Is Windows XP x64’s IE relatively secure (for now)?

After reading CNET’s review of Windows XP x64, it looks like this might be the case, if only temporarily. CNET notes that although Windows XP x64 defaults to the 64-bit version of IE, Microsoft’s does not yet have a 64-bit version of Windows Update for IE, so one has to run the 32-bit version of … Continue reading “Is Windows XP x64’s IE relatively secure (for now)?”

After reading CNET’s review of Windows XP x64, it looks like this might be the case, if only temporarily. CNET notes that although Windows XP x64 defaults to the 64-bit version of IE, Microsoft’s does not yet have a 64-bit version of Windows Update for IE, so one has to run the 32-bit version of IE (both 32-bit and 64-bit IE are included) to get Windows Update functionality.

I’m not familiar with the internals of IE, but based on my understanding of the above, it looks like if someone was running the 64-bit version of Internet Explorer, a 32-bit BHO would probably not be able to execute, thereby thwarting the current crop of [ad|spy|mal]ware targeted at IE users.

Certainly as people begin to write malicious software targeted at 64-bit systems this “advantage” will disappear, but early adopters of Windows XP x64 might get a bit of a free ride, at least with respect to IE’s security.

Now that Windows XP x64 has been released, we should decide when we will begin supporting it by providing official 64-bit builds of Firefox/Thunderbird. Plugins will probably be an issue, but since extensions are not compiled, they should have no problems running. Work has started on this front and is being tracked in bug 237202. Third party Windows x64 Firefox builds are already available.

IT Publication Hall of Shame

After reading Blake’s entry about Foxfire, I did a little bit of Googling and found the following two articles from respected (no longer) publications: Infoworld: Foxfire gets patches eWeek: Mozilla is Dead; Long Live Mozilla, which contains the following gem: Given the group’s resources, I think that was probably the right move. And, back in … Continue reading “IT Publication Hall of Shame”

After reading Blake’s entry about Foxfire, I did a little bit of Googling and found the following two articles from respected (no longer) publications:

Infoworld: Foxfire gets patches

eWeek: Mozilla is Dead; Long Live Mozilla, which contains the following gem:

Given the group’s resources, I think that was probably the right move. And, back in November, Baker made it clear that Foxfire and Thunderbird would be on the front burner, but sudden shifts like this one make me wonder about Mozilla’s long-term planning and management.

Can you say dyslexic? Personally, I think the name is fine. If there are people around who can’t remember a simple name, chances are that they won’t be able to figure out tabbed browsing either.

Computer World HK on Linux and Firefox

Computer World Hong Kong (CWHK) recently ran an article about alternatives to the Microsoft platform, focusing on Linux and Firefox. The article mentions the browser wars and quotes the WebSideStory statistics that we’ve all read so many times. When discussing the adoption of other open source software, it points out that the Singapore Ministry of … Continue reading “Computer World HK on Linux and Firefox”

Computer World Hong Kong (CWHK) recently ran an article about alternatives to the Microsoft platform, focusing on Linux and Firefox.

The article mentions the browser wars and quotes the WebSideStory statistics that we’ve all read so many times. When discussing the adoption of other open source software, it points out that the Singapore Ministry of Defence (MinDef) has already installed OpenOffice on 5,000 desktop machines (20,000 by March 2006), running alongside Office 97. MinDef had this to say about it:

“With our limited budget, we are always exploring opportunities to maximize the value for every dollar spent…We also intend to experiment with Linux desktops, but there are no concrete plans to replace the Microsoft Windows OS on the desktops at this point in time.”

Linux vendors are thrilled at the prospect, and MandrakeSoft’s Francois Bancilhon believes that as soon as customers start using OpenOffice and Mozilla, a switch to Linux is a no-brainer. Microsoft naturally maintains that Windows plus Internet Explorer is more compatible [me: okay, I can give them that], more secure, has a lower TCO, and that Internet Explorer remains the choice [me: emphasis mine] of customers and businesses worldwide.

CWHK examines Linux adoption amongst Hong Kong companies, and talks to Yusuf Goolamabbas of Outblaze, who also happens to be an avid Firefox advocate:

“We started our business in 1998,” said Yusuf Goolamabbas, managing architect for Hong Kong-based outsource-messaging provider Outblaze. “And we’ve been using Linux since Day One.” Goolamabbas noted that at that time, Windows 98 wasn’t suitable for his firm’s needs.

