> Will Firefox now become a new attack vector for exploits?
That's a really good question.
From what I understood from the planning wiki, the MozillaMaintennce Service will only install binaries digitally signed with Mozilla's private key. You can't install arbitrary EXEs with this, so I'd say the risk of becoming a vector is small.
Of course, the service can perform privileged actions *and* be invoked by a non-privileged user, so a buffer-overflow type bug in the service could well be exploitable, so I'm hoping Mozilla have audited this thoroughly.
I agree. At the time of release, IE6 was probably the best browser out there. Netscape 6, based Mozilla 0.6, was released around the same time and was pretty slow and ugly. The problem with IE6 wasn't initially standards support (it supported XMLHttpRequest and a fair bit of dynamic HTML, including.eot embedded fonts), it was Microsoft's utterly contemptuous attitude towards users' safety on the web. Popups, drive-by downloads, rogue ActiveX controls, no adblock unless you used a filtering proxy like Proxomitron -- all of these combined to make web browsing a pretty hellish experience. Which is why, I suspected, a lot of people switched to Phoenix as soon as it was usable in late 2002 -- mainly for the popup blocking and the lack of drive-by downloads. The tabbed browsing was just a bonus.
Microsoft took over the browser market fair and square by making a better product, but they were so afraid that Web-based applications would eliminate the need for Windows that they locked the IE team in a dark dungeon and they haven't allowed improvements to IE for several years now. Now Firefox is the better product and there's a glimmer of hope that one day DHTML will actually improve to the point where web-based applications are just as good as Windows-based applications
The misfits. The rebels. The troublemakers. The round pegs in the square holes.
The ones who see things differently. They're not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them.
About the only thing you can't do is ignore them. Because they change things. They invent. They imagine. They heal. They explore. They create. They inspire. They push the human race forward.
Maybe they have to be crazy.
How else can you stare at an empty canvas and see a work of art? Or sit in silence and hear a song that's never been written? Or gaze at a red planet and see a laboratory on wheels?
====
The reasonable man adapts himself to the world. The unreasonable man persists in trying to adapt the world to himself. Therefore, all progress depends on the unreasonable man. --George Bernard Shaw
====
Goodbye Steve, and thanks for everything. Even the stuff I hated.
MS Office has been capable of saving ODFs since Office 2007 - you needed an add-in. Since Office 2010, I _believe_ saving to ODF is available by default.
I don't understand; how does theming your window manager help against this? I'm assuming the malware bit is *inside* the Google Chrome window, so even if you themed your windows with say a Pikachu theme, the *insides* of the Chrome window would still contain the rogue site, imitating Chrome's red and white-colored malware block UI.
The only way out of this is if crucial error pages are protected with some sort of "sign-in seal", like Yahoo uses for its login screens.
Don't know about NT4 (not used it since the 90s), but XP and up have SteadyState. Check out its disk protection feature, it's functionally chroot with a wipe after app exit.
> Release a hotfix to disable the hlp resource locator.. as you should have done as soon as you got the bug report.
There's one already, but it won't be delivered via Windows Update, users must opt in: On this page look for the Fixit Link ( http://go.microsoft.com/?linkid=9735564 ) The problem is that switching off a feature without fully testing repercussions -- which is what would happen if this was pushed out via Windows Update -- is not good and can cause other things to break.
But Apple does in fact have a solution to the fact that iPhone original and 3G users don't get the latest and greatest. It's calling "upgrading" -- the same strategy they encourage in Mac-land. So far their "lifecycle policy" appears to be -- we'll support the latest version and the latest-1 version. Anything before that, don't expect much.
And in both Mac-land and iPhone-land, developers develop for the latest and greatest as a result, knowing that eventually the users they want to reach will upgrade.
I don't like it myself, but it's true -- people who stay with old OSes etc rarely buy stuff. Big-picture wise, it's a waste of time targeting them.
The Times and the Sunday Times are "just a start" according to News Corp. Presumably the Sun and the News of the World will also follow. However, the Sun's readership is solidly lowbrow and it's not a "quality paper" by any stretch of the imagination, I don't know how many of actually pay to get celebrity news and gossip online.
The interesting thing is that Murdoch's Sky News website remains free to access -- they haven't announced any plans to charge for that.
