Meet Firefox's Built-In PDF Reader

An anonymous reader writes "Not long ago, Mozilla coders announced that they were starting to build PDF.js, a way to display Acrobat documents in the browser using pure web code. No longer will you have to fight with an external PDF plug-in in Firefox. Development on PDF.js has progressed to the point now where you can take an early peek at it. Huzzah!"

Comments

Good

[steevven1]

I usually hate added features to my browser (I prefer a lightweight, fast browser), and Firefox especially has needed to go on a diet for the past year or two (and it has, successfully, since version 4), but I think that this is a pretty fundamental feature for a browser to have. After all, PDF's are everywhere on the 'net. Your browser should be able to show them to you. Gone are the days of saying "Oh, that link to an article I was barely interested in in the first place points to something in PDF format? Nevermind."

Re:Good

[Anonymous Coward]

But every time a new Adobe Reader exploit comes out, everybody complains that a document reader shouldn't be interpreting Javascript.

Re:Good

[Hatta]

What's wrong with clicking the link and having the PDF launch in the viewer of your choice? This is significantly increasing browser footprint and attack surface for no appreciable benefit.

Re:Good

[bazald]

But it's not increasing the attack surface at all. If it's pure javascript, the interpreter is already there anyway. Any attack on PDF.js would exist in the interpreter independently of PDF.js. In fact, this reduces the attack surface by requiring one less program to accept arbitrary data from the network.

Re:Good

[Shoe Puppet]

In Mozilla Firefox, Javascript interprets PDF!

Re:Good

[Gavagai80]

Waiting for a PDF to load externally takes a while and messes up the whole browsing flow -- can't open links in a background tab if they're going to grab hold of your screen and pop up a PDF viewer in front. Chrome's in-browser PDF viewer works great, loads so much faster than an external viewer.

Re:Good

[steevven1]

I'll respond to this with a quote from someone else: "If you have a link to something.jpg, would you rather it open in an image viewer in another application window? The ubiquity of PDFs makes them worthy of the same treatment as images."

Re:Good

[Anonymous Coward]

What's wrong with clicking the link and having the PDF launch in the viewer of your choice?

To take this even further, what's wrong with clicking the link and downloading the PDF for later launch in the viewer/processor of your choice? Usually I don't want my browsing session being interrupted by any PDF interpreter popping up (and possibly crashing my browser).

Although I must say that it is nice to have the possibility to decide to view a particular PDF on the fly (and in parallel to my browser).

Re:Good

[Anonymous Coward]

No no JS support on acrobat is an old thing, nowadays the exploits come from embeded flash videos INSIDE the pdf files, they are almost all SWF exploits...

Re:Good

[tepples]

Waiting for a PDF to load externally takes a while and messes up the whole browsing flow -- can't open links in a background tab if they're going to grab hold of your screen and pop up a PDF viewer in front.

If the PDF viewer raises and focuses itself when launched from your web browser, that's a window manager problem.

Re:Good

[keytoe]

I'll respond to this with a quote from someone else: "If you have a link to something.jpg, would you rather it open in an image viewer in another application window? The ubiquity of PDFs makes them worthy of the same treatment as images."

Except that images are inline elements that fit within the document model of a web page and PDF documents are separate ... er ... documents. Images and PDFs are used in completely different ways.

Re:Good

[Darinbob]

Saving it for reference later is always good. But very often there are links you get while browsing the web and you want to read them then and there, not save them first and wait for reader to load, etc.

The other problem is that too many "readers" have bloated features not needed. I don't care if a doc is signed, or the ability to add my own notes to it, or all those security holes that should not exist in a small simple read-only reader. PDF has gotten extremely complicated over the years and each new Adobe Acrobat Reader is getting uglier (and it's a pain to keep finding their hidden older versions that work better).

Re:Good

[Anonymous Coward]

If you have a link to debian-6.0.3-i386.iso, would you rather it open in an external emulator in another window?

Although PDF's are more ubiquitous than operating systems, They're completely different from HTML. They're a different, incompatible format, designed to be displayed in a different way, by a different program.

Re:Good

[FatdogHaiku]

In Mozilla Firefox, Javascript interprets PDF!

Aww, come on mods! That's the first "In Soviet Russia" spin-off joke that was funny and insightful and informative... possibly ever!
and there it sits at 1...

Re:Good

[Anonymous Coward]

But if I follow a link to http://example.com/something.jpg, should it just download the image and open an image viewer, or should it display the image in my browser? Images can be inline elements in an html document, or they can be linked to on their own.

Re:Good

[Anonymous Coward]

Gone are the days of saying "Oh, that link to an article I was barely interested in in the first place points to something in PDF format? Nevermind."

They are? Whenever I see a PDF link, I always skip over it. If it's important, it will be in standard HTML. PDF might be an "open" format now, but it wasn't always and was only made open because it would have already died off had Adobe not done so. No thanks, I'll take my truly open formats, not formats that were opened solely to keep Adobe in the business of selling Acrobat.

Re:Good

[epine]

What's wrong with clicking the link and having the PDF launch in the viewer of your choice? This is significantly increasing browser footprint and attack surface for no appreciable benefit.

I've configured the majority of my web clients to use external PDF viewers in the past because there wasn't much benefit to running them inline as opaque applications in affordable housing. There's nothing wrong with being too old for school. However, if PDF behaved more like web content and integrated fully with Zotero, Session Saver, AdBlock, and NoSquint the benefits would be highly appreciable.

I've grown fond of having the ability to remove any image (or logo) from a document I'm reading in Firefox by whichever of my multitudinous plug-ins added "remove this object" to my popup context menu.

Neither am I particularly fond after a system restart of having to rearrange my PDF windows on their habitual desktops, after fighting round one with FF.

From How Netflix Lost 800,000 Members, and Good Will

Reed Hastings was soaking in a hot tub with a friend last month when he shared a secret [doomed plan]. "That is awful," the friend, who was also a Netflix subscriber, told him under a starry sky in the Bay Area, according to Mr. Hastings. "I don't want to deal with two accounts."

In fact, I've always hated that PDF was a cloistered universe. I'll be much happier when it's demoted to just another www markup language and treated as such.

But don't feel bad, Reed couldn't see it either.

Re:Good

[EdgeCreeper]

It would be nice if the parent post was visible. The only thing that I could think of that would increase the attack surface is that it will be implemented as an extension. This really shouldn't be a problem as Mozilla will surely look this over very carefully.

Re:Good

[Jarik C-Bol]

that, and with every 'in browser' PDF viewer i've used in the past 4 years, its sort of a dice roll. usually about a 2 in 6 chance that the browser crashes trying to fire up the PDF file.

Re:Good

[keytoe]

But if I follow a link to http://example.com/something.jpg, should it just download the image and open an image viewer, or should it display the image in my browser? Images can be inline elements in an html document, or they can be linked to on their own.

Users' choice. A link to an image opens a new document - and that document (html, pdf, jpg, etc) can end up in a new tab, new window or a different app - whatever the user prefers.

I'm not arguing against having a PDF viewer built into the browser - but I've got a much more full featured PDF viewer that I'd prefer to use. Taking the choice away sucks.

Re:Good

[tyrione]

Good? Just require merge Poppler stable into the Tree and you'll get a high quality engine. By all means use Javascript. That'll guarantee ISO 32000 certification. Poppler is getting major improvements to the tree and you jump ship for an interpreted option in-house? I've stopped developing and testing against Gecko based browsers. This only makes me glad I've focused on WebKit solutions.

Re:Good

[BZ]

The whole point of implementing in JS is to not increase attack surface: everything pdf.js does can already be done by web pages.

Re:Good

[geminidomino]

usually about a 2 in 6 chance that the browser crashes trying to fire up the PDF file.

You're either a PnP gamer, or a gambler, right?

Re:Good

[petermgreen]

Because when you are comparing parts it's so much easier to have the PDFs open in tabs of the same window as the search that found them than having to open them in a seperate app, look at them and then find the browser window you were using again. Especially if you are working on windows which doesn't have virtual desktops.

I just hope this new PDF system is actually fit for the purpose of looking at things like IC data sheets (which means it MUST support PDF bookmarks and it MUST NOT choke on large PDF files).

Re:Good

[laffer1]

I can think of one benefit. On any platform that Firefox runs on, one can actually view a PDF. Adobe makes a reader for the big three platforms.. Windows, Mac, and Linux, but not for any others. There are certainly nice open source PDF viewers, but not all of them have a browser plugin. This also gives us a working PDF viewer on other architectures. Old PPC and Sparc boxes.. maybe new ARM and x86-64 systems.

Re:Good

[cbhacking]

Not entirely true. Much of Firefox is written in JavaScript (this is , among other things, part of the reason you don't need separate versions of AdBlock Plus for each host OS and architecture). However, that JS runs at higher permissions than webpage content (for obvious reasons). If this PDF reader is also running at those higher permissions, then it is introducing a new parser of untrusted files into the browser.

If it actually runs with the same permissions as any random script on a webpage, then you're correct. It could, too. I wouldn't simply assume that just because it's in JS it isn't a new attack surface, though.

Re:Good

[Anonymous Coward]

> What's wrong with clicking the link and having the PDF launch in the viewer of your choice?

The web-design is usually wrong for that. You view a document as an "attachment", a document added to a web site. Many "web designers" use PDFs as integral parts of their web site, with embedded links and everything. Launching it in an external viewer breaks the browsing experience - mouse buttons work differently, your history is broken, and there are many other subtle details that are just wrong. This happens both with internal and external viewers, unless the viewer is part of the browser.

Of course once we have solved the problem with PDF, people will do the same with Word documents (argh!).

Re:Good

[neokushan]

What's wrong with a bit of user choice? The image thing is a good example. If you're looking around for a particular image, you don't want to download each one before trying it, you want your browser to download it first and display it quickly. PDF's aren't much different.

I regularly have to google around for specific information that's nearly always found in PDFs and currently it's more of a chore than it needs to be. Adobe reader's browser plugin is horrendous and crashes more often than not. To make matters worse, it locks up the whole browser while the PDF downloads in the background. I mean, that alone is idiotic. It's much easier to download the PDF separately and then display it, but I'd much rather it display in the browser for quick access.

Re:Good

[TheLink]

But it's not increasing the attack surface at all. If it's pure javascript, the interpreter is already there anyway.

1) Depending on how it is implemented, it might be for those who use noscript ;).
2) There's plenty of stuff like click jacking, session stealing etc, so if the mozilla's pdf renderer can somehow be tricked into executing arbitrary javascript of the attacker's choice, then there may be ways to pwn users.

Re:Good

[maxwell demon]

So when will we get a JavaScript implementation of Flash?

Re:Good

[maxwell demon]

But in 99% of all cases when I start a program, I want it on the top. After all, I've started it in order to use it. Actually in most cases, this is even true for the PDF reader started from the browser. And unless there's support from the PDF reader (which ultimately has the control over its window, and therefore is the only program which could give hints to the window manager), and the browser knows how to tell the PDF reader about the desired launch mode (because you determine by the way you open it in your browser, e.g. left click vs. middle click, if you want to have it on the top or bottom), the only options are for the window manager to either start the PDF reader always on top, or always on bottom. Both suck, but the second option IMHO sucks more.

Of course, the ideal solution (not only for the browser/PDF reader problem) would be to have a standardized way to tell an application to start raised/lowered (ideally without the need of the application itself to cooperate).

Re:Good

[maxwell demon]

Did they say they take away the choice? If they do so, I agree, that would be bad (but then, there probably would soon come a plugin which adds that functionality).

Re:Good

[maxwell demon]

Who cares about why a format was opened? Remember that Mozilla code was only opened because Netscape tried to avoid failing (it did then fail anyway, though).

Re:Good

[hairyfeet]

But the flip side of that friend is that PDFs have traditionally also been one of the biggest sources of exploits on the net and now the bad guys will know that if the browser is FF they can simply target the PDF interpreter.

Personally I'd rather have Firefox do something like "You need a PDF reader to read this document, might we suggest" followed by a link to several PDF readers, especially FOSS readers like Sumatra since Firefox is a FOSS browser. But I would have links to Adobe, Foxit, Sumatra, and let the user choose, this not only puts choice in the hands of the user but makes it much harder for a bad guy to guess which PDF reader a FF users would have.

Besides adding non browser features leads to bloat and FF hasn't been very skinny of late to start with. There are a lot of Word docs on the net too, should they build in LO Writer? hell why not just build in eMacs, since the meme is eMacs does everything already?

