Fortunately Firefox

I dropped by the Mozilla web site tonight.  I discovered on their Firefox news page, that Firefox 9.0.1 has already been released.

I am pretty excited because this version dramatically speeds up some web pages which use JavaScript.  I read elsewhere this evening that the developers used some clever optimization techniques to get the higher performance.

Apparently, MathML support has been improved too.


On a side note, this is my first post using the draft version of the new version of Google's Blogger service which will be getting an update soon.

It seems nice. This is certainly one of those changes that you notice.  The post-a-blog-entry page is nothing like the old one they have had for years.  Saying it is different is a radical understatement.

Labels: blogging, browsing, firefox, software, update, web

The Nobel Peace Prize web site and others have been infected with malware that in turn infects computers via Firefox if the user is not running the just released update of Firefox - version 3.6.12 (or the 3.5 equivalent).

The vulnerability was in the JavaScript interpreter.  It was of a category named use-after-free.  Memory was dynamically allocated, then freed - and then use continued after that.  It is not terribly uncommon in large, complex programs written in C and C++.  This type of bug cannot be written directly in Java because Java uses garbage collection instead of letting application programmers do alloc/free themselves.

Users running NoScript addon for Firefox were safe all along, unless they expressly gave permission to an infected web site to run JavaScript.

Labels: firefox, javascript, malware, mswin, security, security snafus, web

My iMac running latest, up-to-date Mac OS X (10.6.3) blue screened while I was typing in Safari and went through a reboot process.  It seemed to take extra long compared to a warm boot; seemed like a cold boot or even a boot that did some kind of update.

At the time it happened, I had Safari in the foreground and I had Firefox sitting idle in the background.

Other applications were not running.  I have 5.6 GB of disk storage free on my boot drive.  My computer was downstairs on the western facing side of the house.  So there were no free disk space or ambient temperature problems.

When the system came back up, I was naturally curious what was in the logs at the point it crashed and just before that so I ran the Console application that comes as part of the Mac OS. What I saw surprised me.

There was a process called "firefox-bin" running and it was running amuck.  The process was logging over a dozen messages per second.  Every message was the same error:


6/5/10 7:36:10 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:10 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:10 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:10 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:10 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:10 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:10 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:10 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:10 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:11 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)
6/5/10 7:36:12 AM firefox-bin[4299] _NXGetScreenRect: error getting display bounds (1001)


Well, I am pretty sure I had not launched Firefox yet! It had not been opened, yet firefox-bin, the main Firefox application process, was already running.  Not only that, it was stuck in a loop trying to do something it could not do, over and over really quickly.

I checked and this error message repeatedly being output has been reported by other users back in late 2009, running Mac OS X 10.5 (older than my 10.6) and an older version of Firefox than I have.

Here is the discussion thread on it at support.mozilla.com: System.log shows that Firefox is spamming the following error in large chunks .  The person who posted that message listed the error message absolutely identical to the one on spotted above on my system.  They said they updated Firefox, and the problem went away.

Oh, and someone reported the same problem (same error message) being output by iCal in December 2009:   _NXGetScreenRect: error getting display bounds (1001).  Completely unrelated application gave the same error message.

I killed the process, by the way.  I am not sure why it was running, what it was doing, why it had this error and why it was apparently doing it really fast over and over in a tight loop.  Nothing about it seemed kosher or okay.

Here is me killing the rogue, runaway Firefox process:


John-intel-iMac:~ jcollins$ ps 4299
  PID   TT  STAT      TIME COMMAND
 4299   ??  Ss    19:26.69 /Applications/Firefox.app/Contents/MacOS/firefox-bin
John-intel-iMac:~ jcollins$ ps -elf 4299
  UID   PID  PPID        F CPU PRI NI       SZ    RSS WCHAN     S     ADDR TTY           TIME CMD                  STIME
  501  4299     1     4000   0  57  0   517184 189464 -      Ss    40a5000 ??        19:27.11 /Applications/Fi   4:01.47
John-intel-iMac:~ jcollins$ kill -9 4299

I am running Firefox 3.6.3 which has a reported file size of 55,240,723 bytes on my system.  I am really sure about those two numbers because I copied and pasted them directly from the Get Info pane in the Finder.

I am really disturbed by this highly unusual and unexpected behavior on my system. Nothing like this has ever happened before on this computer. In all the 2 or 3 years I have had it, it has never spontaneously rebooted.

I am going to look into this further because clearly something is wrong with my system at that point on the basis of the reboot.  Why Firefox was running and why it had this error message being logged at an absurdly rapid rate over and over is an issue too. Whether they are related or not, I cannot say at this point but I hope to find out soon.

I verified my Mac was up to date immediately after the reboot.  It was except for printer software which must have been updated in the past week.

Labels: crash, firefox, macintosh, macosx, reliability, security, snafus, software, web

Brian Krebs, independent computer security blogger and former columnist at the Washington Post reported on a commercial web browser exploit toolkit for hackers. Note when I say commercial that does not in any way imply it is legal or anyone in there right minds endorses it.

What it does say is that hackers go after web users systematically and would like no marks to get away, regardless of the browser the user has chosen.

However, the statistics published in the screenshots of the article show that the user's choice of web browser has the most drastic choice on whether he gets successfully hacked or not.

In the statistics sampled, Firefox 3.5.6 registered several successful attacks against it, but others were left unscarred.