IE8 doesn't install automatically in the same way that Chrome updates automatically from 2.x to 3.x or Windows installs security updates. You get a new dialog box prompting you to "upgrade your web experience with a new version of IE", or language to that effect. LOTS of of non-expert users just hit the [X] Close button at that point (for whatever reason -- fear of installing new software, having been taught that installing random new software off the Net is bad, and so on).
Browser upgrades ought to be invisible. But because of Microsoft's awkward IE 6 to 7 to 8 transitions, it isn't. And it keeps a lot of people from upgrading as quickly as they should.
> That big new Corvette Engine does not fit in 8 year old Chevy Cavalier, is that GM's fault?
Car analogies for software are imperfect. You can't fit a bigger engine retroactively into a Chevy Cavalier, but you can backport new software to older OSes. Microsoft even does it for their Windows Live software (Live Messenger has some very snazzy Windows 7-style graphics).
The real reason for not supporting IE9 on XP is that they don't want to. Imho this is stupid given the number of XP users out there (and XP is here to stay 'til 2014), but if they don't care about marketshare... *shrug*.
While I agree with everything you say, I'll point out the following (and I usually support MS on many issues):
Windows Live Messenger 14.x (labelled '9 series' or something) has lots of snazzy Windows 7-style visual effects and was backported to Windows XP (I am aware this is less elaborate than what IE9 is planning).
Opera supports 2D acceleration under XP
The technical arguments against backporting to XP are hogwash. Chrome has superior sandboxing on Vista/7, but gracefully downgrades on XP
Microsoft is shooting themselves in the foot by effectively ceding the modern XP browser market to Chrome, Firefox and Opera. XP will still be around 'til 2014-2015. That's 4-5 years. If they think they can afford that, well, more power to them.
Excellent point. Last year I visited a customer with ~200 Windows 2000/IE6 desktops. They don't connect to the Internet and will get updates until July 2010. They'll probably move to Windows 7 in 2011, especially as virtualization can guarantee their old apps will continue to run.
These guys spent next to nothing on software and very little on hardware for the past 10 years. It doesn't work for everyone but they saw it as a good deal.
XP users savvy enough to upgrade to IE8 probably also have another browser. Very few corporate intranets have mandated XP/IE8. I foresee many developers having to support mainly IE6/XP and Firefox* in the near future, and maybe a quickie test on IE7 and IE8 if you have resources to do so.
* The idea is that if you wrote a reasonably standards-based site and tested with Firefox, it will work well in Chrome/Safari/Opera. Feel free to test with any other standards-based browser instead.
The CrunchPad was supposed to be a dead-simple, cheap $200 tablet. Closer to production, it looks like it'll cost more like $500. A $99 device would be nice, but I'll believe it when I see it. A decent screen + NAND memory + battery alone will add to the cost.
> When you're buying a web-based application, you make sure it works on every browser you can get your hands on.
_Every_ browser? seriously? Then we'd have to ditch this newfangled web thang and go back to VB-style client/server apps.
We do test for IE7 and Firefox, and are currently testing and deploying IE8. Chrome still has loads of site-compat problems. Opera has really improved over the years, but even with the latest 10.5 version things remain broken, even on well-trafficked public sites like Google and Facebook. It does work with the internal apps I've tried it with, but I couldn't put my hand on heart and swear it was compatible with _everything_.
We do have a simple rule to enforce security: our proxy blocks the IE user agent from accessing the external internet (and the desktops are locked down so spoofing isn't a problem). IE is an intranet browser for us. Those who need internet access (mainly devs) get Firefox.
* The content was blocked without warning, leading many to think Ars was broken * Readers who complained were called "leechers" who were "held in contempt". * They use Doubleclick and serve animated Flash ads * Apparently text ads (e.g. Google AdSense) don't pay very well
Many of us do understand that Ars is more expensive to run than Stack Exchange or (maybe) Slashdot, because Ars has to pay writers. However the fact that web advertising is so inflexible and user-hostile is very sad and says something about the industry. BoingBoing and Daring Fireball seem to be doing well with their homegrown ad networks, maybe someone will take some ideas from them and come up with a non-evil ad network.
Slashdot Mirror
> Will Firefox now become a new attack vector for exploits?
