Mozilla Testing Click-to-Play Option For Plugin Content

Why did it take so long?! by Anonymous Coward · 2012-04-13 04:43 · Score: 5, Insightful

Seriously, this is a no-brainer, that has been implemented by tonnes of extensions. So now that we're at version 4000, why is it suddenly a good idea to implement it?

Re:Why did it take so long?! by b4dc0d3r · 2012-04-13 05:26 · Score: 3, Informative

And, it was the subject of an EOLAS lawsuit against Microsoft, who IIRC had to disable automatically running things in IE for a while (maybe they got that overturned before actually having to implement it).
EOLAS invents something, patent-trolls, gets $30million (down from the 500+ originally awarded) and 10 years later everyone starts to realize it's a bad idea!
Re:Why did it take so long?! by Assmasher · 2012-04-13 07:00 · Score: 1

It isn't a good idea unless it is disabled by default and only available as an option.
I WANT Firefox to spread in the enterprise, and this will likely make that less probable.
Web based applications requiring individual permissions for aspects of their functionality in the corporate world? I have enough trouble getting these mental giants to load a web page...

--
Loading...
Re:Why did it take so long?! by Deathlizard · 2012-04-13 10:29 · Score: 1

Frankly, MS should have kept that Click to run as an security option in IE. It pretty much did the same thing noscript did back in 2003. Of course IIRC it had one of those annoying drop down bars you had to click on in order to get it to run instead of clicking the control box in question and it was easily worked around (but that could be fixed)

--
In Soviet Russia, Trojan exploits YOU!
Re:Why did it take so long?! by thereitis · 2012-04-13 13:27 · Score: 1

That's the nice thing about throwing rocks from the peanut gallery: You can throw them if they don't implement a feature, and still throw them if they do implement it. Well played, sir.

finally by Anonymous Coward · 2012-04-13 04:44 · Score: 2, Insightful

This should have been the default 10 years ago.

I'm a fan of Java, but I still cringe when I go to a web page and the Java console opens.

for javascript? by sdnoob · 2012-04-13 04:46 · Score: 4, Insightful

really? you'd get carpel tunnel if you had to click-to-run every script on most commercial sites these days.

no script is more effective but with a learning curve.

but either method will still have the masses turning the 'feature' off (essentially white-listing everything).

Re:for javascript? by Anonymous Coward · 2012-04-13 04:48 · Score: 0

Konqueror has had this option forever.
Re:for javascript? by phayes · 2012-04-13 04:50 · Score: 3, Informative

I've been using NoScript for years. You whitelist the trusted sites where you need it & the others are just an occasional click.

--
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Re:for javascript? by sdnoob · 2012-04-13 04:57 · Score: 1

exactly.. but the brain-dead masses won't "get" how to use it... thus, would just turn it off (if they could even figure *that* out) or continue their click-click-click-click ways..
Re:for javascript? by Anonymous Coward · 2012-04-13 05:18 · Score: 0

The "brain-dead masses" will always be a lost cause. Frankly, I say make it more difficult for them. Add a feature that warns you by dialog box, twice, that allowing the content to play could possibly be a security risk. Also include a way to disable it in the settings, but don't make it super easy to find. Those that are smart enough to find and disable the feature might just be smart enough to not click on every damn advertisement they see.
If the "brain-dead masses" can't be bothered to learn how to properly and responsibly use the internet, why should the rest of us be bothered by the side-effects of their incompetence? If it weren't for the "brain-dead masses", there would be significantly less crap on the web to begin with. Just like if there weren't morons that fell for 419 scams, 419 scams would eventually stop.
Re:for javascript? by amicusNYCL · 2012-04-13 05:19 · Score: 3, Informative

This doesn't have anything to do with Javascript, Javascript is not a plugin. This affects plugins like Flash, Java, and Silverlight.

--
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Re:for javascript? by metrometro · 2012-04-13 05:25 · Score: 1

Or, we stop loading scripts. You're assuming a whitelist wouldn't be built in. I use Ghostery, and it sometimes requires intervention, but for the most part silently nukes ad scrapers. This would create something similar, but standard in the browser. Third party script? No thanks.
Oh, and Click-for-Flash (via an add on) has been my preferred UI for years. Works fine.
Re:for javascript? by jank1887 · 2012-04-13 05:29 · Score: 1

the braindead will want a way to fix it, quick, without thinking hard. if you want this as default, but don't want them turning it completely off, then you need to provide a really easy way of them to think they've fixed their immediate problem. They won't think beyond that. Maybe a "whitelist this page so your scripts work?" popup the first time you visit a site? may get annoying on every other page, though.
Re:for javascript? by Anonymous Coward · 2012-04-13 05:37 · Score: 0

The "brain-dead masses" bring some good. If the majority of Web users started using AdBlock, FlashBlock, etc., then most webpages would start telling you to go stuff it unless you viewed their ads, or move to even more intrusive ads (interstitials, content only available via video), or having their content only viewable via an add-on (where the whole site is a Flash app.)
So, let the "brain-dead masses" view the ads. I'll keep my ad blocking and clean computers (since there were reports earlier on /. that ads are the #1 vector for infections these days.)
Re:for javascript? by Rolgar · 2012-04-13 05:38 · Score: 1

