Firefox 2.0 vs. Internet Explorer 7

Web browsers are among the most commonly used software. Recently, both Internet Explorer 7 (IE7) and Firefox 2.0 trumpeted new or improved security features during their well-publicized launch campaigns. While these features are primarily aimed to attract the business user, they also are directed toward the everyday user who has started to take Internet security more seriously. But what are these new features and do they make using the Web any safer?

Internet Explorer 7 and Firefox 2.0 enhancements
Both Internet Explorer 7 and Firefox 2.0 filter and analyze the Web address, the page content and the structure of a page. And, though both make use of blacklists, only Internet Explorer 7 offers this as a default setting. Firefox 2.0 makes up for this by offering the choice of two blacklists, one of which happens to be a live database maintained by Google. Also impressive is the speed with which all lists are updated.

Both browsers' development groups have upped the ante regarding user warnings, especially warnings applicable to providing personal information. Internet Explorer 7 now uses color-coded warnings in the URL bar based on whether a site is trusted and Firefox's dialog box to warn of cross-domain scripting. Internet Explorer 7 has also enhanced their default settings: the Medium setting has been raised to Medium-high, and the Low setting has been removed altogether. Unfortunately, the much-anticipated Internet Explorer 7 Protected Mode, which stops Web sites from changing a computer's critical files or settings, will work only in Windows Vista! Nonetheless, these improvements take steps to enhance the user experience as each browser now offers enough information to enable users to make intelligent decisions about the safety of a Web site.

Both Web browsers tackle downloads with a barrage of warnings. It seems that Microsoft really learned from past problems caused by ActiveX. Now, a download dialog box only appears when you click a direct link to a download. This prevents pop ups from prompting you to download a file. In addition, if there's a need to install a software program, the prompt will only appear once. Microsoft has also reworked ActiveX prompts; they now appear in the Info bar where they don't interfere with navigation and can be ignored. And, although drive-by ActiveX installs are now impossible, users still need to change their habits. While Internet Explorer has provided publisher program information for some time, simply doing so hasn't deterred people from installing malicious programs.

Alternatively, Firefox allows Web pages to trigger a download dialog box that users must deal with. Firefox also has its own add-on model, and there are concerns about the ease with which they can be installed.

Firefox 2.0 vs. Internet Explorer 7: End-user appeal
However, Firefox 2.0 will likely appeal more to the technically knowledgeable user and its options and dialog boxes reflect that. It offers more customization, such as allowing users to choose which warning messages they receive, and which cookies they can view and remove. On the other hand, if Internet Explorer 7 considers its browser settings to be unsafe, the "Fix Settings for Me" option can help the less technically savvy surfer.

Presently, Firefox has a better reputation for security than Internet Explorer, but Internet Explorer 7 definitely reflects Microsoft's increased focus on security. Regardless, in order to consume Firefox's loyal user base, Microsoft has to show that it can match Firefox's fast response when new security issues arise.

About the Author:
Michael Cobb, CISSP-ISSAP, is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for SearchSecurity.com's Messaging Security School and, as a SearchSecurity.com site expert, answers user questions on application and platform security.

Michael Cobb
12.14.2006

Two security flaws discovered in Firefox

A security company has reported two new flaws in the Mozilla Firefox browser that may leave locally saved files vulnerable to outside attacks.

Both flaws were announced by SecuriTeam, a division of Beyond Security, this week. The first flaw lies in Firefox's pop-up blocker feature, according to a SecuriTeam statement on Monday. The browser typically does not allow websites to access files that are stored locally, according to the official report, but this URL permission check is superseded when a Firefox user has turned off pop-up windows manually. As a result, an attacker could use this flaw to steal locally stored files and personal information that might be stored in them.

A possible scenario for such an attack would involve the user clicking on a malicious link that would furtively plant a target file equipped with an exploit code on the computer's hard drive. Then it would display a prompt asking the user to allow a pop-up to appear in order to play a video file or download. The attacker-supplied file would then be loaded thanks to the browser flaw, which could give the attacker local file read privileges.

It appears that this flaw may only apply to older versions of Firefox, prior to the current 2.0 release, but Beyond Security was unavailable for comment on the matter.