That's a really good question.
From what I understood from the planning wiki, the MozillaMaintennce Service will only install binaries digitally signed with Mozilla's private key. You can't install arbitrary EXEs with this, so I'd say the risk of becoming a vector is small.
Of course, the service can perform privileged actions *and* be invoked by a non-privileged user, so a buffer-overflow type bug in the service could well be exploitable, so I'm hoping Mozilla have audited this thoroughly.
I agree. At the time of release, IE6 was probably the best browser out there. Netscape 6, based Mozilla 0.6, was released around the same time and was pretty slow and ugly. The problem with IE6 wasn't initially standards support (it supported XMLHttpRequest and a fair bit of dynamic HTML, including .eot embedded fonts), it was Microsoft's utterly contemptuous attitude towards users' safety on the web. Popups, drive-by downloads, rogue ActiveX controls, no adblock unless you used a filtering proxy like Proxomitron -- all of these combined to make web browsing a pretty hellish experience. Which is why, I suspected, a lot of people switched to Phoenix as soon as it was usable in late 2002 -- mainly for the popup blocking and the lack of drive-by downloads. The tabbed browsing was just a bonus.
Joel Spolsky said it best:
The misfits. The rebels. The troublemakers. The round pegs in the square holes.
The ones who see things differently. They're not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them.
About the only thing you can't do is ignore them. Because they change things. They invent. They imagine. They heal. They explore. They create. They inspire. They push the human race forward.
Maybe they have to be crazy.
How else can you stare at an empty canvas and see a work of art? Or sit in silence and hear a song that's never been written? Or gaze at a red planet and see a laboratory on wheels?
====
The reasonable man adapts himself to the world. The unreasonable man persists in trying to adapt the world to himself. Therefore, all progress depends on the unreasonable man. --George Bernard Shaw
====
Goodbye Steve, and thanks for everything. Even the stuff I hated.
MS Office has been capable of saving ODFs since Office 2007 - you needed an add-in. Since Office 2010, I _believe_ saving to ODF is available by default.
> you still can't zoom the font size, only the whole damn page as an image.
Indeed. That bug's been marked as WONTFIX for 2 years now.
> oracle is one of those business providing useless solution so they can charge you twice for the consultancy.
I thought that was IBM.
> Some of us haven't ruined their taste buds with bad beers and ketchup sauce, so we do care.
But would you be able to prove that you can detect geographic differences in a double-blind taste test?
I don't understand; how does theming your window manager help against this? I'm assuming the malware bit is *inside* the Google Chrome window, so even if you themed your windows with say a Pikachu theme, the *insides* of the Chrome window would still contain the rogue site, imitating Chrome's red and white-colored malware block UI.
The only way out of this is if crucial error pages are protected with some sort of "sign-in seal", like Yahoo uses for its login screens.
Don't know about NT4 (not used it since the 90s), but XP and up have SteadyState. Check out its disk protection feature, it's functionally chroot with a wipe after app exit.
> Release a hotfix to disable the hlp resource locator.. as you should have done as soon as you got the bug report.
There's one already, but it won't be delivered via Windows Update, users must opt in: On this page look for the Fixit Link ( http://go.microsoft.com/?linkid=9735564 ) The problem is that switching off a feature without fully testing repercussions -- which is what would happen if this was pushed out via Windows Update -- is not good and can cause other things to break.
Sort of off topic, but I've always wondered: Can I be on an Atkins diet and still be a pastafarian?
You must've not been check the stock markets lately, these days AAPL is almost as big as MSFT and gaining fast.
(via)
But Apple does in fact have a solution to the fact that iPhone original and 3G users don't get the latest and greatest. It's calling "upgrading" -- the same strategy they encourage in Mac-land. So far their "lifecycle policy" appears to be -- we'll support the latest version and the latest-1 version. Anything before that, don't expect much.
And in both Mac-land and iPhone-land, developers develop for the latest and greatest as a result, knowing that eventually the users they want to reach will upgrade.
I don't like it myself, but it's true -- people who stay with old OSes etc rarely buy stuff. Big-picture wise, it's a waste of time targeting them.
