rfrangioni77 wrote:Doubtful. This is the 3rd unplanned release since 0.9 that deals with security problems. If the first two didn't prove that the developers listen, care, and make an effort to get it right, I'm pretty sure the third one won't, either.
Nope. This is the second unplanned release since 0.9 that deals with security.
0.9.1 dealt with stability problems, as the EM wasn't quite stable enough for people (I think they were all EM fixes.....)
rfrangioni77 wrote:Doubtful. This is the 3rd unplanned release since 0.9 that deals with security problems. If the first two didn't prove that the developers listen, care, and make an effort to get it right, I'm pretty sure the third one won't, either.
Nope. This is the second unplanned release since 0.9 that deals with security.
0.9.1 dealt with stability problems, as the EM wasn't quite stable enough for people (I think they were all EM fixes.....)
I guess so. I've never heard of a "time based" password cracking method. I mean, it would be a brute-force attack anyway, which means that you have to try each combination of letters, numbers and symbols until you pick the right one; the longer the password, the longer it takes to discover it.
A little bit of late response, but anyways:
This is not a myth, though the hacking that I know of was slightly different.
This one I have seen with my own eyes: The "malicious" user is logged in on a unix system and is trying to find the root password, he makes up a password and in his program he manages the pass so that the first character of the password is in one memoty page and the rest on in a different page. If the first character matches in the test, then the system will try to match the second character, but the second character is in a different page so a page fault signal occurs for the system to bring up the next page into memory frame, and this way the hacker can guess the password in linear time instead of exponential. After finding the first character, he aligns the first 2 letters of apss to be in a page and the rest on the next page, and so on.
Thanks (and thanks to the other poster that mentioned this). This was the story I'd heard, I just hadn't remembered it very clearly. Makes somewhat more sense this way, although the point I was trying to get across still holds.
ShanghaiKid wrote:Surely it is time to stop worrying about 56k users though? Which cheap broadband packages now available (speeds such as 150 kbps which are not typical broadband speeds but a lot faster than dialup surely 56k users will start to dwindle in their numbers?
Let's not abandon those who pay sub-$10 a month for internet just yet. Is that really what we WANT Mozilla to do?
To be honest yes I do. I don't want to see the mozilla suite and firefox suffering because they can't implement bigger and better features because they have to worry about the dial-up users. I know there are still a lot out there but I don't think it should be ruined for the rest of us. Maybe a lite version of firefox which is just the basic secure browser with no frills. Where as the full version could have the extras and new features which I hope to see post 1.0. I know that won't happen but I still don't think progress should stop just because it takes ages to download for dial-up users. I noticed you said $10 so I don't know what broadband prices are like in the states, but in the UK most dial-up packages are around £14.99 (unlimited ones) and 150 kbps broadband is £15.99, I just see that as weird to why anyone wouldn't pay and extra pound per month for all the extra speed. But as I said the situation could be different else where.
At the end of the day I'm sticking by my yes as I don't think mozilla and firefox should suffer because of dial-up users.
I thought Firefox was meant to be the lite version. If broadband users want a full-featured browser with multimedia and all the extras, they should create a BlackDiamond style project to create a one-click install for that. I like my small, fast browser. It's not just downloading that makes a difference, smaller files take up less space on disk and in memory too, great if you're browsing on an older machine.
I say leave Firefox as the lightening-fast, waif-like browser.
Also, remember a large proportion of the planet are on slow connections with old machines. The more people that can use Firefox, the less people will be using something else, and the more people there will be looking for extensions and writing compliant web pages.
@ mad_goldfish - I do see your point and to a certain extent I also agree with what you are saying. I personally think firefox should abandon dial-up users but I do also agree that they shouldn't be like singled out and not be allowed to enjoy something that the rest do.
However something which caught my eye earlier this week was a c-net newsletter talking about South Korea and how over there the average connection is 8 mbps (here was me thinking 512 kbps was fast). Some places in South Korea are even up to speeds of around 20 mbps. My point being the UK in particular and I think to a great extent the majority of Europe and the US are behind speed wise and I think it is about time dial-up was outlawed and broadband was made standard.
But in the meantime mad_goldfish whilst I agree with you firefox is supposed to be mean and lean. But look IE, when it is updated (yes it does happen) the download process can be anywhere up to 75 MB. Now I don't think it is awful if firefox was to grow to about 15 MB if features were to be added as this is still no where near the size of IE. For firefox to ever be perfect (or near) updates are going to have to happen and it is inevitable the size of the installer will increase thus I don't think firefox as a project should suffer too much because mozilla has to worry about dial-up. At the end of the day if you want it so much then get it on CD.
For me, Firefox with a couple of extensions (UA Switcher and Radial Context are my only must-haves), is pretty much perfect, and I cannot see how 10Mb of extra code can make it better. What features do you really think it needs that are essential to a browsing experience? Or are you looking for an all-in-one browser and plug-in download?
Well, I am not a developer and at the moment I do agree with you mad_goldfish that firefox does have everything I need. But it isn't perfect and does need to become more stable and a tad faster loading and less resource hungry. But I agree with you that this won't take MB's worth of extra coding. But before I started using mozilla 0.9 I think it was a few years ago I never had even heard of tabs, now I couldn't use a browser without them and IE looks so pathetic when going back and using it. My point being times do change, for all we know within a months time a new idea may have been dreamed up by the mozilla people (I am aware that mozilla wasn't the first browser to have tabs before I get any opera lovers shouting at me). For example a new way to browse other than tabs may be introduced and this may take up a lot of extra coding. My point being I do not want to see the mozilla developers saying 'nah this takes up 5 mb of extra code so we can't introduce it due to dial-up users'. Now this may not be relevant at the moment but it is feasible that new ideas for browsers will surface and they will take up more MB's and that is what I mean by saying I don't want firefox to suffer due to dial-up users.
Also at the end of the day if firefox is to be mean and lean does it really need and integrated search bar, tabs, extensions and so on? These are all little extras so firefox isn't that mean and lean after all.
It's the same as 0.9.1/0.9.2, but with some fixes for recently discovered security flaws:
Bug 253121 - lock icon and certificates spoofable with onunload document.write
Bug 249004 - Importing false CA certificate leading to error -8182 (perm DoS), especially exploitable by email
Bug 251381 - new libpng buffer overflow vulnerabilities
Bug 250906 - null (%00) in filename fakes extension (ftp, file)
Last edited by michaell522 on August 4th, 2004, 9:11 am, edited 1 time in total.
mozillaZine is an independent Mozilla community and advocacy site. We're not affiliated or endorsed by the Mozilla Corporation but we love them just the same.