The second flaw, announced by SecuriTeam on Wednesday, concerns Firefox's phishing protection feature. With this vulnerability, an adept phisher could fool the browser into believing that a fraudulent site is actually secure by adding particular characters into the URL of its website.

The phishing flaw does appear to apply to the current 2.0.0.1 version of Firefox.

Mozilla was unavailable for comment at the time of writing.

Release notes Firefox Alpha 3 - Known Issues

This list covers some of the known problems with Gran Paradiso Alpha 2. Please read this before reporting any new bugs, and watch for updates as new bugs are discovered.

All Systems

• The browser may consume excessive amounts of memory after prolonged browsing. In order to better handle memory issues, a new garbage collection system has been implemented. However, as the process of integrating Gecko into this system is still ongoing, there are some known leaks that result in large memory usage when the browser is used for a long period of time. A restart should resolve the problem, which will be fixed in Alpha 3.
• The Cairo graphics system has drastically changed the way all text and images are rendered from previous versions of Gecko, so occasional misrenderings of non-latin scripts and fonts may occur.
• The Phishing Protection notification bubble is hidden by the content area (see bug 341950.)

Windows

• Upscaling images can result in misrendering, causing the edges of the image to appear blurry.

Mac OS X

• The user's choice of a default font may not always be honored.
• Font decorations such as underline and strikethrough may be drawn incorrectly.
• Complex script (ex: Indic) may be misrendered.

Linux and Unix systems

• Loading any page with Chinese, Japanese or Korean text can hang the browser (see bug 357637).
• Performance on complex script (ex: Indic) may be slower than previous versions of Gecko.
• Compatibility issues have been reported when users are not running Xorg 7.0 or better.
• Users may experience problems when attempting to print complex pages.

Troubleshooting

• Poorly designed or incompatible Add-ons can cause problems with your browser, including make it crash, slow down page display, etc. If you encounter strange problems relating to parts of the browser no longer working, the browser not starting, windows with strange or distorted appearance, degraded performance, etc, you may be suffering from trouble with your Add-ons. Restart the browser in Safe Mode. On Windows, start using the "Safe Mode" shortcut created in your Start menu or by running firefox.exe -safe-mode. On Linux, start with ./firefox -safe-mode and on Mac OS X, run:

  cd /Applications/GranParadiso.app/Contents/MacOS/
./firefox-bin -safe-mode

  When running in Safe Mode, you can disable the add-ons that are causing trouble and then restart to try again.

If you uninstall an extension that is installed with your user profile (i.e. you installed it from a web page) and then wish to install it for all user profiles using the -install-global-extension command line flag, you must restart the browser once to cleanse the profile extensions datasource of traces of that extension before installing with the switch. If you do not do this you may end up with a jammed entry in the Extensions list and will be unable to install the extension globally.

If you encounter strange problems relating to bookmarks, downloads, window placement, toolbars, history, or other settings, it is recommended that you try creating a new profile and attempting to reproduce the problem before filing bugs. Create a new profile by running Firefox with the -P command line argument, choose the "Manage Profiles" button and then choose "Create Profile...". Migrate your settings files (Bookmarks, Saved Passwords, etc) over one by one, checking each time to see if the problems resurface. If you do find a particular profile data file is causing a problem, file a bug and attach the file.

Release notes Firefox Alpha 3 - Changes in this Development Milestone

Changes in this Development Milestone

Gecko 1.9 Alpha 2 introduces several new features which can be tested by using Gran Paradiso Alpha 2:

• Core layout code affecting the calculation of widths in tables, floats, and absolutely positioned elements has been rewritten. The code for handling incremental layout of pages (as data arrives over the network, as images load, or as dynamic changes are made) has also been changed extensively. (See the Reflow-Refactoring wiki page for more information.
• Resolved remaining issues with ACID2 test compliance.
• Support for the Web Apps 1.0 API for changing stylesheets.
• The inline-block and inline-table values of CSS 2.1's display property are now implemented.
• XML documents can now be rendered as they're downloaded instead of only after the full document has been loaded.
• Greatly improved Mac widgets support since Alpha 1.
• Improvements in the Cairo graphics layer.