The Times and the Sunday Times are "just a start" according to News Corp. Presumably the Sun and the News of the World will also follow. However, the Sun's readership is solidly lowbrow and it's not a "quality paper" by any stretch of the imagination, I don't know how many of actually pay to get celebrity news and gossip online.
The interesting thing is that Murdoch's Sky News website remains free to access -- they haven't announced any plans to charge for that.
> Just wait, in ten years, Chinese firms will be outsourcing there.
They already are planning to do so (warning: the FT restricts how many pages you can view, even if you register)
But it's not surprising. After all, pretty much all the Japanese auto manufacturers now actually produce in the US.
IE8 doesn't install automatically in the same way that Chrome updates automatically from 2.x to 3.x or Windows installs security updates. You get a new dialog box prompting you to "upgrade your web experience with a new version of IE", or language to that effect. LOTS of of non-expert users just hit the [X] Close button at that point (for whatever reason -- fear of installing new software, having been taught that installing random new software off the Net is bad, and so on).
Browser upgrades ought to be invisible. But because of Microsoft's awkward IE 6 to 7 to 8 transitions, it isn't. And it keeps a lot of people from upgrading as quickly as they should.
> That big new Corvette Engine does not fit in 8 year old Chevy Cavalier, is that GM's fault?
Car analogies for software are imperfect. You can't fit a bigger engine retroactively into a Chevy Cavalier, but you can backport new software to older OSes. Microsoft even does it for their Windows Live software (Live Messenger has some very snazzy Windows 7-style graphics).
The real reason for not supporting IE9 on XP is that they don't want to. Imho this is stupid given the number of XP users out there (and XP is here to stay 'til 2014), but if they don't care about marketshare ... *shrug*.
While I agree with everything you say, I'll point out the following (and I usually support MS on many issues):
Excellent point. Last year I visited a customer with ~200 Windows 2000/IE6 desktops. They don't connect to the Internet and will get updates until July 2010. They'll probably move to Windows 7 in 2011, especially as virtualization can guarantee their old apps will continue to run.
These guys spent next to nothing on software and very little on hardware for the past 10 years. It doesn't work for everyone but they saw it as a good deal.
XP users savvy enough to upgrade to IE8 probably also have another browser. Very few corporate intranets have mandated XP/IE8. I foresee many developers having to support mainly IE6/XP and Firefox* in the near future, and maybe a quickie test on IE7 and IE8 if you have resources to do so.
* The idea is that if you wrote a reasonably standards-based site and tested with Firefox, it will work well in Chrome/Safari/Opera. Feel free to test with any other standards-based browser instead.
The CrunchPad was supposed to be a dead-simple, cheap $200 tablet. Closer to production, it looks like it'll cost more like $500. A $99 device would be nice, but I'll believe it when I see it. A decent screen + NAND memory + battery alone will add to the cost.
> When you're buying a web-based application, you make sure it works on every browser you can get your hands on.
_Every_ browser? seriously? Then we'd have to ditch this newfangled web thang and go back to VB-style client/server apps.
We do test for IE7 and Firefox, and are currently testing and deploying IE8. Chrome still has loads of site-compat problems. Opera has really improved over the years, but even with the latest 10.5 version things remain broken, even on well-trafficked public sites like Google and Facebook. It does work with the internal apps I've tried it with, but I couldn't put my hand on heart and swear it was compatible with _everything_.
We do have a simple rule to enforce security: our proxy blocks the IE user agent from accessing the external internet (and the desktops are locked down so spoofing isn't a problem). IE is an intranet browser for us. Those who need internet access (mainly devs) get Firefox.
You're right. Seriously shameful.
Eh, I meant the engine behind StackOverflow, SuperUser and the like.
* The content was blocked without warning, leading many to think Ars was broken
* Readers who complained were called "leechers" who were "held in contempt".
* They use Doubleclick and serve animated Flash ads
* Apparently text ads (e.g. Google AdSense) don't pay very well
Many of us do understand that Ars is more expensive to run than Stack Exchange or (maybe) Slashdot, because Ars has to pay writers. However the fact that web advertising is so inflexible and user-hostile is very sad and says something about the industry. BoingBoing and Daring Fireball seem to be doing well with their homegrown ad networks, maybe someone will take some ideas from them and come up with a non-evil ad network.