Security hole found in Mozilla browser

olefarte · Jul 9, 2004

After having read another thread here at TS, I've begun to use Firefox more and more, even though I like MyIE2 better. But, because of security concerns, I thought I'd move to Firefox.

Now I see this at ZDNet.

Developers at the open-source Mozilla Foundation have confirmed that the latest version of their Web browsers have a security flaw that could allows attackers to run existing programs on the Windows XP operating system.

I guess Firefox is not immune to security flaws, and I imagine as more people use it, problems will only get worse. But I'm going to continue to migrate to it anyway.

young&wild · Jul 9, 2004

Interesting find olefarte. Thanks for the link. Didnt expect this to happen.

DigitAlex · Jul 9, 2004

No software can be bulletproof, y&w, so it was to be expected

Rick · Jul 9, 2004

It's not the first security hole either.

There's been a number of others.. A little FYI for your IE fanboys out there.

http://www.mozilla.org/projects/security/known-vulnerabilities.html

young&wild · Jul 9, 2004

Originally posted by DigitAlex
No software can be bulletproof

I m aware of that. Its just that I didnt expect it would be that bit serious.

olefarte · Jul 9, 2004

A little FYI for your IE fanboys out there.

I myself, am not a IE fanboy. I used to use Opera, and switched to MyIE2, because I liked it better, even though it wasn't as fast. I'm probably going to keep using Firefox, even if there is security leak once in a while. I'ts for sure better than IE, and IE has a new security problem, seems like every day.

Oh, almost forgot. MyIE2 has just renamed there browser to Maxthon, (maybe to get away from the IE stigma?). I've had nothing but trouble out of there new version, even had to reboot my computer a couple of times, after it locked everything up. So if nothing else, that's one good reason for me to switch to Firefox, and I like it better than Opera.

acidosmosis · Jul 9, 2004

Har har har. Your browsers are no longer so perfect aye? I love it when I am right and all of you are wrong. (Your browsers ARENT perfect as you all claim).

Sweet sweet truth.

DigitAlex · Jul 9, 2004

Your last post proves how silly you are and that you are unable to read just what we post. Nobody said it was flawless, bulletproof or perfect.

young&wild · Jul 9, 2004

Well at least the Mozilla team got it fixed real quick. What about IE?

Rick · Jul 9, 2004

Originally posted by young&wild
Well at least the Mozilla team got it fixed real quick. What about IE?

Very true.

acidosmosis · Jul 9, 2004

Originally posted by DigitAlex
Your last post proves how silly you are and that you are unable to read just what we post. Nobody said it was flawless, bulletproof or perfect.

It's not what "you" (alternative browser users) said in this post. It's what they say and claim constantly against IE. IE isn't perfect nor is any other browser and IE does the job I want it to do every time. As many times as I have tried other browsers (I've tried Mozilla, Opera, MyIE2, etc several times over) and I always switch back to IE. That is just my whole point. Why does it work for me and no one else. So what if it has "holes" or "bugs". WE are techies, were suppost to know how to get around these issues. So in that case why are we using alternative browsers? That baffles me.

Spike · Jul 9, 2004

I must admit, for the moment, I've gone back to IE. Not because it's better, but because I'm lazy. lol

When I'm browsing unknown territory though, Firefox is my browser of choice. No-matter what the reason, IE is exploited and attacked a heck of a lot, and I find Firefox a lot more resiliant against spyware, browser hijacks, and the likes. I'm so sick of cleaning up and updating IE.

I wish MS would admit defeat on it and rebuild it from the ground up. Maybe if they do that I won't have to get it patched every other day.

Rick · Jul 9, 2004

Originally posted by acidosmosis WE are techies, were suppost to know how to get around these issues. So in that case why are we using alternative browsers? That baffles me.

While I'm a fairly dedicated IE user, alternative browsers do offer some features simply not found with Internet Explorer. IE is kind of behind when it comes to "innovation".

Aside from stability and fixes, there haven't been any major improvements for years.

RealBlackStuff · Jul 10, 2004

Just started using Firefox. How do I make the window for "Post Reply" on this forum larger? It is awfully narrow.

Firefox on W2K/SP4, 18" vis. monitor with 1024x768 resolution

DigitAlex · Jul 10, 2004

You can't, it's in the HTML, nothing to do with Firefox.

And we don't use alternative browsers to get around porblems. I started using Firefox about two years ago because it was small, launched fast unlike some others, was not tied to windows (it was able to keep the same browser in Linux), has mouse gestures, extensions and was updated with new features and releases very often, unlike IE.

Phantasm66 · Jul 10, 2004

Originally posted by DigitAlex
You can't, it's in the HTML, nothing to do with Firefox.

And we don't use alternative browsers to get around porblems. I started using Firefox about two years ago because it was small, launched fast unlike some others, was not tied to windows (it was able to keep the same browser in Linux), has mouse gestures, extensions and was updated with new features and releases very often, unlike IE.

Some very good points.

That's the first thing I noticed about Firefox as well - its just does what you want it to do.

I still think that IE displays some pages better, but that is probably just because web developers sometimes lazily only code for IE and don't properly test with other browsers.

