScript namespace. Extensions add to the default XUL documents using a special XML patch language that Mozilla calls an "overlay" - but it's really a patch. Each extension alters the XML DOM and adds its functions straight into the single JavaScript namespace.

The end result? Firefox is a giant ball of mud. What can be called modules wind up being dumped into a giant blob. The parts that are written in pure JavaScript have no data hiding since JavaScript doesn't support that. (The exception being XPCOM objects written in JavaScript, with the exception to the exception being that there's some magic that can be done to get past that restriction.)

After having played around with writing Firefox extensions, it always amazes me that the browser works at all. Its internals are amazingly fragile.

Re:Firefox is too large to be secure

[bunratty]

At the core, literally, Firefox is C++. You're describing the user interface, which is written in XUL. In that way, Firefox is modular, not monolithic, as the XUL interface and C++ core are obviously two different parts. Other Mozilla browsers, such as SeaMonkey, can change the user interface while using the same core. You can think of XUL almost as the browser skin.

Re:Firefox is too large to be secure

[Anonymous Coward]

At the core, literally, Firefox is C++. In much the same way that, at the core, Java programs literally run using native code? It's technically true, but entirely irrelevant.

In that way, Firefox is modular, not monolithic, as the XUL interface and C++ core are obviously two different parts. That doesn't follow. Linux doesn't suddenly become a microkernel just because it supports dynamic module loading, and Firefox doesn't magically become modular just because the core is written in C++.

Other Mozilla browsers, such as SeaMonkey, can change the user interface while using the same core. Right - making Firefox a JavaScript application built on top of the Mozilla core. Just like SeaMonkey is a JavaScript application built on top of the Mozilla core and Thunderbird is a JavaScript application built on top of the Mozilla core.

The parts that make Firefox what it is are all written in JavaScript, and this JavaScript forms a giant blob of code that all interacts in a single namespace. Just because it's object oriented doesn't make it modular.

Re:Firefox is too large to be secure

[bunratty]

In much the same way that, at the core, Java programs literally run using native code? It's technically true, but entirely irrelevant.

No it's not the same at all. 95% of Firefox source code is the core, written in C++. The only part that is JavaScript is the user interface, which is a tiny fraction of the total source code. What you say is true for XUL, but irrelevant to most of Firefox's source code. Yes, what makes Firefox different from SeaMonkey and Thunderbird is mostly XUL, but it's very little of the total source code for Firefox.

This bug is less important than it seems

[enodo]

If you take a look at what this is doing, there's much less to it than meets the eye.

The way the page works is that it is able to load the file all.js in the greprefs directory inside your firefox installation. However, it is not *reading* this file and making it available to the javascript interpreter, it is *executing* the file. The file is a big list of browser preferences, each set with a call to a function with the signature pref(name, value). There is no code in there other than calls to pref. What the page does is define its own pref(name, value) which gets called, and the names and values are therefore available to the javascript interpreter.

So:

1. It has to know exactly what is in the file, and it has to be able to overwrite a function or functions so that some sort of privileged data becomes available to it. It has to be able to do this without the page throwing errors or halting execution. (That was easy with all.js, because the only thing in there was calls to pref. In other files I doubt it would be so easy.)
2. As demonstrated, it can only read data that's inside the directory of the default install, not your home directory or anywhere else. As others have pointed out, it's not clear that there's ever anything really privileged in there for it to get. (The settings gotten in the exploit demonstrated are not very interesting.)

I would additionally point out that the view-source: part of the URI appears to be unnecessary, since at least for me (Ubuntu FF 2.0.0.12) the "exploit" worked just fine without it.

Re:Exactly! That's why I use Internet Exploder

[milsoRgen]

hahahahahahahahahahahaha /wipes tear

DIRECTORY TRAVERSAL?

[dominious]

Indeed,
From TFA: "We can trick Firefox itself in traversing directories back".
but then it says:
"we are able to read out all preferences set in Firefox, or just open or include about every file stored in the Mozilla program files directory"

Since TFA is not clear, I have tried it myself and I WAS NOT ABLE TO TRAVERSE a directory back with resource:///../
So the only files someone can read with this vuln are the files inside firefox directory which from what I can see are just default files and no cookies or passwords.

If anyone thinks any different please let me know.

