Firefox 1.0.1 Released

homeobocks writes "Firefox 1.0.1 has been officially released by the Mozilla Foundation, with some important security fixes. An announcement and release notes are available." Presumably this fixes the window injection vulnerabilities.

IDN Problems Fixed?

[michaelhood]

From changelog: International Domain Names are now displayed as punycode [wikipedia.org].

(wiki linkage mine).

Mirrors

[Anonymous Coward]

If the downloads for Firefox become overloaded today/tomorrow, Coral cache mirrors:

http://download.mozilla.org.nyud.net:8090/?product =firefox-1.0.1&os=win&lang=en-US [nyud.net] Windows
http://download.mozilla.org.nyud.net:8090/?product =firefox-1.0.1&os=linux&lang=en-US [nyud.net] Linux

Re:/. rendering

[vurg]

Nope, the center column still goes off to the left.

Re:seems like only yesterday

[michaelhood]

Hello FUD.

From changelog:
International Domain Names are now displayed as punycode. To show International Domain Names in Unicode, set the "network.IDN_show_punycode" preference to false.

It's just no longer the default, which is what most have been crying for, right? Better security by default so our less web-savvy family and friends don't get owned online?

Re:/. rendering

[damiam]

Oops. On further exploration, I see that it's fixed in the trunk, and the fix will be included in the 1.1 release (I guess must have misread that to say 1.0.1). In the meantime, there's always the SlashFix [hardgrok.org] extension.

OS X-specific fixes?

[moosesocks]

Any word on if this includes fixes for the massive memory leaks in the OS X port? I know they were on track for 1.1, but it's possible they could have made their way into 1.0.1......

Re:Check Updates...

[asa]

We'll be turning on the application update mechanism starting next week. Given the daunting task of updating all 27+ million people who have downloaded and are using Firefox today, we've elected to stagger the update over several days.

--Asa

Re:IDN Problems Fixed?

[michaelhood]

Did you even read the wiki?

The encoding is applied separately to each component of a domain name which is not representable solely within the ASCII character set, and a reserved prefix 'xn--' is added to the translated Punycode string. For example, bücher becomes bcher-kva in Punycode, and therefore the domain name bücher.ch would be represented as xn--bcher-kva.ch in IDNA.

Compare an ASCII 'punycoded' URL http://xn--tdali-d8a8w.lv/ (http://xn--tdali-d8a8w.lv/) (working) and its full Unicode counterpart that does include Latvian characters with appropriate diacritics: http://tûdaliò.lv (http://t%C5%ABdali%C5%86.lv) punycoded URLs are prefixed with xn-, and look like nonsense to those of us looking at Latin character sets. Look at the difference between those two sample URLs. Which one is easier to train to identify? Do you have a suggestion for a better solution to IDN spoofing concerns?

Better Release Notes

[Anonymous Coward]

... over at the burning edge [squarefree.com].

Re:seems like only yesterday

[jdkincad]

They removed default compatibility for international domain names. I wonder how much of an impact this will have on foreign adoption of Firefox over IE

None. IIRC they just turned off IDN support, and did not remove it. If someone needs it, the can turn it back on.

IE has no IDN support without third party software, so Firefox is still a better choice if you need IDN support.

Actual list of changes

[timealterer]

Here [squarefree.com] is the full list of changes and related bugs for Firefox 1.0.1.

You'll note that it's quite terse - this is not the 1.1 update from trunk that will get us rendering fixes, etc. that we'll see in June or so. Almost all security fixes here.

Re:seems like only yesterday

[jeffg]

They removed default compatibility for international domain names.

Your statement is misleading.

Support for IDNs is still present, it's just that after inputting a URL using an IDN domain name like http://www.göögle.com/, it is displayed as the punycore representation in the address bar: http://www.xn-ggle-5qaa.com/

The merits of this work around are certainly up for debate (hint: the debate started years ago).

I wonder how much of an impact this will have on foreign adoption of Firefox over IE.

Seeing as no currently shipping version of Microsoft Internet Explorer supports IDNs... you can probably stop wondering. :)

Re:/. rendering

[Jonny_eh]

If not, get this [hardgrok.org] in the meantime:.

Be kind to the mirrors, use official bittorents!!!

[Jedbro]

Be friendly to the Mozilla.org mirrors, they
have set up an official Bittorent seeder [mozilla.org].

-Jed

( http://bittorrent.mozilla.org/ [mozilla.org] )

Re:But can I upgrade using Software update?

[bersl2]

They are going to enable that in a few days, after those who know about the upgrade have cleared from the servers, lest they be fried.

