Minor upgrade Firefox 1.0.1 (bug and security fix) released

Discussion in 'Fred's House of Pancakes' started by Sufferin' Prius Envy, Feb 25, 2005.

  1. Sufferin' Prius Envy

    Sufferin' Prius Envy Platinum Member

    Joined:
    Jul 7, 2004
    3,998
    19
    0
    Location:
    USA
    Vehicle:
    Other Non-Hybrid
    #1 Sufferin' Prius Envy, Feb 25, 2005
  2. rflagg

    rflagg Member

    Joined:
    Jan 5, 2004
    947
    9
    0
    Location:
    Springfield, VA
    Sounds like it doesn't fix their biggest security problem that was mentioned a few months ago in the news.

    The bug has to do with giving the user a link that looks legit that isn't - say paypal.com - the link could look legit, but perhaps the 'a' in paypal is actually a symbol in another language instead of the english-a code, even though they look the same. IE doesn't have this problem because it only allows certain languages, and won't allow ALT codes above a certain point. (ALT codes meaning holding down ALT and typing 255 will equate a space to your computer, every keystroke has a corresponding alt code).

    -m.
     
    #2 rflagg, Feb 25, 2005
  3. rflagg

    rflagg Member

    Joined:
    Jan 5, 2004
    947
    9
    0
    Location:
    Springfield, VA
    I stand corrected - they have a 'temp' fix for this in the latest release:

    "One security patch addresses the problem of international domain name spoofing, in which a hacker could potentially spoof a Web site through the international characters in the browser. The fix involves putting "funny-looking characters" in the susceptible area of the browser, though Hofmann acknowledges it's only a temporary solution. Security firm Secunia described the IDN spoofing vulnerability in a bulletin earlier this month. "

    -m.
     
    #3 rflagg, Feb 25, 2005
  4. Sufferin' Prius Envy

    Sufferin' Prius Envy Platinum Member

    Joined:
    Jul 7, 2004
    3,998
    19
    0
    Location:
    USA
    Vehicle:
    Other Non-Hybrid
    Re: Minor upgrade Firefox 1.0.1 (bug and security fix) relea

    Rflagg: You could add the SpoofStick 1.05 extension . . . but if you upgraded to FireFox 1.0.1 the author of SpoofStick will need to confirm the compatibility with FF 1.0.1 before it will load. (I don’t use SpoofStick myself. Last time I tried it I felt SpoofStick took too much screen real estate)

    A neat thing about extensions is they will not crash updates of FireFox due to incompatibilities. The offending extensions are disabled until it is updated to conform to the new FireFox version, and you can not install an incompatible older extension either.

    For the really paranoid amongst us:

    Display the current Homeland Security Threat Level as an icon in the status bar with the U.S. Homeland Security Threat Level 0.4 extension.
    :|
     
    #4 Sufferin' Prius Envy, Feb 25, 2005
  5. bookrats

    bookrats New Member

    Joined:
    Mar 12, 2004
    2,843
    2
    0
    Location:
    Seattle, WA
    Thanks for pointing this out, Patrick -- updated this right away.
     
    #5 bookrats, Feb 25, 2005
  6. Sufferin' Prius Envy

    Sufferin' Prius Envy Platinum Member

    Joined:
    Jul 7, 2004
    3,998
    19
    0
    Location:
    USA
    Vehicle:
    Other Non-Hybrid
    <div class='quotetop'>QUOTE(bookrats\";p=\"67379)</div>
    Which?
    Homeland Security Threat Level 0.4
    Or
    Manually updating all extensions?

    “They†really should make the updates check the extensions automatically when a newer version of FF is installed . . . and warn you which extensions are not yet compatible. Oh well, maybe FF 1.0.2 will have that upgrade.

    If the extension authors are on top of things, they will have the extensions marked prior to the release of the new versions. It’s a good system to stop feature rot.

    I could be sitting here in blissful ignorance expecting Homeland Security Threat Level 0.4 to warn me prior to a terrorist attack. (No, I don’t have it installed.)
     
    #6 Sufferin' Prius Envy, Feb 25, 2005
  7. bookrats

    bookrats New Member

    Joined:
    Mar 12, 2004
    2,843
    2
    0
    Location:
    Seattle, WA
    No, Firefox itself.

    And actually, I'm cool with manually updating the extensions; I'm just pleased that they've put such a "strong" versioning system into Firefox.

    Overall, I think it will make for fewer Firefox crashes due to an incompatible extension.
     
    #7 bookrats, Feb 26, 2005
(You must log in or sign up to post here.)