Well what exactly do you expect people to do? Record every web site they visit, every key they press, every mouse movement they make, so that when the browser's memory usage eventually gets too high there is a clear record of what has happened?
I've never had to work that hard to find the steps to reproduce a memory problem. And if lots of people are seeing the problem, then at least a few people will get lucky and be able to find steps easily. The fact that no one has been able to find the problem is an indication of just how rare the problem is.
I understand that. However, absolutely none of these people can report how to reproduce the problem, so no one can see what it is and it cannot be fixed. Additionally, as is said even in the famous InternetWeek article about Firefox 1.5 problems, it is clearly only a "on a small percentage of Windows, Mac, and Linux computers" that this problem occurs. The people who are not using those computers don't see any problem.
While these extensions may all have memory problems, they are not the main cause of memory leaks in Firefox. With none but the default settings causes the browser to constantly eat memory, there is a problem.
Yes, that would be a problem. Could you finally tell us how to see this problem? Many users, myself included, are not able to cause "the browser to constantly eat memory" without using an extension with a severe memory leak.
I don't think you understood what I said. Although you may need to use extensions, you may easily avoid the ones that significantly decrease performance.
Sorry, I wasn't engaging in "personal attacks on anyone who runs into difficulty." I pointed out the poster was fabricating an obviously untrue report about the number of Firefox users decreasing. I have noticed many other people fabricating other bad news about Firefox (such as the recent hoax about security problems), and often the "bad news" can easily be proven untrue.
As for your genuine memory problem, I'm sorry to head about it. I use Firefox for days at a time, and memory use stays at around 100 MB for me. If you want something done about the problem you're having, you'll have to give enough information that other people can see the bug on their own machine (as easily as possible). Simply saying you see the problem after a day or two of use doesn't help, because most people see memory usage stay low, even when running Firefox continually for days.
And yet whenever I ask how to reproduce "this memory issue" no one can tell me how to see it. Frankly, lots of us have no idea what you're referring to when you say you're having problems with memory usage in Firefox. Please, explain to us what the problem is, in enough detail that we can finally see it.
My Firefox 2 RC2 process from early this afternoon ended up hitting about 650 MB of RAM
If you can find steps to reliably reproduce any memory problem in Firefox 2 RC2, please go to MozillaZine and give them the information about how to see the problem. Someone will make sure the bug is reported in the bug database so it can be fixed.
What has gone up dramatically has been the amount of bad news people are making up about Firefox. Sorry, trying to make Firefox look bad hasn't worked in the past and it won't work now.
Somebody may have some anecdotal 'evidence' that they ran it with a small memory print but generally Firefox will bloat to several hundred MB and keep climbing unless you close it completely and restart it
Sorry, no one can seem to reproduce this "bloat to several hundred MB and keep climbing" thing you're referring to. Can you give us some hints about how to do it? Without being able to reproduce it, I think we'll eventually have to brand this problem as a hoax, too. Especially if people are able to reproduce the benchmark results with Firefox consuming much less memory than Opera or IE.
If they won't say what the vulnerabilities actually are in detail, how could anyone know? Remember, they are refusing to report them; they just want to exploit them and brag about it.
When it comes to patching, all of the browsers are improving. Firefox is the fastest to get its patches out, with a one-day window of exposure. Opera had a two-day window of exposure, down from 18 days during the last half of 2005. The window of exposure for Safari is up to five days (from zero), while Internet Explorer typically has a nine-day window, down from 25 days in the previous study.
It seems like Mozilla developers are quite interested and skilled in fixing bugs to me.
Chances of this happening is slim to none, unless some funds the 10,000's of man-hours necessary to do this.
Why does TFA say "Besides the inclusion of those two softs inside the office suite, connectors to Sun Calendar Server and Microsoft Exchange will also be developed accordingly." then?
It's not what some vendors would advocate, but it's what is currently listed in Wikipedia as the description for responsible disclosure:
Some believe that in the absence of any public exploits for the problem, full and public disclosure should be preceded by disclosure of the vulnerability to the vendors or authors of the system. This private advance disclosure allows the vendor time to produce a fix or workaround. This philosophy is sometimes called "responsible disclosure".
I agree four months seems like an excessively long time to stay quiet about a vulnerability, especially a serious one. Serious vulnerabilities should be fixed in the next security patch, unless the next one is too close for adequate testing.
In the case of a vulnerability that is being exploited, I agree that immediate action is necessary. However, with full disclosure there's always the possibility the some, or even most, black hats don't know about the vulnerability. In that case, again you've just made exploits more likely.
Doesn't it seem more responsible to disclose only what's necessary, such as that a hot fix is available for a security problem, or that disabling a certain service on a certain OS will prevent your system being exploited? That's responsible disclosure, which seems more responsible that full disclosure to me.
Same goes for exploit disclosure. If an exploit is found, it might be okay to keep it quiet for a little while, as there is a high probability of a fire rather than an actual fire. But the longer you wait, the more likely somebody else a little less honorable will also find the exploit.
I completely agree. Immediate disclosure does nothing but help the bad guys. Staying quiet about it too long helps the bad guys, too. The only question is, what is the proper amount of time to wait after a vulnerability is discovered before you fully disclose information about it? Days? Weeks?