Re:Good

[hairyfeet]

That is why on first install I take my builds and refurbs over to Ninite and along with the usual (Klite, LibreOffice, irfanview) I install Sumatra PDF Reader. its fast, its lightweight, no extra BS, it just loads PDF VERY fast. And if you are in FF or Chromium based it'll just pop it up in a new tab, don't know about IE as I haven't used it for years.

But reading the comments it seems like those for having an internal PDF reader have basically been burnt by Adobe Reader but I'd say it'd be better to just ditch adobe for something that doesn't suck than to build in a reader and increase the risk. which BTW if it is still running with Firefox's higher permissions IS a risk. Does FF even support low rights mode yet? Its been nearly 5 years now and soon we'll be on the third version of Windows with low rights mode.

Re:Good

[Anonymous Coward]

Although JPEGs are more ubiquitous than operating systems, They're completely different from HTML. They're a different, incompatible format, designed to be displayed in a different way, by a different program.

See what I did there? ;-)

There's a difference between content and applications. We certainly don't treat them the same way. In most cases (not all, but most) a user who's a passive viewer viewing content designed to be passively viewed will want their web browser to display the content, which, in part, is why Adobe's Acrobat Reader includes a browser plug-in so you can view the PDF that way. It's let down by the fact that viewing a PDF still doesn't feel completely smooth because a giant PDF reading framework gets loaded into an application whose integration capabilities aren't exactly seamless.

So the browser plug-in thing is half a solution, but proper browser integration would be infinitely better, especially as a browser can better manage the loading process so the user gets all the loading hints (progress bar support, etc) and immediate display capabilities they're used to with HTML pages.

The issue here isn't that ISOs are less common, it's that they're not intended for passive viewing. HTML, JPEGs, movies, and PDFs, are. That's why it generally feels better if an external application isn't loaded up to display them.

Re:Good

[BrokenHalo]

Maybe I'm just being a troglodite, but if I see a link to a PDF that I actually want to read, I am usually happy enough to save it to my desktop so I can file (or discard) it later.

Re:Good

[BrokenHalo]

What's wrong with 1 in 3?

Re:Good

[Anonymous Coward]

Chrome's in-browser PDF viewer works great, loads so much faster than an external viewer

I'm glad to hear that it works for some people. For me, it seems to constantly tell me that it can't quite manage to render something about the PDF files and offers to open the file in an external viewer. It never can tell me WHAT it can't render though, so I can never make a decision based on any information and just always end up opening the PDF in the external viewer. Doesn't anyone else get that on at least a good chunk of PDF files with the Chrome viewer?

Re:Good

[Lennie]

PDF.js just used HTML5/CSS3/JavaScript/fonts, it does not need any extra permissions like you get with an extension.

Re:Good

[Lennie]

So a PDF-document is like any HTML-document. I think it is find the view it in the same viewer-application.

Re:Good

[Lennie]

You should have a look at the PDF landscape and wonder if you really want (to use) it:

http://www.youtube.com/watch?v=4F2xMw3987I

"They're a different, incompatible format"

Actually as mentioned in the video, PDF is even incompatible with itself. :-)

Re:Good

[cmdr_tofu]

I kindof have to agree. I don't want to open up a 200 MB PDF in something written in Javascript. I'll take C/C++ based PDF viewer any day.

Re:Good

[Anonymous Coward]

Most people's PDF reader is known as "the shit one" aka Adobe.

Obviously if you have something more lightweight, then there's no problem, but Adobe's majority share means a fair few users will benefit from this.

Re:Good

[Jarik C-Bol]

i don't own a 3 sided dice?

Re:Good

[Anonymous Coward]

Waiting for a PDF to load externally takes a while...Chrome's in-browser PDF viewer works great, loads so much faster than an external viewer.

I can't speak for Chrome having used Chromium mainly but your waiting concerns are true only if you're using Acrobat*. Evince (GNOME) or Sumatra (Win) are blindingly-quick.

Re:Good

[geminidomino]

I don't disagree either -- I'm a big fan of the Unix philosophy and I hate the ever-spreading feeping creaturism. Just thought it was telling that he didn't reduce the odds. :)

Re:Good

[CSMoran]

Second that.

Re:Good

[Pascal Sartoretti]

What's wrong with clicking the link and having the PDF launch in the viewer of your choice?

The lack of a good, light, simple (and ideally open source) PDF Viewer on Windows.

Personally, I would prefer Mozilla to put the same effort in creating a cross-platform, open source PDF Viewer, which I could also use to view PDF file not downloaded via a browser.

Re:Good

[Grishnakh]

Ever heard of FoxIt? No, it's not open-source, but it's free for non-commercial use.

Re:Good

[Anonymous Coward]

"Messes up the whole browsing flow"
"grab hold of your screen"
"loads so much faster"

It sounds to me like your window manager is of very low quality. Consider reconfiguring it or installing a new one.

Re:Good

[Pascal Sartoretti]

Ever heard of FoxIt? No, it's not open-source

FoxIt is my PDF reader of choice, I use it everyday, but I don't trust it : every time that I upgrade it, it tries to install unneeded stuff behind my back.

, but it's free for non-commercial use.

Mmmmh, my impression is that it is completely free today (as in "free beer"), the commercial version being named "FoxIt Phantom".

Another thing that I don't like with these pseudo-free readers (such as also PDF Xchange Pro) : a feature which is present today in the free version may someday only be available in the commercial version. It once happened to me a long time ago with FoxIt...

Re:Good

[Anonymous Coward]

So a PDF-document is like any HTML-document.

No, it's a completely different beast, just like a spreadsheet or a slideshow or a movie. It has different features from HTML and is used for different things. If it was like any HTML document, people would just use HTML.

You are, of course, welcome to want to view all documents in a single application. You are not alone: plenty of people view spreadsheets in their browser and slideshows in their browser and movies in their browser. If you enjoy that kind of thing, hey, have fun! Just don't expect the rest of us to be eager to join you. We don't see the point. You're just replicating your entire operating system within an application. Fine, and where does that lead?

Eventually you'll end up right where I am -- with an operating system that includes an HTML viewer, and a PDF viewer, and a spreadsheet program, and a movie player, and a bunch of games, and everything else I have. Except this operating system only lets you see one of them at a time, maximized, and has tabs instead of a task bar / dock / window list, and is slower, and lacks support for half your hardware, and you still need another operating system to run it in. What have you gained? (Why not just run FreeBSD in VirtualBox? It's your dream browser today!)

Re:Good

[Anonymous Coward]

Waiting for a PDF to load externally takes a while and messes up the whole browsing flow -- can't open links in a background tab if they're going to grab hold of your screen and pop up a PDF viewer in front.

Possibly you need to stop running all your applications maximized? It's 2011 and we don't use 800x600 anymore. Even my little laptop has plenty of screen space for a PDF viewer to open without obscuring the browser.

Re:Good

[Anonymous Coward]

I'll be much happier when it's demoted to just another www markup language and treated as such.

But it isn't a WWW markup language. If you want a WWW markup language you use HTML. PDF is a print markup language. It has completely different goals and uses.

Your entire post boils down to "I don't like PDF and I wish everything just used HTML instead". That's a perfectly valid point of view. I partially agree with you -- I hate the way so many interesting articles are published in 2-column PDFs, so I have to constantly scroll up and down and up and down to read them on my computer. I would guess that the vast majority of the PDFs on the web would be better off just using HTML anyway. But the solution to that is making it easier for people to generate standards-compliant HTML that looks the way they want it to look, not emasculating PDF by cutting off all the un-weblike features that give it any reason to exist in the first place.

(For example, last time I looked into converting LaTeX to HTML, there were a dozen half-finished programs none of which worked properly and most of which produced hideous output. Is it any wonder people putting LaTeX papers on the web just upload PS or PDF output instead of struggling to generate a native format?)

Re:Good

[baka_toroi]

So what? The problem still exists

Re:Good

[tepples]

I understand the problem exists. But the first step toward getting it solved is finding the appropriate part of the system for solving it.

Please God no!

[Spazmania]

I don't want PDFs to open in the web browser. I want to open them in Acrobat in another window. Let the browser be a browser and Acrobat be Acrobat!

Re:Please God no!

[Spazmania]

If I was an Adobe person I'd want Acrobat to open in the browser window. No. No. No. A thousand times No. Get this crap out of my browser!

Re:Please God no!

[bloodhawk]

Acrobat sucks balls, but I have to agree, let the friggen web browser do what it does best, browse the web, what is so wrong with having your pdf reader of choice open seperately, more gunk in browsers is not what we need.

Re:Please God no!

[BeardedChimp]

I don't want PDFs to open in the web browser. I want to open them in Acrobat in another window. Let the browser be a browser and Acrobat be Acrobat!

So you don't like googles feature of viewing pdfs in html? Personally I love not having to download the file and wait for the pdf viewer to instantiate itself. The main benefit being not having to worry about the latest pdf exploit ruining your day.

Re:Please God no!

[Anonymous Coward]

There are addons for that... Some of them very popular.

Re:Please God no!

[Anonymous Coward]

If you have a link to something.jpg, would you rather it open in an image viewer in another application window? The ubiquity of PDFs makes them worthy of the same treatment as images.

Re:Please God no!

[Anonymous Coward]

Being able to read a PDF with a web browser using exactly the same (or enhanced) controls as the any HTML document sounds like a great idea to me. Writing a PDF parser in javascript sounds like a really stupid idea. Come to think of it, writing anything in javascript is a dumb idea.

Re:Please God no!

[amicusNYCL]

You realize that Acrobat is the #2 attack vector for Windows machines, right? It's right between Java and Flash. Why would you voluntarily use it when there are several other PDF readers which don't even show up on the attack vector charts? I was in a meeting today at the Maricopa County Community Colleges District office and I was pleasantly surprised to see that Foxit reader opened up whenever someone clicked a link to a PDF in IE. They use IE and still have enough sense to get Java and Acrobat off their machines.

Re:Please God no!

[Anonymous Coward]

Nope. Having pdf in a separate window with *FULL MENU* support and much better printing is much better than the browser block off 25+% of the viewing area with minimal support and *sucky* printing.

Re:Please God no!

[Anonymous Coward]

You realize that Acrobat is the #2 attack vector for Windows machines, right? It's right between Java and Flash.

Assuming what you say is true, wouldn't Acrobat be the #3 attack vector?

Re:Please God no!

[icebraining]

Then don't use it. Whew, problem solved.

(Valid) Criticism is useful. Personal preferences are irrelevant.

Re:Please God no!

[thetoadwarrior]

Who said the browser is only supposed to open HTML documents?

Re:Please God no!

[Anonymous Coward]

Uh, you have to download the PDF in to view it in your browser too.

Re:Please God no!

[larry bagina]

I can't be the only person who remembers when images on the web pages had to be viewed with a separate application.

Re:Please God no!

[kripkenstein]

I don't want PDFs to open in the web browser. I want to open them in Acrobat in another window. Let the browser be a browser and Acrobat be Acrobat!

That's fine, this is a Firefox addon: Just don't use it. Addons are optional.

Re:Please God no!

[Anonymous Coward]

What a fucking assburger.

Re:Please God no!

[Overzeetop]

I've got to agree, mostly (except for the Acrobat part - I find Bluebeam far more useful, though it's not free). I almost never want to open a PDF in the browser, because most PDFs are stuff I need to download and keep anyway.

Re:Please God no!

[Anonymous Coward]

Nice try Adobe Salesperson.

Nah. Actually it's a Microsoft Salesperson. Don't you remember the $500M legal shellacking Microsoft took for embedding apps in IE?

Re:Please God no!

[martin-boundary]

I agree, but I don't need Acrobat. I already have a PDF viewer in Emacs. What I'd like is to open Emacs directly in firefox, then I can get PDF viewing for free. Come on, firefox devs! Complete program reuse is the Unix way!

Re:Please God no!

[Anonymous Coward]

Mosaic 1.0 could handle images.

Re:Please God no!

[Panoptes]

"instantiate"? This horrible word doesn't mean what the writer thinks it does: it means "represent as or by an instance" (OED).

Re:Please God no!

[Anonymous Coward]

I remember Gopher.

Re:Please God no!

[enrgeeman]

No, because it's between java and flash, not behind them.

Re:Please God no!

[aztracker1]

I'm partial to SumatraPDF myself... lighter than foxit, without the installer grenade traps.

Re:Please God no!

[aztracker1]

LOL, I remember when "online" was a dial-up modem to ANSI-BBS session.. ;)

Wait, still do, just via telnet. /self_promotion

Re:Please God no!

[mhotchin]

...which works perfectly for a running computer program - it is an instance of the program that resides on the disk. More than one PDF - more than one instance running.

Re:Please God no!

[McGuirk]

SumatraPDF. I never install acrobat: it's a festering pile of cholesterol.