I do this, but if everybody had it as the default, the websites would put all the scripts in the same domain so you would have to choose to get all or nothing.
The companies the host the ad scripts would have to figure out a way to make money without hosting their scripts directly, but I'm sure they would figure out something.
Re:for javascript? by Anonymous Coward · 2012-04-13 06:02 · Score: 1

The summary doesn't say "JavaScript" it says "Java scripts", as in applets. JavaScript isn't even a plugin. They're talking about blocking automatic execution of Java applets and Flash, not JavaScript.
Re:for javascript? by Anonymous Coward · 2012-04-13 06:38 · Score: 0, Troll

Yes, but anyone who says "Java scripts" instead of "Java applets" deserves to be shot. It's hard enough trying to tell people there's a difference between "Java" and "Javascript" without mouth-breathing retards making it even more difficult.
Re:for javascript? by Anonymous Coward · 2012-04-13 09:03 · Score: 0

Opera also has this - I use it a lot.
Re:for javascript? by Anonymous Coward · 2012-04-13 11:00 · Score: 0

I think they meant java, not javascript. Even if you do embed something like NoScript or NotScript into the browser it wouldn't be the end of the world for the power user. I use those addons because I like the degree of control they give me. However, I think you're right about the average user not being OK with javascript being blocked.

You mean like by CanHasDIY · 2012-04-13 04:48 · Score: 0

NoScript? Already done, thanks.

--
An enigma, wrapped in a riddle, shrouded in bacon and cheese

Re:You mean like by ElmoGonzo · 2012-04-13 04:50 · Score: 3, Informative

FlashBlock, too.
Re:You mean like by FudRucker · 2012-04-13 04:51 · Score: 1

noscript already blocks flash so flashblock would be redundant if you already have noscript

--
Politics is Treachery, Religion is Brainwashing
Re:You mean like by phayes · 2012-04-13 04:53 · Score: 1

Yeah those of us who care about security have been using NoScript for years but this will push the ignorant masses into better security.

--
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Re:You mean like by allo · 2012-04-13 05:02 · Score: 2

i think you need to change the defaults for that. Might be a reason, why some noscript users still use flashblock.
Re:You mean like by sexconker · 2012-04-13 05:15 · Score: 1

Yeah those of us who care about security have been using NoScript for years but this will push the ignorant masses into better security.
No, those of us who care about security, speed, and and hate ads and social crap have been using NoScript for years.
And we set it up so that clicking the button triggers "Temporarily allow all this page". If a site doesn't work, we just click the button repeatedly until it does.
Re:You mean like by Anonymous Coward · 2012-04-13 05:28 · Score: 0

If a site doesn't work, we just click the button repeatedly until it does.
If you actually care about security and/or privacy, that's a pretty shitty policy. I guess you just hope that the site you want to load doesn't have any malware? What the fuck is the point of even using NoScript at that point? Some of us actually look at what scripts the site is trying to load, and make rational decisions accordingly. I don't think I've ever once used "Temporarily allow all this page".
Re:You mean like by mfwitten · 2012-04-13 05:47 · Score: 1

IIRC, NoScript would allow every YouTube video to play automatically if I just allowed one YouTube video to play temporarily. So, I installed flashblock, which ALWAYS requires me to start each flash video manually.
Re:You mean like by b4dc0d3r · 2012-04-13 05:57 · Score: 1

People who allow scripts so the page will run/load, might not want flash running automatically. For example the entire Gawker family, including iO9 which occasionally posts interesting things. I might whitelist it to read the content, but I don't want flash loading automatically.
So you get the combination. By default, Java, Flash Silverlight, and 'other plugins' are disabled bu default.
Re:You mean like by santosh.k83 · 2012-04-13 05:58 · Score: 1

Exactly. For example slashdot wants to run scripts from four domains viz., slashdot.org, fsdn.com, doubleclick.net and google-analytics.com, but I allow only those from the first two, and that too only when I want to post a reply. Similarly for most other sites I find that allowing scripts from the same domain as the site is usually enough to enable essential site functionality.
Re:You mean like by FudRucker · 2012-04-13 06:07 · Score: 1

noscript will block flash too if you configure it, you need to set "Apply these restrictions to whitelisted sites too" on the "embeddings" tab in the option

--
Politics is Treachery, Religion is Brainwashing
Re:You mean like by allo · 2012-04-13 06:38 · Score: 1

yeah, and you can configure noscript to block plugins even when scripts are allowed.
you need to enable "block plugins even on whitelisted sites" or something like this. Then you have exactly the flashblock behaviour.
Re:You mean like by CanHasDIY · 2012-04-13 09:31 · Score: 1

Yeah those of us who care about security have been using NoScript for years but this will push the ignorant masses into better security.
A little bit... however, I doubt Mozilla is going to go as far as NoScript with the concept; likely, they'll stick to blocking media (read: Flash videos) and continue to allow the ad servers all the access they want.

