An anonymous reader writes "Firefox 3.0.1 was released today. It fixes 3 security vulnerabilities, including a critical issue reported by Billy Rios, Ben Turner, and Dan Veditz. The issue could be combined with an issue in Apple's Safari browser to read data from the user's disk or to execute arbitrary code. This issue was previously discussed on Slashdot.
The release also fixes a remote code execution bug involving the CSS reference counter, reported by the Zero-Day Initiative (previously discussed on Slashdot here), as well as a Mac-only potential code execution bug involving GIF image rendering, reported by Drew Yao of Apple Product Security."
Firefox 3 was crashing 3-10 times a day for me even after completely removing everything FF related. At the risk of jinxing myself I will say that I'm crash free on 3.0.1 for 4 hours now.
OK, if you saw the following I may have an answer for you. If you installed FF3 and around a day or two later mysteriously it seemed to put up the
hourglass cursor with the disk thrashing a lot, then you got bitten by the urlclassifier db (anti-phishing sqlite database) being downloaded. After
a day or so things go back to normal. (It would look more like a temporary freeze of the program
rather than a crash to the desktop).
For anyone on a slow connection or with an old machine (like me) that was almost a showstopper. Thankfully, *seems* to be fixed now.Haven't seen
any real crashes to the desktop even with the betas...
A workaround is to go Tools->Options-> Security and turn off the attack site and forgery options.
Mine crashes every time I run it, but that's due to either no libpangocairo or no GTK+ 2.10 or someone deciding I shouldn't have permissions to be able to run X applications on that machine. But then that's probably not considered crashing as it never got running properly in the first place. So I'm running 2.0.0.16.
At least I solved one of the crashes I used to get with it: a very long Javascript bookmark in the toolbar to open a Javascript console would crash the browser if it tried to display as a tooltip
I finally upgraded last night. So far, so good - it's certainly faster, and the most important mods to me (CSL and NoScript) seem to be working just fine.
Of course, if it isn't all good then I'm screwed now, but c'est la vie.
I upgraded to Firefox 3, but had so many problems with it crashing and not rendering some sites correctly that I reverted to Firefox 2. Strangely, I only had problems with FF3 on my work machine running the Windows XP version (this is the one I rolled back to FF2). I haven't had any problems with it on my Linux machine (Kubuntu 8.04).
Hmm, a Google search reveals that while the "awesome bar" is still the default, you can disable it by following the directions below (but, maybe you already knew this):
1. Type about:config into the location bar and change the value browser.urlbar.matchOnlyTyped to true. After this, you need to restart Firefox. All this does is make it so that Firefox only searches the URLs you have typed and not the titles of pages.
2. Install the Old Location Bar extension. This changes the location bar so that it looks like how it looked in Firefox 2. As of me writing this post, it is an experimental addon so you will need to register to the Firefox addon service to install it.
Type 'co' in the Awesome bar. Marvel at how it "awesomely" returns every site in the.com TLD.
If you are the type who remembers the URL of sites you visit, it just means a bunch of false positives.
I've used it once to date, when going back to a walkthrough page on gamefaqs. 99% of the time, I know the address I'm going to, or I have it bookmarked, so the "awesomeness" is wasted on me.
Matching co to.com is obviously a bug. As for those that remembers URLs, it is admittedly not too useful.
That being said, if you are someone with a lot of bookmarks, it can really speed up looking for something in your bookmarks. It also brings this search ability to every page in your history, which is great for the unwashed masses that either don't understand bookmarks (really!) or just don't use them for whatever reason.
Lifehacker [lifehacker.com] has instructions on how to restore the yellow for SSL sites, among other nice UI changes (such as removing the Go and Search buttons from the Address and Search bars, respectively). It does require an extension (either Stylish or Greasemonkey), but it definitely works, I've been using this at home for a few weeks now.
I finally did what you suggested and typed "co" into the address bar. It gives fifteen suggestions, although I'm sure I go to many more than fifteen.com sites. The top suggestions were for COmputer documentation for where I work, COnsumer Reports magazine, COmputer Cable Store, two sites I frequent that are.com domains, and Weather Forecast and COnditions for my city. I fail to see the problem. Care to explain?
Yeah, well, the FF2 bar wasn't all that hot either. The only thing more annoying than waiting for the list of sites to never come up because you started typing while another tab was still loading, is having the list of sites popup while you're typing and since you had the mouse in the wrong location when you hit enter you went to some completely different place than you had expected.