Re:Please God no!

[hedwards]

Well, the vulnerabilities in PDF, if I'm understanding it correctly, are largely a matter of bugs in Acrobat and the scripting abilities that Acrobat supports. Failing to implement the scripting alone would probably go a fair ways towards securely viewing PDFs.

Re:Please God no!

[Arlet]

Personal preferences are irrelevant.

Only if there's an option to keep your preferences. It seems that is has become fashionable for the designers to force their own personal preference on all the users, and remove options for customization.

Re:Please God no!

[kiddygrinder]

fuck acrobat. how can a program that essentially just renders markup be 64.69 MB? i was so happy when chrome brought in pdf viewing.

Re:Please God no!

[rapidreload]

Why would you voluntarily use it when there are several other PDF readers which don't even show up on the attack vector charts?

Adobe Reader will read ALL PDFs that are out there, guaranteed. I've encounter PDFs which opened up to a blank page in Foxit, whereas they worked just fine in Adobe Reader. I don't want to have to deal with that level of unpredictability when it comes to reading file formats, hence I still use Adobe Reader.

As for the attack vectors, well I have yet to encounter any issues. The same people that rant on and on about attack vectors are also the same people who think Windows BSODs and gets infected with malware/viruses/trojans all the time, which simply doesn't happen (to me at least), and as such I tend to downplay the rants they make regarding Reader, Flash and Java attacks.

Re:Please God no!

[icebraining]

I'm pretty sure they won't remove the Applications tab in the Preferences. Failing that, there's about:config. Failing that, someone will write an extension.

Re:Please God no!

[lennier]

"instantiate"? This horrible word doesn't mean what the writer thinks it does: it means "represent as or by an instance" (OED).

Yes, that's what it means in philosophy. It squelched from there into computing via Object Oriented Programming, as the squicky term for "creating an instance of a class", and from there into Windows via COM. Strictly speaking, instantiating means creating a running in-memory instance of an object or component, but since most of the time in Windows you're dealing with COM objects even when you think you're dealing with EXEs, it's pretty much the case that whenever you think you're "launching an executable", the Windows COM architecture is probably instantiating a COM object.

Wasn't that a nice semantics lesson?

Re:Please God no!

[maxwell demon]

Actually, with adobe reader (and many other programs) these days it is really only one instance running, even if started with separate commands. Which can royally suck if the command to show a PDF file doesn't terminate when you close that file, just because a completely unrelated file was opened from the web.

Re:Please God no!

[maxwell demon]

I think he wanted to imply that the #1 vector is Windows itself, making Java #2 and Acrobat #3. Which may or may not be true, I honestly have no idea whether it is (I don't use Windows, so I have little incentive to keep track of related exploits).

Re:Please God no!

[Panoptes]

It was indeed a nice semantics lesson! As an English teacher I really appreciate learning advanced meanings and lexical shift, so this is a little gem for me.

Re:Please God no!

[multipartmixed]

LOL, I remember when ANSI BBS sessions were *new* and a revolution over plain-text BBS sessions.

A full screen editor for making posts?! What a novelty!

Re:Please God no!

[140Mandak262Jamuna]

I don't want PDFs to open in the web browser. I want to open them in Acrobat in another window. Let the browser be a browser and Acrobat be Acrobat!

But the problem is Acrobat wants to be a browser. Why the hell should it follow hyperlinks and open itself for so many attacks? If you are still using acrobat and have not disabled the hyperlink ability you are in great danger of contracting a virus.

Re:Please God no!

[aztracker1]

Well, I kind of came in at the peak of BBSing... mostly PC based, and ANSi (Early-mid 90's)... Though I did start out on a monochrome monitor attached to an IBM PC-XT... with a 1200bps modem. ANSi was S-L-O-W... bumping to 14.4 was a godsend by comparison. 28.8/33.6 blazing fast.. until of course the intertubes... man, does everything feel sluggish at times now.

Re:Please God no!

[JohnnyBGod]

I use PDF X-Change Viewer. PDF annotation in a free program? The MSc student in me says "Yes, please!"

Re:Please God no!

[Spazmania]

I don't want Acrobat to be a browser either, but that's Acrobat's problem not Firefox's.

Re:Please God no!

[amicusNYCL]

Adobe Reader will read ALL PDFs that are out there, guaranteed.

Right, even the ones with malicious scripting that get delivered and opened in an iframe that doesn't even show up on the page.

I've encounter PDFs which opened up to a blank page in Foxit, whereas they worked just fine in Adobe Reader.

So why not set the default reader to an alternative, and only use Acrobat if the document can't be opened elsewhere? Having Acrobat set as the default reader with the browser plugin installed and enabled is the source of the problem.

The same people that rant on and on about attack vectors are also the same people who think Windows BSODs and gets infected with malware/viruses/trojans all the time

Pay attention to what I'm saying. I'm not saying that Windows is insecure or unstable, I'm saying that Acrobat is insecure. That's a fact, it's not just my opinion. I'm not ranting against Windows, I'm still happily using XP. IE, for it's part, is only number 4 or 5 on the attack vector list, a full 85% of attacks come through insecure plugins (like Acrobat). You can bury your head in the sand and act like it isn't true if you want, but that doesn't change anything in reality. Acrobat alone is responsible for nearly a full third of infections. Here is the study.

Will they ...

[Anonymous Coward]

Will they include any way to turn off automated content within PDFs? What measures will they take to protect my privacy?

May be the feature that drives me away from FF ...

Re:Will they ...

[icebraining]

It's Firefox, not Chrome. You'll be able to disable it if you want to.

Re:Will they ...

[Anonymous Coward]

You can disable the PDF Viewer in Chrome. Have you ever used Chrome? It even offers to open it in Acrobat if it can't render the PDF 100% correctly. Furthermore, it warns you if your Acrobat Reader is out of date before launching. Firefox is playing catchup here, I'm afraid.

Re:Will they ...

[icebraining]

Yes, I've used Chrome. In fact, I do it every day.

I'm talking about the general approach to the browser, not just the PDF viewer. Chrome is, in general, *much* less customizable than Firefox.

Re:Will they ...

[xyrka]

I'm one of the developers working on pdf.js. Can you elaborate a little more about what feature you're worried about? We want to take any privacy concerns very seriously. That said if you feel we are missing something feel free to start an issue on our github page or send mail to our mailing list https://github.com/andreasgal/pdf.js . The nice thing about the project is it is automatically sandboxed since everything is in javascript.

I like the idea...

[rsilvergun]

But it scares me. PDFs are hideously complex. Can you really do this without opening a whole new world of security vulnerabilities? I guess it's in the JavaScript engine, and that's where the security is....

On an upside, it's cool to see what sort of document processing is possible when you've got as many CPU cycles as you do these days :).

Re:I like the idea...

[BeardedChimp]

Consider that you can now run a linux virtual machine in javascript. Which you could use to launch a window manager and open the pdf into a native viewer.

Document processing is tame compared to what is possible these days.

Re:I like the idea...

[philarete]

The potential vulnerabilities are there whether the PDF is being opened in Acrobat or in the browser. Adobe Reader/Acrobat is one of the main ways that PCs get infected with malware. Comparing Adobe's security track record with that of Mozilla, I'd much prefer to let Firefox handle PDF viewing.

Re:I like the idea...

[arose]

If it's implemented in sandboxed javascript it can't open any vulnerabilities that couldn't be exploited by any old webpage (unless you run noscript that is).

Re:I like the idea...

[icebraining]

If it's implemented in sandbox javascript (...)

It is, since the demo runs as a normal web page, without requiring the installation of any addons.

Re:I like the idea...

[arose]

I know the demo is, less sure about the extension. It might hook into the UI or whatnot.

Re:I like the idea...

[Darinbob]

Step one make sure that it never ever writes to disk, uses the network, accesses DLLs. A reader should never write. Don't allow any operations that may be insecure and provide them as no-ops only. Any operations that are for display only are allowed, anything else should be highly suspect. Ie, go back to just what version 1 or 2 of PDF formats allowed.

It is absolutely absurd and illogical that something called "Adobe Acrobat READER" has security flaws that allows it to WRITE. Display the document only, only allow rendering. If there are special features that MUST be used for some inane corporate use then require using a separate standalone PDF malware vector for this, but you don't need to provide that broken functionality in a limited browser version.

Re:I like the idea...

[Anonymous Coward]

Umm. Injected code can do whatever the program authors didn't do. Including the calling of non-statically-linked functions like Kernel32.WriteFile. Changing the PDF renderer to Javascript won't close this escape vector because Mozilla hasn't supported process sandboxing on the Windows platform (re: MIC).

Re:I like the idea...

[Jiro]

Never mind security, how about speed? Is a PDF reader written in Javascript going to be as fast as a PDF reader written in a standard compiled language (which is already quite slow even on a modern machine)?

Re:I like the idea...

[Eil]

My big concern is that by adding seamless PDF rendering to browsers, we're inadvertently encouraging the less clueful to start designing web sites in PDF rather than the old, cumbersome, finicky HTML/CSS/Javascript combo.

Re:I like the idea...

[hedwards]

It's called Adobe Reader, because it reads PDF files, the notion that in this day and age you can have a program that doesn't write out its preferences somewhere is questionable at best. As soon as a program needs to write to disk for any purpose at all, there's going to be the possibility of it being exploited.

I'm not sure where you got the idea that a reader wouldn't do any of those things. A program with any utility at all is going to write to the disk, use the network and/or access DLLS. Unless you're coding the equivalent of a pet rock, you're going to be doing at least one of those things with any program you write.

Re:I like the idea...

[Rich0]

This is why we need to improve access control policies. Right now all your processes run under the same privilege level - your user account. I have no issues with Acrobat/etc opening its preferences file - but it shouldn't have access to anything else except for read-access to the file it was invoked upon.

What you need is a privilege model that is more granular than the user. Having write access to your home directory isn't really much more secure than running as root on a single user machine.

Android works this way by sandboxing individual apps (with the exception of the SD card, which is all or nothing). I think we need something a little better than this, but this is the general concept. SELinux goes a long way towards this.

Re:I like the idea...

[Darinbob]

The program should write out its preferences. The pdf file you're reading should not do this.

Re:I like the idea...

[Anonymous Coward]

It is absolutely absurd and illogical that something called "Adobe Acrobat READER" has security flaws that allows it to WRITE. Display the document only, only allow rendering. If there are special features that MUST be used for some inane corporate use then require using a separate standalone PDF malware vector for this, but you don't need to provide that broken functionality in a limited browser version.

Doesn't work that way. Adobe added full macro capabilities to PDF like MS Office. You can have an E-Form in PDF which generates a text file on the harddrive and uploads it to an FTP server using Javascript in a PDF.

Stupid? Absolutely. Unfortunately, that has never stopped business users who have decided they need something and that there is no other possible way to do it (we'd have to spend money on legacy systems to support changing requirements, holy shit!).

Re:I like the idea...

[butlerm]

Is a PDF reader written in Javascript going to be as fast as a PDF reader written in a standard compiled language?

No.

Re:I like the idea...

[Anonymous Coward]

It probably *will* hook into the UI(*), but the security implications depend on how deep it does and how much the actual PDF rendering uses these hooks / depends on them.

(*) for example, the demo website for the JS-based renderer won't let me save the PDF with cmd+s since that saves the renderer code, not the PDF. A proper extension would hopefully let me save the PDF instead.

Re:I like the idea...

[ChrisMaple]

I share your concern on PDF web pages, but at least PDF is unambiguous and (should) be rendered the same on all browsers. 3 years ago I tried to create a resume in html that looked the same on firefox and IE, and gave up after two weeks.

Re:I like the idea...

[b4dc0d3r]

While your point is valid, that a reader should not write, you misunderstand vulnerabilities. Yes it could be sandboxed, but it isn't.

If a program loads Win32 API libraries, which it pretty much has to to run under Windows, the code to write and modify is already loaded and available. A small vulnerability can allow malicious code to call the write functions, and it doesn't take much code to do that.

This is why simply having the Explorer interface show icons of the app lead to a critical vulnerability. Load an icon, fail to handle buffer overflow, and arbitrary code is now running on your computer.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1049

I tried this days ago.

[mhh91]

It does work, but it's still alpha quality at best.

Page layout is messed up.

Re:I tried this days ago.

[xyrka]

It definitely still is a work in progress, but if you find a problem please file an issue on https://github.com/andreasgal/pdf.js . We are working hard to support more PDFs, but the spec is huge (over 1000pages) so it will take some time.

FIGHT!

[thegarbz]

No longer will you have to fight with an external PDF plug-in in Firefox.