Re:Is a .0.1 dot release really newsworthy

[homeobocks]

As I mentioned in the story, 1.0.1 contains fixes for 9 security holes, some of which allowed spoofing.

Major crashing Bug

[kyhwana]

Is anyone else getting the type a URL into the URL bar crash?
It doesn't matter what URL I try to enter, with tabs or without, *boom* it crashes.

A few bugs in this release

[CaptBubba]

After installing 1.0.1 on WinXP I could not navigate anywhere. Everytime I would hit enter after typing something into the location bar firefox would crash.

I've gone back to 1.0 and there are no problems. here's a link to the windows 1.0 versions [mozilla.org] in case anyone else similarly needs to revert back.

Re:How do I automatically kill history in Firefox?

[PReDiToR]

Grab the Kiosk extension [extensionsmirror.nl] from extensionsmirror.nl.

Or you could go to Tools > Options > Privacy > Clear all (under Windows).

Bittorrent!

[GarfBond]

Official BT Torrents here! [mozilla.org]

Now if you're worried about putting too much strain on the Mozilla download servers, use the BT links!

Alternatively, this page lists translations and direct download links [mozilla.org]

Now in more languages

[teslatug]

They upped the number of localized versions.

Re:Check Updates...

[cshields2]

It will most likely not be staggared for the next release, as we will have a major infrastructure upgrade by then allowing the update service to survive the hit all at once. The staggaring had to be done at this point in time.

Cheers!

Re:Mirrors

[whitespacedout]

Only checks for extension updates AFAIK.

Re:This version doesnt fix some new type of popups

[mrnobo1024]

That's not actually a popup, it's just an image inside an <div> with CSS "position: absolute". There's no way to stop this unfortunately, blocking absolute positioning would screw up a lot of site's layouts.

Re:This version doesnt fix some new type of popups

[LnxAddct]

It blocks fine in 1.0 and 1.0.1.
Regards,
steve

Re:Major crashing Bug

[Anonymous Coward]

try doing a clean install. del your firefox directory and the user directories that store the config info and cache. call us in the morning.

Re:Too bad it still doesn't fix the RAM problem

[Anonymous Coward]

But fortunately, I've got 1GB of RAM, and there's barely any spyware, so I'm ok with it now. I just wish I didn't have to put either Dillo for Linux or IE6 on Win98 for those old late Pentium Is / early Pentium IIs I fix up for people in my spare time, since Firefox is a nice browser despite its flaws. Too bad it won't run decently on anything less than a Pentium III with 256MB of RAM.

Do try K-Meleon [sourceforge.net], as it performs much better than Firefox on older computers. Its RAM usage should be somewhat lower as it doesn't use XUL for the GUI, but still has Gecko underneath.

My computer is 4 years old now and Firefox is not a dream to use as it keeps freezing up for 2 seconds whenever its CPU usage maxes out. K-Meleon is much lighter, though not as pretty ;)

Did you have the flash blocker?

[Kip Winger]

I've heard from a few friends that the plugin that blocks Flash animations from playing until you hit the large button in the center will crash any pages that load flash under Firefox 1.0. Which is pretty much anything, from cnn to ebaums to slashdot itself.

Uninstall Firefox, delete your C:\progra~1\Firefox folder, and then delete the extensions folder from your profile under C:\docume~1\(username)\applic~1\mozilla\firefox folder, and install Firefox 1.0.1. It'll work fine.

Re:Ah, so this software does have vulnerabilities

[freitasm]

Secondly, FF is NOT faster, despite the FUD that FF zealots like to spread. I've timed both and it takes FF several seconds longer to start up as well as to render a complex page.

Well said... Check previous /. [slashdot.org] story with browser speed comparison. Opera is faster, but IE is actually faster than Firefox in most operations.

horrible themes?

[SweetAndSourJesus]

Have you seen the GrApple [grapple.net.tf] themes?

Über secks.

Re:seems like only yesterday

[jeffg]

However if an ASCII character is being represented using IDN representation, then spoofing is likely taking place, switch to punycode.

[...]
Of course, I could be out to lunch on this one too, since I don't know in detail how the IDN thing works.

It might be time for you to do a little more reading...

The issue isn't an ASCII letter being "represented using an IDN representation" in the way that you seem to imply.

It's a matter of an ASCII character being replaced with a unicode letter that LOOKS the same. It's not just a different way of encoding the same character, it's an entirely different letter that just LOOKS like the letter it is impresonating.

That's why it's called a homograph attack. :)

Re:Too bad it still doesn't fix the RAM problem

[Owndapan]

Mine is at 37K with several tabs opened, 5 RSS feeds, heaps of bookmarks, and with a few extensions installed. This is less than IE opening to a blank page on my PC. Maybe you have a lot of extensions installed? I have never actually seen it higher than 40K (even with heaps of tabs open), but maybe I'm just lucky.