--
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Re:You mean like by phayes · 2012-04-13 09:53 · Score: 1

You're certainly right & that will mean that there will still be a good reason to use NoScript. However that doesn't mean that what Mozilla is planning still won't be a good thing for the less security consious.

--
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Re:You mean like by Jane+Q.+Public · 2012-04-13 11:37 · Score: 1

"i think you need to change the defaults for that. Might be a reason, why some noscript users still use flashblock."
Interface for Flashblock is better. You just click the element, you don't need to go through a menu.
Re:You mean like by Jane+Q.+Public · 2012-04-13 12:08 · Score: 1

Addendum:

I just tested it, and the "Block Adobe Flash" option in my NoScript settings doesn't even work.
Re:You mean like by allo · 2012-04-14 01:13 · Score: 1

same interface in noscript. i do not speak of the script blocking part,but of the click-to-start-plugin part.
Re:You mean like by allo · 2012-04-14 01:15 · Score: 1

[x] block adobe flash
[x] use on trusted websites, too
[x] show placeholder symbol
(not the exact text, as my system does not have an english locale)
Re:You mean like by Jane+Q.+Public · 2012-04-14 10:33 · Score: 1

Hard for me to tell, since the Flash blocking in my NoScript did not work at all. Even after restarting Firefox.
Re:You mean like by Jane+Q.+Public · 2012-04-14 10:35 · Score: 1

Yep. All of the above. Didn't work for me.
Re:You mean like by allo · 2012-04-14 21:28 · Score: 1

works fine, firefox 11. dunno if any other settings are relevant. but flashblock additional is fine, too.

since flash on Linux is soon to be by FudRucker · 2012-04-13 04:49 · Score: 1

monopolized by google's chrome browser i would rather see HTML-5 make plugins like flash obsolete, i refuse to install google chrome just to have flash, and will remove the existing flash plugin at the first sign of vulnerability problems, for javascript and plugins i use noscript extension in firefox at the moment and if mozilla.org developers build something similar to noscript right in to the browser itself would be fine with me

--
Politics is Treachery, Religion is Brainwashing

Yes, I have Flash installed in my browser. by QuietLagoon · 2012-04-13 04:50 · Score: 1

So much so, that over 99% of internet users have Flash installed on their browser,' writes Mozilla's Jared Wein, the lead software engineer on the project, in a blog post.

Yes, I have Flash installed in my browser.

No, I do not have Flash enabled all the time in my browser. I only enable Flash for the particular content I want to view via Flash.

I already have the "click to play" option for Flash.

Re:Yes, I have Flash installed in my browser. by Anonymous Coward · 2012-04-13 04:58 · Score: 0

You're 99% of internet users?
That's great! I was hoping you could tell us why you use IE 6 2% of the time. Is there a specific web site you visit that's not compatible?
Re:Yes, I have Flash installed in my browser. by Anonymous Coward · 2012-04-13 05:00 · Score: 0

Yeah: thegpliscancer.org only works with IE6.

Bad TFA by Anonymous Coward · 2012-04-13 04:52 · Score: 1

The linked article says "Java scripts" but the actual blog post http://msujaws.wordpress.com/2012/04/11/opting-in-to-plugins-in-firefox/ she was writing about just says plugins. I'm guessing they wouldn't require permission for javascript.

Re:Bad TFA by VGPowerlord · 2012-04-13 05:07 · Score: 1

While it could have been worded better, Java scripts clearly has a space in the middle, meaning that the language being referred to is Java, not JavaScript.
They should have said Java Applets, though.

--
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
Re:Bad TFA by hobarrera · 2012-04-13 06:24 · Score: 1

There's no such thing as a java script. Java is not a scripting language.

Little late there. by Anonymous Coward · 2012-04-13 04:54 · Score: 0

There's already several add-ons that do this.
Mozilla is slowly becoming that guy that pops in when the car is invented screaming how he just now invented a wheel.

99% do NOT have flash anymore by Anonymous Coward · 2012-04-13 04:54 · Score: 0

how many millions of apple handhelds are there? that 99% has to be significantly lower now.

Re:99% do NOT have flash anymore by CharlyFoxtrot · 2012-04-13 05:04 · Score: 1

Yeah, looks like he forgot to count smartphone and tablet users. Maybe he meant 99% of Firefox users ?

--
If all else fails, immortality can always be assured by spectacular error.

HTML5 has half the frame rate of Flash by tepples · 2012-04-13 05:00 · Score: 4, Interesting

i would rather see HTML-5 make plugins like flash obsolete

So would I. But first, someone must fix these problems:

Make vector animations in web browsers implementing HTML5 Canvas play as fast as they do in Flash Player. This benchmark gives about 40 fps for Flash on my computer and 20 fps for Canvas in Firefox.
Make a tool to author vector animations.
Make a way to reliably convert existing vector animated series, such as Weebl and Bob and Homestar Runner, so that they can be played through an implementation of HTML5. Smokescreen goes part of the way toward this.