I'm sorry but if you are fighting with the PDF plugin you're doing it wrong. Every plugin I've used to read PDFs seems to work pretty seamlessly from Acrobat to Foxit. They just work, no fighting involved.

Frankly I couldn't give a damn about the ability for browsers to read PDFs natively since on every computer I've used recently this doesn't actually add any functionality. PDFs open anyway.

Re:FIGHT!

[93 Escort Wagon]

I'm sorry but if you are fighting with the PDF plugin you're doing it wrong. Every plugin I've used to read PDFs seems to work pretty seamlessly from Acrobat to Foxit. They just work, no fighting involved.

But that's usually proprietary software using a non-Slashdot approved license! Think of the children!

Seriously - you're right. Why reinvent the wheel? Just hook into what the OS provides - the Mac has handled PDFs next to forever, and I'm pretty sure Windows 7 does as well. And Linux... well no one uses a GUI there anyway, right?

Re:FIGHT!

[icebraining]

For mousy users embedded readers are fine. For keyboard users it's hell, since plugins grab the focus away from the browser.

Re:FIGHT!

[icebraining]

(...) I'm pretty sure Windows 7 does as well

Nope. Windows only has APIs for their own pet document format (XPS).

Re:FIGHT!

[Anonymous Coward]

Reader X's ActiveX plugin was broken and unsupported on IE9 for like 6 months.

Re:FIGHT!

[Anonymous Coward]

Addendum: I don't think it supports 64-bit IE either.

Re:FIGHT!

[thegarbz]

This is slashdot. Sympathy will be hard to find for this problem.

Re:FIGHT!

[Anonymous Coward]

I'm sorry but if you are fighting with the PDF plugin you're doing it wrong. Every plugin I've used to read PDFs seems to work pretty seamlessly from Acrobat to Foxit. They just work, no fighting involved.

It even works better if it isn't a plugin. Just open the PDF in an external application (not necessarily Adobe reader) and use a UI that works well for PDFs. All the browser needs to be able to do is launch an application, the application needs to know nothing about the browser. It's simple and it just works without creating all kinds of unneeded dependencies. I don't consider a PDF to be a web page, just because I happen to find it on the web.

There are real problems to solve first, Mozilla!

[Anonymous Coward]

What Mozilla apparently doesn't realize is that there are serious problems with Firefox that should be fixed long, long before this sort of crap is added.

1) The poor performance and the extreme memory usage. Yes, this is still a problem. It's easily reproducible with fresh Firefox installations. No, it's not a problem extensions. No, it's not a problem with plugins. No, it's not a problem with my computer (Chrome, Opera and Safari run just fine). The problem is solely with Firefox.

2) Can the "UI designers". The Firefox UI has been completely trash since Firefox 4. It is much less usable than earlier releases. Bring back the status bar. Bring back the menu bar. Bring back the protocol in the URL bar. Don't make us install extensions or resort to other hacks just to bring back this basic and integral functionality!

3) Fix the fucking auto-update process and the releases so that extensions don't break near-constantly!

4) Stop trying to imitate Chrome. If we wanted to use a browser like Chrome, we'd fucking use Chrome! If we aren't using Chrome, it's probably because we want something different.

For crying out loud, Mozilla, fix these real issues that affect every user before adding useless crap like this PDF nonsense to Firefox.

How about eradicating PDFs instead?

[MrEricSir]

Don't mean to knock Mozilla's hard work here, but how about tackling this problem in the other direction: get rid of PDFs entirely.

Sure, PDFs are great for printing, but who prints anymore? It's 2011.

And before you say "well you can fill out forms with PDF" might I remind you that you can do the same on the web, in plain ol' HTML.

Re:How about eradicating PDFs instead?

[amicusNYCL]

Sure, PDFs are great for printing, but who prints anymore? It's 2011.

You're being serious, right? You think that companies everywhere dumped their printers in the garbage why?

Re:How about eradicating PDFs instead?

[kerashi]

PDFs are great when you want to save a document for later, offline use. Like a product manual, which one may refer to once in a while. You can refer to your local copy, and not have to download it every time.

PDF's are also great for preserving the formatting on documents. It takes a lot of effort to get the formatting to appear exactly the way you want it to in HTML in every browser. Now imagine you have 5,000 separate product manuals, which one can either simply and easily export to PDF, or have the headache of converting to HTML (and losing portions of the formatting in the process), and it's an easy choice.

Using PDF's for major portions of websites is stupid, but they do have their place. It's all a matter of using the right tool for the job (or at least the least bad tool).

Re:How about eradicating PDFs instead?

[presentchaos]

Who prints anymore? How about people who work outside the office or from home in the field, whether they are sitting in a movie theater having to write down the trailers, or have to visit several retailers where the signature is necessary. Maybe a person who audits a large electronics store and the audit paperwork exceeds 40 pages? Just a few examples and if people didn't print anymore because it is 2011 maybe you need to convince HP, Lexmark, Brother, Canon to stop making the devices and let Office Max and Staples know they are wasting floor space with their print services because printing is a thing of the past.

Re:How about eradicating PDFs instead?

[Anonymous Coward]

Perhaps I'm just feeding the trolls but...

Almost all academic research is published as PDFs. Printed or not, I couldn't get through even one day without opening a PDF.

Re:How about eradicating PDFs instead?

[Anonymous Coward]

Because PDF, unlike most filetypes, is capable of handling vector graphics and embedded fonts so that they can be reliably displayed on any device. In particular, it's also easy to scale with PDF, thanks in large part to the vector support. This means that anyone who can open a PDF file (an open format, I might add) has access to these advantages. This is especially useful for creating documents and posters not destined to be printed professionally, but which also have the same appearance regardless of the system used, and regardless as to whether it's for display or print.

Re:How about eradicating PDFs instead?

[icebraining]

You know you can save HTML pages too, right? Browsers nowadays are pretty good at saving the page requisites too, like images and CSS files.

Re:How about eradicating PDFs instead?

[tepples]

As I understand it, popular web browsers aren't yet good at laying out HTML documents for a paged medium (as opposed to an infinitely vertically scrolling medium). How much of the paged media module for CSS do the popular browsers implement?

Re:How about eradicating PDFs instead?

[Jeremy Erwin]

PDFs are great for scientific papers. The equations and footnotes are formatted correctly, I can cross reference 30 or 40 pages at once, without trying to click back and forth through ad laden pages, and I can see two pages at once on my wide screen monitor, or go back to a single page if I want to make Preview.app's window smaller.

The alternatives based on Flash are horrible-- the anti-aliasing is subpar, the window can't be resized and so on.

Re:How about eradicating PDFs instead?

[MagicM]

PDFs are great for printing, but who prints anymore?

I do. Better yet, I use PDF to print stamps so that I can send my printed PDF to someone else.

Re:How about eradicating PDFs instead?

[icebraining]

I was actually referring to the first paragraph of parent's post about saving a local copy for later use. I have no idea how the paged media support is nowadays.

Re:How about eradicating PDFs instead?

[melikamp]

PDFs are great for scientific papers.

Only for printing. The difference between PDF (produced from something like LaTeX) and XHTML+MATHML+SVG is that

(1) PDF is paginated nicely, which is essential for printing, and an obvious minus for on-screen viewing.

(2) PDF has lost the content layer, which is nearly irrelevant for printing, and unforgivable for on-screen viewing.

What you really need for scientific papers is a large page that can flexibly display full color text and images. PDF is one of the best ways to describe a printable version, but it's a far cry from the best way to describe an on-line document .

Re:How about eradicating PDFs instead?

[Anonymous Coward]

Scientific papers are done primarily in LaTeX. I'm guessing you don't actually write science papers, eh?

Re:How about eradicating PDFs instead?

[Raenex]

PDFs don't flow text, which makes them crap for online reading. I also really hate when the PDF author decides he wants two columns, which really sucks when you have to scroll down and then up to continue reading.

Re:How about eradicating PDFs instead?

[jrumney]

I'll be impressed if PDF.js can handle this. I don't know about the USPS version, but Royal Mail's stamp printing relies on security features of PDF that do not work in any third party PDF reader I have seen. Which is a pain because Adobe Acrobat is a bloated pile of security vulnerabilities that manages to freeze Firefox while PDF documents load.

Re:How about eradicating PDFs instead?

[Ltap]

PDF is about the only document format that hits all the checkboxes of being standardized, more open than the alternatives, preserves formatting, wide support in word processing, LaTeX, etc., wide OS support, and supports more advanced formatting.

Re:How about eradicating PDFs instead?

[ortholattice]

Scientific papers are done primarily in LaTeX. I'm guessing you don't actually write science papers, eh?

Yes, in they usually are done in LaTeX in math and physics. However, the resulting PDF (or less frequently, PostScript) is what is distributed and viewed. I have published many papers myself and have never had a reprint request for the original LaTeX, only for the PDF.

The LaTeX goes to the publisher (usually written to the journal's standards using highly customized formatting packages), who redistributes it in a printed journal and usually on-line in PDF form (unfortunately for a price). Some journals force you to use a two-column format, which I agree with another poster is awful to read on-screen; I have no control over that. When the publisher allows, I put a preprint in PDF format on arxiv.org where you can get it for free.

A problem with a flowing text document format is that the page numbers are variable, making references to specific pages and paragraphs impossible. I also tend to have a "page memory" where I can recall roughly what the page looked like and where on the page an item I want to find is positioned. I think a lot of people have had the experience of not remembering exactly in a book something was, but they remembered where it was on the page it and can quickly find it by thumbing through pages. I am not as good at remembering where something was in a flowing document and have to resort to a search, which is doesn't work too well for equations and symbols.

I have a large collection of scientific paper PDFs that I constantly reference. One thing I do (when the publisher doesn't lock the PDF) is trim off the margins so that fill-width view automatically fits the full text on screen without having to zoom by trial-and-error and futz with the horizontal scroll bars. Actually even when the publisher locks it, if it is a paper I reference frequently I'll print it to a PDF, then trim the annoying margins and re-OCR it.

Re:How about eradicating PDFs instead?

[Anonymous Coward]

I'd sooner eradicate HTML than PDF.

Re:How about eradicating PDFs instead?

[petermgreen]

Sure, PDFs are great for printing, but who prints anymore? It's 2011.

I do because when reading a long document I preffer to do it on paper than on screen ;)

get rid of PDFs entirely.

Going from printed to pdf was a relatively easy transition. Just install a printer driver or a plugin in your document preperation system and you are good to go. For big documents you probablly want to convert the TOC to bookmarks but even that isn't too big a deal (for latex users the hyperref package can do it and IIRC for word users the hyperref package can do it). Even paper documents could be converted to PDF if necessary though the results were often less than ideal. Storing stuff electronically represented a major convenience improvement and cost saving over a photocopy on request system (which afaict is how both academic papers and component datasheets were handled in the days before PDF).

Preparing reflowable documents on the other hand requires a totally different workflow than preparing sequences of pages. Making a workflow that does both well (because you still have to provide a printed/printable version) is even harder. Further even if all new documents were prepared to be reflowable (fat chance) that still doesn't provide a soloution for existing non-reflowable content.

Re:How about eradicating PDFs instead?

[hedwards]

The right tool for the right job. HTML isn't intended for the purpose. PDF was designed for the explicit purpose of taking it to pretty much any computer and opening up, while preserving the formatting, fonts and content that is in the PDF.

HTML is getting better, but it's really not an acceptable solution when you're requiring a number of files per page. Sure, you could zip them all up, but at the end of the day it's the wrong tool for the job.

As far as PDFs go, there's nothing wrong with them that removing the extra functionality couldn't fix. Most of the problems are purely because somebody decided that it would be cool to do more than just format and display documents. Sort of like what happened at MS that gave us word macro viruses.

Re:How about eradicating PDFs instead?

[Anonymous Coward]

I think you misspelled EPS when you accidentally typed PDF. Scientific papers only need PS or EPS.

PDF was originally just a non-Turing-Complete subset of postscript, but then for some fucked up reason it re-evolved interactive Turing-Complete Javascript extensions that are completely unnecessary for scientific papers.

Oh yeah, and the PS/EPS files are usually smaller than PDF, too.

Re:How about eradicating PDFs instead?

[melikamp]

I really like PS, even as a programming language. Somehow it reminds me of the Logo turtle. But my point is, both PS and PDF kind of suck for online scientific "papers". They are hard to flow, they lack the content layer, and are very hard for robots to read.

Re:How about eradicating PDFs instead?

[Arlet]

PDFs don't flow text, which makes them crap for online reading

It's also an advantage, because if the text doesn't flow, it's much harder to change it dynamically, which makes it much harder to put advertisements in there.

Re:How about eradicating PDFs instead?

