Exploit turns up heat for Firefox flaw

CNet News ^ | 8 February 2006 | Joris Evers

[N3WBI3]

You never had a BSD after installing a kludged driver on a video card?

Not asking where 3rd party stuff can hurt OSS, Im asking for an example of a freeper syaing MS is responsable for a thrid pary application not being compatable with windows?

[N3WBI3]

You argue like a Leftist.

And you troll like a 5 year old...

I made a post

That someone disagreed with

I know that Firefox is a bunch of people trying to break the Mozilla browser down into components. Maybe that's part of the problem. Too many cooks, and no recipe, no well defined roadmap.

But your only solid statement as to why its not ready for prime time is that some people write bad extensions. Ignoring the fact its not a weakness in the browser (on XP I did not have to replace one extension going from 1.5.0 to 1.5.0.1) its a weekness at most in oversite of what extensions they put on their site.

I find it astonishing that such a major flaw as erasing the whole Program Files folder taking a year to fix not only doesn't raise any eyebrows

Oh for petes sake thats when it was offically in BETA, thats not now. Did you hear some of the crap the IE7 beta does to peoples computers? I suppose because of the fact IE& has tosted at least two of my friends computers that even a year from now when its officially released its not 'ready for primtime'.

No, I'm sure you'd rather keep that quiet.

Keep what quite that bate OSS products are not the cleanest things in the world?

[JoJo Gunn]

Are you still here, Foghorn?

This is all you're gonna hear from me, Foghorn, so heed it well: earlier today someone on a thread about the Ditzy Chicks said something that's just as pertinent to Mozilla, or Microsoft, or General Motors or SONY or HP, etc, and their fanbois thereof.

They need me. I don't need them.

And don't hink you'll get a pass for defending your idiot fanboi and his condescending crap about getting a grip on my anger. That twit asked for a slapping, and I gave it to him. (How chivalrous of you to run to the aid of the lady. You get a gold star).

See ya around....

[N3WBI3]

So I take it other than the fact

(1) While in beta the installer was hinki

and

(2) Some third party modules are poorly written

You really have no other reason FireFox is not 'ready for prime time'...

BTW If Im FogHorn its a fair bet we all know who you are

[antiRepublicrat]

Based on what? some people have written bad third party software for it?

Mozilla could use a mechanism to kill and disable extensions that misbehave.

[N3WBI3]

Perhaps, and thats about the most constructive thing said on this thread, I still think the low hanging fruit in all of this is for Mozilla to be more selective about what plugins they post on their site...

[webstersII]

How's the weather in Redmond, BTW?

[antiRepublicrat]

I know that Firefox is a bunch of people trying to break the Mozilla browser down into components. Maybe that's part of the problem. Too many cooks, and no recipe, no well defined roadmap.

2.0 Roadmap

Firefox was an effort to simplify things. The one large app was getting bloated. Now they have the Gekko core, with several applications built off of it.

I find it astonishing that such a major flaw as erasing the whole Program Files folder taking a year to fix not only doesn't raise any eyebrows

Ah, the famous installer problem in beta 0.8, first entered in the bug tracking system on 12/16/2003 (#228672) and fixed in all builds after 02/06/2004. It involved a custom install over another folder (like Program Files) and specifying a clean install. It was really a UI problem since it didn't make it clear that Firebird wouldn't make its own folder to clean install in. The "clean install" feature was there because the product was beta.

People later found a case for the uninstaller deleting files if you stupidly installed Firefox directly in to the Program Files folder, and on uninstall specifically agreed to delete "C:\Program Files." This bug was basically hidden by the previous installer bug, because most people didn't get to this stage if they''ve already wiped out the Program Files folder on install. This one did linger until just after 1.0 release, and there was a lot of furor in Mozilla for letting that happen. Most thought it should have been a stopper for 0.9. Unfortunately, others were for rewriting the installer (which eventually happened), so it delayed the quick fix.

Basically it boils down to Mozilla didn't do enough to protect stupid users from themselves. That doesn't excuse it, it was still a bad bug, but it's not as generally serious as some make it out to be because it required specific stupid actions on the part of the user.

Ah, the problems people have going to version 1. I remember Windows version 2. Firefox 0.8 was more ready for prime time.

However, at 1.5 it's definitely better than IE in every way except one: it doesn't render bad HTML as well as IE does.

[antiRepublicrat]

If I'd been an extension writer, I'd have long ago given up on trying to keep up with the changes, and some have.

I have written extensions. When writing an extension you can specify the minimum and maximum version of Firefox that it will work with. Even if the extension is compatible with the new version, it will check for a new version if you set maxVersion at lower than the new version.

The problem is, the more you extend out your maxVersion, the bigger chance a new Firefox could break your extension with architectural changes. How far out to set it is based on how complex your extension is and how it meshes with the roadmap, what conflicts may arise.

Luckily, we have wildcards. The format is maxVersion="1.5.0.*" in the install description file. That would cover 1.5 but not require an update for minor bug fixes (this latest made it 1.5.0.1), and is a generally good idea. Using maxVersion="1.5.*" would cover even bigger updates within 1.5, but slightly opens the window for possible incompatibilities should a key Firefox component you rely on change. Using maxVersion="1.*" back in the days of 1.0 probably would have been pretty dumb.

