Akon writes, "eWeek is running a follow-up story on the claim by two hackers that Firefox's implementation of JavaScript is critically flawed and could result in code-execution attacks. Turns out this is a possible hoax that was overblown for laughs." Mozilla's engineers say the risk is limited to a denial-of-service issue. From the article: "'As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has... I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code,' Spiegelmock said." Spiegelmock also stated that the claim that there were 30 other undisclosed exploits was made solely by his co-presenter, Andrew Wbeelsoi.
The first time that I actually started to worry that FF might have a problem, and that I should be careful, it turns out to be a hoax. I don't know whether to be happy about this or not?
Fix the copy and paste? In both Windows and Linux it works fine for me.
I'm scratching my head too. Just to test things out I just copied and pasted from web page to location bar, web page to editor, web page to konsole session using either the mouse or keyboard shortcuts. Everything worked as expected, including shift-insert.
I've encountered this bug a number of times under Firefox for Windows. Copying/pasting text from the address bar and/or webpages will work fine for hours, and then out of nowhere it will just stop working until I quit then restart Firefox. I run into this probably once every few weeks. However, I've never been able to find any rhyme or reason behind it. All I can say is that it does happen.
by Anonymous Coward
on Tuesday October 03 2006, @01:16PM (#16294889)
It was painfully obvious to anyone at the presentation that the whole thing was a joke. It was the best presentation I saw at Toorcon just for the hilarity factor. If they were talking at any other convention I'd go see them again.
Most of the press got the joke, laughed, and ignored it. It was some tool at CNET's fault for compromising his journalistic integrity and reporting satire as fact that caused the problem.
If the CNET folks didn't get it, the panel should've made sure they did.
Any prank like this NOT done on 1 April needs to end with "and for those of you who left your sense of humor at home, the preceeding presentation was 100% pure entertainment and any resemblance to reality was purely to tweak your nose. Please stay for the next panel on novel approaches to perpetual motion. Thank you."
I think that these two were looking for a little fame... and did not realize how the professionals would react to their claims.
Once they realized that the professionals (who are better programmers than they) were looking into their claims, they fell back on the "it's a joke" claim.
That's an interesting theory. They're either guilty of being fame-hungry alarmists, or creepy, untalented kids with a bad sense of humor. Either way, they need a cardboard tube beating.
The way this went down reminds me of an event from high school. Now, to put this in perspective, it was probably 1993, so about 5 years before Columbine.
There was a drama festival that our school attended each year, held at a nearby college. One year, one of our scenes involved prop guns. One of my classmates took one of the fake guns up onto a balcony, stood on the railing, and pretended he was going to shoot himself. Big surprise, campus security showed up, assuming he had a real gun and was really going to blow his brains out. The next year, the festival banned prop weapons. IIRC if you had a scene that needed them, you could sign up to use *their* props, which would be provided for the particular scene.
Had he done the same thing on stage, introduced as a monologue he had written, with people aware the gun was a prop, no one would have freaked out.
Back to the Firefox panel, I don't know how clearly this presentation was labeled as humor. But all it takes is someone who doesn't have the full context to take it seriously -- and security people have to take threats seriously, at least long enough to investigate and find out that the gun is just a prop.
And, this should noted, this should NOT be limited to security exploits and hoaxes. It's twice as true for news that really matter. Too many people want to believe what they hear as long as it fits their personal point of view, without even questioning whether something is true or not.
As long as it fits into their view of the world, it becomes true for them and they perpetuate the lie.
I disagree. Now you still have to find a 3rd source to agree with you and 3 sources to discredit me. And of course I just got off work so I have all day long to disagree with those who disagree with me in the first place. Better put on a cup of coffee.:-)
I disagree. Now you still have to find a 3rd source to agree with you and 3 sources to discredit me. And of course I just got off work so I have all day long to disagree with those who disagree with me in the first place. Better put on a cup of coffee.:-)
Actually, I think you owe us two more sources to confirm your disagreement. Well, I would think that, but we haven't found three sources to conclusively prove that three sources are needed to conclusively prove something.
This is to be taken with a grain of salt and not as a proof of anything until further inquiries, but since it's going to be posted anyway it may as well be posted with some warnings:
I think the most interesting part from the Post piece on this is this last line, about LiveJournal's Mischa Spiegelmock, who co-presented this Firefox malarky.
"The Toorcon talk was given by Mischa Spiegelmock a software engineer for Six Apart's LiveJournal blogging service, and a guy speaking under the pseudonym "Andrew Wbeelsoi."