[Raenex]

I just use AdBlocker and don't worry about it for the most part. I also am not worried about ads in scientific papers. The people who host PDFs could put ads in now by prepending pages. They don't.

Re:How about eradicating PDFs instead?

[Arlet]

With adblockers, the text doesn't always flow nicely around the place where the ad used to be. So, if you want to print HTML from a website, even with ads blocked, you rarely get a good looking result. Even if there are no ads on the page, HTML designers add way too much crap to a page, with extra graphics, lines, borders, fading colors, etc...

In contrast PDFs I read (mostly datasheets and user manuals) are often much cleaner in design.

Re:How about eradicating PDFs instead?

[Raenex]

I'm just not worried about ads that would appear in traditional sources of PDFs. I'm much more concerned about being able to flow text properly.

Re:How about eradicating PDFs instead?

[caution live frogs]

You're arguing this from the standpoint of someone who assumes all scientific papers are centered around MathML. You're ignoring humanities, for example, and behavioral sciences where images and graphs are a lot more common than equations. Anything that can be a vector should be a vector, in my mind, and PDF works very well for this. It's not new technology, it's mature, and it works on essentially any device and platform.

What is more, PDF works for papers already published. I need to access stuff from JStor, from pre-digital archives of Nature and Science, and so forth. If you want to go and retroactively convert millions of articles into XHTML, you go ahead. The rest of us will scan them into a PDF with OCR.

What you really NEED for scientific papers is a format that works on any device, including paper. We need to have the information available to anyone, anywhere, not just on 1st world computing devices. PDFs do this quite well.

Re:There are real problems to solve first, Mozilla

[Vaphell]

Memory:
noscript, adblock, flashblock to cut down unnecessary bullshit
http://kb.mozillazine.org/Browser.sessionhistory.max_total_viewers

Bring back the protocol in the URL bar:
about:config -> browser.urlbar.trimURLs = false

Consider your environs

[Anonymous Coward]

TFA's about a PDF renderer running in Firefox - and what you take out of that for a security concern is the PDF renderer? Um... The horse goes in front.

why not ditch pdf?

[pspahn]

Instead of spending all the time supporting pdfs, why not just ditch the format entirely and make documents with HTML?

Re:why not ditch pdf?

[Shikaku]

http://dowebsitesneedtolookexactlythesameineverybrowser.com/

Re:why not ditch pdf?

[icebraining]

For the same reason web developers still need to support IE6: people won't stop using certain software/formats just because we really wish they wouldn't, and we have to deal with it.

Re:why not ditch pdf?

[Anonymous Coward]

Because HTML has shitty support for vector graphics, and every browser renders things differently, which is exactly the reason that PDF exists to begin with.

Re:why not ditch pdf?

[Anonymous Coward]

And that's why web sites don't use PDF, and why not all documents are friggin web sites.

HTML is great, but when I have a document to which I refer to "the bottom of page 2", I do not want to have to qualify this with "depending on which of the five hundred and nineteen trillion possible layout configurations possible with the current software stack and device resolution".

Re:why not ditch pdf?

[spage]

Because HTML has shitty support for vector graphics

You're mistaken, there's <canvas> and <SVG>. Here's a basic summary comparing them. You can also do some impressive vector effects just with CSS, such as animating graphs and pie charts.

goodbye acrobat reader and good riddance

[lophophore]

I like how Chrome can display most PDFs right in the browser. No troublesome plugin required.

The last few versions of Acrobat Reader have so much bloat and need to be updated so often, it is nearly more trouble than it's worth.

To have Firefox display PDF directly is wonderful news. Good job!

Re:goodbye acrobat reader and good riddance

[godel_56]

I like how Chrome can display most PDFs right in the browser. No troublesome plugin required.

The last few versions of Acrobat Reader have so much bloat and need to be updated so often, it is nearly more trouble than it's worth.

Foxit Reader is tiny compared to Acrobat.

BTW, they've just released V5.1 for Windows.

Re:goodbye acrobat reader and good riddance

[Overzeetop]

If you get a real reader with editing capabilities you'd find the experience much better. Adobe is not the best our there; Bluebeam is awesome if you need to make notations in PDFs. I wish they had a version for tablets.

Re:goodbye acrobat reader and good riddance

[Anonymous Coward]

Why are you recommend $179 PDF-editing software to a commenter that never mentioned needing to edit PDFs? The issue at hand here is the latency, overhead, and security concerns of having a third-party PDF reader have to operate within the browser; being able to notate PDFs with Bluebeam addresses absolutely _none_ of those concerns.

Re:goodbye acrobat reader and good riddance

[Malc]

This was the reason I didn't switch to Chrome from FF when I evaluated it last year. I have to deal with a lot of PDFs for my job (e.g. Specs from other companies), many of which are stored on intranet web servers, many on my local hard drive I prefer the UI of the standalone Adobe Acrobat reader, even over the Adobe browser plug-in. I found a way to get Chrome to open these in the Adobe Reader, but then Chrome kept a window open that didn't redraw and killed the Adobe Reader if closed. WTF? What kind of idiot programmer thinks that's an acceptable user experience? I hope FF does a better job and I can continue to use the standalone reader. I might as well move to Chrome otherwise, which will let me regain some control over memory usage.

BTW you can hardly complain about Adobe updating all the time. FF has this stupid version inflation going on. And I have a bunch of other FOSS software that constantly interrupts and bombards me with upgrades, mostly irrelevant to me and not security related.

Re:There are real problems to solve first, Mozilla

[adolf]

Bring back the protocol in the URL bar:
about:config -> browser.urlbar.trimURLs = false

I didn't even notice it was gone, but I'm pleased to have it back. Thanks!

Re:There are real problems to solve first, Mozilla

[rimugu]

You have to be kidding.

Menu bar, Firefox Menu/Options/Menu bar
Status bar, Ctrl+/

You have already been answered about protocol, and I have not seen poor performance, memory usage could be better, but it is clear you are ignorant of Firefox and blowing it out of proportion.

Depends on what "features" Firefox enables

[knorthern knight]

PDF started out as "Portable Display Format" that showed you what a document would look like if you sent it to a decent printer.. If it had stayed that way, it would be ideal. Unfortunately Adobe succumbed to the Microsoft/Mozilla "features disease". The "latest greatest" versions now support javascript, live URLs that you can click and go to. And then there's "/launch" (it's not a security hole, it's a feature). Not to mention support for schlockwave trash.

Over the years people have complained about how every new version of Adobe Reader is more bloated, and takes longer to load than its predecessor. If Firefox offers a lightweight PDF ***READER***, I'm all for it. But puhlease, not all the stupid features in Adobe's version. Speaking of versions, the one feature I strongly suggest is that Mozilla allows its PDF engine to lie about what it is. Just like asshole webdesigners who hardcode Internet-Explorer-only into their web pages, I'm sure there are idiots who hardcode their webpages to only allow Adobe Reader above a certain version to access their PDF documents.

Re:Depends on what "features" Firefox enables

[hedwards]

I'm pretty sure that's not true. PDF has been an open standard for a few years now, and I'm not sure how any document would know what reader was trying to read it anyways.

Re:Depends on what "features" Firefox enables

[Rich0]

Yup - I think that the Reader team was in competition with the Photoshop team to see which app could display more plugin loading messages on its startup banner...

Re:Depends on what "features" Firefox enables

[kermidge]

On April 14, this year, Wisconsin efile tax site required a specific version or higher of Adobe Reader; no lesser versions, no alternatives.

Re:Depends on what "features" Firefox enables

[One-Note Pony]

The online grant applications at grants.gov are famous for this. They require Adobe Reader/Acrobat of a specific version and point revision. Worst of all, said version is usually but not always the latest version, so if you're aggressive about pushing security updates to the end users who actually need the Adobe product (and with Adobe software you need to be) you can actually end up having too recent a version.

Viewing a partially downloaded PDF

[tepples]

Uh, you have to download the PDF in to view it in your browser too.

Some PDF viewers can begin displaying the first page while the rest of the pages are still downloading.

Re:Viewing a partially downloaded PDF

[Anonymous Coward]

Exactly, which is why I didn't understand BeardedChip's complaint.

Re:Viewing a partially downloaded PDF

[maxwell demon]

I think the normal procedure is that the web browser downloads the file, and then starts the PDF viewer to show that file. Whether the PDF viewer would have been able to download that file by itself and display it is then irrelevant because it is not even started before the download is complete, and it doesn't even get to see the original URL.

That does it.

[Fuzzums]

If this finds it's way into FF, I'll finally will ditch FF.
They are WAY of the KISS path. Updates every week, new GUI every 6 weeks. FRELL THAT!
I want long term stability in my browser. Not this crap.

FF. Time to branch the development. One for BS and one for KISS. I'll install the plugins I need.
Oh. About:plugins. Stop breaking them every 3 months.

Re:That does it.

[Anonymous Coward]

If this finds it's way into FF, I'll finally will ditch FF.

I really doubt the thing has emotions of any kind.

Re:That does it.

[Anonymous Coward]

Go for it - nobody is stopping you. Isn't it great to have choices?

Personally, I think PDF.js is a great step forward and my choice is still Firefox.

Re:That does it.

[Anonymous Coward]

So you are going to use Chrome?

Which btw has one built in... And update every few weeks too...

Or maybe you will use IE or Opera? Opera updates every few weeks. So that leaves you with IE who update about every 1.5 years.

Re:That does it.

[Microlith]

Updates every week

I know, it's so terrible getting regular security updates.

new GUI every 6 weeks

Funny, after I installed FF4 I reset the UI to FF3.5 style. Now I'm on Nightly 10 and it looks the same.

I want long term stability in my browser. Not this crap.

Fortunately it's javascript, so it won't impact the browser itself at all.

I'll install the plugins I need.

Enjoy your Adobe-introduced security holes.

Oh. About:plugins. Stop breaking them every 3 months.

The single biggest problem is addon developers not bothering to keep pace with FF development. That is to say, they don't bother to update it while it's in Beta and people are upset their addons break on release. Whereas well maintained plugins like NoScript work great even on the bleeding edge, hell even some that haven't been updated for anything past 5 work fine if the version number is ticked upwards.

Re:That does it.

[Fuzzums]

Go for it - nobody is stopping you. Isn't it great to have choices?

True :)
I just think it's sad that such a nice browser, fast, no bs, has changed into.. this.
Maybe if the next step would be a huge setup procedure where you choose not to install a lot of features. THAT would be nice :)

Personally, I think PDF.js is a great step forward and my choice is still Firefox.

I already have a pdf reader on my computer. so why would I need another one?

Re:That does it.

[Anonymous Coward]

Some of us use wget followed by lynx ./index.html you itchy bitch.

Re:That does it.

[Anonymous Coward]

I'm guessing your going to Chrome, right? Has exactly the same release model and ... *drumroll* ... a builtin PDF viewer.

Re:That does it.

[caution live frogs]

There is no functional PDF plugin for Firefox on OS X. The one that worked in prior versions (PDF-Quartz) was broken by Fx 4 and only works if you use the right patched unofficial version, and force Fx to start in 32-bit mode. I look forward to a working, built-in PDF plugin. The goal here is a cross-platform plugin that eliminates the need for third party crap (I don't like having things open in a separate window, because that forces a local download whether I want the PDF on my disk or not, and every version of the Acrobat plugin I've ever used on Windows was dog-slow and laden with unnecessary features).

I welcome any software that makes it easier for me to be platform-agnostic in my daily computing tasks.

Page number references

[tepples]

Say I have an element <h3 id="something">something</h3> on one page of a document. On another page of the same document, how do I get the browser to calculate the page number of this element so I can write, for example, "See section 'something' (p. 5)"?

Re:Page number references

[Anonymous Coward]

If you were writing HTML, you wouldn't use "page numbers" at all, you'd just write 'See section something'.

Re:Page number references

[broken_chaos]

For a web document? You hyperlink it. "See section '<a href="section.html#something">something</a>."

PDF is great for documents that will be printed out, though. Unlike what paper-free idealists think, this is a number which is substantially larger than zero -- so the format does have its place. If you're providing it via the web, though, it would generally be polite to provide both an HTML copy and a PDF copy.

Re:There are real problems to solve first, Mozilla

[splorp!]

THANK you! That's been pissing me off for a while.

Neat!

[OQuotes]

Pretty neat. Leave it to Firefox!

Will it also be able to save html as pdf?

[Toddlerbob]

I know the answer to this must be no, at least in the short term, but I would think that the same engine might some day be used for that purpose, which I would use a lot, as I often save web pages, and I usually save them in that awful format with the text separated from the directory of resources, because that's what every browser, even old models, can read. It would be nice to save web pages or even web sites from the browser into pdf, like I used to do with Adobe Acrobat, back when I could afford to buy such things.