Note that on Windows, I believe the task manager only reports the maximum amount of memory used, not the current amount.

Re:404

[rincebrain]

It's just not on some mirrors.

Why not use the torrent [mozilla.org]?

No more mr. Memory Hog

[Daedalon]

Windows users who have problems with Mozilla software (Firefox, Thunderbird or Suite) being too slow or using too much memory and CPU, check out the Moox optimized builds [www.moox.ws].

One of my friends reported having constantly about 100 MB more free memory after switching to Moox M2 in his Athlon XP. A bit of a warning though: I tried to install original 1.0.1 over Moox M2 1.0, and it now crashes every time I press enter in the URL bar. Now typing in Internet Explorer, I'm anxiously waiting for Moox optimized 1.0.1 builds to come out and solve the situation.

Re:How do I automatically kill history in Firefox?

[Bagels]

Set it to accept cookies for current session only, have it remember history for past 0 days. Don't worry about the cache, as IIRC it's encoded such that it only means something to the browser (not left with the same title as the cached webpage item or even its extension).

Re:Too bad it still doesn't fix the RAM problem

[Anonymous Coward]

I know anecdotal evidence isn't worth much, but here's what I see looking at this page (no tabs):

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
26677 user 21 1 52608 31m 15m R 4.0 8.3 0:12.31 firefox-bin

That's 16m unshared memory. Opening a few tabs (5) to this same page:
26677 user 21 1 55580 32m 15m R 4.0 8.6 0:17.11 firefox-bin

That's 17m unshared memory.

Opening 5 more tabs (for a total of 10 tabs) to a more graphics page like fark.com brings it up to:
26677 user 21 1 67964 38m 15m S 4.3 10.2 0:25.90 firefox-bin

That's 23m unshared memory.

Opening 10 more tabs (for a total of 20 tabs, 5 slashdot, 5 fark.com, 10 ps2.ign.com) to a even more graphical page like ps2.ign.com brings it up to:

26677 user 21 1 106m 81m 23m R 6.9 21.7 0:49.53 firefox-bin

For a total of 58m unshared memory.

Closing all 19 of the tabs brings the memory back to:
26677 user 21 1 91720 70m 17m S 0.3 18.8 0:53.77 firefox-bin

For a total of 43m unshared memory.

So yea, not perfect, but I definately don't see 50m or RAM being used after opening the browser.

Re:Mirrors

[the_bard17]

Gotta vote against ya, and go with the parent. Following the parent, there are two distinct options for updating: Firefox, and My Extensions and Themes. That's on my Gentoo system, Firefox 1.0

That would imply that one can update Firefox through that menu. Not sure if it actually works or not, though. I just tried it, and it stated that no updates were available.

I wonder how Portage would handle it, too... I imaagine that it would assume 1.0 was still installed, and not the update. *shrug* So I waste some time the next time I 'emerge sync && emerge -u world'... I'll probably be at work or sleeping anyhow.

Re:Did you have the flash blocker?

[CaptBubba]

Interesting. I do not have that plugin installed, however I do have another (adblock) that overlays flash animations with a clickable tab. Perhaps that could be what is causing the problem.

Not quite.

[Anonymous Coward]

Don't worry about the cache, as IIRC it's encoded such that it only means something to the browser

Not so. Type in "about:cache" (not the quotes). From there there are links to view the contents of the cache.

Re:IDN Problems Fixed?

[Edgewize]

Yeah, I'm sure they're really happy about domainnames like "xn--tdali-d8a8w.lv".

Um, you can still enter the full Unicode name in the address bar or use it in links. This only changes how it is displayed /after/ you type it in.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Here is an example.

[maotx]

Here [shmoo.com] is an example how Firefox 1.0.1 shows IDN names.*
Click the Fake and Real link to see the difference.

The Fake site will not work with Internet Exporer with the latest service pack.

*Requires Firefox 1.0.1

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Too bad it still doesn't fix the RAM problem

[darkmeridian]

There may be something wrong with your setup. When you uninstall Firefox, you have to delete all the stuff in your Profiles folder. I am running Windows XP SP2 with six tabs, one of which is this website, and there's only 28,288K of memory usage.

Delete all the stuff in your \Mozilla\Firefox folder when you uninstall Firefox when installing a newer version. There may be extensions getting in the way of your setup.

Re:Too bad it still doesn't fix the RAM problem

[Datasage]

You CANT use task manager to get the full memory ussage of any app. It only displays the ussage of the physical memory, it doesnt say how much page file space it uses.

