

Firefox Lead Engineer On Origins, Security, And More 57
An anonymous reader writes "ZDNet has an interesting interview with Ben Goodger, the lead engineer for Firefox. When asked to comment on critics' claim that Firefox has a better security reputation than IE because it doesn't have enough market share to attract trouble, Goodger responded with a one-two punch. "Firefox is better designed in a number of ways -- we have no "mode" that allows untrusted content to be executed automatically, for example -- no "safe zone. Another reason -- market share does not predict security. Apache has more market share than has Microsoft IIS, which has more holes than Apache." On Longhorn, he believes it will be a tough sell for Microsoft because of backward compatibility issues."
firefox vs. Nortons (Score:5, Interesting)
Re:firefox vs. Nortons (Score:2)
We run Norton Antivirus and Firefox side by side, with no trouble whatsoever.
While I'm not doubting that someone stupid might have done such a thing, Norton certainly wasn't the root of the problem.
Re:firefox vs. Nortons (Score:5, Informative)
It was probably "Norton Internet Security," aka firewall. Firefox was "trying to access the internet" so Norton prompted the user to authorize this. It's perfectly normal Windows firewall behavior (cf. SP2 firewall, ZoneAlarm, etc).
Nothing to be concerned about.. have you tried explaining this to your customer?
Re:firefox vs. Nortons (Score:5, Funny)
>explaining this to your customer?
Something about "Pack the computer into the box and ship it back. You're obviously too stupid to use a computer."
Re:firefox vs. Nortons (Score:2)
Well then, as a sysadmin it looks like I ought to start deactivating at least half of my users' accounts . . .
Re:firefox vs. Nortons (Score:2)
Re:firefox vs. Nortons (Score:5, Insightful)
I cannot believe not more fuss was kicked up to stop Sophos (or whoever) removing the dialer software of thier list.
It is thier software, they advertise it as preconfigured to thier judgement. If all cisco routers suddenly came preconfd to block mp3 packets, then we would all sooon find isp's telling cisco to remove this feature, or shop else where.
I am guessing people wont mind dialers being blocked and that it is a service.
Dumb client probably completely missread it, or saw a zonealarm request for access or something.
User, pfftsk.
Ugh (Score:2)
Re:firefox vs. Nortons (Score:2)
How did you respond? I hope you did something (preferrably violent) to him. It is one thing to be ignorant, but an entirely other thing to accuse someone (especially someone who was trying to help you) of wrong doing. There is absolutely no excuse for that, and no one should have to put up with taking the blame for somethin
Distribution (Score:2)
Nah (Score:2)
Re:final 1.0 (Score:2, Insightful)
It's simple (Score:5, Insightful)
Microsoft could always ditch IE and use firefox code to develop their "new and secure" browser, but they've been pissing OSS for too long to take that route.
The browser wars are starting back up again. IE hasn't changed in years because it hasn't had to. Now everyone is screaming to use firefox over IE. This hurts Microsoft because they need to keep the image that they're the best of everything.
I hope firefox kills them in the browser wars. They have a better product. It was designed with usability and security in mind.
Re:Correction (Score:5, Informative)
ActiveX is native code, essentially, specially modified DLL's that run unsandboxed with the same permissions as the parent process. This opens up all kinds of fun things you can do to someones system. On top of this interesting feature there are IE zones, which give different default execution permissions. For instance, the Internet zone causes a prompt to be shown when an unsafe ActiveX control is trying to execute. Unfortunately it is relatively easy to trick IE into thinking an ActiveX control is coming from a trusted zone, which doesn't prompt before executing an unsafe ActiveX control. And another problem is that many ActiveX controls are marked safe, but are in actuallity, unsafe.
So how is the above similar to XPI? You always get a prompt from XPI files. Even if an XPI is signed you get a prompt. What's similar?
Re:Correction (Score:2, Insightful)
Re:Correction (Score:2)
Maybe Firefox should ship with XPInstall disabled, and pop a warning explaining that it is disabled (if it is disabled) whenever an XPI is clicked. The current behavior with it disabled is to do nothing. I have only seen one site attempt to install an XPI "for me" like so many ActiveX controls that get offered to you in IE, and that will likely ramp up if Firefox becomes more common.
XPI has pretty much the same power as a runaway ActiveX control, theoretically limited to the OS permissions of the proces
Re:Correction (Score:1)
Re:Correction (Score:1)
Re:Correction (Score:2)
ActiveX is native code, essentially, specially modified DLL's that run unsandboxed with the same permissions as the parent process. This opens up all kinds of fun things you can do to someones system.
Same with Mozilla XPI. Or do you really ignorant enough to think that there is any "sandbox"?
Unfortunately it is relatively easy to trick IE into thinking an ActiveX control is coming from a trusted zone
And what if you could "trick" Mozilla in a siml
Re:Correction (Score:1)
XPI's are not "Auto-installing", they prompt you. You have to download them explicitly. ActiveX controls are embedded in the page and download automatically. Mozilla has no concept of zones so you can't trick it into thinking the code comes from a privileged zone. There is a difference between a possible bug in Mozilla vs. an intentional feature built into IE. You speculate that one day there may be a bug that allows XPI's to be installed without
Re:Correction (Score:2)
Right, you are a condesending ignoramous with his facts wrong. And you started it
ActiveX controls are embedded in the page and download automatically.
This is just factually incorrect. (Unless you mess with the settings, but this is also true of FireFox.)
Re:Correction (Score:1)
If I have my facts wrong tell us which facts? I have IE set to default and I view a page with an ActiveX control embedded in it, what happens? Tell us how you embed an XPI in a page? Where am I wrong? Saying your wrong and I'm right doesn't make it so. Lets see some specifics.
