7 ms·

The Firefox 3.5 fiasco

145 points by felixmar 17y ago

felixmar 17y ago
I used Procmon to monitor Firefox at startup and it indeed traverses my entire temp folder and Internet Explorer's cache folder.
tptacek 17y ago
Although the interminable feeling the author had while waiting for Firefox 3.5 to start up mirrored my own feeling of waiting for him to get to the f'ing point, he's absolutely right: Firefox should just be using the system's secure random number generator on each platform. If you have a vulnerability in /dev/random or CryptGenRandom(), you have a massively more important finding than Firefox crypto.
- maukdaddy 17y ago
  Apparently the 10,000 eyes of open source missed this huge mistake =( This is exactly the kind of thing I wouldn't except to see in open source software.
  - jerf 17y ago
    This is the 10,000 eyes of open source catching the mistake. It happens in public because there is very little "private". Working As Designed. How often do you see a forensic analysis of this type on commercial software? Not zero, but less often.
    - tptacek 17y ago
      I'm gonna go with, "every time Microsoft releases a security patch of any severity in any product whatsoever".
      - jerf 17y ago
        Hey, absolutely. I'm just saying that it's much harder and thus much more rare. (I have to admit it's sort of more impressive when someone whips out a debugger rather than reading through source.)
    - CWuestefeld 17y ago
      Well, catching it after a long beta and then three rounds of release candidates. Indeed, it was apparently caught by an end user, and not those 10K eyes of developers at all.
      - FooBarWidget 17y ago
        I'm not sure what you're expecting or what you're disappointed about. It's not like closed source commercial software have any better track records.
        jeffesp 17y ago
        If we only measure ourselves (and our work) by the next best person, then only thing we can become is slightly better than them.
      - rbanffy 17y ago
        And that's the beauty of FLOSS. An end-user caught a problem that will, hopefully, be corrected in a couple days. Were it a problem within IE (or Oracle applications - let's be fair as this is not a Microsoft-only problem) we would have to wait until a developer reads the report, the bug being assigned and the correction being put in a future bug-fix release. In a way, a guy from Microsoft just made a huge point on how open-source is far superior to their own closed development cycle.
- codyrobbins 17y ago
  This is exactly the reason, as a general rule of thumb, why I don't like end-user software packages that are designed to be cross-platform. While I find Firefox 3.5 on OS X to be way faster than Firefox 3.0, it still doesn't hold a candle to Safari. It may as well be written in Java. For something as fundamental as a web browser, which I'm using all day long, it can't take 30 seconds to open a new window, freeze up and start thrashing halfway through rendering a page, or crash twice a day. (All of which Firefox 3.0 did, and which made me decide to move to Safari.) On top of the performance, the fact that Firefox uses a fake skinned XUL look-alike interface on each platform is the straw that breaks the camel's back, at least for me. Port the renderer cross-platform, and write separate native apps for each target platform. The amount of complication and cruft that must be in the codebase for making a massively complex software package like Firefox work cross-platform, and the amount of basic OS-level functionality that must have to be reimplemented from scratch because it isn't available on some particular target platform, is probably no small contributor to its performance woes.
  - lamnk 17y ago
    Of course Safari loads faster than Firefox on OS X, as IE loads faster in Windows. Their libraries are preloaded by OS ... Native apps for each platform may give performance boost, but maintaining a consistent UI will be a lot harder
    - blasdel 17y ago
      That's the point: we don't want consistent UI If we want native UI, it's obviously going to have major inconsistencies between platforms!
      - __david__ 17y ago
        Well that's not 100% true because the main interface for Firefox on Mac OS X looks more like Safari than it does Firefox on Linux. I think they've actually done a really good job making it look like a native app instead of just a port from some other OS.
- gms 17y ago