The reason for all of this is that extensions don't use an API that can be set in stone. Extensions have access to all of Firefox. It's a tradeoff. IE's API system is stable, but limits developers. Firefox's isn't as stable since it changes with the program, but there's pretty much no limit to what developers can do.

[JoJo Gunn]

How's the weather in Redmond, BTW?

How absolutely horrible that your seeing eye dog has jilted you. Is there anything I can do to help?

This is all you're gonna hear from me, Foghorn, so heed it well: earlier today someone on a thread about the Ditzy Chicks said something that's just as pertinent to Mozilla, or Microsoft, or General Motors or SONY or HP, etc, and their fanbois thereof.

They need me. I don't need them.

[JoJo Gunn]

People later found a case for the uninstaller deleting files if you stupidly installed Firefox directly in to the Program Files folder, and on uninstall specifically agreed to delete "C:\Program Files." This bug was basically hidden by the previous installer bug, because most people didn't get to this stage if they''ve already wiped out the Program Files folder on install.

So, who was more stupid, the user who took for granted that Mozilla knew what they were doing and trusted a crappily written uninstaller, or the Mozilla folks who couldn't drop everything until the problem was fixed?

How ironic, that I'm not "stupid" because I'm one of the rare ones that call Mozilla on the carpet for this, but instead I get called a Redmond shill. There's just no way of winning with the True Believers.

[JoJo Gunn]

Addenda:

....if you stupidly installed Firefox directly in to the Program Files folder

I'm confused. Just where would you install something? In "My Pictures"???

[antiRepublicrat]

I'm confused. Just where would you install something? In "My Pictures"???

No, as in the program's executable is at "c:\Program Files\firefox.exe"

Basically, the installer with the custom option allowed you to do that, and since choosing the beta's "clean install" option was meant to delete all files of a previous installation, it deleted everything in the install folder, which is Program Files, before installing. The installer UI contributed to the problem by not making it clear what was going on.

Conversely, the uninstaller was pretty efficient in its job -- a little too efficient. Uninstalling deleted all of the files in the program's installation folder, normally not a problem. But if that folder happened to be c:\Program Files, well, kiss it goodbye if you answered yes to "Delete folder C:\Program files?"

The former was fixed quickly. The latter should not have made it out of beta. However, neither of these affected people who just used the automatic install, or used the custom install but didn't change the program location.

There was a lot of internal confusion in the early days when Netscape still had hold of Mozilla. Netscape had its money-making priority and Mozilla had its build-a-good-browser priority, and they clashed, badly, with the applications suffering. Things are better now that Mozilla is comfortably settled into its post-Netscape existence.

[antiRepublicrat]

How ironic, that I'm not "stupid" because I'm one of the rare ones that call Mozilla on the carpet for this

A lot of people from within Mozilla were calling them on this. It was noticed at beta 0.8 and there were immediate calls for a hold on 0.9 until it could be fixed. Mozilla was still under AOL/Netscape's thumb at the time, which probably contributed to the push for 1.0 before show-stopper bugs like this were fixed (you know how proprietary software companies normally are about meeting their release timelines no matter what).

I can't excuse it at the time, but I can say Mozilla is, legally and in reality, a very different organization from the one that allowed that to happen.

It's almost like two years from now blaming Disney's animation division for releasing the horrid Pocahontas 2.

[JoJo Gunn]

Mozilla was still under AOL/Netscape's thumb at the time, which probably contributed to the push for 1.0 before show-stopper bugs like this were fixed....

I'm still confused. The Mozilla Suite and Netscape is literally the same, but Firefox isn't, (except for those dang pictures still in the Downloads box, which sometimes still pops up, so what good is Cusser's image toolbar clone? ) and there's not a Netscape version of FF, so what hand they have in this? Were they pushing for their product first? Was FF relegated to second stringers? See, we expect that kind of crap from Redmond.

It's good to know some on the inside thought as I did, but obviously it wasn't enough. I personally didn't get hit by such a bug, and can imagine the bitter taste of those who had.

---

And to all who wanna pile on me as some kind of "shill", I'd like to introduce you to a novel concept - some of us raise hell because we like something. When we shut up, and you hear nothing good or bad from us, then you'd better start worrying, know what I mean?

[antiRepublicrat]

I'm still confused. The Mozilla Suite and Netscape is literally the same, but Firefox isn't

Not quite, they're the same code base, but Netscape does a lot of their own work, mainly putting in commercial ties. That relationship alone hurt Mozilla because the capacity for all those ties had to be built-in.

Firefox is still the Gecko engine, but that wasn't the real problem, which was AOL/Netscape's severe mismanagement. Also, while they took Mozilla OSS, they didn't really understand OSS, which caused problems.

Were they pushing for their product first? Was FF relegated to second stringers?

They warped the product to their own ends and didn't treat the OSS programmers well even though they were some of Mozilla's best resources. Serious PHB problem.

[webstersII]

"How absolutely horrible that your seeing eye dog has jilted you. "

If you are going to make a pithy insult, at least make it a good one. That was lame.

[JoJo Gunn]

Someone who asked me how the weather was in Redmond calls me "lame".

I genuflect to you, sir.

[webstersII]

Mine was at least funny; yours didn't even make sense.

[JoJo Gunn]

Mine was at least funny; yours didn't even make sense.

Yours was funny?

Prove it.