Also, Wbeelsoi, or "Weev" as he is called by friends, is part of a group that calls itself "Bantown," a loose-knit outfit that claimed responsibility for a fairly high-profile [washingtonpost.com]
In other news, Microsoft has said thet their version of Genuine Internet Explorer has no bugs, and any bugs, must be due to a bad download, or user tampering. As such, all user installs of Internet Explorer will be renamed to "Meshed-Screen Interpolated E-reader" (MSIE for short), and will subsequently be subject to licensing fees.
It takes a very rare and specific skill set to write a memory corruption exploit. The fact that one person was unable to go from overflow to arbitrary code execution proves absolutely nothing about whether doing so is possible.
The fact that one person was unable to go from overflow to arbitrary code execution
of course big, complex programs (like a JavaScript VM) have errors, if you want
proof, you have to make a hoare calculus http://en.wikipedia.org/wiki/Hoare_logic [wikipedia.org] for the source code and beleive me, this is really really much work! - - - but this alleged error seems to be nothing but posing...
You mean Six Apart hasn't sacked Spiegelmock yet? What's Mena waiting for? Maybe she's having all the chairs in her office bolted down in case she has the sudden urge to impersonate Steve Ballmer during the exit interview. I know if I caught an employee pulling the shit Spiegelmock just did on my watch, I'd need the most sound-isolated conference room in the building.
If you want some fun, google Mischa Speigelmock and catch the returns - geesh! >Mischa Spiegelmock is a 19-year old boy in San Francisco, CA. is single. is tagged bbqs, dork, and frisbee. >Mischa Spiegelmock. Yo yo beezies this is m-spizzle straight outta... keep it real up being studious and shit at the university of muhfuh san francisco and... >Hi, my name is Mischa Spiegelmock. I'ma software engineer intern at LiveJournal. >Picture Gallery: The Great SF Pillow Fight. The Great San Francisco Pil
I'm with some of the folks here about secondary verification.
Something deep inside me gives a knee jerk any time a developer or product engineer starts any sentence with "I have not succeeded in making this code do..." or "I cannot reproduce..." (no pun intended).
I think Firefox is pretty good. So far (since the first public betas), I get very few issues at runtime (besides the occasional spin-forever cursor when Firefox encounters a site with some really bad browser-side code.)
Well seems like my notion was right after all.
They are nothing but sad wannabes, scriptkiddies who wanted to pose as l33t haX0rZ. Well, heads up guys, this will have been your last convention for quite some time because somehow quite unexpectedly (for you) most of the community didn't go "we really got punked!!! LOLOLOLOLOL! you win teh internets!" Bottom line. Don't be an asshole, or you will pay for it.
It actually turns out that Mischa Spiegelmock and Andrew Wbeelsoi are closely related. As we all now know, Misa works for LiveJournal. Andrew Wbeelsoi is part of Bantown, who claimed responsibility for a Javascript attack on LiveJournal (see http://blog.washingtonpost.com/securityfix/2006/01 /account_hijackings_force_livej.html [washingtonpost.com]).
The two are obviously related, and LiveJournal should consider immediate termination of their employee Mischa, as he is in league with Wbeelsoi, who attacked LiveJournal members themselves.
Here as some nice quotes from the article:
"We do have exploits for all the stuff we're going to show you," the 21-year-old calling himself Wbeelsoi said. "We'll give them away to anyone who proves their actions are going to be politically motivated. We don't care what side you're on as long as you commit yourself to destruction."
"We were just trying to have some fun up there," Spiegelmock said.
Mozilla should really consider civil, if not criminal actions. Damage to the Firefox brand has already been done, regardless if the exploit is real or not.
Mischa works for Six Apart _because_ Bantown "pwnzed" them two years back.
Six Apart didn't try to fight them, instead they tempted them with guided tours and positions in the company.
Utter idiocy.
Actually, there's more than enough supposition to imply that SixApart's software is contaminated with trojans. Face it, you have someone who wants to claim they have a flaw, and they want to make a secret communications network. The best way to do it is to use sites like LiveJournal and people who use software like
Anyone who releases it on their own is sued for copyright violations.
Actually not, it's trademark violation, and it's only if you release it under the name of "firefox". Call me the day when I can fork Internet Explorer and release my patched version as "Intarweb Implorer" without getting sued though.
You can use GMail just fine without JavaScript. It complains and writes you a message at the bottom of every page saying something like 'To take full advantage of Gmail, use a supported browser...'
You obviously don't use GMail, Google Calendar, and the like.
With NoScript one can designate sites that are allowed to run javascript, it's just that it is disabled by default. I use NoScript and have simply whitelisted google.com and any other trusted sites that require javascript.