At work, Goolamabbas said that his firm’s engineers use Linux exclusively, while the marketing department uses Windows machines to stay in step with the firm’s 35 million users.

But Goolamabbas uses Red Hat Linux on his desktop machine at home. “My five-year-old daughter uses it without any problems,” said the Outblaze IT architect. Goolamabbas remains wary of IE’s reputation for Swiss-cheese-security and bemoaned the productivity lost as users spend time “killing viruses, squashing worms and keeping out Trojan horses.” He also declared that the HKSAR government could do more to promote usage of open-source software among its Netizenry. “The Hong Kong government says, ‘oh, everyone uses IE, but it’s not the case.”

The article is very detailed and covers a lot more topics as well. It’s well worth a read for anyone who is interested in learning about both the challenges of adopting open source software in Asia and the extent of its deployment there.

GDS with Firefox support coming Today

CNet reports that Google Desktop Search is coming out of beta today with new features including the ability to search Firefox history and Thunderbird mail. This is great news for Mozilla, though other desktop search engines such as Copernic have supported Firefox and Thunderbird for months already. Better late than never, eh?

CNet reports that Google Desktop Search is coming out of beta today with new features including the ability to search Firefox history and Thunderbird mail. This is great news for Mozilla, though other desktop search engines such as Copernic have supported Firefox and Thunderbird for months already.

Better late than never, eh?

Featured Extension: Coral Distribution Network

For those of you who are unfamiliar with the Coral NYU Distribution Network, here is a short introduction: Coral is peer-to-peer content distribution network, comprised of a world-wide network of web proxies and nameservers. It allows a user to run a web site that offers high performance and meets huge demand, all for the price … Continue reading “Featured Extension: Coral Distribution Network”

For those of you who are unfamiliar with the Coral NYU Distribution Network, here is a short introduction:

Coral is peer-to-peer content distribution network, comprised of a world-wide network of web proxies and nameservers. It allows a user to run a web site that offers high performance and meets huge demand, all for the price of a $50/month cable modem.

Publishing through Coral is as simple as appending a short string to the hostname of objects’ URLs; a peer-to-peer DNS layer transparently redirects browsers to participating caching proxies, which in turn cooperate to minimize load on the source web server. These volunteer sites that run Coral automatically replicate content as a side effect of users accessing it, improving its availability. Using modern peer-to-peer indexing techniques, Coral will efficiently find a cached object if it exists anywhere in the network, requiring that it use the origin server only to initially fetch the object once.

Since I’m currently located in Beijing, I find the Coral Network very useful for accessing sites that have been censored by the Chinese Government. By simply adding .nyud.net:8090 onto the end of a hostname, it will fetch any page and deliver it to you via its cache. There are many other uses for it, such as accessing Slashdotted sites, but I use it primarily for accessing banned sites (for example, anything on Blogspot, TypePad or LiveJournal, amongst a lot of others).

In order to make things easy for us Firefox/Mozilla users, they’ve written a search engine plugin using which you can easily ‘Coralize’ any page, an extension with which you can ‘Coralize’ any links on the current page, and a ‘Coralize’ bookmarklet that Coralizes the currently viewed page.

I’m sure someone out there will find Coral as useful as I do.

Gates brands IPR opponents Communists

CNET’s News.com was able to interview Bill Gates at the Consumer Electronics Show in Las Vegas. It’s a pretty interesting read, if for no other reason than it gives a window into the software industry’s most well known individual. However, in a not so subtle way, Gates likens IPR opponents to communists. I think this … Continue reading “Gates brands IPR opponents Communists”

CNET’s News.com was able to interview Bill Gates at the Consumer Electronics Show in Las Vegas. It’s a pretty interesting read, if for no other reason than it gives a window into the software industry’s most well known individual.

However, in a not so subtle way, Gates likens IPR opponents to communists. I think this is very much a misnomer. Here it is in his own words:

Q: In recent years, there’s been a lot of people clamoring to reform and restrict intellectual-property rights. It started out with just a few people, but now there are a bunch of advocates saying, “We’ve got to look at patents, we’ve got to look at copyrights.” What’s driving this, and do you think intellectual-property laws need to be reformed?

A: No, I’d say that of the world’s economies, there’s more that believe in intellectual property today than ever. There are fewer communists in the world today than there were. There are some new modern-day sort of communists who want to get rid of the incentive for musicians and moviemakers and software makers under various guises. They don’t think that those incentives should exist.