  Some background: on Unix, Firefox obtains seed entropy from /dev/urandom, while on Windows it calls RtlGenRandom() for some reason instead of CryptGenRandom(). This seeding material is then fed to the random number generator, a NIST SP800-90 Hash_DRBG. However they do obtain additional (optional) entropy (if you're familiar with the NIST DRBG's, then I'm talking about the 'Additional Input' parameter) by reading system time while periodically reading a bunch of system dirs to advance time in a non-deterministic manner. And that's where this bug creeps up.
  - itgoon 17y ago
    > it calls RtlGenRandom() for some reason instead of CryptGenRandom() It is calling a kernel interface. The prefix "Rtl" means that it is in the kernel run time library. Reference: http://blogs.msdn.com/wdkdocs/archive/2008/12/19/windows-kernel-routine-naming-conventions.aspx http://blogs.msdn.com/wdkdocs/archive/2008/12/19/windows-ker...
    - gms 17y ago
      Aha, cheers for the explanation.
skip 17y ago
And this is precisely why the most recent Firefox install I have is from the 2.x series. It used to be that Firefox (then Firebird) was the lean and mean cousin of bloated Netscape. Alas, age has taken it's toll and the amount of built in crud in Firefox that has nothing to do with downloading had display HTML documents is overwhelming...
- ScottWhigham 17y ago
  Hmmm - looking back, I'm not sure why I'm on 3.0x. Were there new features? JSON backups - whoopee! Other than that, from a user's perspective, I'm not sure there is anything better. 2.x was fine by me too.
  - stepherm 17y ago
    The "awesome bar" (updated address bar) was added in 3.0 I believe.
  - thaumaturgy 17y ago
    2.x has at least one rendering bug that was fixed in 3.x -- whatever rendering bug it was that I discovered the other day but can't now recall.
  - mr_justin 17y ago
    Because the JavaScript engine in 3.0 is lightning fast compared to the 2.x engine and the 3.5 is ummm, faster than lightning. By a heck of a lot. For me personally, the only reason I downgraded back to 3.0 from 3.5 is because Firebug 1.4 is bloody awful at the moment (in beta). Other than that, Firefox 3.5 is great.
  - pbhj 17y ago
    I quite like the awesome bar now (was that in 2.0?); some CSS3 support too. Bookmarking tagging, update checking are good as well. Improved SVG support I use occassionally for viewing. Other than that I suppose faster javascript and optimisations through use of sqlite for history/bookmarks is good. Probably a few other things if I thought about it. Main features are in add-ons for me, firebug, yslow, noscript, adblock, seoquake,download toolbar, greasemonkey. I keep a separate clean profile, without all the footer-bar ("clutter bar") icons for the wife to use whilst surfing
owyn 17y ago
To summarize for those who have less spare time than I: Some firefox developer had a Very Bad (tm) idea to seed a random number generator by scanning the Windows Temp folders, which is now causing a 30 secs to over a minute pause in start up for a lot of users (particularly those that use IE, which creates a LOT of temp files). Yikes.
- OperaLover 17y ago
  At least the good news about the Bad Idea(tm) is that this should be a very small fix for 3.5.x.1 - as opposed to some competing browsers invested development that ignored/contradicted standards, requiring complete re-do's.
- michaelneale 17y ago
  Wow - thanks for the summary. Certainly didn't need wads of text to say that. Its one of those things "seemed like a good idea at the time, worked well, I feel clever" and then you move on. Then it bites you (or one of your users).
- pj 17y ago
  my question is: If you have NO files in any of your temp folders, do you always get the same random number? Doesn't seem very random to me.
jrockway 17y ago
One bug is a "fiasco"? How about the 15 years the web has been set back by supporting broken browsers like IE6? Oh, well at least it starts up quickly... The real issue here is how hard it is to be a consumer of open source software on Windows. On Debian, if I wanted to fix this, I would just "apt-get source" the relevant package, make the change, and have Debian build me a new package with the fix. On Windows, this is apparently not possible, as there is no package management system to install the compiler and source code for you, and the apps check themselves to make sure that you don't modify them. (I also like how the virus / spyware situation is so out of hand on Windows that you can't even recompile libraries without your own computer assuming you are hacking yourself. Nice.) Why do people still use Windows?
- phatboyslim 17y ago
  My grandma hacks debian and changes source code all the time. I don't get why people use Windows either.
  - jrockway 17y ago