Noscript runs scripts

[Anonymous Coward]

If scripts are so unsafe then why does Noscript run scripts too? On top of that Noscript puts itself on a whitelist by default, but it leaves off sites like youtube. That kind of behavior by a plug-in makes no sense unless it can't be trusted.

just another reason to uninstall firefox

[Anonymous Coward]

oh well. it sucked anyway. fucking open source fails where it claims it's strongest. liars and faggots.

Whyyy !!!! ?

[beyaz45]

Why isn't NoScript just a mandatory extension at this point? It seems like it would be pretty unobtrusive with default settings at a slightly reduced paranoia level. -- "On Vulcan, the teddy bears are alive and have six-inch fangs." Regards dizi izle

Because.

[furbearntrout]

Internet Explorer has a much larger market share than Firefox; thus, an exploit in that browser would affect more people.

With great power comes great responsibility...

tired of these vulnerabilities which is why...

[Anonymous Coward]

I run my Firefoxes (yup, with "es" ;) in special user accounts, made especially for surfing. My main Firefox (the one I use the most) is run as a user that does nothing else than browsing. Sure, it's a little cumbersome when I d/l files that I need to move to my real account, but I'm running Firefox like that since years and I can't stop LMAO'ing when I read about another yet Firefox vulnerability. Then I've got another special user account, only for another Firefox, to do my GMail/PC Banking. These two Firefox instances are always on, each on a virtual desktop.

Some even go the 'virtual-machine-only-for-browsing' way and I may do that soon (probably using KVM). I know, I know, "virtual machines" perfs sucks (so you think).

So, yup, a nasty person using a Firefox vulnerability could read every single file in Firefox's directory (and subdir), that's what the exploit referred to in TFB (the f*cking blog?) talks about or it could read every single file belonging to the user running the browser: no big deal, that's exactly my point.

Re:tired of these vulnerabilities which is why...

[myspace-cn]

Some people would call me a a nasty person using a Firefox.
That's a really fucking good idea.
Keep em seperated -- until a batch file slams into a junction. whoopeee....

I miss my panzer'd netscape 3.
Now we hex edit everything. Hide everything, change the name on everything. redirect everything. block everything. search everything. Recode everything. Protect process's on everything. It's a wonder you can even edit video anymore with all the shit running to protect your box!

Re:tired of these vulnerabilities which is why...

[Anonymous Coward]

So YOU must be the reason for recent stock jumps in the Aluminum Foil market. How are those deflector beanies coming?

Re:Exactly! That's why I use Internet Exploder

[uvajed_ekil]

I think you mean "Steve Ballmer," as no one named Gates is CEO of Microsoft. Nice try though, and better luck next time!

Stop Hatin On JS

[Anonymous Coward]

Nobody is going to live in a world where javascript isn't enabled in the browser except weirdo slashdot users. Get over it. We live in a world where JS exists. Just get used to it. AND design/patch browsers that aren't vulnerable to attacks using JS.

/rant

Re:Time to see if Konqueror fixed the damn flash b

[mad.frog]

Macromedia released a new version (r115)

Actually, Adobe released a new version. Macromedia hasn't existed for a few years now...

Comment removed

[account_deleted]

Comment removed based on user account deletion

As a MS executive who has nothing better to do...

[Anonymous Coward]

... I'd like to say that that is a fantastic idea, and I'll ensure that we acquire Mozilla ASAP.

Enjoy being beaten up by your fellow /.ers.

Whew!

[loopiv]

Thank god I use Internet Explorer.

Re:Whew!

[marzipanic]

Thank god I use Internet Explorer.

LOL. Is ANY browser 100% safe? I think not, unless you disconnect from the Internet your at risk. Firefox is like swiss cheese with security holes, IE is more like a chasm, not being rude but I look at the charts on Secuina. I just use the Proxomitron with every browser.. don't panic!

Re:As a MS executive who has nothing better to do.

[Eighty7]

highest marketshare browser buys 2nd highest marketshare browser. Yeah the feds are gonna like that.

I've had enough -- I'm going back to Mosaic!!!!!

[Anonymous Coward]

No vulnerabilities, no security issues. Just plain and simple. I'm going back to using Mosaic! http://browsers.evolt.org/?mosaic-ncsa/

This bug is NOT CRITICAL

[Anonymous Coward]

It does not allow directory browse, it allows directory browse in
C:\Program Files\Mozilla Firefox\...

There is almost no data in there other than default settings.