Re:HTML5 has half the frame rate of Flash by allo · 2012-04-13 05:04 · Score: 1

> vector animation
> canvas
you're doing it wrong.
you need to test scripted svg.
Re:HTML5 has half the frame rate of Flash by Gordo_1 · 2012-04-13 05:17 · Score: 1

That's funny because for me, with Win7/Firefox 11 on a Core i5 CPU with a recent Nvidia GPU, for a 2000 particle run I get 40fps in Flash and about 45fps using canvas.
http://themaninblue.com/experiment/AnimationBenchmark/flash/?particles=2000
http://themaninblue.com/experiment/AnimationBenchmark/canvas/?particles=2000
So I guess YMMV.
Re:HTML5 has half the frame rate of Flash by Desler · 2012-04-13 05:17 · Score: 1

I get ~42fps on my 3rd gen iPad for canvas. Either you have an old computer or Firefox's implementation is crap.
Re:HTML5 has half the frame rate of Flash by SScorpio · 2012-04-13 05:21 · Score: 1

Flash gives me about 60fps, where canvas was staying right around 90fps with an occasional drop to 75fps, though Flash also did have some slow spikes. This is on Firefox 11 with the on CPU Intel graphics on a mobile i7.
Re:HTML5 has half the frame rate of Flash by Anonymous Coward · 2012-04-13 05:34 · Score: 0

I have a similar setup (AMD GPU instead of Nividia) and am getting almost the same results as you. FF11 on Windows 7 as well.
SVG is slow though, it's practically a slideshow with 2000 particles.
Re:HTML5 has half the frame rate of Flash by StuartHankins · 2012-04-13 08:22 · Score: 1

YMMV and all that, but I'm getting fastest results (42-43 fps) with canvas under Firefox 12 / Snow Leopard (there is an update I haven't applied yet, it just showed up). This is not a new machine by any standard -- it's a 2007 Core 2 Duo 2.4 MBP. I'm running Parallels with a Windows XP VM while testing, and I've got 2 X11 rdesktop sessions open (IOW if I wasn't at work and could close out everything, my results would probably be faster).

I get roughly the same under Flash, but it's very jumpy, with swings from 38-45 but returning to around 41 after the swings. You can feel the system under higher load once Flash starts up, but I don't see that with canvas.

At 42-43 fps, canvas is very usable for me on my older computer.
Re:HTML5 has half the frame rate of Flash by Tubal-Cain · 2012-04-13 09:02 · Score: 1

HTML: 60 fps
Canvas: 87 fps
SVG: 85-90 fps
Flash: 33-36 fps
Chromium 17 & Flash 11-r1, on Debian testing.
Re:HTML5 has half the frame rate of Flash by Bryan+Bytehead · 2012-04-13 13:52 · Score: 1

32-33 FPS HTML
69-70 FPS Canvas
23-28 FPS SVG
54-60 FPS Flash
Quad-core I5 at 3.40GHZ running Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:14.0) Gecko/20120412 Firefox/14.0a1 ID:20120412030726
GeForce GT 440
So, yes, I'm cheating by running the burning edge of the latest FF in 64-bit mode, alpha software running on Windows 8 64-bit, also alpha.

--
Bryan

There's a better solution by daem0n1x · 2012-04-13 05:01 · Score: 1

Just ban Flash outright! The whole world will be thankful.

Re:There's a better solution by CharlyFoxtrot · 2012-04-13 05:08 · Score: 1

Ban plugins, their time has come and gone. The web's a very different place from when they were introduced in the mid 90's.

--
If all else fails, immortality can always be assured by spectacular error.
Re:There's a better solution by tepples · 2012-04-13 05:14 · Score: 3, Insightful

As I wrote in another comment, both Firefox's implementation of Canvas and Firefox's implementation of SVG are substantially slower than Flash Player at playing back vector animations. Furthermore, most web browsers don't provide an API for a JavaScript program to (ask the user's permission to) turn on the camera and microphone. Once Firefox's implementation of Canvas becomes competitive in frame rate and once a device API becomes widely implemented, I will become more inclined to agree with you. Until then, SWF is the only way to push certain features out to users of IE 8 who lack permission to install other browsers (e.g. work break room, public library) because Adobe Flash Player is far more widely installed than Google Chrome Frame.
Re:There's a better solution by CharlyFoxtrot · 2012-04-13 05:30 · Score: 1

That's a vicious circle: things get implemented in Flash because the browser's too slow, browser features get a low priority because there's Flash to lean on, ... Third party plugins are the bane of the modern open web maybe it's worth dealing with breakages for a year if it forces the issue.