    This guy is not your grandma. His blog claims he is a "most valuable professional", so executing a Makefile should not be too difficult for him. I have different expectations for professional programmers than I have for 80-year-old non-programmers.
    - ttrashh 17y ago
      This guy happens to be a damn good software engineer. He shouldn't have to recompile Firefox to use it. His choice in typography and blog design sucks ass though.
      - dsteinweg 17y ago
        > This guy happens to be a damn good software engineer. I'd have to agree with that point. I think he pretty much single-handedly wrote LLBLGen Pro, an ORM solution for C# or VB.NET. My company uses it and I personally think it's really quite nice.
jcsalterego 17y ago
line-height: 0.1em ftl (gross exaggeration)
- ironkeith 17y ago
  As soon as I see eye filth like that I go right to my readability bookmarklet: http://lab.arc90.com/experiments/readability/ http://lab.arc90.com/experiments/readability/ 80% of the time, it works every time.
  - Encosia 17y ago
    Thank you.
  - hesdeadjim 17y ago
    Oh you rock, this is awesome. As soon as I opened the link for this news item I closed it immediately due to the complete lack of readability. Someone buy the man a book on typography, please!
  - zacharypinter 17y ago
    This comment was more valuable than the article. Thanks!
  - rpdillon 17y ago
    You just made my day. Thank you, sir.
  - rms 17y ago
    There's also always View -> Page Style ->No Style
    - troels 17y ago
      And Ctrl + (Repeat until satisfied)
      - rms 17y ago
voidpointer 17y ago
Well yes, it's a bug but it's hardly a fiasco. Something like this should be caught in pre-release testing. Still, most users have their browsers running all the time anyway so a slow startup is not really that critical. I've seen far more serious bugs being taken far more lightly.
- dave_au 17y ago
  I'd more alarmed by the fact that they've thrown something new into the mix security-wise than the effect on startup time. If the system pseudo-random number generator has no problem, what's the use case for not using it? And if it does have a problem I'm sure they would have told someone :) I just don't know why you add another moving part to the security system if you could avoid it, especially since it seems like a reasonably safe bet that people have had more eyes move over / experience with the alternative.
  - voidpointer 17y ago
    Yeah, it's a stupid bug. Most bugs are once you find them. I also agree that this got into the security layer is probably the most worrisome part of the whole story. Maye this could build a case for mandatory code reviews for security related modifications.
gizmo 17y ago
Maybe it's just me, but I consider this a (serious) security issue as well. The contents of temp files, which Firefox shouldn't even have access to, will now float around in the process memory of Firefox, even after the memory has been deallocated. Firefox should never, ever, ever, open any file outside its own app directory, user preferences directory, or cache directory. And a reasonably secure OS shouldn't even allow Firefox to open any of those files.
- teilo 17y ago
  Not necessarily. If this is a typical seeding algorithm, at most there would be one block of data in memory, used for hashing. And one would also think they are smart enough to zero it out before deallocating it. It IS a security library, after all.
- __david__ 17y ago
  If the files are really that important shouldn't they have good permissions set? That is, if "Firefox shouldn't even have access to" them, shouldn't that be enforced by some OS level permissions? And shouldn't any other programs one has around not be writing confidential information to temp files in the first place? Seems like more of a dumb bug to me than a security problem.
blasdel 17y ago
It gets worse security-wise -- their recommended fix is to delete all your caches, removing the entropy seed from their RNG: https://support.mozilla.com/tiki-view_forum_thread.php?comments_parentId=381674&forumId=1 https://support.mozilla.com/tiki-view_forum_thread.php?comme... And if clearing the caches doesn't affect entropy quality, it's even stupider -- why bother to read them in the first place?
billzeller 17y ago
If you want to see the code that does this: EnumSystemFiles: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/win_rand.c#182 http://mxr.mozilla.org/mozilla-central/source/security/nss/l... ...called by rng_systemJitter: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/win_rand.c#359 http://mxr.mozilla.org/mozilla-central/source/security/nss/l... ...called by rng_systemFromNoise: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/sysrand.c#74 http://mxr.mozilla.org/mozilla-central/source/security/nss/l... ...called by RNG_SystemRNG: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/win_rand.c#509 http://mxr.mozilla.org/mozilla-central/source/security/nss/l... ...called by (among others) rng_init: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/drbg.c#379 http://mxr.mozilla.org/mozilla-central/source/security/nss/l...