Your private settings and cookies are in the user directory
C:\Documents And Settings\...

Amazing coincidence

[GlobalEcho]

The browser can present to me a list of script functions and fragments, each with a "allow", "deny", or "remap" option. What an amazing coincidence! My grandmother, my boss and my brother's girlfriend were all wishing out loud for that very feature just yesterday! We'll all be secure in no time!

Re:Amazing coincidence

[th3rtythr33]

Of course, because they weren't already having trouble figuring out what to do when IE7 announced there was a security certificate error!

Re:Amazing coincidence

[corifornia2]

My grandmother uses Lynx, and she said "ur teh ghey n3wb".

Hahaha

[FrameRotBlues]

As if the Feds actually know what a browser is. I can just hear Ted Stevens now: "So, is it like a little window where you can look in the tube? Can I see the internet I sent to Bob Dole yesterday in the window?"

Re: "Blabbing" is a GOOD THING(tm)

[bussdriver]

The threat of exploitation (with consequences) is what MOTIVATES developers to fix it. Security by obscurity is not just common due to ignorance its also cheap and easy. Lack of threat, causes exploits to go unfixed until it is convenient (months, major releases, never...)

Open source by its nature will make exploits more public; Telling an open source development team tends to be a public process or at least open enough that a hacker could join up if the forum, bug db, or maillog searches don't provide enough information.

off topic.. white text on black background

[_Qiang_]

why people have page with black background and white text. it makes my eyes bleed!! and even worst, TFA has also a section with white background and black text.

i never read page like that.

Comment to cancel erroneous moderation

[Suzuran]

Reply to cancel erroneous moderation

Bingo! Give this man an award!

[an.echte.trilingue]

You are absolutely correct. Adblock works by checking externally referenced content against a black list. This works because most ads these days are built with copy and paste html that a web developer just sticks into the page somewhere, either in an iframe or with javascript includes. Advertisers do this because it makes it very easy for any webmaster to stick an ad on their page, and it makes it easy for them to monitor how many ads have been displayed and where.

However, this method of blocking ads is easy to circumvent with server side scripting. All you have to do is write a script that fetches the content and images from the advertiser's servers and serves it as if it were coming from your site. It only takes 3 lines of php. Once this is done, the entire premise behind adblock will cease to work.

This technique is uncommon because it makes it slightly more difficult for webmasters to stick an ad on their page and it makes it more difficult for advertisers to track their ads. Distrowatch is the only site that I am aware of that uses a technique like this to display its ads: they are obviously aware of the fact that many of their users also use adblock. The only reason that ads like this have not become common is that adblock itself is uncommon. To be quite honest, it surprises me that slashdot doesn't do this. But don't worry, if adblock gains a wide user base, it will be circumvented overnight.

Fix for "Access and Defaults" bug

[Torodung]

I fixed that by adding the DWORD value "IconsVisible" set to 0x00000001(1) to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\InstallInfo

Firefox seems to place that value at the "FIREFOX.EXE" key, but if you compare it to Internet Explorer's entries, it appears it properly belongs in the "InstallInfo" key.

Anyway, that puts it on my menu, and I suspect it will put it on yours.

I really should send that tip off to bugzilla so they can fix it in the next release.

--
Toro

Re: "Blabbing" is a GOOD THING(tm)

[cnettel]

I thought Mozilla and other projects kept the real public resources (like the bug db) under some limited access, where relevant (exploitable) bugs tend to be locked-down until the fix is released. I don't say it's simple to join an inner circle through some social engineering, but it will and should be harder than just signing up in a form.

Why is parent marked informative?

[Viol8]

Firefox runs on more than just Windows so who cares what Task Manager says. I'm more interested in what "top" would have to say.

mitigating browser vulnerabilities

[bl8n8r]

Run Firefox/thunderbird as a different user.
Not perfect, but gives you the ability to protect your home directory.

- xhost +localhost
- kdesu -u webuser -c /usr/local/firefox/firefox

Firefox has neglected security configurability

[Eravnrekaree]

It is surprising that one is not able to disable JS on a per site basis by default. However, I have written firefox for years about a feature called security profiles which would allow the user to specify on a per site basis not only whether JS should run, but whether applets should run and a large number of options and settings. Sites could then be placed into one of these profiles. The idea has been ignored by Firefox even though it would give more control to the user, and used the tacky excuse to use user profiles, but which would be terribly inconvient, involving launching a seperate browser for each set of security settings and keep track of which is which. Between this and Firefoxs outrageous memory leaks, I am not impressed.