On the other hand, if a security update is only days away, full disclosure of the vulnerability won't get a fix in the next update. It takes time to write and test that a fix doesn't introduce new bugs. Additionally, what if the black hats haven't found the vulnerability yet? By announcing the vulnerability immediately after discovery, you haven't helped get the fix out sooner, and worse, you've made it more likely for an exploit to be developed.
Announcing a vulnerability immediately doesn't seem responsible, because it could likely do only harm. Why not give the vendor until the next security update, or until the security update after that if the next update is scheduled within two weeks, to write, test, and deploy the fix?
If there is really a fire, or a likelihood of a fire, you should inform the management so they can make an announcement that doesn't set off panic, which could lead to people being trampled to death.
In the case of security announcements, publicly disclosing a vulnerability before the vendor has been given time to get a patch out actually can cause a fire, because disclosing the vulnerability also allows anyone to create an exploit for the vulnerability.
In essence, full disclosure isn't as bad as shouting "Fire!" in a crowded theater. It's like being in a theater made of flash paper doused in gasoline, and then giving an arsonist a match.
Slashdot Mirror
I understand that. However, absolutely none of these people can report how to reproduce the problem, so no one can see what it is and it cannot be fixed. Additionally, as is said even in the famous InternetWeek article about Firefox 1.5 problems, it is clearly only a "on a small percentage of Windows, Mac, and Linux computers" that this problem occurs. The people who are not using those computers don't see any problem.
I don't think you understood what I said. Although you may need to use extensions, you may easily avoid the ones that significantly decrease performance.
Sorry, I wasn't engaging in "personal attacks on anyone who runs into difficulty." I pointed out the poster was fabricating an obviously untrue report about the number of Firefox users decreasing. I have noticed many other people fabricating other bad news about Firefox (such as the recent hoax about security problems), and often the "bad news" can easily be proven untrue.
As for your genuine memory problem, I'm sorry to head about it. I use Firefox for days at a time, and memory use stays at around 100 MB for me. If you want something done about the problem you're having, you'll have to give enough information that other people can see the bug on their own machine (as easily as possible). Simply saying you see the problem after a day or two of use doesn't help, because most people see memory usage stay low, even when running Firefox continually for days.
And yet whenever I ask how to reproduce "this memory issue" no one can tell me how to see it. Frankly, lots of us have no idea what you're referring to when you say you're having problems with memory usage in Firefox. Please, explain to us what the problem is, in enough detail that we can finally see it.
Nope, Firefox is still gaining usage share at the rate of several percentage points per year.
What has gone up dramatically has been the amount of bad news people are making up about Firefox. Sorry, trying to make Firefox look bad hasn't worked in the past and it won't work now.
Maybe we could debunk the Firefox is a memory hog hoax, too.
If they won't say what the vulnerabilities actually are in detail, how could anyone know? Remember, they are refusing to report them; they just want to exploit them and brag about it.
Oh, Linux lets you use a compiler now, instead of forcing you to compile everything by hand? Whew, that's certainly going to make things much easier!
You mean an arbitrary code execution vulnerability? Yes, Firefox and Opera have both had them, too.
Earlier this year Coverity analyzed the Firefox source code also.
From The Ars Technica article:
It seems like Mozilla developers are quite interested and skilled in fixing bugs to me.
On the other hand, if you want Exchange support in Mozilla, vote for bug 128284.
I agree four months seems like an excessively long time to stay quiet about a vulnerability, especially a serious one. Serious vulnerabilities should be fixed in the next security patch, unless the next one is too close for adequate testing.
In the case of a vulnerability that is being exploited, I agree that immediate action is necessary. However, with full disclosure there's always the possibility the some, or even most, black hats don't know about the vulnerability. In that case, again you've just made exploits more likely.
Doesn't it seem more responsible to disclose only what's necessary, such as that a hot fix is available for a security problem, or that disabling a certain service on a certain OS will prevent your system being exploited? That's responsible disclosure, which seems more responsible that full disclosure to me.
On the other hand, if a security update is only days away, full disclosure of the vulnerability won't get a fix in the next update. It takes time to write and test that a fix doesn't introduce new bugs. Additionally, what if the black hats haven't found the vulnerability yet? By announcing the vulnerability immediately after discovery, you haven't helped get the fix out sooner, and worse, you've made it more likely for an exploit to be developed.
Announcing a vulnerability immediately doesn't seem responsible, because it could likely do only harm. Why not give the vendor until the next security update, or until the security update after that if the next update is scheduled within two weeks, to write, test, and deploy the fix?
If there is really a fire, or a likelihood of a fire, you should inform the management so they can make an announcement that doesn't set off panic, which could lead to people being trampled to death.
In the case of security announcements, publicly disclosing a vulnerability before the vendor has been given time to get a patch out actually can cause a fire, because disclosing the vulnerability also allows anyone to create an exploit for the vulnerability.
In essence, full disclosure isn't as bad as shouting "Fire!" in a crowded theater. It's like being in a theater made of flash paper doused in gasoline, and then giving an arsonist a match.