I don't care whether it's awesome or not, give me an option to make it not appear unless I press down or alt-down or tab or s
Let me save you some time and map out your journey to acceptance of the awesome bar.
First you hate it, because it's new and different to what you expect. You are trained to use it as an address bar and nothing else, so it acting like a search bar is confusing and suboptimal to you.
At this point many people decide to trial the new bar, but you are the kind of person who tends to think he (forgive me, but he) knows what's good and what's not, and even quite enjoy the idea of customizing your Firefox. So you l
Workaround
This attack only works if the user is using another internet-connected application with Firefox not running. Using Firefox, or making sure it is at least running, prevents this attack.
I had to giggle at the workaround. To prevent a firefox flaw from biting you, you need to have firefox open. Phew, I'm so glad I'm safe.
So far as I know, the only application that normally runs with its current directory on the desktop (and is thus a potential target for any successful exploit of this issue) is Internet Explorer.
When you run an application from Windows Explorer, it is normally run with its current directory set to the directory that the executable is located in. The vulnerability exposed by the "carpet bombing" attack involved attacking Internet Explorer, because Internet Explorer runs with its current directory set to the desktop... not the directory containing the IE executable. There is no obvious reason why IE does this, nor any reason I can come up with for Microsoft not to change it.
This attack only works if the user is using another internet-connected application with Firefox not running. Using Firefox, or making sure it is at least running, prevents this attack.
So as long as you use Firefox all day long, you will not be affected.
Now if only they could get around to fixing the much bigger memory issues that seem to get worse and worse with every release. I'm getting tempted to go back to IE for the first time in years.
Ok, seriously: what are these memory issues everyone keeps bitching about? I keep open a considerable selection of tabs myself with low memory usage...and I haven't even made the optimizations for lower memory usage. I'm yet to see any evidence of these "memory issues".
Nice to repeat the same ol' FUD, but you do realize that FF3 memory usage is significantly lower than FF2 and IE [pavlov.net], don't you? You/did/ know that, right?
I could swear that I was notified of a security update regarding Firefox a few days ago. After the update, I checked Firefox and it's own About dialog reported it was 3.0.1. Can anyone else confirm this or am I going bonkers? I'm certainly on 3.0.1 now and I only received some mundane updates this morning.
My issue is that "No one cares when Opera or Safari have a similar release. [or Internet Explorer, or Konqueror...]" but they do when its Firefox.
Opera 9.51 went through a few RC's and a final and is on 9.52RC/Snapshot, Safari has gone through a couple *.*# and a whole #.0 in the last few months for Mac, Win and Mobile...
But no, Firefox 3.1 Sub-Alpha-Hypothetical-Possibility-Beta-RC Build 3219 hits front page and we're supposed to eat a cracker drink some wine and pray to it, but oh wait, we're all for competition and innovation, as long as its Firefox Vs. Firefox.
My issue is that "No one cares when Opera or Safari have a similar release. [or Internet Explorer, or Konqueror...]" but they do when its Firefox.
Opera 9.51 went through a few RC's and a final and is on 9.52RC/Snapshot, Safari has gone through a couple *.*# and a whole #.0 in the last few months for Mac, Win and Mobile...
Your post is sorta worded as flamebait to some, but it does have truth. It doesn't take a statistician or a complex algo to add up how many postings have been about FireFox in the past 6
And Safari and Opera are both non-free so they are more reluctant to give detailed fix reports.
http://my.opera.com/desktopteam/blog/ [opera.com] [opera.com]
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox. I don't recall paying to download either Opera or Safari for my desktop and laptop. Yes, I do know opera charges now for the Wii browser, but I don't have a Wii.
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox.
Safari is Open Source. Head over to WebKit.org [webkit.org] and you can get the source via Subversion or browse it via Trac. It's licensed under a mix of LGPL and BSD licenses.
Safari is closed source. WebKit (the layout engine Safari uses) is open source, but the builds used by Safari rely on a binary closed source blob from Apple. If you value software freedom, you shouldn't use Safari.
no crashes yet (Score:3, Interesting)
crash crashing or? (Score:5, Informative)
For anyone on a slow connection or with an old machine (like me) that was almost a showstopper. Thankfully, *seems* to be fixed now.Haven't seen any real crashes to the desktop even with the betas...
A workaround is to go Tools->Options-> Security and turn off the attack site and forgery options.