Some of the changes in Gecko 1.9 Alpha 2 will affect the web and platform compatibility of Gran Paradiso Alpha 2:

• Windows 95, Windows 98, and Windows ME are not supported for Gecko 1.9.
• OS X 10.2 is no longer supported, and OS X 10.3.9 or better is required.
• The non-standard JavaScript Script object is no longer supported.
• Moving DOM nodes between documents now requires a call to importNode or adoptNode as per the DOM specification.

Gran Paradiso release notes

Gran Paradiso Alpha 2 is an early developer milestone for the next major version of Firefox that is being built on top of the next generation of Mozilla's layout engine, Gecko 1.9. Gran Paradiso Alpha 2 is being made available for testing purposes only, and is intended for web application developers and our testing community. Current users of Mozilla Firefox should not use Gran Paradiso Alpha 2.

These Release Notes cover what's new, download and installation instructions, known issues and frequently asked questions for the Gran Paradiso Alpha 2 release. Please read these notes and the bug filing instructions before reporting any bugs to Bugzilla.

Give us your feedback through this feedback form.

Some reason to choose Firefox

Reason No.1 : Security
The more secure browser to browse web pages you want than IE. you will be protected from most security threats of the world wide web. Firefox included Phishing Protection to protect your financial details fished out anonymously.

Reason No.2 : Open Source
Firefox is an open source program and thousands of experienced programmers and security experts are contributing to Firefox to beat all security threats.

Reason No.3 : Protection from Spy Ware
Firefox will not allow to download any software automatically. Without your explicit agreement, Firefox will not allow any web pages to download and install software. So you are absolutely protected from Spy Ware

Reason No.4 : Automated Update
Firefox’s update system always checks to see if you are running the latest version, and notifies you when a security update is available in over 40 languages. These security updates are small (usually 200KB - 700KB), giving you only what you need and making the security update quick to download and install.

Reason No.5 : Clear Private Data
Firefox offers the ability to clear all your private Web browsing data with just one click with the Clear Private Data tool. You can be confident that when you clear your private data in Firefox it’s gone - whether you are using your own computer or one at the library.

Reason No.6: Tabbed Browsing
You don't have to open many windows and flooded up your status bar with too many windows. Using Firefox you can open as many as Tabs in a single window.

Reason No. 7 : Spell Checking
Don't you sure about spelling of a word while you type your email? Firefox has this feature enabled and it will highlight the wrong words and will tell you the correct spelling.

Reason No. 8 : Search Suggestions
Firefox will suggest the search items, that you type on the integrated search box of Firefox. This works for Google, Yahoo and Answers.Com

Reason No. 9 : Accessibility
Firefox helps to browse visually impaired too. Firefox includes support for DHTML accessibility. Web developers can create pages that reduce the amount of tabbing required to navigate a document to minimize keystrokes for those with mobility disabilities. Firefox also includes support for Microsoft Active Accessibility, Microsoft’s accessibility API standard for Windows. This support allows Firefox to work with screen readers such as GW Micro’s Window-Eyes and Freedom Scientific’s JAWS

Reason No.10 : Popup Blocker
The Firefox blocks unwanted pop-ups that irritates the user when visiting to a web site. You can customize the pop-up blocking options to allow your favorite webs tie to show pop-ups for you!

Reason No. 11 : Session Restore
Losing your place while you’re doing things on the Web is a pain. Now, with Session Restore, if Firefox has to restart or closes when it comes back you will pick up exactly where you left off. The windows and tabs you were using, the text you typed into forms, and the in-progress downloads you had running will all be restored. You can even set Firefox 2 to always restore your previous session instead of loading a home page, so you will never lose your place again.

Reason No.12 : RSS Feeds
What do news headlines, indie rock podcasts, and pictures of kittens have in common? They are all things that you can subscribe to with Web feeds. Firefox 2 gives you full control over Web feeds, showing you a preview and letting you choose how you want to subscribe. You can use a Firefox Live Bookmark, or a feed reader that you have installed on your computer, or through a Web service such as My Yahoo!, Bloglines or Google Reader.