Re:Will it also be able to save html as pdf?

[shutdown -p now]

You can easily do that today with any of the free "Print to PDF" applications (in Windows; in OS X, it is built-in, and I'm pretty sure this is the case for Linux as well).

Re:Will it also be able to save html as pdf?

[Anonymous Coward]

Seriously. Ever hear of PDFCreator? I print dozens of HTML pages to PDFs a week.
can they do something like this for IE? I'd love to get the 200 mb adobe reader off my PC, and not have to patch it across the whole company every two weeks.

Re:Will it also be able to save html as pdf?

[shutdown -p now]

IE - as in, the browser - is really just an ActiveX host container that displays the appropriate component depending on the type of file downloaded from any given URL. If it's HTML, it'll use the HTML rendering engine. If it's PDF, it'll use whatever application is registered as the ActiveX handler of PDF documents. Adobe does it for their stuff, but third-party PDF viewers could do the same - and I would be surprised if some of them don't do just that.

As for this Firefox thingy, they claim that it's written in JS and uses HTML5, by which I suspect they mean canvas... if so, it shouldn't be hard to adapt it to IE9.

...once printed

[tepples]

So how do I make that link turn into a page number reference once printed? I guess I could make each document available as both HTML for viewing on a scrolling screen and PDF for paper or an e-ink screen, but that isn't "ditch[ing] the format entirely".

Goodbye, developer version of Google Chrome!

[Anonymous Coward]

The only reason I had Google Chrome (and deleted all of its updating components!) was to look at PDF files.

If Firefox can eventually do this job as nicely as that old Chrome version, then goodbye, Chrome!

Re:There are real problems to solve first, Mozilla

[Anonymous Coward]

That's still far more effort than should be necessary to make visible things that never should have been hidden in the first place.

The problem isn't even so much that they're gone, but rather that the Mozilla dev team was stupid enough to remove them in the first place.

Re:There are real problems to solve first, Mozilla

[reub2000]

4) Stop trying to imitate Chrome. If we wanted to use a browser like Chrome, we'd fucking use Chrome! If we aren't using Chrome, it's probably because we want something different.

Hey, Konqueror had integrated kpdf into the browser way before Chrome existed.

Congratulations to Firefox...

[Shag]

...for adding a capability Safari has had for over five years. :)

But seriously - the sooner we get to a point where all major browsers have this capability built-in, the sooner we can be free of the abomination that is "Acrobat plugin."

Re:Congratulations to Firefox...

[Anonymous Coward]

The worst thing is that there's been a firefox extension on OS X to use the same Quartz backend to render PDFs inside the Firefox window. It worked from 3.x to 5. It apparently works on firefox 7/32bit, but is broken on x86_64. Updating the shim to work when Firefox is run as 64bit would not be difficult, but effort is being spent on reinventing the wheel.

Re:Congratulations to Firefox...

[jlebar]

Safari uses Preview internally, I believe. That's a C/C++/Objective C program, with all the security vulnerabilities that go along with that.

The news here is that Mozilla is trying to develop JavaScript which renders PDFs. So long as our JS engine is secure, this PDF reader would be secure. (And if the JS engine isn't secure, the whole browser isn't secure, so adding the PDF viewer isn't an attack vector.)

Re:There are real problems to solve first, Mozilla

[mqduck]

Me either. But it doesn't seem to hide it if it's anything other than HTTP, so it's still unambiguous. I decided to leave the feature on.

how about reversing the process?

[pr0t0]

Opening PDF files in the browser is great and all, but I would be more interested in using this lib to programmatically create PDF files from what is in the browser. This would be particularly useful as svg gets wider adoption. Right now, the process requires conversion to canvas as an intermediate step.

Re:how about reversing the process?

[PARENA]

Not sure if it's what you want, but you can "print" a web page and instead of sending it to the printer, you can save it as a PDF file. I believe it's available in most browsers.

laugh...

[Anonymous Coward]

"Meet Firefox's Built-In PDF Exploit Hole"

I use Google docs thanks.

Page or slide defined

[tepples]

A "page" or "slide" is a division of a document that is the same size as a viewport. Progression through a document made of pages is done by showing the next or previous page in the entire viewport. The analogy is to a codex, which has two pages on each sheet of paper, or a set of film slides loaded into a projector, which presents one page on the screen.

Layout for paged media uses different techniques from layout for an unbounded vertical scrolling document. Pages are typically given sequential numbers displayed in a "footer" at the bottom of each page. The title of a document may be shown in a "header" across the top of each page, analogous to the "title bar" in a scrolling windowed environment. A footnote may be shown at the bottom of the page where it is first referenced, instead of at the end of a document. Figures and tables are rarely split from one page to another. And in general, it's a bad idea to leave one line of a paragraph at the top of a page.

Re:There are real problems to solve first, Mozilla

[cyberstealth1024]

I didn't notice that it was gone either. btw, even with the URL trimmed, it still shows "https://" for secure sites.

Oh awesome...

[Anonymous Coward]

something else firefox have that will cause every program running to hang for 30 seconds at a time.

Re:There are real problems to solve first, Mozilla

[jlebar]

1) The poor performance and the extreme memory usage. Yes, this is still a problem. It's easily reproducible with fresh Firefox installations.

We have a whole team of engineers devoted to memory usage, and a second team devoted to performance. If you have issues you can reproduce, especially on a clean Firefox install, we'd love it if you'd file a bug. We can only fix problems we're aware of, and we're not aware of any huge leaks in the versions we're shipping.

http://bugzilla.mozilla.org/

Re:There are real problems to solve first, Mozilla

[Anonymous Coward]

We can only fix problems we're aware of, and we're not aware of any huge leaks in the versions we're shipping.

Who said anything about leaks?

Figure out what makes your browser so FAT.

SaltOS includes this library to allow read PDF

[Anonymous Coward]

In my program SaltOS (an online CRM / ERP), I added a online PDF reader using programs as convert and pdfinfo on the server. When the user wanted to view a PDF online, the server must convert all pages to images and all images were transferred to the client. With PDF.JS I can remove the dependency of the two programs on the server and I have only to send the PDF to render the document in the client. I have to say that the results are very good. All PDF generated by my application will automatically be displayed correctly without any plugin. Thanks to the Mozilla team by this great library.

Loading... 0%

[guus_deleeuw]

That's all I got. But I like the idea. It just needs a bit of work .... 100%

Good news

[peppepz]

PDFs are hypertexts, so they fit perfectly in the "browser" model. For example, it's nice to have a single browser history spanning across both PDF and HTML pages. And PDFs are everywere, you often stumble upon them while navigating in technical or legal contexts.

While a PDF reader undeniably widens the attack surface for exploits, I don't think this is going to be much more a security hazard than supporting some new extra features of HTML5.

And adding it to Firefox might induce Google to open source Chrome's PDF engine (assuming they haven't licensed it from a third party).

There are too many PDF features

[pe1chl]

What people apparently don't realize is that there are way too many features in PDF to do a quick and dirty viewer.
It will probably work on some simple PDFs created by a "print to PDF" tool, but once you start viewing more advanced PDFs you will be in trouble.
Some time ago we switched from Adobe Reader to a competitor PDF reader where I work, and we still encounter PDFs that view OK in Adobe but fail in the new viewer.
Especially (but not only) PDFs that contain user fillable forms cause trouble.

The experience is much like using another browser than Internet Explorer was 5 years ago.
Often it worked, but frequently you encountered pages that won't render or function correctly.

Re:There are real problems to solve first, Mozilla

[TheLink]

Perhaps the high memory usage is not actually a leak, and the browser is just "working as designed". Despite that it can still be considered a problem to the users.

Here's an example (firefox 3.6.23). Yesterday I had many mozilla windows and tabs open. The browser took up 600MB. I closed everything except one one window with one tab, and opened a new tab, and closed the other tab (so there is no page to go "Back" to).

The browser process still took up 400MB. Why? Note: I am using noscript, adblock plus, treestyle tabs and certificate patrol.

I just tried it on another mozilla browser that does not have treestyle tabs (but with noscript, adblock plus and certificate patrol), on start up: 67MB. Opened up slashdot, classic discussion, opened a few large articles, got that browser process to 170+MB. Opened Google in a new window (so no cacheable "back history") . Closed everything else. Browser process drops from 170MB to 105MB. So what is the extra 30+MB for?

For people who only use Mozilla that may not be a problem since the 400MB may be buffers or cached data that Mozilla can reuse again.

But many people use other applications as well - word processors, email programs, spreadsheets, virtual machines, development environments. So if they close browser windows and the browser does not return the unnecessary memory to the operating system for use by their other applications unless they close the ENTIRE browser, to them that is a BUG.

Maybe you can have a configurable for "browser only machine" vs "Multitask machine".

No, I am not going to upgrade to your latest major version[1]. I see no proof that you guys fixed the problem. That said, mozilla has improved over the years, thanks.

[1] BTW it's pretty stupid of you guys to mess about with the version numbers for no good reason. At worst case do what the other stupid companies do: have a marketing version number (for those who care about the bullshit) and a technical version number (for those who care about the tech and truth).

PDFs are for high quality rendering

[loufoque]

PDFs are used for high-quality text rendering suitable to print long documents (papers, thesis, etc.).

Web technologies simply *do not* offer that kind of high-fidely rendering. Even the operating-sytem-provided font rendering is far behind the font rendering capabilities of most PDF viewers.
Implementing PDF by making them render HTML is simply utterly stupid and pointless.

It's essentially like trying to view flickr in VGA text-mode. It's possible, but I don't think ascii art is quite good enough to convey the information behind HD photographs.

Re:PDFs are for high quality rendering

[Anonymous Coward]

The groundwork for high fidelity rendering is there. Currently we render to an html canvas which we can make as big or small as we want. We also have been experimenting with an SVG backend. You're right though about printing from the browser being very limited right now. One of our contributors has started discussion on a better API for printing in the browser and we've met with a community member who is also trying to get better printing support. If you have anymore thoughts feel free to send a message to our mailing list or irc channel. See https://github.com/andreasgal/pdf.js for more info.

Re:There are real problems to solve first, Mozilla

[Ash-Fox]

Here's an example (firefox 3.6.23). Yesterday I had many mozilla windows and tabs open. The browser took up 600MB. I closed everything except one one window with one tab, and opened a new tab, and closed the other tab (so there is no page to go "Back" to).

The browser process still took up 400MB. Why? Note: I am using noscript, adblock plus, treestyle tabs and certificate patrol.

I just tried it on another mozilla browser that does not have treestyle tabs (but with noscript, adblock plus and certificate patrol), on start up: 67MB. Opened up slashdot, classic discussion, opened a few large articles, got that browser process to 170+MB. Opened Google in a new window (so no cacheable "back history") . Closed everything else. Browser process drops from 170MB to 105MB. So what is the extra 30+MB for?

I had about 19 Windows open, at least a hundred tabs in each Window and was baffled to only see Firefox using just over a gig for all those pages. So, I closed all the other tabs but this slashdot page, left it for ten minutes (using Firefox 7.0.1 with Certificate Patrol, HTTPS-everywhere, British-English dictionary addons, Flash plugin - Nothing else, not even the skype addon), it's at 109MiB RAM now. I don't understand the problem?

I'm just not seeing this "extreme memory usage".

Re:There are real problems to solve first, Mozilla

[hairyfeet]

I bet you are running an Intel multicore. try it on an AMD single or low end dual core and watch how quickly you change your tune. Frankly i wouldn't be the least bit surprised to find out that Moz is using the Intel crippler compiler which completely cripples anything compiled on it with regards to AMD products. I have noticed that after the 3.6 branch FF performance has gone REALLY downhill with regards to AMD chips. When it runs better on a P4 than a brand new AMD multicore? yeah smells like the Intel compiler to me.

I have to support ALL makes and models of both Intel and AMD so having FF run like shit on half the CPUs really doesn't cut it. I have found browsers based on Chromium (currently using Dragon, but I've found this to be true with Chrome and Chromium as well) simply don't have this problem with AMD CPUs so again I bet Moz is using the crippler compiler.

Run and minimize until user interaction

[tepples]

Of course, the ideal solution (not only for the browser/PDF reader problem) would be to have a standardized way to tell an application to start raised/lowered

This is sort of what I was talking about. For example, even in Windows XP, a shortcut to an application can already specify that the application shall run minimized.

Re:Run and minimize until user interaction

[maxwell demon]

But the browser doesn't click on a shortcut.

Re:Run and minimize until user interaction

[tepples]

But the browser doesn't click on a shortcut.