Andy
Parent
Re: (Score:2)
Mine crashes every time I run it, but that's due to either no libpangocairo or no GTK+ 2.10 or someone deciding I shouldn't have permissions to be able to run X applications on that machine. But then that's probably not considered crashing as it never got running properly in the first place. So I'm running 2.0.0.16.
At least I solved one of the crashes I used to get with it: a very long Javascript bookmark in the toolbar to open a Javascript console would crash the browser if it tried to display as a tooltip
And this is why... (Score:2, Insightful)
... I didn't download Firefox 3 when it came out. In fact, I'm still on Firefox 2, and I'm sure a good percentage of fellow /.ers are as well.
Remember: if there aren't any patches for it, chances are that the reason is not that it's bug-free, but that it's still buggy.
Re: (Score:2, Insightful)
I finally upgraded last night. So far, so good - it's certainly faster, and the most important mods to me (CSL and NoScript) seem to be working just fine.
Of course, if it isn't all good then I'm screwed now, but c'est la vie.
Re: (Score:2)
Re: (Score:3, Insightful)
Chances are that the reason is not that it's bug-free, but that it's still buggy.
Chances are that you are not a developer.
"He who is without a sin throw the first stone."
Re:And this is why... (Score:5, Informative)
... I didn't download Firefox 3 when it came out. In fact, I'm still on Firefox 2, and I'm sure a good percentage of fellow /.ers are as well.
Um... the carpet bombing vulnerability also affects Firefox 2. It looks like someone is in trouble :)
Parent
"awesome bar" (Score:2, Interesting)
Re:"awesome bar" (Score:5, Informative)
1. Type about:config into the location bar and change the value browser.urlbar.matchOnlyTyped to true. After this, you need to restart Firefox. All this does is make it so that Firefox only searches the URLs you have typed and not the titles of pages.
2. Install the Old Location Bar extension. This changes the location bar so that it looks like how it looked in Firefox 2. As of me writing this post, it is an experimental addon so you will need to register to the Firefox addon service to install it.
Parent
Re: (Score:2)
Re: (Score:2, Funny)
I kinda like the so called awesome bar. What's wrong with it?
The oldies want their URL bars to match URLs and those pesky kids to GET OFF THEIR LAWNS!
Re: (Score:3, Insightful)
I've used it once to date, when going back to a walkthrough page on gamefaqs. 99% of the time, I know the address I'm going to, or I have it bookmarked, so the "awesomeness" is wasted on me.
Re: (Score:2)
Matching co to .com is obviously a bug. As for those that remembers URLs, it is admittedly not too useful.
That being said, if you are someone with a lot of bookmarks, it can really speed up looking for something in your bookmarks. It also brings this search ability to every page in your history, which is great for the unwashed masses that either don't understand bookmarks (really!) or just don't use them for whatever reason.
Re: (Score:3, Informative)
Lifehacker [lifehacker.com] has instructions on how to restore the yellow for SSL sites, among other nice UI changes (such as removing the Go and Search buttons from the Address and Search bars, respectively). It does require an extension (either Stylish or Greasemonkey), but it definitely works, I've been using this at home for a few weeks now.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
Yeah, well, the FF2 bar wasn't all that hot either. The only thing more annoying than waiting for the list of sites to never come up because you started typing while another tab was still loading, is having the list of sites popup while you're typing and since you had the mouse in the wrong location when you hit enter you went to some completely different place than you had expected.
I don't care whether it's awesome or not, give me an option to make it not appear unless I press down or alt-down or tab or s
A brief future history of the awesome bar (Score:3, Insightful)
Let me save you some time and map out your journey to acceptance of the awesome bar.
First you hate it, because it's new and different to what you expect. You are trained to use it as an address bar and nothing else, so it acting like a search bar is confusing and suboptimal to you.
At this point many people decide to trial the new bar, but you are the kind of person who tends to think he (forgive me, but he) knows what's good and what's not, and even quite enjoy the idea of customizing your Firefox. So you l
To to prevent the issue I need to use Firefox? (Score:5, Funny)
I had to giggle at the workaround. To prevent a firefox flaw from biting you, you need to have firefox open. Phew, I'm so glad I'm safe.
When will Microsoft fix IE? (Score:3, Interesting)
So far as I know, the only application that normally runs with its current directory on the desktop (and is thus a potential target for any successful exploit of this issue) is Internet Explorer.
Re: (Score:2, Interesting)
maybe I'm misunderstanding you, but I know a lot of people that change their download directory default in Firefox to the desktop.