Make of that what you will, but I think his usage of the word communist here is pretty misleading, and is just trying to play upon the general public’s ignorance of what communism actually is and their misconception that communism is inherently evil.

There’s also the obligatory quote marginalising Firefox, but we’ve heard all that stuff before, so I’m not going to reproduce it.

Mac Firefox Install Problems

I recently set up an OS X machine, installing 10.3 to start with (base install plus BSD subsystem), and then upgrading to 10.3.7 and installing the required security updates. Having a completely clean system, I decided to install Firefox. I tried to do the install from an end user perspective, seeing what kind of experience … Continue reading “Mac Firefox Install Problems”

I recently set up an OS X machine, installing 10.3 to start with (base install plus BSD subsystem), and then upgrading to 10.3.7 and installing the required security updates. Having a completely clean system, I decided to install Firefox. I tried to do the install from an end user perspective, seeing what kind of experience they could expect. I figured I was in a position to do this, since I know little about OS X. Here is that tale:

I fired up Safari (great browser, clean interface) and head over to GetFirefox.com to download Firefox 1.0. In true end user style, I decided to forgo reading any documentation whatsoever and just hit the large “Free Download” link.

A few minutes later, I had a Firefox 1.0.dmg.gz file on my desktop, which I double clicked on. I was greeted with the following dialog:

There is no default application specified to open the document Firefox 1.0.dmg.gz. [Cancel] [Choose Application...]

I chose the ‘Choose Application…’ option and tried to find something that could reasonably be expected to open .gz files, but I wasn’t able to find anything that matched that description.

Having now reached the point at which most end users give up, I decided to be a more savvy end user, and go and read up on some docs. So, off I go and I end up at the Firefox 1.0 release notes, which have install instructions:

Double click the Firefox 1.0.dmg.dz Disk Image to uncompress and mount it. Your browser may have already done this for you. Double click the Firefox Disk Image to open it in Finder and drag the Firefox application onto your hard disk. Do not double click the icon in the disk image! Be sure to drag the Firefox application out of the disk image and onto your Hard Disk before running it. Drag the icon to your Dock if you want it to appear there.

Wait a second, didn’t I just do this? Safari had no earthly idea what to do with the .dmg.gz, so it didn’t open it, and obviously MacOS X had no idea either. Dead end.

The Camino download page had some instructions that looked potentially useful:

Once you’ve downloaded the .dmg.gz file, drag it onto Stuffit Expander to decompress it. If the disk image doesn’t mount automatically, double-click on the .dmg file to mount it. If that fails, and the file does not look like a disk image file, do a “Show Info” on the file, and, in the “Open with application” category, choose Disk Copy. In Mac OS 10.2, you can use “Open with” from the context menu.

But, my install of OS X didn’t have Stuffit Expander, nor did it have the Disk Copy application. After a little further research, I found out that starting in OS X 10.3, the functionality of Disk Copy was integrated into Disk Utility, but I was unable to get Disk Utility to do anything useful with the .dmg.gz file. Another dead end. This is way more than the amount of work we can expect 99% of end users to do, and I still hadn’t got Firefox installed.

Now, I realise that OS X has a BSD base, and has command line utilities to un-gzip files. But really, do we expect an end user to have to do that? I hope not. This install routine assumes too much about users’ systems and the tools they have at their disposal. This is not good.

There is an easy solution, which is to make Firefox available as a .dmg file rather than a .dmg.gz. We should be doing this anyway, because the standard way of distributing Mac software is via .dmg files. Presenting the user with a familiar install process will result in a much better user experience, with more completed installs. It’s rather unreasonable to expect end users to have to troubleshoot getting the installer disk image mounted.

UPDATE: The relevant bugs are as follows:

  • Bug 169602: [Camino] Use compressed disk image instead of gzip’d dmg for installer
  • Bug 242845: Firefox disk image should use .dmg internal zlib-compression, not .dmg.gz
  • Bug 268074: [Suite] Mozilla DMGs are redundantly compressed with gzip
  • Bug 276571: Thunderbird disk image should use .dmg internal zlib-compression, not .dmg.gz

UPDATE 2: Firefox, Thunderbird and Mozilla are all now distributed in compressed DMG format!