Re:Firefox has neglected security configurability

[BZ]

> It is surprising that one is not able to disable JS on a per site basis by default.

You mean surprising that there is no user interface for this? The back end has support; setting a few preferences (to indicate which sites you're whitelisting or blacklisting; both modes are available) does the trick.

Re:Firefox has neglected security configurability

[soulhuntre]

I use that feature all the time in IE.

Not exactly....

[DrYak]

Aren't Firefox plugins just Javascript?

Depends.

Firefox extensions (Like the oh-so-important NoScript and AdBlock Plus, or the must-have for every /.er Resurect pages) are all written in Javascript. That's what makes them portable (installable in Windows IA32 or AMD64, or Linux {whatever CPU you compiled it for}).

On the other hand, web-browser plugins (like Adobe Macromedia Flash, Sun Java, etc.) are binary code in dynamically linked libraries (DLL or SO depending on what's standart on your OS). That's why there are really serious portability problems with closed source companies providing plugins compiled only for a handful of operating system (often without 64bits support).
There are two strategies :
- most of the time open-source projects use very light libraries which obtain the parameters from firefox and launch a player in a separate process that get its output embedded inside the page display (mplayer's plugin just luanch a sepparate mplayer session, gnash' plugin runs gtk-gnash to open the flash movie, webgcjplugin compiles and runs the java applet using gcj, moz-plugger is an universal embedder, etc...)
- whereas most of the proprietary project try to cram everything inside a huge DLL that runs inside firefox' own process (macromedia flash, acrobat reader {BTW who does still use that piece of junk}, etc.)

As I understand it, that's one of the major reasons that Firefox can get bogged down.

The Javascript extensions play some role because the javascript engine of current Firefox isn't very fast (Hopefully the integration of Tamarin VM in some future version will help). If a user has way too many of them, the firefox experience can become slow. But most of the time quite, the extensions are event-driven : they usually add entries in the main menu and the javascripts are only executed when the user clicks the entry.

The other problems comes with memory leaks.
- Javascript extensions, because they are only ran on demand and because of the garbage collector, aren't subject to many leaks. But anyway really badly written code can actually degrade firefox performance and eat up memory.
- Dynamically linked web browser plugins are a completely different animal : because they run inside the browser process (at least, not the open-source one which only launch an external process) if they leak memory, the whole firefox process will get its memory usage up and will only free the memory when the whole program is exited. Also, firefox isn't heavily multi-threaded and if some plugins freezes the whole program gets unresponsive (I've had some awful experience with acrobat and older versions of flash). Similarly crashes inside a dynamically linked library will bring down the whole process that called the function, and any exploit discovered inside flash can be used against firefox itself.

I strongly suspect that most of the memory leaks reported by users are actually due to browser-plugins, because I haven't experienced any leaks even if a use several extensions, whereas I don't run closed proprietary browser plugins at all (mplayer and gnash only !) because of the awful experience with acrobat and flash.

Re:Not exactly....

[bcrowell]

That's why there are really serious portability problems with closed source companies providing plugins compiled only for a handful of operating system (often without 64bits support).
I keep hearing slashdotters complain about this, and it totally baffles me. I have an x64 system, and binary plugins (flash, java, ...) work fine for me. X64 is compatible with x86. Is there some issue I'm not aware of?

Re:Not exactly....

[Anonymous Coward]

Speed? Like using a shopping cart to buy a can of pop...

Re:Not exactly....

[twistedcubic]

I keep hearing slashdotters complain about this, and it totally baffles me. I have an x64 system, and binary plugins (flash, java, ...) work fine for me. X64 is compatible with x86. Is there some issue I'm not aware of?

No, there isn't an issue you aren't aware of. But I'm curious why you prefer not to admit that the flash plugin hangs and crashes firefox frequently.

Re:Time to see if Konqueror fixed the damn flash b

[celle]

Actually I'm glad I can't see it. Just more bandwidth eating crap that I don't want to see to clog up my day and my tubes.

When will people just stop using Firefox

[cyofee]

And use Opera instead? Opera hasn't had a serious vulnerability in over 7 years.

Re:When will people just stop using Firefox

[Kelson]

And use Opera instead?