Though I do agree that Firefox could use a bit better memory managemnt, after opening a bunch of windows or tabs, closing them doesnt free up all the memory it used to show the windows.

Re:Mirrors

[joeldixon66]

From Asa's Blog [mozillazine.org]:

"We're still working on some with the application update infrastructure and the installer so for the first few days, we'll only be offering the release via full download at the website and then turning on the automatic update system hopefully sometime next week."

Re:Too bad it still doesn't fix the RAM problem

[sahrss]

Known troll, see parent's posting history.

I'd like to know what mods modded up an anecdotal post that had no collaboration, from a troll with a history like that!

As far as anecdotes - 24k of RAM on Win2k, opening 20 new blank tabs barely increases the amount of RAM it uses.

Re:Mirrors

[Myen]

Since you're linking to the en-US version anyway...
BitTorrent links [mozilla.org] in case the servers really go to crap. (Theirs, not mine)

Re:Change Log

[Anonymous Coward]

Firstly, don't plagarise. Cite your sources. Your list is an exact copy of http://www.squarefree.com/burningedge/releases/1.1 .html [squarefree.com].

Secondly, if you do plagarise, make sure you steal the right frigging document! You posted a changelog for the not-yet-released Firefox 1.1. This is Firefox 1.0.1. Its changelog can be found at http://www.squarefree.com/burningedge/releases/1.0 .1.html [squarefree.com].

Doesn't require 1.0.1

[Theatetus]

Actually you don't need 1.0.1 to see how it works; spoofstick on 1.0 displays the bogus URL as xn--blah-blah-blah...

Re:IDN Problems Fixed?

[shird]

uhm... it is the use of unicode that causes the problem. Without it, there isnt a problem.

Its because some letters look exactly the same but are effectively different unicode characters that lets you register the same 'looking' address but point it to a different site.

Re:Too bad it still doesn't fix the RAM problem

[kawaichan]

yes you can.

go to -> Windows Task Manager -> view -> select column -> check virtual memory size

Re:On this subject

[PeterPumpkin]

Not really, but it can be figured out from this nice chart [piercedotzler.com].

The ad went out on December 16, 2004.

This is 37 days after the launch of Firefox. If you look to the downloads per day graph, there is a noticable increase afterward.

about:cache

[cheekyboy]

Memory cache device

Number of entries: 208
Maximum storage size: 31744 KiB
Storage in use: 7436 KiB
Inactive storage: 7127 KiB

List Cache Entries
Disk cache device

Number of entries: 312
Maximum storage size: 50000 KiB
Storage in use: 18025 KiB
Cache Directory: C:\Documents and Settings\Development\Application Data\Mozilla\Firefox\Profiles\fd8vwgvl.default\Cac he

Re:Mirrors

[Rirath.com]

I installed 1.0.1, then reinstalled 1.0 because I like the Textzoom extension. This hasn't been officially updated to 1.0, but extensionsmirror has a link to a version patched for 1.0 installs.

Since it's not being maintained, I'll probably eventually have to give it up, but I won't for such a minor Firefox update.

Actually, no you don't. Changing extension maxlimits is trival.

- First, find your profile. In Explorer find: %appdata%\Settings\\Application Data\Mozilla\Firefox\Profiles\\extensions

- Second, open Extensions.rdf with notepad, metapad, etc.

- Third, find and replace any of:
em:maxVersion="1.0"
With em:maxVersion="5.0"

And you're good to go. You can put any number you want, but I like 5.0 just to make it easier, especially with nightlies in the past. You could also use about:config to lower your version number, but that could have other side effects. Now, if doing this makes your extension not work because of code changes (rarely) or somehow borks your profile (highly doubtful), use at your own risk. :)

And Extensionsmirror.nl is a great place to find prebumped extensions.

Re:How do I automatically kill history in Firefox?

[Green Salad]

Here's a simple way. Boot with Knoppix CD or other "live Linux" disk.

I used to travel with a laptop, now I travel with a Knoppix CD. (much lighter & no theft worries)

Re:Mirrors

[Rirath.com]

No sweat, glad it worked for you. I messed the application dir up a bit trying to cut my data out of it, and Slashdot took a bit out... just to clarify it should be soemthing like:

%appdata%\Mozilla\Firefox\Profiles\(random)\extens ions

(No space, Slashdot does that.) Also, for new downloads... you can save an extension to your hard drive, rename the .xpi to .zip (or .rar if I'm wrong), unzip it, find the file with the same maxversion line, and edit that higher. Then just rezip the folders and rename it .xpi again. Instant bumped version.