- andrewf 17y ago
  My best guess.. RNG_SystemRNG first tries to use a deprecated API (http://msdn.microsoft.com/en-us/library/aa387694(VS.85).aspx http://msdn.microsoft.com/en-us/library/aa387694(VS.85).aspx), then CryptoAPI, then this temp file entropy gathering approach. But if the deprecated API is _broken_, rather than absent from the DLL, then it will fall back to scanning temp files without ever trying CryptoAPI.
fno 17y ago
I wish the Firefox developers would focus on bug fixing for the next big release. There are so many bugs that are not fixed for many years. For example alt-text on images not correctly shown or disable-output-encoding on XML/XSLT being ignored. Instead that add more and more features. The awesome bar already made me switch to Opera, I miss some extensions though so I do keep an eye if Firefox gets "better" for me.
- robin_reala 17y ago
  alt-text on images not correctly shown What is correctly shown? It shouldn’t be shown as a tooltip as that leads people to write alt text that’s specifically useful as a tooltip and useless to the real consumers of alt text: screen reader users and search engines.
  - fno 17y ago
    It was something like no alt text being rendered when images are not displayed or found, I don't fully remember and could not find it in 5 minutes Bugzilla search hell. I did stumble on the still-open bug some days ago though, I think it was 8 years old now.
    - InnocentB 17y ago
      Is this what you were talking about? https://bugzilla.mozilla.org/show_bug.cgi?id=45375 https://bugzilla.mozilla.org/show_bug.cgi?id=45375 - TITLE text is truncated. Resolved in 3.0, but was outstanding for many years. The bug comments are worth reading (some of them are from the XKCD and Dinosaur Comics guys, whose sites this bug impacted fairly heavily). It doesn't make their dev community look like a place I'd want to be.
- aceofspades19 17y ago
  Whats so bad about the awesome bar?
  - FooBarWidget 17y ago
weegee 17y ago
I find Safari 3 to run very well on Windows, and I've been using it at home lately. It passes the Acid3 test at 100 percent.
rdoherty 17y ago
FYI Mozilla does have an open blocker bug about this problem: https://bugzilla.mozilla.org/show_bug.cgi?id=501605 https://bugzilla.mozilla.org/show_bug.cgi?id=501605
schizoidboy 17y ago
The "thread dump" feature should be an absolute requirement for any language runtime environment. Java has perfected this with the SIGQUIT signal. Thread dumps give you readable stacks of all threads with a simple user command (kill -3 on Linux/Unix, although a bit more difficult on Windows), without having to install symbol files, install additional software, run "scary" commands (for end users), etc. This is a textbook example of taking a few thread dumps, a few minutes apart, immediately showing what is going on. IBM has one of these as their Performance or Hang "MustGather" script: http://www-01.ibm.com/support/docview.wss?uid=swg21115785&aid=4 http://www-01.ibm.com/support/docview.wss?uid=swg21115785&#3... .NET thread dumps suck -- you have to use adplus to attach and they're not easy to read. Native programs (e.g. C/C++) work better with symbols and are just too scary for end users. DTrace on Solaris with Ruby/Python/PHP extensions is nice, but too cumbersome to install, and again too scary for end users. I'm not aware of built-in thread dumps-by-signal in other non-Java languages (please note in a comment if there is), but this feature is so basic and needs to be baked in to every runtime environment and easy enough for end users to use. Firefox, being a native program, is in a bad problem determination position here and the haphazard nature of the problem determination process in the forum and bug report shows that. I suggest Firefox create something like IBM's MustGather scripts (starting with a performance one such as IBM's hang MustGather -- http://www-01.ibm.com/support/docview.wss?uid=swg21115785 http://www-01.ibm.com/support/docview.wss?uid=swg21115785 [click "Show Details" for the steps]). A hang MustGather should go through the process of installing symbol files, getting the thread stacks, submitting the information, etc. This will allow users to at least feel like they can do something valuable to help the developers fix the problem.