--
If all else fails, immortality can always be assured by spectacular error.
Re:There's a better solution by Desler · 2012-04-13 05:35 · Score: 1

Or the users will just move to the browser that doesn't break things since they won't want breakage.
Re:There's a better solution by CharlyFoxtrot · 2012-04-13 05:45 · Score: 2

Or the users will just move to the browser that doesn't break things since they won't want breakage.
Yeah, It'd require some consensus between Mozilla, Google and Microsoft although the first two would probably be able to force the issue on their own. Note that Apple's already there with iOS. The future is smartphones and tablets and they're already plugin-free, we just need the desktop to catch up.

--
If all else fails, immortality can always be assured by spectacular error.
Re:There's a better solution by Anonymous Coward · 2012-04-13 05:50 · Score: 0

Now we call them extensions? How is the web different? Browsers don't provide the capabilities the market demands, in a timely manner. Seems the same.
Re:There's a better solution by Anonymous Coward · 2012-04-13 06:19 · Score: 0

Extensions run as part of the browser, typically in some sandboxed interpreted language. Plugins are external native binaries. Their crashes and other foibles are big problems for your system, whereas extension problems affect only the browser.
Re:There's a better solution by allo · 2012-04-13 06:56 · Score: 1

even native code could be run in a way, which cannot break your browser.

Its already tested by allo · 2012-04-13 05:01 · Score: 1

flashblock and noscript provide this option since a looooong time. They could just ask the users of these addons for their experience.

ClickToPlugin by Maury+Markowitz · 2012-04-13 05:05 · Score: 2

I run ClickToPlugin in Safari for all the reasons above. During general browsing my fan no longer turns on and my battery lasts days.

And SVG is even slower by tepples · 2012-04-13 05:09 · Score: 2

you need to test scripted svg.

Result of same benchmark with SVG: eight times slower than Canvas.

Re:And SVG is even slower by Anonymous Coward · 2012-04-13 05:55 · Score: 1

They key here actually is that Firefox's SVG sucks - not that SVG in general sucks.
On my machine I get the following results for the test with the default parameters
Firefox:
Canvas ~35 FPS
SVG ~3 FPS
Chrome
Canvas 40-50 FPS (bounces around a bit more than the other tests)
SVG ~ 65 FPS
Re:And SVG is even slower by Anonymous Coward · 2012-04-13 06:31 · Score: 0

Flash, canvas, and HTML are all around 40 FPS in both Firefox and Chromium on my system,
whereas SVG is ~90 FPS on Chromium and ~20 FPS in Firefox.
Of course, it is much easier to link to some 2 year old graphs on some blog.
Re:And SVG is even slower by allo · 2012-04-13 06:47 · Score: 1

flash html canvas svg with chromium.
with firefox, flash is the fastest and the rest is sucking.
good argument for using more chromium.
i really need to evaluate, how much of my data (history, bookmarks, etc.) can be imported and which extensions i would really be missing.

NS by tunapez · 2012-04-13 05:15 · Score: 5, Interesting

I've tried this on numerous occasions, the more advanced users eventually click 'Allow Scripts Globally", the less advanced keep calling me until I click 'Allow Scripts Globally".

I personally love it, easy-peasy black/white-list. My other apps do not stutter and bog whenever I scroll a page or open a new one. Pages load faster or not at all(both good IMO). Google's auto-search doesn't clog up my 1MB connection or freeze FF trying to force feed me their assumptions(must remove Goog from pre-loaded whitelist). Minimal ad tracking tools/cookies/malware collecting in my system, bleachbit completes in record time. My whitelist allows mo-add-ons page, my local library and some local devices. I'm typing now with /. & FSDN blocked. With the exception of moderation, the site suits me better with them blocked!

--
Imagination drew in bold strokes, instantly serving hopes and fears, while knowledge advanced by slow increments...

Re:NS by b4dc0d3r · 2012-04-13 05:52 · Score: 1

Moderation comes and goes. Right now, I shift-click the comment number and get the comment by itself in a new window. Select the moderation, and the 'moderate' button is at the bottom.
Even if it has child replies, as long as they remain 'normal', you only moderate the single comment.
It also helps refresh to see if someone else has changed the moderation, or made a reply that I should consider in my moderation. Unless there are 5 child replies and the page gets large, overall I think this way is the best way.
Re:NS by cpu6502 · 2012-04-13 06:14 · Score: 1

I use the "allow second-level domains" (or whatever it's called) on NoScript. For example: news.slashdot.org. That eliminates a lot of headaches but still blocks dangerous sites filled with viral-scripting.
I also use the free AVG which includes a Firefox plugin to filter-out anything it considers bad.

--
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"

Gnash by buchner.johannes · 2012-04-13 05:39 · Score: 3, Insightful

I would like it if one could decide on a per-site basis to play the Flash with Gnash or with Adobe Flash.

Gnash is much faster, plays nicer with the graphic card, and is more secure. I had success using it on several websites.

However it doesn't support many of the newer Flash features, so everyone trying it out will turn away from it.

If there was a "SafeFlash" extension, that would, like HTTPSEverywhere, use Gnash where the website is compatible, a smooth transition away from Adobe Flash (which will be phased out for Linux anyway apparently) would be possible.