Re:On this subject

[MikeCapone]

www.spreadFirefox.com and Ada's blog at mozillazine.org have most of the information about Firefox's marketshare and marketing campaigns.

I just installed 1.0.1 and everything seems to be working... Except that they haven't fixed the slashdot rendering bug yet (well, to be fair it's probably slashdot's HTML's fault -- I don't know why they haven't switched to CSS yet. They'd save gigs of bandwidth).

Re:On this subject

[dotgain]

BTW the workaround for the rendering bug you encounter on /. is to increase the size of your text then decrease it again (Ctrl +, Ctrl -).

I dunno if it is a slashdot bug or not. It seems to me that if you can fix it with this workaround, then's it's a Mozilla bug (it does it there, too). Yes they definitely should use CSS, but since it's such an ugly site, it'll probably still look better in lynx.

here in germany...

[boeserjavamann]

...they also had a big advert in the most important german newspaper "faz". http://www.zeitform.de/download/041202-firefox-faz -anzeige.pdf [zeitform.de] -- moz1.8 rulez ;)

Re:What branch, tag for FIREFOX 1.1 ?

[Anonymous Coward]

Assuming you meant 1.0.1:

FIREFOX_1_0_1_RELEASE

Use the following to get a list of tags:

cvs status -v filename

Re:On this subject

[tehshen]

Or you could use SlashFix [hardgrok.org]. I am using it on 1.0.1 and it is working as good as ever.

The main Slashdot rendering bug fix is going to be released with 1.1. This version 1.0.1 is only a security fix.

Re:Slashdot bug?

[VargrX]

If your using Ad-Block, there's a very easy way to fix this - add

http://images.slashdot.org/pix.gif

to your block list and the problem go's away.

I would imagine that this could also be added to a proxy easily enough also.

Re:A few bugs in this release

[dveditz]

This crash is bug 280084. We have tracked this down to people who install 1.0.1 over an earlier .zip build. The file structure is different: never, ever mix the two.

Solution:
- don't use .zip builds
- if you must use .zip builds you must always install each build into a new directory. There is no installer to do any cleanup of obsolete files.
- if you've already mixed the two uninstall and re-install 1.0.1 into a virgin directory. If the crash persists anyway delete "xpti.dat" from your profile.

Known bug! (bug 280084)

[prandal]

It is usually caused by installing over an unpacked .zip build.

You need to delete <install directory>/components/autocomplete.xpt and try again.

The fix is checked in for Firefox 1.0.2

Re:On this subject

[sepluv]

Except that they haven't fixed the slashdot rendering bug yet

This was fixed in Gecko in May 2004 on the trunk which is used by the latest stable version of Mozilla Suite (but not on the aviary branch which 1.0.1 is still based on. Aviary is now being exhumed back into the trunk, so hopefully, future builds (including releases) will all be based off the trunk (so Gecko fixes will propogate to Firefox).

To fix it in Firefox:

get a recent nightly build--I find them just as stable

just install the Slashfix extension [slashdot.org].

BTW the bug only occured sometimes if your machine was fast and it was rendering /. too quickly--you could try reloading--it was a genuine bug as it occured intermittently, but the awful, hoggy, invalid slashcode HTML doesn't help (esp. their use of evil many-nested tables for layout--see the funny and informative Why tables for layout is stupid [hotdesign.com]).

Re:Mirrors

[CarbonUnit_718]

DOWNLOAD THE TORRENTS FOR FIREFOX 1.0.1 at: http://bittorrent.mozilla.org/ I wonder why the built in software updater in Firefox doesn't download updates with the bittorent method.

Re:IDN Problems Fixed?

[sepluv]

Actually, the problem is mainly a wetware bug (and maybe a font bug) caused by the lack of support in wetware for the entire Unicode character set. Computers have no problem knowing the whole of Unicode; people do.

It is suggested in the RFC (and is IMO common sense) that UAs should alert users (e.g.: by coluring characters by script and a dialog in suspicios cases) when there are characters in a URI from scripts they wouldn't normally use, or a strange mixture of scripts (esp. where characters that are similar to other characters are included).

Also, in my opinion the user should be able to access both the puny code and the unicode for all URIs displayed in UA GUIs (maybe with a switch if there isn't enough room). IMO, the status bar should default to punycode for now.

Another thing that would help (wrt to font problems) would be, where there are multiple fonts for a given character that the UA needs to display, for the UA to choose a font which uses distinct characters (either via an ordered list of chacters or AI grapheme comparison). A long-term solution to this might be for the Unicode/UCS standards to include descriptions of conformant graphemes (e.g.: "a Z should have only 3 straight lines with no curly lines (so it doesn't look like a 2)").