145 points by felixmar 17y ago

I used Procmon to monitor Firefox at startup and it indeed traverses my entire temp folder and Internet Explorer's cache folder.

tptacek 17y ago

Although the interminable feeling the author had while waiting for Firefox 3.5 to start up mirrored my own feeling of waiting for him to get to the f'ing point, he's absolutely right: Firefox should just be using the system's secure random number generator on each platform. If you have a vulnerability in /dev/random or CryptGenRandom(), you have a massively more important finding than Firefox crypto.

maukdaddy 17y ago
Apparently the 10,000 eyes of open source missed this huge mistake =( This is exactly the kind of thing I wouldn't except to see in open source software.
- jerf 17y ago
  This is the 10,000 eyes of open source catching the mistake. It happens in public because there is very little "private". Working As Designed. How often do you see a forensic analysis of this type on commercial software? Not zero, but less often.
  - tptacek 17y ago
    I'm gonna go with, "every time Microsoft releases a security patch of any severity in any product whatsoever".
    - jerf 17y ago
      Hey, absolutely. I'm just saying that it's much harder and thus much more rare. (I have to admit it's sort of more impressive when someone whips out a debugger rather than reading through source.)
  - CWuestefeld 17y ago
    Well, catching it after a long beta and then three rounds of release candidates. Indeed, it was apparently caught by an end user, and not those 10K eyes of developers at all.
    - FooBarWidget 17y ago
      I'm not sure what you're expecting or what you're disappointed about. It's not like closed source commercial software have any better track records.
      - jeffesp 17y ago
        If we only measure ourselves (and our work) by the next best person, then only thing we can become is slightly better than them.
    - rbanffy 17y ago
      And that's the beauty of FLOSS. An end-user caught a problem that will, hopefully, be corrected in a couple days. Were it a problem within IE (or Oracle applications - let's be fair as this is not a Microsoft-only problem) we would have to wait until a developer reads the report, the bug being assigned and the correction being put in a future bug-fix release. In a way, a guy from Microsoft just made a huge point on how open-source is far superior to their own closed development cycle.
codyrobbins 17y ago
This is exactly the reason, as a general rule of thumb, why I don't like end-user software packages that are designed to be cross-platform. While I find Firefox 3.5 on OS X to be way faster than Firefox 3.0, it still doesn't hold a candle to Safari. It may as well be written in Java. For something as fundamental as a web browser, which I'm using all day long, it can't take 30 seconds to open a new window, freeze up and start thrashing halfway through rendering a page, or crash twice a day. (All of which Firefox 3.0 did, and which made me decide to move to Safari.) On top of the performance, the fact that Firefox uses a fake skinned XUL look-alike interface on each platform is the straw that breaks the camel's back, at least for me. Port the renderer cross-platform, and write separate native apps for each target platform. The amount of complication and cruft that must be in the codebase for making a massively complex software package like Firefox work cross-platform, and the amount of basic OS-level functionality that must have to be reimplemented from scratch because it isn't available on some particular target platform, is probably no small contributor to its performance woes.
- lamnk 17y ago
  Of course Safari loads faster than Firefox on OS X, as IE loads faster in Windows. Their libraries are preloaded by OS ... Native apps for each platform may give performance boost, but maintaining a consistent UI will be a lot harder
  - blasdel 17y ago
    That's the point: we don't want consistent UI If we want native UI, it's obviously going to have major inconsistencies between platforms!
    - __david__ 17y ago
      Well that's not 100% true because the main interface for Firefox on Mac OS X looks more like Safari than it does Firefox on Linux. I think they've actually done a really good job making it look like a native app instead of just a port from some other OS.
gms 17y ago
Some background: on Unix, Firefox obtains seed entropy from /dev/urandom, while on Windows it calls RtlGenRandom() for some reason instead of CryptGenRandom(). This seeding material is then fed to the random number generator, a NIST SP800-90 Hash_DRBG. However they do obtain additional (optional) entropy (if you're familiar with the NIST DRBG's, then I'm talking about the 'Additional Input' parameter) by reading system time while periodically reading a bunch of system dirs to advance time in a non-deterministic manner. And that's where this bug creeps up.
- itgoon 17y ago
  > it calls RtlGenRandom() for some reason instead of CryptGenRandom() It is calling a kernel interface. The prefix "Rtl" means that it is in the kernel run time library. Reference: http://blogs.msdn.com/wdkdocs/archive/2008/12/19/windows-kernel-routine-naming-conventions.aspx http://blogs.msdn.com/wdkdocs/archive/2008/12/19/windows-ker...
  - gms 17y ago
    Aha, cheers for the explanation.