You don't need a shortcut file to pass an nShowCmd to ShellExecute.

sure, open .iso in the browser

[spage]

... ever since jslinux booted a Linux 2.6.20 image.

In Firefox, JavaScript runs 386!

Welcome to 20010...

[brunes69]

..when Chrome did this :P

Re:Welcome to 20010...

[Yvan256]

So, did the human race ever colonize other planets? How about the lottery numbers for december 2011?

Re:Welcome to 20010...

[aanantha]

Chrome just integrates a proprietary plug in. (And not in Chromium.) This is a viewer that's open source and implemented in Javascript.

Re:There are real problems to solve first, Mozilla

[BrokenHalo]

Seems to me that Firefox is now in the position that its forebear Mozilla was some 10 years ago. Mozilla in its default form was a monstrous behemoth of a thing, and I used to build my own browser-only versions that were a lot smaller, faster and more powerful than the Firefox (or Phoenix, as it was then known) versions.

Of course, I eventually went with the flow and accepted Firefox into my life as support for the earlier codebase fell away, and never regretted it. More recently, however, I have adopted Chromium for its smaller footprint on my screenspace.

However, I find this unnecessary dissing of Firefox a bit tiresome. It has served us well, and still does. If the user insists on keeping 150 tabs open at once, he has no right to complain that the thing is hogging memory. If he can't be bothered keeping track of what he's reading, why should anyone else? Why not simply bookmark tabs, close them and move on?

HTML referencing page numbers

[spage]

Good question, I don't think you can. The CSS Print Profile keeps track of a current page counter, but I think you only have access to the current page number for presentation and styling; you can't query another element and ask what page it's on. So you have to do references by section number, and when printing arrange for the current section's number to show up in the page header or footer.

Re:There are real problems to solve first, Mozilla

[multipartmixed]

> No, I am not going to upgrade to your latest major version[1]. I see
> no proof that you guys fixed the problem. That said, mozilla has improved over the years, thanks.

How are you going to see proof if you don't try the latest version? You clearly don't read Bugzilla, or you'd know there was a fuckload of a lot of work done on memory consumption after 1.9.2*

*using internal version numbers because you hate marketing ones.

Re:There are real problems to solve first, Mozilla

[multipartmixed]

> I bet Moz is using the crippler compiler.

You lose.

Mozilla uses gcc for Linux and related platforms, Visual Studio for Windows, and Apple's gcc for Mac OS/X. The Solaris contrib builds are built with the Sun Studio compiler (or whatever it's called these days).

x86_64 is regularly benchmarked, and you can see perf improvements/works on various platforms at http://arewefastyet.com./

Additionally, if you are aware of specific x86_64 performance problems, you should bring them to the attention of the folks at Mozilla (via Bugzilla).

Also, "runs like shit" does not count as specific.

Betraying their design principles

[The Immutable]

Wasn't firefox originally intended to have a LIGHT footprint by being modular and relying mostly on extensions to provide functionality beyond basic web browsing? PDF is not basic web browsing. You might as well include routines for MSOffice documents too. And mp3s, and movies, and pretty soon we've got one gargantuan program that does everything and does it badly when all we wanted to do was look at cat pictures.

Not what I need

[Anonymous Coward]

Oh great, yet another PDF renderer that I will be forced to test. Chrome is annoying enough. It has had issues with our PDFs for 5 of the last 8 releases. And now Firefox is planning on adding in this experimental half-baked piece of crap? Yet another reason for me to recommend we drop official support for Firefox.

Re:There are real problems to solve first, Mozilla

[TheLink]

Don't give me that crap.

Look at all the memory problems in bugzilla. Fact is it's only till Firefox 7 there's this memshrink stuff. Didn't the mozilla bunch claim it was fixed in version 3, 3.5, 3.6, 4, 5 and version 6?

So why is there the need for this memshrink stuff if they told the truth before?

Blame me for not upgrading. But I'll still blame the Mozilla devs. For the past 5 or 6 years I've tried upgrading to solve the problem every time people say they've fixed it. Each time they haven't. So given the Mozilla dev team's track record, maybe by Firefox 8 or 9 it'll really be fixed.

As for the improvements I was talking about. it used to be Mozilla would crash if a website just sneezed at it. IMO the reason for Netscape's demise wasn't mainly Microsoft, but Netscape's crappy product itself - look at how many years it took for Mozilla to get usable. The codebase must have been pretty crap. Compare with the progress Google has made with in a much shorter space of time, basing on webkit.

Yes Google Chrome is a bigger memory hog in many cases, but it's process based, so if the windows/processes you no longer need are closed, the memory is returned to the OS. So Google Chome could be a bigger leaking pile of shit, but the real world impact is less- you close/kill the offending processes and the memory is freed up without affecting the other browser sessions.

Don't add bloat where it's not required

[Yvan256]

Leave that out of the Mac OS X version. Macs can display PDFs files just as easily as JPEGs.

Re:There are real problems to solve first, Mozilla

[Derek Pomery]

Well, it used to screw up in editing/modifying/copying of portions of a URL, but they seem to have that pretty much solved.

Re:There are real problems to solve first, Mozilla

[jlebar]

I don't understand why people get so mad about this.

I'm sorry that you don't trust Mozilla to deliver on its promises any longer. I wish you'd check out the new version of Firefox, because we've put a lot of work into improving it. But hey, it's free software, and if you want to run a browser released in January 2010, more power to you!

The good news is that Firefox, Chrome, and Opera work on Windows, Mac, and Linux. You have options; nobody's making you use Firefox.

But maybe next time before you assert that memory usage is "still a problem", you could try the latest version. If you never upgrade your browser, you're never giving us a chance to fix anything.

Re:There are real problems to solve first, Mozilla

[pionzypher]

maybe by Firefox 8 or 9 it'll really be fixed.

What are they, miracle workers? Give them more than a couple of weeks to work on the problem.

Re:There are real problems to solve first, Mozilla

[TheLink]

Sorry can't keep track. Did I leave out some zeroes?

Re:There are real problems to solve first, Mozilla

[TheLink]

OK I tried it. I after getting the memory usage up to 700MB by opening many tabs and windows (slashdot and some news sites), I then closed everything except one tab, opened a new window to the default Firefox start page, closed old window. After waiting a minute or two, usage went down to about 180+MB. Is it supposed to still be using 180MB? No added extensions at all.

And don't say I never upgrade my browser. I've upgraded it a few times already. Fact is it's only till Firefox 7 there's this memshrink stuff. Didn't the Mozilla bunch claim the memory problems were fixed in version 3, 3.5, 3.6, 4, 5 and version 6?

Go ahead blame me for not wanting to waste my time upgrading only to face the same problem.

Re:There are real problems to solve first, Mozilla

[jlebar]

Didn't the Mozilla bunch claim the memory problems were fixed in version 3, 3.5, 3.6, 4, 5 and version 6?

As I recall, the claim was that memory problems were addressed in 3, 3.5, 3.6, 4, 5, and 6, not that your memory problems were fixed. It was before my time, but there was a concerted memory-usage effort in the 3 - 3.5 timeframe. You're right in that it's only in Firefox 7 that the results of our latest big memory push have seen the light of day. But that doesn't mean we didn't fix any problems in the meantime.

Go ahead blame me for not wanting to waste my time upgrading only to face the same problem.

In the amount of time it took you to write this post to Slashdot, you could have done each of these browser upgrades. We even save your tabs across upgrades. But like I said, my issue isn't that we lost your trust through bad PR -- that's our fault -- but rather that you claimed that memory usage is "still a problem" when you hadn't tried the latest version!

Is it supposed to still be using 180MB?

You can open up about:memory and see exactly where that 180mb is going, if you're curious. I'd love for our after-closing-tabs memory usage to be smaller, but with our current architecture, we're never going to be as small after you've used the browser as when you first start up. 180mb isn't abnormally high.

We've improved things in upcoming versions, too, but I'm not promising miracles. :)

Re:There are real problems to solve first, Mozilla

[TheLink]

OK here's what I got from about:memory (curiously repeatedly clicking on minimize memory seems to increase some memory use numbers, after the initial reduction).

111.74 MB (100.0%) - explicit
+-44.45 MB (39.78%) - js
l +-33.23 MB (29.74%) - compartment([System Principal])
l l +-15.13 MB (13.54%) - gc-heap
l l l +-7.52 MB (06.73%) - objects
l l l +-4.47 MB (04.00%) - shapes
l l l +-1.98 MB (01.77%) - arena-unused
l l l +-1.05 MB (00.94%) - strings
l l l +-0.12 MB (00.10%) - (3 omitted)
l l +-9.34 MB (08.36%) - mjit-code
l l +-2.94 MB (02.63%) - scripts
l l +-2.42 MB (02.16%) - string-chars
l l +-1.94 MB (01.73%) - object-slots
l l +-1.37 MB (01.23%) - mjit-data
l l +-0.09 MB (00.08%) - (2 omitted)
l +-6.65 MB (05.95%) - gc-heap-chunk-unused
l +-3.33 MB (02.98%) - compartment(atoms)
l l +-1.97 MB (01.77%) - string-chars
l l +-1.36 MB (01.22%) - gc-heap
l l l +-1.18 MB (01.05%) - strings
l l l +-0.18 MB (00.16%) - (6 omitted)
l l +-0.00 MB (00.00%) - (6 omitted)
l +-1.24 MB (01.11%) - (7 omitted)
+-37.88 MB (33.90%) - heap-unclassified
+-26.91 MB (24.08%) - storage
l +-26.91 MB (24.08%) - sqlite
l +-21.48 MB (19.23%) - urlclassifier3.sqlite
l l +-21.40 MB (19.15%) - cache-used
l l +-0.08 MB (00.07%) - (2 omitted)
l +-2.62 MB (02.34%) - (12 omitted)
l +-1.92 MB (01.72%) - places.sqlite
l l +-1.63 MB (01.46%) - cache-used
l l +-0.29 MB (00.26%) - (2 omitted)
l +-0.88 MB (00.79%) - other
+-1.09 MB (00.98%) - layout
l +-1.09 MB (00.98%) - all
l +-0.00 MB (00.00%) - (1 omitted)
+-0.87 MB (00.78%) - xpti-working-set
+-0.53 MB (00.48%) - (1 omitted)

Other Measurements
342.00 MB - vsize
172.50 MB - resident
165.39 MB - private
127.55 MB - heap-committed
102.08 MB - heap-used
  91.92 MB - heap-unused
  24.00 MB - js-gc-heap
    2.55 MB - heap-dirty
    0.46 MB - gfx-surface-win32
    0.00 MB - canvas-2d-pixel-bytes
    0.00 MB - gfx-d2d-surfacecache
    0.00 MB - gfx-d2d-surfacevram
    0.00 MB - gfx-surface-image

(some characters replaced/deleted to get past Slashdot's lame lameness filter).

So I see the 110MB "explicit". What's using the rest? Note this is after closing everything down from a peak of 330MB.

The vsize value seems different from the windows reported VM size ( about 170MB).

Re:There are real problems to solve first, Mozilla

[jlebar]

So I see the 110MB "explicit". What's using the rest?

Let's see. Part is heap fragmentation. That's heap-committed - heap-used = 25mb. The rest is probably code. On my Linux machine, we load about 35mb of code (about half are shared libraries). 25mb + 35mb + 110mb = 170, which is very close to your 172.5mb of resident.

There are a lot of things here that we can improve. urlclassifier (phishing protection) does not need to use 20mb of memory; someone is working on this. We don't know where 1/3 of your memory is going (heap-unclassified); it's a slog, but we improve this a little in each version. 25mb of heap fragmentation is more than I'd like, and we're working to update our malloc library, jemalloc, to the newest version, which will hopefully improve this. I've also done some work to reduce the number of calls we make to malloc() in the first place, which has helped some.

As you can see, there's room for improvement, but we have to fix a number of small things to get a big change.

The vsize value [342mb] seems different from the windows reported VM size (about 170MB).

I think task manager may be counting only private bytes, but Firefox is counting everything in its virtual address space. On my Windows 7 VM, Firefox's vsize matches Process Explorer's virtual size column. If these don't match for you, that's probably a bug!

Working on the same for video actually

[LostMyBeaver]

As a proof of concept to get the ball rolling, I've been porting an MPEG-1 decoder to JavaScript with support for WebCL for decoding acceleration and WebGL for color space and scaling acceleration. The reason I chose MPEG-1 is because it's easy to work with as a starter project and proof of concept. H.264 employs pretty much all the same principles as MPEG-1, in fact, H.264 doesn't really do much entirely different than MPEG-1, it's been almost all simple evolution (don't argue it... there's nothing really that special in H.264 that wasn't in MPEG-1... the filters were just makeup on the pig).

