Slashdot Mirror
Firefox 3.6.4 Released With Out-of-Process Plugins
DragonHawk writes "Mozilla Firefox 3.6.4 went to general release today. The big new feature in this release is out-of-process plugins (OOPP). This means things like Flash, Java, QuickTime, etc., all run in separate processes, so when Flash decides to crash, it won't take your browser out with it. If Flash starts consuming all the CPU it can find, you can kill it without nuking your browser session. I've been using this feature since it was in the 'nightly build' stage, and it was still more stable than 3.6.3, just because Flash was isolated." And reader Trailrunner7 supplies another compelling reason to download 3.6.4: "Security researcher Michal Zalewski has identified a problem with the way Firefox handles links that are opened in a new browser window or tab, enabling attackers to inject arbitrary code into the new window or tab while still keeping a deceptive URL in the browser's address bar. The vulnerability, which Mozilla has fixed in version 3.6.4, has the effect of tricking users into thinking that they're visiting a legitimate site while instead sending arbitrary attacker-controlled code to their browsers."
That is because you are using nspluginwrapper to wrap the 32-bit Flash plugin.
Has no-one else yet commented to point out that Opera has run plugins in a separate process for years now? Then I guess I have to.
Not to minimize the accomplishments of the Firefox developers, I mean, and getting this feature to the Firefox userbase is valuable in and of itself, and so on. But there is precedent.
According to the discoverer and the issue; he mixed up two different fixes, initially:
http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html
https://bugzilla.mozilla.org/show_bug.cgi?id=556957#c46
It looks like there is a single process plugin-container.exe to run all flash files. Killing this exe will stop playing all the flash files. This means while you are enjoying a show on hulu.com, a rogue flash ad could still spoil the fun.
I'll take this opportunity to post some non-inflammatory info on planned Firefox development.
Firefox 4.0, which may go into beta as early as next month, is supposed to do a lot in this direction. Overhauled JavaScript engine, overhauled HTML rendering, etc.
http://wiki.mozilla.org/Firefox/4/Beta
http://developer.mozilla.org/en/Firefox_4_for_developers
I thought I had heard that 4.0 was supposed to deliver one-process-per-page functionality, but I'm having trouble finding recent status info. (One drawback to high-speed FOSS development is it's hard to keep track of things like that.) But anyway, the project is named "Electrolysis" ("E10S" in Firefox-developer-speak).
http://wiki.mozilla.org/Electrolysis
http://wiki.mozilla.org/Talk:Firefox/Roadmap
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
No. If I kill firefox.exe in the Task Manager the plugin process disappears too.
"And reader Trailrunner7 supplies another compelling reason to download 3.6.4: "Security researcher Michal Zalewski has identified a problem with the way Firefox handles links that are opened in a new browser window or tab, enabling attackers to inject arbitrary code into the new window or tab while still keeping a deceptive URL in the browser's address bar. The vulnerability, which Mozilla has fixed in version 3.6.4, has the effect of tricking users into thinking that they're visiting a legitimate site while instead sending arbitrary attacker-controlled code to their browsers."" Nope, sorry: https://bugzilla.mozilla.org/show_bug.cgi?id=556957#c46
You're exactly right. Flash assumes that all running instances of it share a single address space and uses various internal communication channels to have the instances talk to each other. The Chrome folks actually tried a process per plugin instance, and it broke too much stuff out there.
This is at least in part because on the 3.6 branch the 64-bit version is not at feature parity with the 32-bit one (for example doesn't have the JS jit, so has much worse JS execution performance). So linking to it on equal terms really doesn't make sense.
For 4.0, 64-bit Linux builds are much higher quality (for example they actually have the automated correctness tests run on them). So there's a decent chance those builds might become tier-1 by the time 4.0 ships.
I'm afraid Firefox hasn't been the feature leader at all. Tabbed browsing? Opera had it before. Mouse gestures? Opera had it before. Quick dial? Opera had it before. Customisable search bars? Opera had them before. Ad blocking? Opera had it before (although, admittedly, worse than Firefox's). Stored sessions? Opera had them before (and it does restore from crashes without any problem in my case). I could keep enumerating, I'd say 90% of the browser features that Firefox implements are copied from Opera.
OK, I think Firefox had private browsing before Opera, making it the browser of choice for pr0n (i.e. 99% of the internet usage); but now Opera has catched up on that and offers private and non-private tabs mixed in the same window :)
BTW, on my machine Opera behaves much better than Firefox with 20+ tabs open (I have 57 right now), it's still snappy and Firefox would be crawling and taking up loads of RAM. But of course YMMV.