The Firefox 3.5 fiasco
weblogs.asp.net
weblogs.asp.net
How often do you see a forensic analysis of this type on commercial software? Not zero, but less often.
(I have to admit it's sort of more impressive when someone whips out a debugger rather than reading through source.)
Were it a problem within IE (or Oracle applications - let's be fair as this is not a Microsoft-only problem) we would have to wait until a developer reads the report, the bug being assigned and the correction being put in a future bug-fix release.
In a way, a guy from Microsoft just made a huge point on how open-source is far superior to their own closed development cycle.
Port the renderer cross-platform, and write separate native apps for each target platform. The amount of complication and cruft that must be in the codebase for making a massively complex software package like Firefox work cross-platform, and the amount of basic OS-level functionality that must have to be reimplemented from scratch because it isn't available on some particular target platform, is probably no small contributor to its performance woes.
Native apps for each platform may give performance boost, but maintaining a consistent UI will be a lot harder
If we want native UI, it's obviously going to have major inconsistencies between platforms!
I think they've actually done a really good job making it look like a native app instead of just a port from some other OS.
Fun Fact: In Safari since version 3, the <input> elements aren't actually native widgets anymore, as NSButton et. al. couldn't support a bunch of the CSS attributes. They are now rigorous behavior-level reimplementations!
A widget that looks native but behaves differently is terrible! At least when it looks alien you don't expect it to behave natively.
"Of course we won't use DirectShow / QT / GStreamer as an alternate backend for <video> -- that would make it actually useful in the real world, and our Theora evangelism comes first!"
The video wars were because [Apple, MS, Real, Macromedia, Sun] were all trying to compete with each other using crap products that conflated [Branding, Plugin, Container Format, Codec] in a mash of uselessness.
Flash won not because it had the same codecs on all platforms, the plugin was customizable the same way on all platforms, and the end-user branding was all yours to theme.
The most interesting part of <video> is not codecs or containers, but the full + uniform control and customizability via its Javascript API. The only reason there is any problem at all is because Mozilla is refusing to expose access to QT / DirectShow / GStreamer.
Mozilla threw all of their weight behind XULRunner years ago. It probably wasn't that bad of a decision, given how much of a headache it is to use Gecko directly.
Even doing the core rendering part cross-platform has a lot of technical issues as the platforms provide a lot of functionality that can be leveraged by the rendering engine (typesetting, drawing, animation etc...). Consequently, the more you want to integrate with the native facilities of the platforms, the more interfaces and glue components you need in order to hook the platform independent part up to the native facilities. This leads to a loads and loads of ceremonial code and interfaces that introduce additional layers of complexity.
However they do obtain additional (optional) entropy (if you're familiar with the NIST DRBG's, then I'm talking about the 'Additional Input' parameter) by reading system time while periodically reading a bunch of system dirs to advance time in a non-deterministic manner. And that's where this bug creeps up.
It is calling a kernel interface. The prefix "Rtl" means that it is in the kernel run time library.
Reference: http://blogs.msdn.com/wdkdocs/archive/2008/12/19/windows-ker...
Some firefox developer had a Very Bad (tm) idea to seed a random number generator by scanning the Windows Temp folders, which is now causing a 30 secs to over a minute pause in start up for a lot of users (particularly those that use IE, which creates a LOT of temp files). Yikes.
Its one of those things "seemed like a good idea at the time, worked well, I feel clever" and then you move on. Then it bites you (or one of your users).
Doesn't seem very random to me.
EnumSystemFiles: http://mxr.mozilla.org/mozilla-central/source/security/nss/l...
...called by rng_systemJitter: http://mxr.mozilla.org/mozilla-central/source/security/nss/l...
...called by rng_systemFromNoise: http://mxr.mozilla.org/mozilla-central/source/security/nss/l...
...called by RNG_SystemRNG: http://mxr.mozilla.org/mozilla-central/source/security/nss/l...
...called by (among others) rng_init: http://mxr.mozilla.org/mozilla-central/source/security/nss/l...
Firefox should never, ever, ever, open any file outside its own app directory, user preferences directory, or cache directory.
And a reasonably secure OS shouldn't even allow Firefox to open any of those files.
And shouldn't any other programs one has around not be writing confidential information to temp files in the first place?
Seems like more of a dumb bug to me than a security problem.
The real issue here is how hard it is to be a consumer of open source software on Windows. On Debian, if I wanted to fix this, I would just "apt-get source" the relevant package, make the change, and have Debian build me a new package with the fix. On Windows, this is apparently not possible, as there is no package management system to install the compiler and source code for you, and the apps check themselves to make sure that you don't modify them.
(I also like how the virus / spyware situation is so out of hand on Windows that you can't even recompile libraries without your own computer assuming you are hacking yourself. Nice.)
Why do people still use Windows?
I have different expectations for professional programmers than I have for 80-year-old non-programmers.