To anyone who is "pro-IE", I always show them Firefox with AdBlock. That gets them every time.
IE can be used safely if it is patched and you don't have the habit of visiting random websites (most people visit only a handful of sites anyway), but FF+AdBlock simply trumps everything else. I know about Proxomitron and all the other solutions for IE, but they simply can't come close to AdBlock.
Paired with a few other must-have extensions like TabMix Plus and CustomizeGoogle, I will happily live with Firefox
You know, I just realized I sort of implied that you were "insulting" your friends or something - sorry. I'm sure that's not the case =)
It all comes down to using the right tools for the job. For a while now Firefox has been the right tool for browsing the web on Windows, in my opinion. Maybe that will change later when IE7 is released. Who knows.
>Maybe we could debunk the Firefox is a memory hog [mozillazine.org] hoax, too.
We could if it *were* a hoax. Since it's reported by decent folk all over the place, I don't think we can.
If the problem really is just extensions, then Mozilla *still* needs to do something about it. Don't list them on the official extensions list until they are fixed. As somebody in the thread you linked to mentioned, what's the point of using FF if you can't use extensions?
If it's not a hoax, it's fucking close to one. Sure, back in the 1.x days, problems ensued, but post-1.5 Firefox is freaking ridiculous with the amount of punishment it can take (and i sure do love dishing it out.)
The situation is: lots of people complain about FF memory usage to this day, including 1.5+, how the memory usage grows over time while the program is open and being used. FF developers say "no it doesn't!" or "it's the extensions' falut!"
My point is, even if it is the fault of extensions, at a minumum FF needs to respond by not listing these extensions on their official list on their website. For many, many users the whole point of using FF i
http://www.mozilla.org/projects/seamonkey/ [mozilla.org]Seamonke y is currently using 351 MB of memory, according to Windows Taskmanager. That's after 5 days of uptime, and no exception. I know, it's not Firefox, but I suppose there is a large code base shared.
The instance I'm running right now(with very few extensions installed, I might add) that has been running(idling mostly) for about 12 hours is already at 102meg and once I start using it again, it'll soon jump over 200 meg easily. If I restart it, it'll start around 40meg and then within 10 minutes(without me doing much more than visiting google) it'll be around 80meg again. I can repeat this time and time again without fail. Eventually it starts hogging enough that it requires another restart. I might get
All I can do is throw an anecdote at your anecdote, but the day before yesterday I had FF taking up 759MB of RAM after a day or so of idling, followed by an hour or so of actual use.
That's unusual, I'll grant you, but I regularly see FF using 150-200MB of RAM. It's gotten to the point now where I rarely bother checking; I just shut it down every day or two on general principle.
It leads to a piece of JavaScript - either an attempted proof of concept, or just an annoying fork bomb - I didn't bother to work out which, but either way, I recommend sticking with "Save As" or wget or what have you.
Great!! (Score:4, Funny)
Re:Great!! (Score:5, Funny)
Parent
Re: (Score:2)
Fix the copy and paste? In both Windows and Linux it works fine for me.
I'm scratching my head too. Just to test things out I just copied and pasted from web page to location bar, web page to editor, web page to konsole session using either the mouse or keyboard shortcuts. Everything worked as expected, including shift-insert.
Re: (Score:2)
Not surprised. (Score:2)
Re: (Score:3, Funny)
It's all fun and games until someone gets hurt (Score:2, Insightful)
Yelling "bomb" in an airport isn't funny. Neither is this.
Next time, make it painfully obvious you are joking so people don't waste valuable time.
Re:It's all fun and games until someone gets hurt (Score:5, Interesting)
Most of the press got the joke, laughed, and ignored it. It was some tool at CNET's fault for compromising his journalistic integrity and reporting satire as fact that caused the problem.
Parent
Then it wasn't painfully obvious enough (Score:5, Funny)
Any prank like this NOT done on 1 April needs to end with "and for those of you who left your sense of humor at home, the preceeding presentation was 100% pure entertainment and any resemblance to reality was purely to tweak your nose. Please stay for the next panel on novel approaches to perpetual motion. Thank you."
Parent
I don't think it was a "joke". (Score:4, Insightful)
Once they realized that the professionals (who are better programmers than they) were looking into their claims, they fell back on the "it's a joke" claim.
Parent
Re: (Score:2)
Re:It's all fun and games until someone gets hurt (Score:5, Insightful)
There was a drama festival that our school attended each year, held at a nearby college. One year, one of our scenes involved prop guns. One of my classmates took one of the fake guns up onto a balcony, stood on the railing, and pretended he was going to shoot himself. Big surprise, campus security showed up, assuming he had a real gun and was really going to blow his brains out. The next year, the festival banned prop weapons. IIRC if you had a scene that needed them, you could sign up to use *their* props, which would be provided for the particular scene.