The fact is.... the video tag is the dumbest thing I've ever seen and the time and effort would have been better invested in making something like a WebAL project which would allow Ecmascript to perform time synchronization between WebGL and WebAL for audio output. By the time the video tag is worth while, both WebM and H.264 will be last generation codecs and then what do we do? Start another bitching match over which one to choose next? How well did that work for getting rid of GIF... which still is everywhere... well unless they replaced them with flash at least.

With technologies like WebCL coming up fast and WebGL already pretty well supported, by the time someone actually manages to implement the codecs in web technologies, it'll be possible to view any video format on any browser without the need of codecs on the device, the codec would simply download along with the video. If you're worried about whether it'll be fast enough... that's rubbish, WebCL is just as fast as OpenCL and you can operate directly on WebGL contexts. The only issue remaining is audio. And let's be brutally honest... audio does not take that much CPU to decode (yes... I know about <insert your shitty engineered lossless codec here, they don't count). So having an audio context which allows passing of buffers from OpenCL to the audio output would be fine.

I look forward to showing off soon :)

Re:There are real problems to solve first, Mozilla

[TheLink]

I'm using Windows XP SP3. The task manager's "Mem Usage" column appears to be the same as process explorer's "Working Set" column.

Here's another one from today: Firefox 7.0.1 after opening and closing many tabs, then closing everything except one window. Opening a new window, having about:memory, closing the other window.

I'm not too clear on what's "explicit" usage, heap-committed and heap-used numbers, and what shows up in Process Explorer. To me what actually counts is whatever that would make the computer start to swap- even if the rest are small/tiny. That's the main thing right? As far as I understand Private Bytes cannot be used by other apps, so if that keeps going up, the computer will start running out of memory.

Process explorer says:
Peak Private bytes = 674MB
Private bytes=239MB
Working Set = 247MB
Virtual Size =631MB

Task manager says:
Mem Usage: 247MB
VM Size= 239MB
Threads = 36

Mozilla says:

135.57 MB (100.0%) - explicit
+-67.89 MB (50.08%) - js
l +-38.87 MB (28.67%) - compartment([System Principal])
l l +-19.02 MB (14.03%) - gc-heap
l l l +-6.92 MB (05.10%) - arena-unused
l l l +-6.85 MB (05.05%) - objects
l l l +-4.18 MB (03.08%) - shapes
l l l +-0.94 MB (00.70%) - strings
l l l +-0.14 MB (00.10%) - (3 omitted)
l l +-11.21 MB (08.27%) - mjit-code
l l +-2.91 MB (02.15%) - scripts
l l +-2.02 MB (01.49%) - string-chars
l l +-1.87 MB (01.38%) - object-slots
l l +-1.59 MB (01.17%) - mjit-data
l l +-0.24 MB (00.18%) - (2 omitted)
l +-23.54 MB (17.36%) - gc-heap-chunk-unused
l +-3.50 MB (02.58%) - compartment(atoms)
l l +-2.10 MB (01.55%) - string-chars
l l +-1.40 MB (01.03%) - gc-heap
l l l +-1.18 MB (00.87%) - strings
l l l +-0.22 MB (00.16%) - (6 omitted)
l l +-0.00 MB (00.00%) - (6 omitted)
l +-0.89 MB (00.66%) - compartment(http://finance.yahoo.com/q?s=1295.KL)
l l +-0.89 MB (00.66%) - (8 omitted)
l +-0.73 MB (00.54%) - gc-heap-chunk-admin
l +-0.36 MB (00.26%) - (4 omitted)
+-37.88 MB (27.94%) - heap-unclassified
+-28.04 MB (20.68%) - storage
l +-28.04 MB (20.68%) - sqlite
l +-22.68 MB (16.73%) - urlclassifier3.sqlite
l l +-22.59 MB (16.67%) - cache-used
l l +-0.08 MB (00.06%) - (2 omitted)
l +-2.37 MB (01.75%) - (11 omitted)
l +-2.02 MB (01.49%) - places.sqlite
l l +-1.73 MB (01.27%) - cache-used
l l +-0.30 MB (00.22%) - (2 omitted)
l +-0.96 MB (00.71%) - other
+-0.89 MB (00.66%) - (2 omitted)
+-0.87 MB (00.64%) - xpti-working-set

Other Measurements
616.33 MB - vsize
319.58 MB - heap-unused
239.49 MB - resident
231.73 MB - private
188.06 MB - heap-committed
123.42 MB - heap-used
  45.00 MB - js-gc-heap
    1.95 MB - heap-dirty
    0.68 MB - gfx-surface-win32
    0.37 MB - canvas-2d-pixel-bytes
    0.00 MB - gfx-d2d-surfacecache
    0.00 MB - gfx-d2d-surfacevram
    0.00 MB - gfx-surface-image

So Is it correct to say that Mozilla (even 7.0.1) often can't return some of the unused private bytes, and that can keep growing as the user opens and closes stuff?

There are many users who hardly ever shutdown their computers (just suspend/hibernate) and even their browsers. But over time they might still close and reopen some browser windows.

I suspect that's why despite Chrome being a fatter (and possibly leakier) browser, such users may think Firefox is worse in practice. From what I see, with Chrome opening and closing some windows/tabs usually frees up all the memory involved - the process just goes away returning the memory to the OS (and letting the geniuses in charge of the OS take care of fragmentation - not the browser's problem anymore ;) ). This appears to be true for IE as well (I haven't looked really closely - hardly ever use it :) ).

The current Firefox approach may require you all to also do what the OS bunch are doing or trying to do: e.g. http://kerneltrap.org/memory

Re:There are real problems to solve first, Mozilla

[jlebar]

FWIW, it looks like you may not have left Firefox idle long enough to trigger a GC before you took this about:memory screenshot -- there's still a compartment for Yahoo Finance open. You can click "minimize memory usage" at the bottom of the page to force all our timers to fire.

To me what actually counts is whatever that would make the computer start to swap- even if the rest are small/tiny. That's the main thing right?

Right. This also means that peak memory usage -- which isn't what people on Slashdot usually talk about -- is just as important, if not more important, than memory usage after closing all tabs. It's when we're at our peak that we're most likely to cause swapping.

So Is it correct to say that Mozilla (even 7.0.1) often can't return some of the unused private bytes, and that can keep growing as the user opens and closes stuff?

I'm not sure if that growth is unbounded. I'm also not sure how much this growth affects our peak memory usage -- a lot of this fragmentation leaves gaps which we can fill in when you open new tabs.

But yes, it's correct that no version of Firefox uses as little memory after you close all tabs as it does when it first starts up.

From what I see, with Chrome opening and closing some windows/tabs usually frees up all the memory involved - the process just goes away returning the memory to the OS (and letting the geniuses in charge of the OS take care of fragmentation - not the browser's problem anymore ;)

Well, you can't fragment physical memory, because all pages are the same size! (Well, modern chips expose different-sized pages, but I'm not aware of this being used on any consumer device.) The heap fragmentation in this latest about:memory dump is pretty bad...

But architecturally, Chrome definitely has a leg up on us here. There's only so much we can do as-is. We're working to make architectural changes to match Chrome, but it's slow going.

Re:There are real problems to solve first, Mozilla

[TheLink]

I did leave it open for a while till it stopped shrinking and I also clicked on "minimize mem usage".

FWIW the yahoo thing is still there despite the tab not being there. I did reopen that link again some minutes ago. How long do I have to wait till it goes away?

Basically what I did was open up a folder with a number of yahoo finance sites. Then open it again, and again, then close the middle bunch. then open folder, then close, repeat a few times ( I guess I kinda abused firefox a bit, but that was only for a short while). Then closed all the windows and tabs, except one. Opened new window, closed old window, go to about:memory, clicked on minimize mem button a few times. Wrote slashdot post. Then did other stuff, then recently I checked some businessweek finance pages. Then now I've closed everything except about:memory and this slashdot form.

And it looks a bit like this:
149.84 MB (100.0%) - explicit
+-72.12 MB (48.13%) - js
l +-44.37 MB (29.61%) - compartment([System Principal])
l l +-20.68 MB (13.80%) - gc-heap
l l l +-7.51 MB (05.01%) - objects
l l l +-7.31 MB (04.88%) - arena-unused
l l l +-4.75 MB (03.17%) - shapes
l l l +-0.96 MB (00.64%) - strings
l l l +-0.15 MB (00.10%) - (3 omitted)
l l +-14.09 MB (09.40%) - mjit-code
l l +-3.08 MB (02.05%) - scripts
l l +-2.10 MB (01.40%) - string-chars
l l +-2.07 MB (01.38%) - object-slots
l l +-1.72 MB (01.15%) - mjit-data
l l +-0.64 MB (00.43%) - (2 omitted)
l +-21.63 MB (14.44%) - gc-heap-chunk-unused
l +-3.85 MB (02.57%) - compartment(atoms)
l l +-2.45 MB (01.63%) - string-chars
l l +-1.40 MB (00.94%) - gc-heap
l l l +-1.21 MB (00.81%) - strings
l l l +-0.19 MB (00.13%) - (6 omitted)
l l +-0.00 MB (00.00%) - (6 omitted)
l +-1.30 MB (00.87%) - (5 omitted)
l +-0.97 MB (00.65%) - compartment(http://finance.yahoo.com/q?s=1295.KL)
l +-0.97 MB (00.65%) - (8 omitted)
+-46.44 MB (30.99%) - heap-unclassified
+-29.07 MB (19.40%) - storage
l +-29.07 MB (19.40%) - sqlite
l +-23.21 MB (15.49%) - urlclassifier3.sqlite
l l +-23.13 MB (15.43%) - cache-used
l l +-0.08 MB (00.06%) - (2 omitted)
l +-2.44 MB (01.63%) - places.sqlite
l l +-2.11 MB (01.40%) - cache-used
l l +-0.34 MB (00.23%) - (2 omitted)
l +-2.41 MB (01.61%) - (11 omitted)
l +-1.01 MB (00.67%) - other
+-0.87 MB (00.58%) - xpti-working-set
+-0.85 MB (00.57%) - layout
l +-0.85 MB (00.57%) - all
l +-0.00 MB (00.00%) - (1 omitted)
+-0.49 MB (00.33%) - (1 omitted)

Other Measurements
608.74 MB - vsize
291.18 MB - heap-unused
269.96 MB - resident
261.20 MB - private
214.35 MB - heap-committed
134.82 MB - heap-used
  45.00 MB - js-gc-heap
    2.24 MB - heap-dirty
    0.57 MB - gfx-surface-win32
    0.00 MB - canvas-2d-pixel-bytes
    0.00 MB - gfx-d2d-surfacecache
    0.00 MB - gfx-d2d-surfacevram
    0.00 MB - gfx-surface-image

Anyway as I've written this the private mem seems to have dropped a bit after I opened a few more windows and is now 259MB. The yahoo thing is still there, so maybe I've found a bug? Not sure if it's easily reproduceable.

I guess I can put up with it if it takes a long while before the minimum usage hits 400MB. But I haven't really been using Facebook much with Firefox 7.0.1 (was using Chrome for it). Maybe will try that tomorrow...

Chrome's approach is sweeping the problem under the carpet, but every now and then the carpet and everything under gets incinerated ;).

p.s. Is the Content Security Policy stuff gaining traction? About 9 years ago I proposed to mozilla.security and a w3c list to create a tag for disabling active content (or some other way of doing it). Everyone was busy creating new and fancy "Go Pedal", there was no "Stop Pedal", the only way to stop was to make sure all the "Go Pedal" were disabled/escaped (even new unknown ones ;) ), which I thought was insane. But nobody else really seemed interested back then.

Re:There are real problems to solve first, Mozilla

[jlebar]

I did leave it open for a while till it stopped shrinking and I also clicked on "minimize mem usage".

FWIW the yahoo thing is still there despite the tab not being there. I did reopen that link again some minutes ago. How long do I have to wait till it goes away?

If you click minimize memory usage, everything should go away immediately. If you don't, I'm not sure how long you have to wait; five minutes (without touching Firefox) should be sufficient.

Are you running with extensions? It's probably an extension bug which is causing that yahoo compartment to stay there. If you can reproduce without any extensions, please file a bug and cc :jlebar. If not, then you may want to get in touch with the extension author (and you're welcome to file a bug and cc me anyway).

p.s. Is the Content Security Policy stuff gaining traction?

I have no idea whether people are using CSP, but apparently there's a WordPress plugin. :) http://people.mozilla.com/~bsterne/content-security-policy/wordpress.html

Re:There are real problems to solve first, Mozilla

[swalve]

Yeah, it's a conspiracy, not the cheap chip you use.