skip 17y ago

And this is precisely why the most recent Firefox install I have is from the 2.x series. It used to be that Firefox (then Firebird) was the lean and mean cousin of bloated Netscape. Alas, age has taken it's toll and the amount of built in crud in Firefox that has nothing to do with downloading had display HTML documents is overwhelming...

ScottWhigham 17y ago
Hmmm - looking back, I'm not sure why I'm on 3.0x. Were there new features? JSON backups - whoopee! Other than that, from a user's perspective, I'm not sure there is anything better. 2.x was fine by me too.
- stepherm 17y ago
  The "awesome bar" (updated address bar) was added in 3.0 I believe.
- thaumaturgy 17y ago
  2.x has at least one rendering bug that was fixed in 3.x -- whatever rendering bug it was that I discovered the other day but can't now recall.
- mr_justin 17y ago
  Because the JavaScript engine in 3.0 is lightning fast compared to the 2.x engine and the 3.5 is ummm, faster than lightning. By a heck of a lot. For me personally, the only reason I downgraded back to 3.0 from 3.5 is because Firebug 1.4 is bloody awful at the moment (in beta). Other than that, Firefox 3.5 is great.
- pbhj 17y ago
  I quite like the awesome bar now (was that in 2.0?); some CSS3 support too. Bookmarking tagging, update checking are good as well. Improved SVG support I use occassionally for viewing. Other than that I suppose faster javascript and optimisations through use of sqlite for history/bookmarks is good. Probably a few other things if I thought about it. Main features are in add-ons for me, firebug, yslow, noscript, adblock, seoquake,download toolbar, greasemonkey. I keep a separate clean profile, without all the footer-bar ("clutter bar") icons for the wife to use whilst surfing

owyn 17y ago

To summarize for those who have less spare time than I: Some firefox developer had a Very Bad (tm) idea to seed a random number generator by scanning the Windows Temp folders, which is now causing a 30 secs to over a minute pause in start up for a lot of users (particularly those that use IE, which creates a LOT of temp files). Yikes.

OperaLover 17y ago
At least the good news about the Bad Idea(tm) is that this should be a very small fix for 3.5.x.1 - as opposed to some competing browsers invested development that ignored/contradicted standards, requiring complete re-do's.
michaelneale 17y ago
Wow - thanks for the summary. Certainly didn't need wads of text to say that. Its one of those things "seemed like a good idea at the time, worked well, I feel clever" and then you move on. Then it bites you (or one of your users).
pj 17y ago
my question is: If you have NO files in any of your temp folders, do you always get the same random number? Doesn't seem very random to me.

jrockway 17y ago

One bug is a "fiasco"? How about the 15 years the web has been set back by supporting broken browsers like IE6? Oh, well at least it starts up quickly... The real issue here is how hard it is to be a consumer of open source software on Windows. On Debian, if I wanted to fix this, I would just "apt-get source" the relevant package, make the change, and have Debian build me a new package with the fix. On Windows, this is apparently not possible, as there is no package management system to install the compiler and source code for you, and the apps check themselves to make sure that you don't modify them. (I also like how the virus / spyware situation is so out of hand on Windows that you can't even recompile libraries without your own computer assuming you are hacking yourself. Nice.) Why do people still use Windows?