I'd have to agree with that point. I think he pretty much single-handedly wrote LLBLGen Pro, an ORM solution for C# or VB.NET. My company uses it and I personally think it's really quite nice.
IE8 is a perfectly good browser :) Ditch Opera PLEASE, they are a pain in the...
(im only kidding Opera is good too)
In the meantime, I walked the floor, said "good morning" to my co-workers and got a nice warm cup of coffee from the espresso machine.
Could I use Linux, I would have to start working only a couple seconds after my computer was turned on. Think of it as a quality of life issue ;-)
I was wondering what was taking so damn long to start FF3.5 - on a SSD. I cant imagine ppl on a HD.
Have you ever written a computer program before?
Really? Outsmarting the OS's built-in PRNG by scanning the HDD of all things?
Oh yeah, it's somebody else's problem. There you go.
What browser were you using in 2001 that was better than IE6? Netscape 6?
I'm a pretty good programmer. If I had to change the source on a program to use it, I wouldn't. I have better things to do with my brain cycles, and that's all there is to it.
And if clearing the caches doesn't affect entropy quality, it's even stupider -- why bother to read them in the first place?
If the system pseudo-random number generator has no problem, what's the use case for not using it? And if it does have a problem I'm sure they would have told someone :)
I just don't know why you add another moving part to the security system if you could avoid it, especially since it seems like a reasonably safe bet that people have had more eyes move over / experience with the alternative.
I also agree that this got into the security layer is probably the most worrisome part of the whole story. Maye this could build a case for mandatory code reviews for security related modifications.
What is correctly shown? It shouldn’t be shown as a tooltip as that leads people to write alt text that’s specifically useful as a tooltip and useless to the real consumers of alt text: screen reader users and search engines.
Resolved in 3.0, but was outstanding for many years. The bug comments are worth reading (some of them are from the XKCD and Dinosaur Comics guys, whose sites this bug impacted fairly heavily). It doesn't make their dev community look like a place I'd want to be.
That said, Firefox 3.5 allows one to VERY easily disable the awesomebar: Preferences -> Privacy -> Location Bar.
Their arrogance of baking into the browser what is essentially a bundled extension was ridiculously annoying. My favorite added misfeature: it blacklists URLs with the 'about' protocol handler.
I had been disabling / detuning it piecemeal with extensions + settings to make it less obnoxious. I've come to like most of the completion features most of the time, but the visual presentation and interactive behavior is just fucking awful.
At least it's not as bad as Epiphany: it sorts only in direct chronological order (oldest first!), and in true GNOME style is not customizable in any way. Why the fuck would you ever want that?
For me personally, the only reason I downgraded back to 3.0 from 3.5 is because Firebug 1.4 is bloody awful at the moment (in beta). Other than that, Firefox 3.5 is great.
Other than that I suppose faster javascript and optimisations through use of sqlite for history/bookmarks is good.
Probably a few other things if I thought about it.
Main features are in add-ons for me, firebug, yslow, noscript, adblock, seoquake,download toolbar, greasemonkey.
I keep a separate clean profile, without all the footer-bar ("clutter bar") icons for the wife to use whilst surfing
* Bookmarks. I can easily bookmark any page by clicking on the star next to the address bar. Clicking it again allows me to edit it or remove it. I use this all the time.
* History with search.
* Spell check. I used to think it's useless but now I cannot live without it.
(gross exaggeration)
http://lab.arc90.com/experiments/readability/
80% of the time, it works every time.
( At least Opera supports this, don't remember about Firefox )
I can see myself using Readability to format most of the articles I read online now.
Thanks for the link!
Forchrissakes people how does anyone think this is even approaching readable!? Someone needs a whack with the UI stick
Oh, and a poor man's arc90 readability thing can be found with the "zap annoyances" bookmarklets:
This is a textbook example of taking a few thread dumps, a few minutes apart, immediately showing what is going on. IBM has one of these as their Performance or Hang "MustGather" script:
http://www-01.ibm.com/support/docview.wss?uid=swg21115785...
.NET thread dumps suck -- you have to use adplus to attach and they're not easy to read. Native programs (e.g. C/C++) work better with symbols and are just too scary for end users. DTrace on Solaris with Ruby/Python/PHP extensions is nice, but too cumbersome to install, and again too scary for end users.
I'm not aware of built-in thread dumps-by-signal in other non-Java languages (please note in a comment if there is), but this feature is so basic and needs to be baked in to every runtime environment and easy enough for end users to use.
Firefox, being a native program, is in a bad problem determination position here and the haphazard nature of the problem determination process in the forum and bug report shows that. I suggest Firefox create something like IBM's MustGather scripts (starting with a performance one such as IBM's hang MustGather -- http://www-01.ibm.com/support/docview.wss?uid=swg21115785 [click "Show Details" for the steps]). A hang MustGather should go through the process of installing symbol files, getting the thread stacks, submitting the information, etc. This will allow users to at least feel like they can do something valuable to help the developers fix the problem.