--
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.

Re:Gnash by hairyfeet · 2012-04-13 06:10 · Score: 5, Interesting

While that is a pretty good idea there is an even worse bug in FF that they need to address because I'm sure other bad guys will pick up on it and that is the Yahoo porn bug. I call it a porn bug because its seen most often on porn video sites but I've been told the trick is showing up at other places so maybe its starting to spread and the sad part is it ought to be trivial to stop. This is how it works:
Target A uses FF to surf a porn video site. While the video is playing FF is sent a hidden iFrame that loads the yahoo login, FF logs the target in and then everyone in their address book gets porn and malware spam links. This gets around many of the spam filters because its from a non blacklisted account and they don't send more than one or two emails per targeted address and having received a couple from those that were hit it looks like it may be taking random sentences from somewhere (maybe another hidden iFrame?) to get past the filters and look like a legit email.
The fix seems pretty obvious and I honestly don't know why mozilla hasn't done so. All one would have to do is prompt the user on install or upgrade to put a master password on their password store and here is the key have it only ask ONCE per session and no means do not ask again for the session because after telling my users to put a master password they immediately started screaming that it made FF unusable so I put a master password on mine and...wow. it will bug the ever loving shit out of you with constant asking for the master password! I was getting 4 or 5 requests for the master password on just regular sites which tells me that the current password design sucks ass if so many see you are running FF and try to hit it.
So while i'm glad they are working on the autoplay problem I'd say user passwords being threatened is just as big if not bigger and really hope they do something about this in future releases. Since I had a machine I was gonna wipe anyway I decided to cook up a couple of phony Yahoo accounts (along with a phony Gmail and Hotmail) and test this for myself and can say that at least as far as i could tell this bug ONLY affects FF and Yahoo, not Gmail or Hotmail, and not Dragon, Opera, Safari, QTWeb, or Chrome. So I'd say if you have a user or family member that uses yahoo as a primary email you might want to switch them to another browser until they get that fixed. Oh and NO I did NOT test IE because after they refused to backport to XP which is still supported i officially wrote off IE. If you have to replace a supported OS just to stay current on the fricking browser then its no longer a functional choice IMHO.
Oh and since someone always seems to ask the version number the one I tested was i believe 8, FF has been spinning through version numbers so fast lately its hard to keep up and I don't have the time to rerun this test every time a browser has a new release. If someone wants to run the test again its pretty easy, you'll need 1 fake yahoo account along with either another fake yahoo or gmail or hotmail in the address book of the fake yahoo so the bug has an email to send spam to. Then simply start clicking on random porn vids, xHamster or youPorn, any of the major porn sites will do. If the bug is still active you'll see strangely worded spam go to your target account from the yahoo account and that's how you know its still active. Like I said i just don't have the time so after trying several browsers i switched my users and family over to Comodo Dragon since it had both ABP and low rights mode. Since the switch no more strange porn spams so I'd say it was a successful switch.

--
ACs don't waste your time replying, your posts are never seen by me.
Re:Gnash by TheRealMindChild · 2012-04-13 06:30 · Score: 1

Are you saying that flash allows for XXS attacks?

--

"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Re:Gnash by Anonymous Coward · 2012-04-13 06:42 · Score: 0

eXtra eXtra Small attacks? Whoa!
Re:Gnash by Anonymous Coward · 2012-04-13 07:00 · Score: 0

The multiple, blocking master password prompt you refer to is the single most annoying megabug in Firefox. Here's the extension to control it: Master Password+. Since I'm using it together with Secure Login, I can actually use Firefox without screaming at it.
Re:Gnash by Anonymous Coward · 2012-04-13 07:38 · Score: 0

I use the master password system all the time. I only get asked after I restart the browser. I do remember that there was a setting to enable a more advanced encryption for the password store and when I enabled that, I started seeing the master password all the time. But if I just use the default encryption with master password, it works great. Though, if you cancel the master password, it will ask you again until you enter one.
Re:Gnash by theshowmecanuck · 2012-04-13 07:57 · Score: 1

F logs the target in and then everyone in their address book gets porn and malware spam links.
FTFY: FF logs the target in and then everyone in their address book gets porn and malware sperm links.

--
-- I ignore anonymous replies to my comments and postings.
Re:Gnash by ThatsMyNick · 2012-04-13 09:30 · Score: 1

FF logs the target in and then everyone in their address book gets porn and malware sperm links
I had to ask, was that intentional?
Re:Gnash by theshowmecanuck · 2012-04-13 12:32 · Score: 1

What you expect from porn related intrusion?

--
-- I ignore anonymous replies to my comments and postings.
Re:Gnash by Anonymous Coward · 2012-04-13 12:41 · Score: 0

Have you filed a bug about this?
Re:Gnash by Anonymous Coward · 2012-04-13 13:20 · Score: 0

install NoScript of Flashblock, thats all there is too it.
Re:Gnash by hairyfeet · 2012-04-13 13:28 · Score: 1

I don't know exactly what he is trying to "fix for me" but I think I would have been pointing this bug out a little more loudly if I had actually gotten malware SPERM, not to mention that PC wouldn't have been wiped but killed with fire.