Re:Correction (Score:1)
Check your settings, because there's something wrong there, or you accidentally hit the spacebar or Enter or hit Yes without reading the dialog box that pop ups.
That's the fact the parent was talking about.
Re:Correction (Score:1)
Re:Correction (Score:2)
You make a point elsewhere that a user has to "click a link" to install XPI, so I suspect that's what you mean by "embedding". Well, a few months ago (before the whitelist appeared), there were pages that attempted to install malicious XPIs that were "embedded" (when the page loaded). I didn't View Source and see how they worked,
Re:Correction (Score:1)
What makes all the difference is the point that you keep glossing over. The security zones. Microsoft has built in a feature that would be considered a bug in the other browsers. The function to be able to bypass all security restrictions. This would even be a problem if ActiveX ran in
Re:Correction (Score:2)
Re:Correction (Score:1)
Summary of conversation so far:
Nutscrape: YOUR WRONG, YOUR WRONG, YOUR W
Re:Correction (Score:1)
Solution: stop being wrong all the time. (And I agree, attempting to talk to you is lame.)
Re:It's simple (Score:5, Insightful)
Let's set the record straight - Microsoft won the browser wars over the Netscape, because it delivered a better product with IE 4 and IE 5. Netscape Communicator 4 was bulky, glitchy, slow to load and slow to respond with ugly widgets. Netscape 6 was the same nightmare with different skin and off-the-scratch source code. IE at that point was faster, easier to use, and had native Windows widgets with faster response times.
IE 6 is function-less, incapable of being customized (internal popup blocker did not come till SP 2) and is a security nightmare. Firefox just delivers a better product at the time.
Microsoft was not always a loser in this game.
Re:It's simple (Score:5, Insightful)
Let's set the record a little straighter - are you sure bundling the browser had nothing to do with its popularity?
Right, but Parent is still right (Score:4, Insightful)
But the parent is totally right in saying that Netscape 4 - 4.5 sucked donkey balls. It was slow, bloated, and incredibly hard to develop HTML for because of its goofy layers system. Even if MS had never bundled anything, I am quite convinced that Internet Explorer 4 (and later 5) would have gotten the majority market.
After that it becomes more grey. If IE had never been bundled, IE6 vs. Netscape 6-7-Mozilla is much more difficult to call.
Re:Right, but Parent is still right (Score:3, Informative)
MSIE was free back then. Netscape Navigator wasn't, it cost (IIRC) around $25 or so. It wasn't just the bundling, it was the 800 lbs gorilla doing the funky billion dollar dance all over the puny competitor. Just another business day in Redmond.
Re:Right, but Parent is still right (Score:2)
1) Made a better product (IE)
2) Gives it away for free.
What the crap is wrong with that?
Are you going to get upset with Apple for giving away iTunes, iPhoto and iMovie? What about Safari?
Either you make a better product, or admit defeat. It's fairly simple logic. The whole bad stink about IE being bundled into windows is stupid.
Re:Right, but Parent is still right (Score:2)
What's wrong with that is that they used their ill-gotten gains (over-priced Windows, as seen in court) and market monopoly to push their own version of a supposedly open technology. That created lock-in and made is easy for them to push ActiveX and IIS to sell Windows servers, making it more difficult for the "better product" to compete on even remotely equal terms. To add insult to injury, they ignored IE for years after they won the first browser battle - simply becaus
Re:Right, but Parent is still right (Score:2)
Says who? The numbers don't reflect that, FYI, as Apache holds the web server "market share". You also aren't required to use IIS in order to deploy ActiveX objects on your website.
To add insult to injury, they ignored IE for years after they won the first browser battle - simply because they had achieved their market dominance.
Who cares? You can use any browser you want. No one's forcing you to use IE's. Lik
Re:Right, but Parent is still right (Score:2)
Re:It's simple (Score:2)
No way. I hated netscape with a passion.
It was slow bulky and other bad things.
IE was much better IMHO.
I now use firefox. Why? Because it is better than IE IMHO.
It don't see wordpad the defacto word processor just because it was bundled with windows for the last decade.
And again (Score:2)
Ahh, let's set the record even more straight (with a nod to dimator [slashdot.org]):
Netscape made a fatal development decision. THEY CEASED DEVELOPMENT FOR THREE YEARS. Let me say that again: some PHB acquiesced to the developers' request (or decided on his own---who knows?) to allow them to start over. Oh a medium to large project, you never, ever, ever start over [joelonsoftware.com] when market shar
Re:It's simple (Score:2)
Huh? You can install BHO's, such as Google's or MSN's toolbar, or an app I use called PopUpCop to deal with that stuff. So yeah, IE can be customized.
Re:It's simple (Score:2)
The problem I have with IE is the lack of updates and the fact that it's mostly now a Windows product.
Companies can manage security a lot easier with one browser across the whole organisation. They're more likely to think about deploying Firefox if the org uses different operating systems.
Re:It's simple (Score:4, Interesting)
Re:It's simple (Score:1)
Firefox is far more feature-rich than IE, once you take into account third-party extensions, which is the second reason most of the people that I know who use FF give for using it over IE (after security). That additional functionality can't be dismissed.
Firefox market share is up to 18% on technology (Score:5, Informative)
Re:Firefox market share is up to 18% on technology (Score:2)
For the lazy: Mozilla Firefox has about 1.5%, Linux has about 0.60%. And no, as with all other web statistics, it's not scientific.
The most important thing he said... (Score:4, Interesting)
another good message (Score:1)
this is the message on my companies employee website!
security? (Score:2, Interesting)
I love (Score:1)