I think Firefox will get more and more popular.

olefarte · Jul 10, 2004

Looks like a lot of people are starting to use Mozilla. Read this for more.

A series of highly publicized security vulnerabilities found in Microsoft's Internet Explorer Web browser may be having an effect on the browser's market share, according to data compiled by WebSideStory, a San Diego Web metrics company. Over the last month, Internet Explorer's share of the browser market dropped by 1 percent, the first noticeable decline since WebSideStory began tracking the browser market in late 1999.

Nic · Jul 10, 2004

Some interesting reviews on browsers ...

Firefox

MyIE2

Opera 7

And finally, two of the best compared ...

MyIE2 versus Opera

Nic · Jul 10, 2004

Originally posted by Rick
IE is kind of behind when it comes to "innovation".

You mean innovation that is obvious to users. IE packs a puch under the covers (as it integrates with the OS), but that is exactly why it is a security risk. It was designed at a time when security wasn't such a big issue as it is today. By the time longhorn comes along, much of these issues should be a thing of the past (lets hope).

I read an article recently in which the author has an explanation for why he believes Microsoft hasn't developed it's browser further, in recent years.

You can find the article over here ...

How Microsoft Lost the API War

Enter the Web

I'm not sure how I managed to get this far without mentioning the Web. Every developer has a choice to make when they plan a new software application: they can build it for the web or they can build a "rich client" application that runs on PCs. The basic pros and cons are simple: Web applications are easier to deploy, while rich clients offer faster response time enabling much more interesting user interfaces.

Web Applications are easier to deploy because there's no installation involved. Installing a web application means typing a URL in the address bar. Today I installed Google's new email application by typing Alt+D, gmail, Ctrl+Enter. There are far fewer compatibility problems and problems coexisting with other software. Every user of your product is using the same version so you never have to support a mix of old versions. You can use any programming environment you want because you only have to get it up and running on your own server. Your application is automatically available at virtually every reasonable computer on the planet. Your customers' data, too, is automatically available at virtually every reasonable computer on the planet.

But there's a price to pay in the smoothness of the user interface. Here are a few examples of things you can't really do well in a web application:

1. Create a fast drawing program.

2. Build a real-time spell checker with wavy red underlines.

3. Warn users that they are going to lose their work if they hit the close box of the browser Update a small part of the display based on a change that the user makes without a full roundtrip to the server.

4. Create a fast keyboard-driven interface that doesn't require the mouse.

5. Let people continue working when they are not connected to the Internet.

These are not all big issues. Some of them will be solved very soon by witty Javascript developers. Two new web applications, Gmail and Oddpost, both email apps, do a really decent job of working around or completely solving some of these issues. And users don't seem to care about the little UI glitches and slowness of web interfaces. Almost all the normal people I know are perfectly happy with web-based email, for some reason, no matter how much I try to convince them that the rich client is, uh, richer.

So the Web user interface is about 80% there, and even without new web browsers we can probably get 95% there. This is Good Enough for most people and it's certainly good enough for developers, who have voted to develop almost every significant new application as a web application.

Which means, suddenly, Microsoft's API doesn't matter so much. Web applications don't require Windows.

It's not that Microsoft didn't notice this was happening. Of course they did, and when the implications became clear, they slammed on the brakes. Promising new technologies like HTAs and DHTML were stopped in their tracks. The Internet Explorer team seems to have disappeared; they have been completely missing in action for several years. There's no way Microsoft is going to allow DHTML to get any better than it already is: it's just too dangerous to their core business, the rich client. The big meme at Microsoft these days is: "Microsoft is betting the company on the rich client." You'll see that somewhere in every slide presentation about Longhorn. Joe Beda, from the Avalon team, says that "Avalon, and Longhorn in general, is Microsoft's stake in the ground, saying that we believe power on your desktop, locally sitting there doing cool stuff, is here to stay. We're investing on the desktop, we think it's a good place to be, and we hope we're going to start a wave of excitement..."

The trouble is: it's too late.

Incidentally, he also says that ASP.NET is currently the best web development tool out there, which if anything shows that Microsoft may be changing its attitude towards web development, and hence Internet Explorer, may yet see some significant changes when longhorn finally arrives (my guess).

Another view: IE is of course FREE, so it isn't in Microsoft's interest to spend money developing it.

TechSpot

Security hole found in Mozilla browser

olefarte TechSpot Ambassador

young&wild TechSpot Chancellor

DigitAlex TechSpot Paladin

Rick TechSpot Staff

young&wild TechSpot Chancellor

olefarte TechSpot Ambassador

acidosmosis TechSpot Chancellor

DigitAlex TechSpot Paladin

young&wild TechSpot Chancellor

Rick TechSpot Staff

acidosmosis TechSpot Chancellor

Spike Newcomer, in training

Rick TechSpot Staff

RealBlackStuff Newcomer, in training

DigitAlex TechSpot Paladin

Phantasm66 Newcomer, in training

olefarte TechSpot Ambassador

Nic TechSpot Paladin

Nic TechSpot Paladin