phatboyslim 17y ago
My grandma hacks debian and changes source code all the time. I don't get why people use Windows either.
- jrockway 17y ago
  This guy is not your grandma. His blog claims he is a "most valuable professional", so executing a Makefile should not be too difficult for him. I have different expectations for professional programmers than I have for 80-year-old non-programmers.
  - ttrashh 17y ago
    This guy happens to be a damn good software engineer. He shouldn't have to recompile Firefox to use it. His choice in typography and blog design sucks ass though.
    - dsteinweg 17y ago
      > This guy happens to be a damn good software engineer. I'd have to agree with that point. I think he pretty much single-handedly wrote LLBLGen Pro, an ORM solution for C# or VB.NET. My company uses it and I personally think it's really quite nice.

jcsalterego 17y ago

line-height: 0.1em ftl (gross exaggeration)

ironkeith 17y ago
As soon as I see eye filth like that I go right to my readability bookmarklet: http://lab.arc90.com/experiments/readability/ http://lab.arc90.com/experiments/readability/ 80% of the time, it works every time.
- Encosia 17y ago
  Thank you.
- hesdeadjim 17y ago
  Oh you rock, this is awesome. As soon as I opened the link for this news item I closed it immediately due to the complete lack of readability. Someone buy the man a book on typography, please!
- zacharypinter 17y ago
  This comment was more valuable than the article. Thanks!
- rpdillon 17y ago
  You just made my day. Thank you, sir.
- rms 17y ago
  There's also always View -> Page Style ->No Style
  - troels 17y ago
    And Ctrl + (Repeat until satisfied)
    - rms 17y ago

voidpointer 17y ago

Well yes, it's a bug but it's hardly a fiasco. Something like this should be caught in pre-release testing. Still, most users have their browsers running all the time anyway so a slow startup is not really that critical. I've seen far more serious bugs being taken far more lightly.

dave_au 17y ago
I'd more alarmed by the fact that they've thrown something new into the mix security-wise than the effect on startup time. If the system pseudo-random number generator has no problem, what's the use case for not using it? And if it does have a problem I'm sure they would have told someone :) I just don't know why you add another moving part to the security system if you could avoid it, especially since it seems like a reasonably safe bet that people have had more eyes move over / experience with the alternative.
- voidpointer 17y ago
  Yeah, it's a stupid bug. Most bugs are once you find them. I also agree that this got into the security layer is probably the most worrisome part of the whole story. Maye this could build a case for mandatory code reviews for security related modifications.

gizmo 17y ago

Maybe it's just me, but I consider this a (serious) security issue as well. The contents of temp files, which Firefox shouldn't even have access to, will now float around in the process memory of Firefox, even after the memory has been deallocated. Firefox should never, ever, ever, open any file outside its own app directory, user preferences directory, or cache directory. And a reasonably secure OS shouldn't even allow Firefox to open any of those files.

teilo 17y ago
Not necessarily. If this is a typical seeding algorithm, at most there would be one block of data in memory, used for hashing. And one would also think they are smart enough to zero it out before deallocating it. It IS a security library, after all.
__david__ 17y ago
If the files are really that important shouldn't they have good permissions set? That is, if "Firefox shouldn't even have access to" them, shouldn't that be enforced by some OS level permissions? And shouldn't any other programs one has around not be writing confidential information to temp files in the first place? Seems like more of a dumb bug to me than a security problem.

blasdel 17y ago

It gets worse security-wise -- their recommended fix is to delete all your caches, removing the entropy seed from their RNG: https://support.mozilla.com/tiki-view_forum_thread.php?comments_parentId=381674&forumId=1 https://support.mozilla.com/tiki-view_forum_thread.php?comme... And if clearing the caches doesn't affect entropy quality, it's even stupider -- why bother to read them in the first place?

billzeller 17y ago

If you want to see the code that does this: EnumSystemFiles: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/win_rand.c#182 http://mxr.mozilla.org/mozilla-central/source/security/nss/l... ...called by rng_systemJitter: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/win_rand.c#359 http://mxr.mozilla.org/mozilla-central/source/security/nss/l... ...called by rng_systemFromNoise: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/sysrand.c#74 http://mxr.mozilla.org/mozilla-central/source/security/nss/l... ...called by RNG_SystemRNG: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/win_rand.c#509 http://mxr.mozilla.org/mozilla-central/source/security/nss/l... ...called by (among others) rng_init: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/freebl/drbg.c#379 http://mxr.mozilla.org/mozilla-central/source/security/nss/l...