Opera hasn't had a serious vulnerability in over 7 years. Are you joking, or have you just not paid any attention? Opera has had plenty of serious vulnerabilities in the past 7 years. Not as many published as Internet Explorer or even Firefox, but they exist. Take a look at this one from December, rated "highly critical," then explore the lists for various Opera versions.

The difference is, people rarely publish an Opera vulnerability without first going through channels, so the problem tends to get announced at the same time as the updated version of the app.

Re: "Blabbing" is a GOOD THING(tm)

[bunratty]

I would agree if a company has a poor security record. On the other hand, Mozilla fixes security bugs faster than the other major browser makers. They also fix bugs that were not publicly known with nearly every release. What makes you think they need the motivation of having the exploit publicly exposed immediately after the release? It looks like 0x000000 is just looking for attention, not altruistically helping to increase security. If he wanted to do that, he should have discussed the problem (even publicly) before the release, or filed a private security bug report after the release. If he reported the problem weeks ago, and a new release came out without the fix, then it might make sense to blab about the problem.

Re:Exactly! That's why I use Internet Exploder

[Just Some Guy]

The only thing is, that the browser only seems to be available for a small number of available Operating Systems.... namely "Microsoft Windows" and also a small number of "Macintosh OS Ten"

Actually, it's not available for OS X. This is actually a good thing. When I'd complain about Firefox/Safari compatibility to certain webmasters - not the guy from "Bob's House of Flash Cartoons" but ones I actually cared about, like my online banking - the canned response would be for me to "upgrade to Internet Explorer". Now that MS has officially EOLed IE for Mac, they actually have to deal with the problem. Thanks, MS!

Odd.

[RavenChild]

Right as i opened this story, firefox asked me if I would like to complete this update's installation by restarting firefox. I'm not restarting until they fix it.

Re:Odd.

[Kelson]

Right as i opened this story, firefox asked me if I would like to complete this update's installation by restarting firefox. I'm not restarting until they fix it. You're better off restarting Firefox now.

The issue reported is already present in the version you're already running, so upgrading won't make you any more vulnerable. And since Firefox 2.0.0.12 does fix a bunch of other bugs and vulnerabilities, you'll be safer with the newer version.

(Also, it doesn't seem to be as serious as reported, since it can't actually read anything but the Firefox program directory, which is public knowledge anyway. Your preferences, passwords, etc. are all stored somewhere else.)

Not a flaw

[Anonymous Coward]

Come on guys. Anyone with any sense will realize that the file its actually reading is pre-included with all Firefox installs, it does not contain any user data only the predefined defaults which are totally worthless because you can even read them from the online Mozilla repository.

I tail to see how useless default settings apply as a security risk when there is no confidential user material being read. So inaccurate.

Opera

[Anonymous Coward]

FYI, Opera works great under Linux. And as I saw in a previous post, it has a "noscript" built-in

Make Javascript Unobtrusive

[Keeper Of Keys]

If it became part of the browser, 3 things would happen: Idiots would scream and cry about being forced to use it, it would integrate better making it more effective, and vulnerabilities like the one referenced here would be a non-issue for a much larger percentage of the user base.

Also, web developers would have to make their sites work properly with javascript turned off. Some sites do this already, but not enough, including some which supposedly take accessibility seriously. JS should *enhance* usability of a site, not be absolutely required for it to work at all.

Godwin's Law for Slashdot

[thethibs]

Slashdot needs an implementation of Godwin's Law that shuts down a thread the first time Microsoft is mentioned and the topic is something that involves neither Microsoft nor any of its products.

Thankfully, that would have put this thread out of our misery almost immediately, with no one any less informed as a result.

text mode browsers that Just Work

[doom]

It's like lynx, only on steroids. It's like the web is pure and clean again.

I like w3m well enough, but I'm still a fan of lynx for many things... lynx doesn't make much effort to do graphical layout, all of the content is just linearized, and presented one piece at a time. This means that typically there will be several screens of cruft you need to page down through to get to the main body of text, but it also means that the "designer" can't dictate how you're going to use your screen real estate.

(Also, it doesn't leak like a sieve and crash all the time: I can open up a lynx window showing a long document, and it will still be there a month later after four Firefox 1.x crashes or thirty Firefox 2.x crashes. But then, w3m is pretty much the same as far as that goes.)