UPDATE 3 (11 May 2005): Camino nightlies are now distributed in compressed DMG format! Also, Mac OS X 10.4 (Tiger) no longer ships with Stuffit Expander installed by default, thus making this change even more important.

HP recommending testing webapps in Firefox

In a monthly web standards newsgram, HP recommends testing webapps in Firefox. They note that after IE6, Mozilla based browsers are the second most popular UAs that hit HP.com. That’s very interesting, since that means we must be beating out even older revisions of IE. They put it pretty well: “Make sure your Web Section … Continue reading “HP recommending testing webapps in Firefox”

In a monthly web standards newsgram, HP recommends testing webapps in Firefox. They note that after IE6, Mozilla based browsers are the second most popular UAs that hit HP.com. That’s very interesting, since that means we must be beating out even older revisions of IE.

They put it pretty well: “Make sure your Web Section is as smooth and polished in Firefox as it is in IE. Don’t let your customers find your bugs first!”

It’s great to see this kind of enterprise adoption catching on.

new york times firefox ad goes live

The NYT Firefox ad has gone live. I’m not going to cover it in great detail, since that’s been done already by plenty of others. Instead, I offer you a sample from my Inbox: Woo! My name is in the New York Times ad as one of the Mozilla Firefox donators. Ali’s name is listed … Continue reading “new york times firefox ad goes live”

The NYT Firefox ad has gone live. I’m not going to cover it in great detail, since that’s been done already by plenty of others. Instead, I offer you a sample from my Inbox:

Woo!

My name is in the New York Times ad as one of the Mozilla Firefox donators. Ali’s name is listed also.
Here’s the sample ad URL:
http://www.mozilla.org/press/nytimes-firefox-final.pdf

Thanks Ali for spreading the word. I’m going to buy the poster for this thing!

When the NYT ad was still accepting signups, I posted a note about it to an email list consisting of quite a few of my friends from high school, and the above email was seen today on the same list.

As it turns out, Firefox is back in the NYT again and getting more attention, this time in an article by Randall Stross. Some choice quotes from there are reproduced below:

Mr. Schare has said that Mozilla’s Firefox must prove it can smoothly move from version 1.0 to 2.0, and has thus far enjoyed “a bit of a free ride.” If I were the spokesman for the software company that included the company’s browser free on every Windows PC, I’d be more careful about using the phrase “free ride.”

[snip]

Mr. Schare of Microsoft does have one suggestion for those who cannot use the latest patches in Service Pack 2: buy a new personal computer. By the same reasoning, the security problems created by a car’s broken door lock could be solved by buying an entirely new automobile. The analogy comes straight from Mr. Schare. “It’s like buying a car,” he said. “If you want to get the latest safety features, you have to buy the latest model.”

In this case, the very latest model is not an ’01 Internet Explorer, but an ’04 Firefox.

Looks like Mr. Schare has a penchant for putting his foot in his mouth. 🙂

blog housekeeping

I’ve been doing some housekeeping on my blog over the last few days, and have made a few changes and additions: In addition to the faux blog post about Firefox that IE users see, I’ve added browser sniffing code to my Firefox sidebar box, which serves different content according to what browser you use to … Continue reading “blog housekeeping”

I’ve been doing some housekeeping on my blog over the last few days, and have made a few changes and additions:

  1. In addition to the faux blog post about Firefox that IE users see, I’ve added browser sniffing code to my Firefox sidebar box, which serves different content according to what browser you use to view it. Currently, it’s capable of differentiating between (and serves different content to) the following:
    • Firefox
    • Gecko-based, non Firefox
    • Internet Explorer
    • Opera / Safari / Konqueror
    • Others

    There’s no real reason for this, other than one of the PHP tutorials for beginners happened to cover user agent sniffing at an early stage, so I thought I’d tinker with it.

  2. I’ve added TypeKey support to comments. Later on I might enable comment moderation for non-Typekey enabled commenters.
  3. I’ve added a class to my blog called aebrahim-mozillaAdvertising. Any form of static Firefox or Thunderbird advertising is enclosed within this class. Feel free to do whatever you want with it using userContent.css (or whatever alternate method your browser supports).
  4. I’ve made my blog’s HTTP headers a little more sensible. I’ve added Last-Modified headers to all pages, and added charset=utf-8 to the Content-Type header. I’ve also added Vary: User-Agent to the blog homepage.

UPDATE: I’ve removed most of the advertising because I think it’s annoying.