Internet Explorer, you ask?  Oh, my god!  It gets mauled when it shows up on an infected web site!!  The article shows that IE is like some barroom brawler that cannot possibly walk away from a fight.  Though the successful attack rate against Internet Explorer has been steadily decreasing since version 5.0 (about 2/3 successful attacks) the rate of successful attacks for IE 8.0 is a little over 1/10.

Another interesting thing is that Firefox 3.5.x was seen twice as much as Internet Explorer 8.0 by the toolkit.

To me, these statistic say when Microsoft has been saying for the past 6 years that Firefox was not getting infected a lot was because few people are using it is not just one lie but two.  Apparently, Firefox is seen quite a bit by infected web sites.  However, for the most part these sites can look but they cannot touch.

The other surprise is that plugins do get attacked and sometimes the attacks are successful:  Java, Adobe plugins, etc. are attacked.  Java attacks are rarely successful but you do see a grouping of some successful attacks against a recent but non-current version of Java 6.  The lesson there is clear:  keep your Java web browser plugin up to date in all of your web browsers!

Another interesting though perhaps malleable fact is that the Adobe Acrobat Reader and Adobe Flash attacks that are wildly successful on Windows when running IE, just do not currently work against the Macintosh.  Another case for the argument that a lot of people should have switched from Firefox to Macintosh years ago.  If they had, then this web hacker industry would not be quite so large and wealthy as it is now.  There is no question the minions and gangs in this industry are making quite a lot of money.

Perhaps, if IE users want to be slightly safer on the web, they will update their browsers and avoid installing plugins - like, say Silverlight.  But if they want to cut there risk by another ten to hundredfold, they will install Firefox.  At least then they will not be reeling around like a punch drunk barfly with a glass jaw.

Lesson learned:  avoid Internet Exploder - run Firefox instead - beware Adobe plugins, and keep Java plugin up to date if you have it installed in your web browser.

Labels: browsing, snafus, statistics, web

At last, Mozilla Firefox 3.6 has arrived. It got here a few weeks, well, exactly 3, after the end of 20009. Not bad though. The speed improvements from the newly improved JavaScript interpreter might make up for it.

Labels: browsing, firefox, update, web

Adobe Acrobat Reader has been plagued countless times throughout this entire decade with malware vulnerabilities arising from programming errors related to its built-in JavasScript interpreter.

As usual, Adobe has instructed users to go into the Preferences for Acrobat and disable the JavaScript interpreter.

I recommend doing that, and also I recommend uninstalling the Acrobat Reader plugin. Looking at PDF files in a web page with Acrobat is too dangerous. This JavaScript problem keeps hitting it. Adobe needs to provide a permanent solution - not a perpetual problem.

Macintosh computers come with the Preview application, which was written by Apple. Macs also have an OS that actually understands PDF really well. The Mac Preview application will not execute JavaScript that is in PDF files. So it is the way to go if you have a Mac. It is bad, actually, to install Acrobat Reader on a Mac. No good will come from it.

For MS Windows computers, just deactivate JavaScript in Adobe Acrobat Reader, and uninstall its plugin. That will make an incredibly huge improvement in the safety of your Windows PC. Keep it that way.

Labels: web

There are issues fixed by updating to Firefox 3.5.6. It is very important at this time to keep Firefox up to date.

That goes for the Firefox application program itself, the extensions you have installed, and the plugins.

Unfortunately, Firefox lacks a built-in, automated way to check for out-of-date plugins and offer to update them for you.

However, there is at least a web page at the Mozilla web site that will do that for you. Using Firefox web browser, click the shiny bit of blog bling in the lower left corner of my weblog page here, so you can get that done.

That simply takes you to their web page. Their page does all the work. Just read it carefully. Make sure you bookmark their page, by the way. You will want to visit that web page regularly. I recommend doing it about once a week.

Updating Ad-ons in Firefox is easy. Just go to the Tools menu in Firefox, Choose Add-ons menu item, and click the Find Updates button at the bottom of the dialog box that appears. It will let you know if there are any updates that need to be applied and then display a Restart button if there are.

To update Firefox itself, you should go to its Help menu and choose the Check for Updates menu item.

If software developers at Mozilla update Firefox, but you never get those updates from them - then your computer just gets more and more at risk. Plus, you are not going to get improvements. The same goes for updating its third-party plugins and add-ons.

Labels: browsing, firefox, software, update, web

The long awaited Firefox web browser version 3 came out this afternoon (morning, if you live on west coast of US).



More details after I have had a chance to install it and check it out. In the meantime, grab your own copy.

The Mozilla guys are pushing to see how many people they can get to download and try it out in the first 24 hours. The clock started ticking today a little before or after noon today - depending on where in the US you live. If you live elsewhere, it probably came out around 10 AM PDT (GMT-7, considering daylight savings time is on now).

Labels: browsing, firefox, Firefox 3, web

Firefox 3 RC 2 is out now.  Here are the release notes.

Labels: firefox, http, web

I installed Flock 1.2.1 an hour or two ago. Finally upgraded from version 1 which came out about a year ago.

I have to say, I am pretty impressed.

The feel of this browser is very smooth now.

The only problem that sliightly detracted from its use was I got some long pauses. This happened especially when I hit the backspace key.

Other than that, Flock 1.2.1 is a very neat program. If you like having your online world at your fingertips - this is the browser to have. Social web stuff is its forté.

Labels: browsing, web