Tis true, if you're looking for emacs integration, the w3m world is much better -- I've been living without for awhile, myself (I had some random set-up hassle I didn't feel like figuring out.)

Re:text mode browsers that Just Work

[ShieldW0lf]

his means that typically there will be several screens of cruft you need to page down through to get to the main body of text, but it also means that the "designer" can't dictate how you're going to use your screen real estate.

So, you demolish the good design of the good sites, so you can avoid the bad design on the bad sites? Why don't you just skip the poorly designed sites entirely and stick to the good ones?

Re:text mode browsers that Just Work

[sticks_us]

Lynx really does have a "several screens of cruft" problem--agreed. Part of this is due in part, I believe, to the fact that a lot of the "tables
for layout" sites really suffer when Lynx just plops down text in the order it's received. It's not a huge hassle, but it can be a minor annoyance.

w3m understands tables, which seems to help the layout a lot. It isn't perfect, but you do avoid a lot of the "long page" issues you see in Lynx.

Some websites do different things with hyperlinks and navigation buttons. In Yahoo! mail (which has traditionally been pretty Lynx-friendly) it's
impossible to "send" a message IIRC because Lynx renders the send button as a non-clickable image.

Since w3m incorporates images pretty well, I've found this problem (and several other ones related to graphics) goes away.

The main weaknesses still seem to be with javascript navigation (or window:open stuff for hyperlinks that open in a new window). Design-savvy
individuals will correctly argue that the layout, being basically decimated and/or reinterpreted without CSS can really screw up the appearance and
functionality of certain websites. AJAX-driven content and other javascript-dependent features are probably going to be severely limited.

Much of this really depends on your browsing habits, I am sure. If you're looking for rather dull, text-heavy (with occassional images) material
most of the day, you really don't need 500MB of RAM dedicated to your web browser! On the other hand, a lot of people would be driven crazy by Lynx
or w3m.

Re:text mode browsers that Just Work

[doom]

So, you demolish the good design of the good sites, so you can avoid the bad design on the bad sites? Why don't you just skip the poorly designed sites entirely and stick to the good ones?

I'm not sure what you're trying to say here -- I suspect you're yet another "designer" who resents the fact that you're fabuloso designs are irritating the hell out of a large chunk of the populus -- but you're logic is totally whacked. Why blame the author of some text for the decisions made by other people in the organization?

Consider the way the world looks when I use Firefox. I go to read a column by Robert Fisk in the Independant, and a bar appears at the edge of the screen telling me that the execution of some script has been blocked. I habitually use custom colors with light text on black -- my opinion is this minimizes eye-strain, by the way: computer screens are not paper and should not try to mimic paper -- and the various little graphics they've squeezed in on the page are glaringly bright in comparison, because they presume I'm using a white background. Then I come to the dread Flashing GIG advertisement, and it's once again time to right click and use Adblock to make it go away.

Do you see what I'm getting at? Lynx (or w3m) is not without it's annoyances, but using Firefox is not without it's annoyances either: I need to constantly fuss with it to fight the faddish nonsense that the web is always infested with.

What's so crazy about using a text-mode browser if what you want to do is read some text?

Re:text mode browsers that Just Work

[doom]

Lynx really does have a "several screens of cruft" problem--agreed. Part of this is due in part, I believe, to the fact that a lot of the "tables for layout" sites really suffer when Lynx just plops down text in the order it's received. It's not a huge hassle, but it can be a minor annoyance.

w3m understands tables, which seems to help the layout a lot. It isn't perfect, but you do avoid a lot of the "long page" issues you see in Lynx.

I realize that it's often more fun to talk than it is to read what it is you're nominally replying to, but my point is that I don't particularly care about the several screens of cruft: I at least sometimes like the way lynx tosses the layout and presents content one-bit-at-a-time. There are some cases that lynx would display incoherently (e.g. if someone were to use an html table to present acutal tabular data for example), but it's interesting how often the "layout" just doesn't matter at all.

Similarly the lack of javascript handling is often as much an advantage as a disadvantage, and nothing stops you from using a different browser now and then: you're not forced to make one choice and stick to it.

As far as graphics goes, lynx can be configured to spin off an external image viewer if you want to look at an image, but this is only mildly useful, because most images on webpages are really stupid things like blank areas used for layout tweaks.