--
ACs don't waste your time replying, your posts are never seen by me.
Re:Gnash by theCoder · 2012-04-13 23:52 · Score: 1

Why is this a Firefox bug? What do other browsers do to prevent this type of thing? I was under the impression that cross site scripting prohibitions in the browser prevented sites from doing what you're saying is happening.
Why would a master password protect against this issue? Wouldn't the password autofilling (assuming that's the issue) be available once the user had entered the master password, just as if there were no master password? I admit I've never bothered to set a master password, so maybe the behaviour is different when you have one.

--
"Save the whales, feed the hungry, free the mallocs" -- author unknown
Re:Gnash by Anonymous Coward · 2012-04-14 01:26 · Score: 0

So Firefox doesn't just autofill the yahoo login dialog, it actually logs you in automatically? I can't say i've seen this behaviour from a browser's saved password filling function before, are you absolutely sure there isn't something else going on?
Re:Gnash by Anonymous Coward · 2012-04-14 01:34 · Score: 0

Lesson of the day: Always use a separate browser which blocks all social networking (Do Not Track Plus and priv3 are a good FF combination for this or ShareMeNot) if you are browsing sites that would be embarrassing if your social network found out.
Re:Gnash by Zaiff+Urgulbunger · 2012-04-14 10:51 · Score: 1

I've no idea what might be causing that particular bug, but ever since this bug (360493) was active, I've enabled/disabled saving passwords as I need them. The reason being, FF seemed far to happy to automatically insert saved usernames/passwords when really I'd have much preferred have a button that *I* have to press to do activate this. I believe that is/or was the solution in Opera using a magic-wand button? (never used Opera for anything other than browser testing).

That said... I've switched to Chrome for my day-to-day browsing now! :D

FlashBlock by Anonymous Coward · 2012-04-13 05:43 · Score: 0

yay, so I can uninstall FlahBlock some day?

Scripting by Anonymous Coward · 2012-04-13 05:46 · Score: 0

Has anybody considered that some people don't like flyout menus and moving web parts? The main reason I use no script is to stop all this playing around with a website when I am there just to find some information. Now that flash and javascript are going to these new methods, I won't be able to turn off this stuff easily. What if I don't want a website storing information on my computer etc?

Re:Here's The Deal by Anonymous Coward · 2012-04-13 05:54 · Score: 0

I like the way you work it. Got to bag it up.

You mean... by ledow · 2012-04-13 06:03 · Score: 1

Like Opera's had for about 3 major versions now?

There's always the Flashblock plugin by sl4shd0rk · 2012-04-13 06:08 · Score: 1

"..Blocks Flash so it won't get in your way, but if you want to see it, just click..."

https://addons.mozilla.org/en-US/firefox/addon/flashblock/

--
Join the Slashcott! Feb 10 thru Feb 17!

Re:There's always the Flashblock plugin by hobarrera · 2012-04-13 06:23 · Score: 1

Came here to say exactly that. Looks like their intention is to integrate the functionality into firefox itself.
Re:There's always the Flashblock plugin by allo · 2012-04-13 06:57 · Score: 1

like personas. put more stuff into the core, which works better as an extension.
Re:There's always the Flashblock plugin by Anonymous Coward · 2012-04-13 07:10 · Score: 0

This doesn't protect you from flash exploits, the SWF is still processed by the plugin.
Re:There's always the Flashblock plugin by Anonymous Coward · 2012-04-15 02:53 · Score: 0

The SWF isn't even downloaded until you click to play.
Re:There's always the Flashblock plugin by hobarrera · 2012-04-15 16:26 · Score: 1

Well yeah, essential thing *should* be made part of the core. Hell, have you tried browsing the web without flashblock? Flash eating all you CPU all the time with ads, sounds comming from background tabs you can't find, etc, etc.
In some cases, it *is* more effiecient too, imagine writing something that connects to an API, registers a callback, etc, vs doing something in-core. If done properly, a minor efficienty improvement might be seen.
Finally, flashblock is ugly, the icon is horrible streched all the time! I want thing pretty!! :P

Per usual Opera's been doing it for years by cpu6502 · 2012-04-13 06:09 · Score: 1

Well maybe not "years" but since Opera 10 came out. The Javascript operates normally, but if you turn-on the Turbo mode, Opera does not load any flash content but just displays a placeholder until you click it.

That's a nice way to avoid loading a lot of ads, or embedded youtube videos (thus speeding-up browsing). Opera also has a convenient "images off/on" toggle at the bottom, which I use on slow connections like Dialup or cellphone.