Reason No. 13 : Live Titles
Keep an eye on that auction or the status of a delivery using the new Live Titles feature in Firefox 2. Compact enough to fit as a bookmark label, Live Titles are regularly updated summaries of the most important information on a Web page. As the information on the page gets updated, so does your Live Title.

Reason No. 14 : Integrated Search
Firefox helps you find whatever it is that you are looking for. The Search bar comes pre-loaded with search engines for Google, Yahoo!, Amazon, eBay, Answers.com, and Creative Commons. Wherever you are on the Web, you can enter a search term in the Search bar and receive immediate answers from the search engine you have chosen. You can select a new search engine from the Search bar menu at any time, and add search engines from hundreds of your favorite Web sites.

Reason No. 15 : Live Bookmarks
Firefox Live Bookmarks let you view Web feeds such as news and blog headlines in the bookmarks toolbar or menu. With one glance, quickly review the latest headlines from your favorite sites and click to go directly to the articles that interest you.

Reason No. 16 : Look and Feel
In Firefox you can change the Look and Feel of your browser by using different themes.

Reason No. 17 : Options
Less confusing and cluttered than IE’s Internet Options is another reason in Firefox. You can easily navigate through each setting. Deleting saved passwords is a snap and clearing any saved history.

Reason No. 18 : Add-on for everyone
Firefox allows you to choose add-ons over one thousand add-ons at Firefox web site. Try using them, its quiet fantastic. An Add-On manager will help you to arrange all the add-ons

Reason No. 19 : Search Engine Manager
You can now quickly add, remove and re-order your search engines in the Search bar. Firefox 2 will also detect when a Web site has a search engine that can be installed, and will install it for you with a single click in the drop-down menu.

Firefox to open corporate office in China

The Mozilla Corporation, the company behind the popular Internet browser, Firefox, has their eyes set on China in an effort to compete in the world’s second-largest Web market.

The Mozilla Corporation was established in August 2005 to handle the revenue operations of the Mozilla Foundation, a non profit organization, with a rumored $75 million profit from Firefox in 2005 and an ever increasing ad revenue from Firefox’s Google toolbar.

Mozilla has been in China for some time now, but their presence consists of a non-profit office entirely dedicated to supporting open-source software. Mozilla is ready to take the next step by opening up a corporate office in Beijing.

Skeptics are questioning whether the new corporate office will have any influence on the browser’s popularity in China; stating that it’s already available worldwide, and anyone is free to download and share the open-source browser, and tweak it to their liking.

Mozilla Chief Operating Officer, John Lilly, is expecting to match their Japanese market with a nine percent share in China in just a couple years; however, Lilly is taking a different approach to winning over the market by not pushing it on consumers. “It’s not our goal to make sure that everyone in the world is using Firefox. My main goal is that people know there’s a choice.”

The explorers of the Internet are constantly switching from Internet Explorer to Firefox, and not just because of security; Firefox prides itself in its security. A 2006 Symantec study showed that Firefox had surpassed Internet Explorer in the number of vendor-confirmed vulnerabilities that year through September.

The bottom line - Firefox is fun; with developers constantly pushing out extensions and add-ons, it will be impossible for the nearly 135 million users of China to resist.

Source: TECH.BLORGE.com

Mozilla releases list of features most likely to be included in Firefox 3

Mozilla releases list of features most likely to be included in Firefox 3

Mozilla developers have released to the public their plans of features that they hope are included in Firefox 3 when it is released sometime in the third quarter of 2007.

The developers released three different lists of items to be included in the next full version. The first list, includes the following (among other things):

• Support for remote bookmarks, bookmarks and history annotation.
• An MSI installer which would make it easier for IT administrators to install, configure, and update Firefox across a Lan.
• Google’s open source crash reporting tool, called Airbag, will replace the current tool, called TalkBack.

The next list contains features that are “highly desirable,” such as a private browsing mode, which would leave behind no cache, saved user names and passwords, or history. The ability to save entire web pages as PDFs is another feature that has been desired for a long time by many people.

The last list is labeled as “Nice to Have,” and includes such items as Windows Vista Parental Controls, the ability to install add-ons without restarting Firefox, and Tab Grouping.

Source: www.gadgetell.com