Bad FireFox Hole

[piratePenguin]

Yea, power of free software. Just like "fixing" bugs so that same function gets rewritten 3 times, each patch not really fixing the problem but merely protecting against the specific exploit, when it's a critical vulnerability such as remote crash bug in linux kernel related to packet fragmentation. Microsoft sometimes does that too, but don't go touting about power of free software when even critical bugs can take damned long time to fix, and they STILL haven't patched several remote crash bugs in FireFox. Hell, there are heaps of open bugs which have been around for years and known by everyone. Nobody's just bothering to fix them. Power of free software my ass.

Holy shit.
The damn thing is FIXED! Stop crying, just 'cause the Firefox dev's are faster at fixing security vunerabilities than MS.
As soon as that vunerability was noticed and revealed, hundreds (I'd say) of programmers looked through some of the Firefox code to fix it. They did. Fast.

And don't tell me "oh well the quality of these programmers skills are questionable", I know it is. As are the MS programmers. We all know that Firefox is better than Internet Explorer, it doesn't take a genius to figure that out. In my mind, it's safe enough to assume that the Firefox dev's are better than the Internet Explorer dev's.

[skyman8081]

Are you actually implying that the availibility of source code makes a peice of software inherently better?

In practince, yes, many time OSS packages are in fact better than their proprietary counterparts.  However, this does not mean that a peice of software is somehow "better", ONLY because it is open source.  This would mean that the GPL licensed KDE/Qt is magically better than when it is released under a commercial license.

[piratePenguin]

Are you actually implying that the availibility of source code makes a peice of software inherently better?

No I am not. I'm saying that:

As soon as that vunerability was noticed and revealed, hundreds (I'd say) of programmers looked through some of the Firefox code to fix it. They did. Fast.

EDIT: And the availabilty of the source code probably and more than likely speeded up the fixing process, at least on this occasion.

EDIT: Please read my other post again.

[muzzy]

The damn thing is FIXED! Stop crying, just 'cause the Firefox dev's are faster at fixing security vunerabilities than MS.
As soon as that vunerability was noticed and revealed, hundreds (I'd say) of programmers looked through some of the Firefox code to fix it. They did. Fast.

If you only look at the incidents that you choose, you won't get very interesting view. As an example to counter your silly little view, I present you a bug that's been reported over two years ago, is marked critical, crashes the browser, and testcase is available:

https://bugzilla.mozilla.org/show_bug.cgi?id=202765

See the bug live in here, tested against latest firefox:

http://muzzy.net/ffcrash/crash.xml

So, where are the "hundreds" of programmers now? Oh, it's not an issue because it hasn't been publicized in any magazine?

[Aloone_Jonez]

That's not that critical in my opinion. So what the browser crashes, it's more of an inconvenience than anything, it's not like it crashes the whole system or allows a hacker to compromise the system or allow some executable code to run.

I do take your point though, this should've been fixed years ago.

[BobTheHob]

If you only look at the incidents that you choose

[sarcasm]Oh ok, so HE is the one doing that all the time, i could have sworn it was you[/sarcasm]

[piratePenguin]

http://muzzy.net/ffcrash/crash.xml

That's the first time ever that Mozilla crashed on me.

[Aloone_Jonez]

Same here.

Unlike Internet Explorer which often crashes for no reason.

[piratePenguin]

And muzzy, of course Firefox will have it's bugs. As will Internet Explorer. The only difference is that the Firefox bugs, fixed and not-fixed, are publicly availabe. That's why you can rumage through the bug database and craft some amount of pages that take advantage of these (publicly available) bugs, to try to undermine it's stability. EDIT: And that is what you did do. Those crashes were no accident, if they were, I might get worried (not).

Could you imagine if Microsoft released a bug database to the world with all the fixed and not-fixed bugs in Internet Explorer?

[piratePenguin]

http://www.internetnews.com/security/article.php/3504661

[piratePenguin]

Are you actually implying that the availibility of source code makes a peice of software inherently better?

I never suggested that.
You should read this tho. The following is stolen from that:

"A lot of security problems derive from the core ... [With open-source code,] thousands of people look at the critical portions of source code and ... check [to make sure that] those portions are right. It's a major advantage to have open-source code."

[muzzy]

I'd like to mention that the bug I'm touting about was independently found by my friend, who actually tried to do document.write() inside a stylesheet. I didn't just go looking through the bug database, looking for a crash bug. I only found afterwards that the bug had already been known for quite a while.

Also, while this demonstration doesn't show any code execution, HOW CAN YOU KNOW it isn't a remote code execution hole? Every crash bug potentially is, and it takes a while to analyze it to see if it is or isn't. This is damn well a critical hole.

[piratePenguin]

I'd like to mention that the bug I'm touting about was independently found by my friend, who actually tried to do document.write() inside a stylesheet. I didn't just go looking through the bug database, looking for a crash bug. I only found afterwards that the bug had already been known for quite a while.

Also, while this demonstration doesn't show any code execution, HOW CAN YOU KNOW it isn't a remote code execution hole? Every crash bug potentially is, and it takes a while to analyze it to see if it is or isn't. This is damn well a critical hole.

I'm sure your friend is very pissed off that (s)he can't do document.write() inside a stylesheet without Firefox crashing. Why would (s)he want to do such a thing (I have no idea about this XML/etc. stuff)?

[Calum]

that's hardly the point though, is it? perhaps the aim of somebody who did such a thing is to crash firefox? in which case, it needs fixed.

[piratePenguin]

that's hardly the point though, is it? perhaps the aim of somebody who did such a thing is to crash firefox? in which case, it needs fixed.

If it happened to every second webpage, yes, it would be fixed in no time at all. But very, very few people are gonna be crashed because, obviously, it seems that document.write(), or whatever, inside stylesheets, isn't incredibly popular.

Yea, I agree that it should be fixed, but it shouldn't be a huge priority. And it's not gonna make anyone switch from Firefox back to IE, I would hope.