--
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"

Re:Per usual Opera's been doing it for years by Anonymous Coward · 2012-04-13 06:29 · Score: 1

You don't have to use turbo mode.
Tools -> Preferences -> Advanced -> Content -> Enable plug-ins only on demand.
Re:Per usual Opera's been doing it for years by Anonymous Coward · 2012-04-13 08:13 · Score: 1

In addition, this can be turned on granularly as well (per website). It'll be under F12->Edit Site Preferences.

not good by allo · 2012-04-13 06:54 · Score: 1

instead of stuffing more and more into the browser itself, put more of the stuff in plugins.

but not the old nsplugins, limited to their square area, but plugins which can for example improve the javascript engine, define new html-tags, and such stuff.
okay, much of this is done via javascript already nowadays, but everthing which would run faster with native code, should go to plugins. so what about and video? They could be plugins, just with a reasonable api, not the limited api which nsplugins use.

tl;dr: Plugins could mean, just make your code modular and load only when needed. Much like firefox-addons, but the concept should be cross-browser. At least stop putting more and more into firefox, when only a part of the users really use it.

Five-year-old PCs in this recession by tepples · 2012-04-13 07:20 · Score: 1

Yes, it's a fairly old (2007 or earlier) desktop PC running Windows XP. But given the recent recession, I'd imagine that plenty of PCs of similar vintage are still in use, especially in workplaces.

Re:Five-year-old PCs in this recession by Anonymous Coward · 2012-04-16 05:46 · Score: 0

What version of Firefox? Please don't tell me you're using 3.6 still.
Re:Five-year-old PCs in this recession by tepples · 2012-04-16 08:53 · Score: 1

Latest stable release (11 if I recall correctly).

yes, please by Tom · 2012-04-13 08:38 · Score: 3, Insightful

On anything that is video (animated images count) or audio, I absolutely want confirmation.

I regularily open several tabs in the background, e.g. go through a news site, open all interesting articles in their own tabs, continue until end of summary page, then go read all of them. The next time some audio suddenly starts blasting through my speakers, drowning out my music, and I have to hunt down the fucking window that does it, I'll do berserk.

Seriously, audio in webpages should always require an explicit user start.

--
Assorted stuff I do sometimes: Lemuria.org

Re:yes, please by Anonymous Coward · 2012-04-14 02:12 · Score: 0

The thing is that for plugins the problem has been solved years ago with extensions.
But html5 is free to annoy you to hell. Add that youtube's html5 opt-out resets itself every other week because they absolutely wanna show you that great new feature (fuck you google) and most other pages don't even have one (fuck you), your only recourse on Firefox is to disable WebM.
On Chrome you're shit out of luck.
Meanwhile I can't use Firefox since version 5 because it freezes on Flash every 30 minutes and leaks memory like a sieve. Thanks guys.

What am I missing? by WillyWanker · 2012-04-13 09:06 · Score: 2

OK, I don't use Firefox, I use Chrome. And I have plug-ins disabled by default, so they all show up as grey boxes. If I want to run one I right click and select Run. How is this any different?

Re:What am I missing? by Anonymous Coward · 2012-04-13 13:45 · Score: 0

Firefox is enabling it by default.
Incidentally, Chrome 18 includes a "click to play" setting so you can just left-click the box, instead of right-click -> run. (The feature's actually existed for a long time in about:flags, but was finally added to the regular options in 18.)
Re:What am I missing? by DMUTPeregrine · 2012-04-13 14:57 · Score: 1

If you want to run one you left click it and it runs. One less click.

--
Not a sentence!

If analytics show a lot of Gecko by tepples · 2012-04-13 11:16 · Score: 1

good argument for using more chromium.

So if analytics show a lot of Gecko (Firefox, SeaMonkey, etc.) and a lot of MSIE, what's the most polite way to encourage the user to install one of the Chromium browsers so that the frame rate will become acceptable?

Users who lack privs to move to another browser by tepples · 2012-04-13 12:28 · Score: 1

Or the users will just move to the browser that doesn't break things

In an office, public library computer lab, school computer lab, or other institutionally managed setting, it's not the user's choice; it's the IT administrator's choice. Users don't get to install browsers because they aren't administrators, and in some cases (such as AppLocker), users don't even get to download executables or bring them in on USB flash drives.

My own results by tepples · 2012-04-13 12:33 · Score: 1

2 year old graphs

I wasn't intending to link to the graphs per se; I wasn't even aware that they were on that page. I was linking to a benchmark suite and stating my own results of running three of the benchmarks on the latest release-channel version of Firefox on a particular PC. Which benchmarks would you prefer that I had used instead?

"Java scripts" by Anonymous Coward · 2012-04-15 10:43 · Score: 0

Bad summary. There's Java, and there's Javascript. This plugin makes Java click-to-play, but spares Javascript.

Java is not a scripting language. Javascript is. The confusing naming leads to errors like these.

Re:"Java scripts" by linuxgeek64 · 2012-04-15 10:51 · Score: 1

And by "this plugin" I mean "this feature." My apologies for being stupid.

Slashdot Mirror

Mozilla Testing Click-to-Play Option For Plugin Content

124 comments