Much of this really depends on your browsing habits, I am sure. If you're looking for rather dull, text-heavy (with occassional images) material most of the day, you really don't need 500MB of RAM dedicated to your web browser!

And here we run into some irreconcilable differences: you think text-heavy pages are "dull".

Re:text mode browsers that Just Work

[sticks_us]

"Cruft" wasn't my term; I incorporated it in my post to compare the rendering behavior of the two browsers in question.

Perhaps I have an underdeveloped sense of humor, but I thought referring to text-heavy sites as being "dull" would be rather
droll, considering I was posting on slashdot.

Sorry if I missed the subtlety of your original post.

Re:text mode browsers that Just Work

[doom]

Sorry if I missed the subtlety of your original post.

All right, already. Stop hitting me over the head with your subtlety.

Re:Exactly! That's why I use Internet Exploder

[uvajed_ekil]

Wow, I get knocked down to 0 by a "-1 Overrated" for pointing out an obvious factual error in a smart-assed post. Brilliant use of mod points!

I had a very insightful reply...

[rush22]

...only, while I was typing it in Firefox, suddenly the focus of the textbox changed when I pressed the apostrophe key, then I hit delete and it sent me back 4 pages. Also does anyone know what "virtual memory" is? I seemed to have run out of it.

compatible but not miscible

[DrYak]

X64 is compatible with x86. Is there some issue I'm not aware of?

Yes, X64 processors (AMD64, Intel EM64T, VIA's newest superscalar low-power) *CAN* run IA32-bits instructions.

*BUT* you can run both inside the same process without using a translation layer.
A 32bits application cannot directly call 64bits functions in a dynamically linked library (for example, it won't be able to understand the returned pointers)
A 64bits application cannot directly call 32bits functions in a dynamically linked library (for example it could request pointers that are outside the library's range.)

That's why on most Linux installation in addition to the basic libraries (all the packages ending in "lib" like SDL-lib) when installing in a mixed environment you also install special compatibility layers (all the package ending in "-32bits") which basically are the necessary bindings and translation layers needed to call the native 64bits libraries from within 32bits applications. On Windows 64 there's a similar thing called WoW64 (Windows on Windows64).

Also the reverse exist too : translation libraries made to run 32bits browser plugins inside a 64bits Firefox - nspluginwrapper.

Anyway most opensource browser plugins use only a thin layer that basically only serves as a launcher which will start an external player in a separate process and redirects the ouput inside the rendered page. You could mix whatever architectures you want (as long as they are supported by the CPU and Linux) they run in separate process each with its own memory model.

Flash works on your 64bits Linux installation because, most probably your distribution automatically downgrade Firefox to 32bits if you select to install Flash, Realplayer, Java, etc. It works flawlessly (I mean on Macromedia Flash's scale of flawlessness, i.e.: has the same frequency of freezes and crashes as a regular 32bits installation), only because the whole firefox stack is running in 32bits (which is possible thanks to the 32bit compatibility layer) and there's no problems with mixed architectures between the browser plugins and the browser itself.
But have a look on you browser about box, I'm pretty sure your browser is running in 32bits mode and not 64bits native.

Unless recent distributions have started shipping nspluginwrapper as a standart (openSUSE 10.3 has not yet).
Or unless, all of sudden, Adobe decided to release a 64bit version of their software - which they didn't a couple of months ago when I last checked and which I seriously doubt they'll ever do.

I personally prefer running Firefox in native 64bits mode. Anyway MPlayer's browser plugins is much better then any proprietary video player. And gnash is sufficient to me for the rare couple of times I need flash (some website use flash instead of <h#> tags to display titles). For video, I prefer using UnPlug and SaveTube and open the video in an external player, rather than using flash video players.
Of course I don't have the typical flash usage that the average user may have and that's why most /.es complain about not enough support for additional architectures. For them it's either stick with 32bits Firefox, or use less stable solutions (nspluginwrapper, gnash, swfdec, etc...)

DONT LOOK A GIFT HORSE IN THE MOUTH!

[bussdriver]

Being NICE is making the problems known; its nice icing on the cake to have them bend to your opinions on etiquette.

If a VOLUNTEER gets a kick out of finding bugs when you don't like it, that floats their boat and that is what matters. The GOAL is better code.
This is the sort of off-topic office politics that weakens projects, etc.

Take it like a student - they have to do work and be criticized when the thing is completed.