Firefox 3 security alert, patch needed

A security glitch has been found, that apparently threatens every Firefox 3 user, regardless of platform. I learned about it here:

Firefox Looking To Lose The Flab - And The Flaw

Memory leaks and code exploits are a fact of life for both browser developers and their users — regardless of the specific browser in question. For the developers at Mozilla, both issues have been on their minds this week, as browser bugs of both sorts have been all over the news.

[...]

Security researchers published code on Wednesday that reportedly would allow an attacker to load unauthorized software on a target's computer simply by having the target view a specially-coded XML file. According to reports, Mozilla developers were blindsided by the bug and immediately raced to find a patch, a task they'd completed by this morning, adding it to next-week's Firefox 3.0.8 release. Because of the exploit, that release is now considered a "high-priority fire-drill security update" for all users.

Yikes. More about it here:

Firefox fix due next week after attack is published

[...] Mozilla Corp. developers have already worked out a fix for the vulnerability. It's slated to ship in the upcoming 3.0.8 release of the browser, which developers are now characterizing as a "high-priority fire-drill security update," thanks to the attack code. That update is expected sometime early next week.

"We ... consider this a critical issue," said Lucas Adamski, director of security engineering at Mozilla, in an e-mail.

The bug affects Firefox on all operating systems, including Mac OS and Linux, according to Mozilla developer notes on the issue.

By tricking a victim into viewing a maliciously coded XML file, an attacker could use this bug to install unauthorized software on a victim's system. This kind of Web-based malware, called a drive-by download, has become increasingly popular in recent years. [...]

If you are using Firefox 3, this would be an update to watch for.

     

Firefox 3 Memory Issues Explained

Pat and I were talking about how the latest versions of Firefox (3.X) uses memory. He read that at times it uses much greater amounts of memory than Firefox 2 did. Then I came across this article, explaining how the usage is now more efficient, and verifiable in test results:

Firefox 3 Memory Usage

[...] Ways to test

There are many ways to measure memory usage in a browser. Open up 10 tabs with your favorite websites in them and see how much memory the browser is using. Close all but the last tab and load about:blank or Google. Measure again. Another simple test is simply loading Zimbra, Google Reader and Zoho each in their own tab and logging in. We’ve learned that users do so many things with the browser it is nearly impossible to construct a single test to measure memory usage.

We wanted more of a stress test — One that was more reproducible than loading random sites from the web.

[...]

For the results below we loaded 29 different web pages through 30 windows over 11 cycles (319 total page loads), always opening a new window for each page load (closing the oldest window alive once we hit 30 windows). At the end we close all the windows but one and let the browser sit for a few minutes so see if they will reclaim memory, clear short-term caches, etc. There is a 3 second delay between page loads to try and get all the browsers to take the same amount of time. We used the proxy server that is part of Standalone Talos to make sure we were serving up the same content. We had to disable popup blocking to allow the test window to open the 30 windows for running the test. You can get the simple webpage test here and the python script to monitor memory usage here. These things are built on top of the standalone talos framework so you’ll need to drop the python script in with talos to get good results. Mad props to Mike Schroepfer for getting this all working.

Results



Looking at the graph:

* All browsers increase in memory use slightly over time, but the Firefox 3 slope is closer to 0.

* The _peak_ of Firefox 3 is lower than the terminal size of Firefox 2!

* The terminal state of Firefox 3 is nearly 140MB smaller than Firefox 2. 60% less memory!

* IE7 doesn’t appear to give any memory back, even after all the windows are closed!

* Firefox 3 ends up about 400mb smaller than IE7 at the end of the test!

This is just one test that I feel shows the great progress that has been made. We’ll continue working on adding additional tests that can measure more of the ways that users use their browser.

Conclusion

Our work has paid off.

We’re significantly smaller than previous versions of Firefox and other browsers.

You can keep the browser open for much longer using much less memory.

Extensions are much less likely to cause leaks.

We’ve got automated tools in place to detect leaks that might result from new code. We’re always monitoring and testing to make sure we’re moving in the right direction.

All of this has been done while dramatically improving performance. [...]

If you follow the link to the full article, there is LOTS more information, and embedded links too. I just excerpted the parts that seemed to matter most - or should I say, that I actually understood best ;-).
     

Firefox 3 is here, and better than ever

I've been using their last beta, and it fabulous. Now the final release is out, and you can download it here:

The Best Firefox Yet

They are boasting they've made more than 15,000 improvements. If you follow the link, on that page at the lower left hand corner, is a neat video that showcases many of the more dramatic improvements. It's worth a look-see.
     

Firefox 3, beta #5: Is it usable yet?

Normally I don't use beta software because of potential bugs, but I began using firefox way back when, before it was even offically released, because it was already so good. Now we have the latest beta version of Firefox 3 about to be released. Just how usable is it? Steven J. Vaughan-Nichols at Desktoplinux.com asks that very question, in this review of Beta#4. (Beta#5 is due to be released tomorrow):

Is Firefox 3 ready for prime time?

[...] Over the last few days, I've used this system for my usual work and fun. The first thing I noticed is that, even as a beta, Firefox 3 is faster than Firefox 2.12. In particular, screen updates were snappier.

That was impressive, but what was far more impressive was how Firefox ripped through JavaScript-based applications and applets. Here, I found that Firefox 3 ran about three times as fast as Firefox 2 with the same programs. For example, Firefox 3 zoomed along in Gmail.

This wasn't just my impression. Using the SunSpider JavaScript Benchmark, Firefox 3 Beta 4 ran this popular JavaScript basics benchmark in 5,694.6 milliseconds. Firefox 2.12 ran the same tests in 19,616 milliseconds. So, it's actually running JavaScript faster than my eyes alone were telling me.

What made me even happier than Firefox's newly boosted performance is that the new version finally does a decent job of memory management. In the past, Firefox was like a boat with holes in the hull. It would run great at first, but as time went on it would leak more and more memory, and it would get slower and slower. Eventually, and I know because I've seen it, it would sink.

This time the developers have patched up hundreds of memory leaks and the good ship Firefox can run without slowing and sinking a system from constantly leaking memory. Better still, Firefox now includes its own memory garbage collector: the XPCOM Cycle Collector. With this, Firefox modules can do a much better job of releasing memory to the system when it's no longer needed by any running routines.

As far as features are concerned, Firefox 3 comes with a greatly augmented Places Organizer that works hand-in-glove with the Location bar & auto-completion and the Smart Bookmarks Folder. This gives you, for example, the ability to add tags to bookmarks or Web pages, and then easily search for, say, Web pages tagged "Red Hat" that you've looked at in the last week. My one problem with this is that I have never been convinced of the value of tagging. To me, it's always seemed a lazy way of organizing that's all too prone to typos. I'm far happier using a cataloging system to keep track of what's what. Your browser usage may vary.

The beta browser also has several security improvements. One that I really appreciate is that now when I log onto a password-protected site, Firefox 3 asks me whether I want to save my password, after I've managed to log in. As one of the fastest, but sloppiest, typists in the known universe, I really appreciate Firefox waiting until I get it right before asking if I want to preserve my password. [...]

(bold emphasis mine) Wow, this sounds like it's going to be really good, I may download beta 5 and find out for myself. See the full article for embedded links and more information.