Re: (Score:3, Informative)
Re:When will Microsoft fix IE? (Score:4, Informative)
When you run an application from Windows Explorer, it is normally run with its current directory set to the directory that the executable is located in. The vulnerability exposed by the "carpet bombing" attack involved attacking Internet Explorer, because Internet Explorer runs with its current directory set to the desktop... not the directory containing the IE executable. There is no obvious reason why IE does this, nor any reason I can come up with for Microsoft not to change it.
Parent
Workaround (Score:4, Informative)
This attack only works if the user is using another internet-connected application with Firefox not running. Using Firefox, or making sure it is at least running, prevents this attack.
So as long as you use Firefox all day long, you will not be affected.
Re: (Score:2)
As more and more applications are becoming Web Based. Developers having 1 browser open is stupid, as they need to test different environments.
Re: (Score:2)
Or use the IE tab extension...switches rendering in a heartbeat. That takes care of two of the browser.
Re: (Score:2)
Re: (Score:3, Funny)
"But boss, I have to browse the Web all day."
Another software release post? (Score:3, Interesting)
Re: (Score:2)
Slashdot needs a "important software updates" section.
In addition, or as a replacement for, the "stuff that matters" section?
I didn't even know there was a problem. (Score:2, Informative)
Re: (Score:2)
Ok, seriously: what are these memory issues everyone keeps bitching about? I keep open a considerable selection of tabs myself with low memory usage...and I haven't even made the optimizations for lower memory usage. I'm yet to see any evidence of these "memory issues".
Re: (Score:3, Informative)
Ubuntu Repos (Score:3, Interesting)
Re: (Score:3, Interesting)
I would guess you have the 'proposed' repository enabled.
Re:Who Cares... (Score:5, Informative)
Actually, it's a .0.1 release. Firefox 3.1 (alpha due this summer) has a lot of new features that didn't make it in time for 3.0.
Parent
Re:Who Cares... (Score:4, Interesting)
I for one, welcome our browser caring overlords.
My issue is that "No one cares when Opera or Safari have a similar release. [or Internet Explorer, or Konqueror...]" but they do when its Firefox.
Opera 9.51 went through a few RC's and a final and is on 9.52RC/Snapshot, Safari has gone through a couple *.*# and a whole #.0 in the last few months for Mac, Win and Mobile...
But no, Firefox 3.1 Sub-Alpha-Hypothetical-Possibility-Beta-RC Build 3219 hits front page and we're supposed to eat a cracker drink some wine and pray to it, but oh wait, we're all for competition and innovation, as long as its Firefox Vs. Firefox.
(stomps off)
Parent
Re: (Score:3, Interesting)
Your post is sorta worded as flamebait to some, but it does have truth. It doesn't take a statistician or a complex algo to add up how many postings have been about FireFox in the past 6
Re:Who Cares... (Score:4, Funny)
And Internet Explorer is still going through lots of *&^%$#@!
Parent
Re: (Score:3, Informative)
And Safari and Opera are both non-free so they are more reluctant to give detailed fix reports.
http://my.opera.com/desktopteam/blog/ [opera.com]
Re: (Score:3)
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox. I don't recall paying to download either Opera or Safari for my desktop and laptop. Yes, I do know opera charges now for the Wii browser, but I don't have a Wii.
Re: (Score:3, Informative)
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox.
Safari is Open Source. Head over to WebKit.org [webkit.org] and you can get the source via Subversion or browse it via Trac. It's licensed under a mix of LGPL and BSD licenses.
Re:Who Cares... (Score:5, Informative)
Safari is closed source. WebKit (the layout engine Safari uses) is open source, but the builds used by Safari rely on a binary closed source blob from Apple. If you value software freedom, you shouldn't use Safari.
Parent
Re:Who Cares... (Score:5, Informative)
no, Safari isn't open source, WebKit is open source, because it is based on khtml.
Parent
Re: (Score:3, Informative)
Re:Who Cares... (Score:5, Funny)
It seems you haven't run Windows Update for a long time then...
Parent
You may find this useful (Score:3, Informative)
http://dictionary.reference.com/search?q=irony [reference.com]
Re: (Score:2)
The Firebug version [mozilla.org] from July 14 seems to work fine on Firefox 3.0.1 for me.
Re:Addons? (Score:4, Informative)
when the authors update them?
of course, you could google for a couple of seconds and fix it yourself (hint: you can force it to ignore the version)
Parent