andrewf 17y ago
My best guess.. RNG_SystemRNG first tries to use a deprecated API (http://msdn.microsoft.com/en-us/library/aa387694(VS.85).aspx http://msdn.microsoft.com/en-us/library/aa387694(VS.85).aspx), then CryptoAPI, then this temp file entropy gathering approach. But if the deprecated API is _broken_, rather than absent from the DLL, then it will fall back to scanning temp files without ever trying CryptoAPI.

fno 17y ago

I wish the Firefox developers would focus on bug fixing for the next big release. There are so many bugs that are not fixed for many years. For example alt-text on images not correctly shown or disable-output-encoding on XML/XSLT being ignored. Instead that add more and more features. The awesome bar already made me switch to Opera, I miss some extensions though so I do keep an eye if Firefox gets "better" for me.

robin_reala 17y ago
alt-text on images not correctly shown What is correctly shown? It shouldn’t be shown as a tooltip as that leads people to write alt text that’s specifically useful as a tooltip and useless to the real consumers of alt text: screen reader users and search engines.
- fno 17y ago
  It was something like no alt text being rendered when images are not displayed or found, I don't fully remember and could not find it in 5 minutes Bugzilla search hell. I did stumble on the still-open bug some days ago though, I think it was 8 years old now.
  - InnocentB 17y ago
    Is this what you were talking about? https://bugzilla.mozilla.org/show_bug.cgi?id=45375 https://bugzilla.mozilla.org/show_bug.cgi?id=45375 - TITLE text is truncated. Resolved in 3.0, but was outstanding for many years. The bug comments are worth reading (some of them are from the XKCD and Dinosaur Comics guys, whose sites this bug impacted fairly heavily). It doesn't make their dev community look like a place I'd want to be.
aceofspades19 17y ago
Whats so bad about the awesome bar?
- FooBarWidget 17y ago

weegee 17y ago

I find Safari 3 to run very well on Windows, and I've been using it at home lately. It passes the Acid3 test at 100 percent.

rdoherty 17y ago

FYI Mozilla does have an open blocker bug about this problem: https://bugzilla.mozilla.org/show_bug.cgi?id=501605 https://bugzilla.mozilla.org/show_bug.cgi?id=501605

schizoidboy 17y ago

The "thread dump" feature should be an absolute requirement for any language runtime environment. Java has perfected this with the SIGQUIT signal. Thread dumps give you readable stacks of all threads with a simple user command (kill -3 on Linux/Unix, although a bit more difficult on Windows), without having to install symbol files, install additional software, run "scary" commands (for end users), etc. This is a textbook example of taking a few thread dumps, a few minutes apart, immediately showing what is going on. IBM has one of these as their Performance or Hang "MustGather" script: http://www-01.ibm.com/support/docview.wss?uid=swg21115785&aid=4 http://www-01.ibm.com/support/docview.wss?uid=swg21115785&#3... .NET thread dumps suck -- you have to use adplus to attach and they're not easy to read. Native programs (e.g. C/C++) work better with symbols and are just too scary for end users. DTrace on Solaris with Ruby/Python/PHP extensions is nice, but too cumbersome to install, and again too scary for end users. I'm not aware of built-in thread dumps-by-signal in other non-Java languages (please note in a comment if there is), but this feature is so basic and needs to be baked in to every runtime environment and easy enough for end users to use. Firefox, being a native program, is in a bad problem determination position here and the haphazard nature of the problem determination process in the forum and bug report shows that. I suggest Firefox create something like IBM's MustGather scripts (starting with a performance one such as IBM's hang MustGather -- http://www-01.ibm.com/support/docview.wss?uid=swg21115785 http://www-01.ibm.com/support/docview.wss?uid=swg21115785 [click "Show Details" for the steps]). A hang MustGather should go through the process of installing symbol files, getting the thread stacks, submitting the information, etc. This will allow users to at least feel like they can do something valuable to help the developers fix the problem.