Had he done the same thing on stage, introduced as a monologue he had written, with people aware the gun was a prop, no one would have freaked out.
Back to the Firefox panel, I don't know how clearly this presentation was labeled as humor. But all it takes is someone who doesn't have the full context to take it seriously -- and security people have to take threats seriously, at least long enough to investigate and find out that the gun is just a prop.
Parent
...crash and eat up system resources... (Score:5, Funny)
Never believe anything without a second source (Score:4, Insightful)
As long as it fits into their view of the world, it becomes true for them and they perpetuate the lie.
Re:Never believe anything without a second source (Score:5, Funny)
Anyone want to reiterate what he said so we can know that we should believe him?
Parent
Re:Never believe anything without a second source (Score:4, Funny)
Parent
Re: (Score:2)
Re:Never believe anything without a second source (Score:4, Funny)
Parent
Re: (Score:3, Insightful)
Does that include the article saying it was a hoax? What are we to believe?!?!?
Re: (Score:2)
Then again, seeing is believing. If someone produces a reproducable proof, that's good enough for me.
Microsoft link? (Score:5, Interesting)
This is to be taken with a grain of salt and not as a proof of anything until further inquiries, but since it's going to be posted anyway it may as well be posted with some warnings:
A blog called Geemondo [blogspot.com] also reports that Mischa Spiegelmock seemed to have had dinner with Microsoft guys. [2y.net]
(PS: mods, if you want this post to be seen without me karma whoring, just mod it funny)
Assholes! (Score:2)
Not a funny joke (Score:5, Informative)
If I was Alistapart, I would have gotten rid of this "clown" immediately.
Re: (Score:3, Interesting)
I think the most interesting part from the Post piece on this is this last line, about LiveJournal's Mischa Spiegelmock, who co-presented this Firefox malarky.
"The Toorcon talk was given by Mischa Spiegelmock a software engineer for Six Apart's LiveJournal blogging service, and a guy speaking under the pseudonym "Andrew Wbeelsoi."
Also, Wbeelsoi, or "Weev" as he is called by friends, is part of a group that calls itself "Bantown," a loose-knit outfit that claimed responsibility for a fairly high-profile [washingtonpost.com]
FTA: Meant "to be humorous" ?? (Score:2)
Moo (Score:5, Funny)
In other news, Microsoft has said thet their version of Genuine Internet Explorer has no bugs, and any bugs, must be due to a bad download, or user tampering. As such, all user installs of Internet Explorer will be renamed to "Meshed-Screen Interpolated E-reader" (MSIE for short), and will subsequently be subject to licensing fees.
FireFUD (Score:2)
he hasn't gotten it to do so? (Score:4, Insightful)
Re: (Score:3, Informative)
of course big, complex programs (like a JavaScript VM) have errors, if you want proof, you have to make a hoare calculus http://en.wikipedia.org/wiki/Hoare_logic [wikipedia.org] for the source code and beleive me, this is really really much work! - - - but this alleged error seems to be nothing but posing...
Not "a FORMER developer"?! (Score:2)
You mean Six Apart hasn't sacked Spiegelmock yet? What's Mena waiting for? Maybe she's having all the chairs in her office bolted down in case she has the sudden urge to impersonate Steve Ballmer during the exit interview. I know if I caught an employee pulling the shit Spiegelmock just did on my watch, I'd need the most sound-isolated conference room in the building.
Re: (Score:2)
>Mischa Spiegelmock is a 19-year old boy in San Francisco, CA. is single. is tagged bbqs, dork, and frisbee.
>Mischa Spiegelmock. Yo yo beezies this is m-spizzle straight outta
>Hi, my name is Mischa Spiegelmock. I'ma software engineer intern at LiveJournal.
>Picture Gallery: The Great SF Pillow Fight. The Great San Francisco Pil
Trust but verify (Score:3, Insightful)
Something deep inside me gives a knee jerk any time a developer or product engineer starts any sentence with "I have not succeeded in making this code do..." or "I cannot reproduce..." (no pun intended).
I think Firefox is pretty good. So far (since the first public betas), I get very few issues at runtime (besides the occasional spin-forever cursor when Firefox encounters a site with some really bad browser-side code.)
Translation: We, the wannabe script-kiddies... (Score:3, Insightful)
They are nothing but sad wannabes, scriptkiddies who wanted to pose as l33t haX0rZ. Well, heads up guys, this will have been your last convention for quite some time because somehow quite unexpectedly (for you) most of the community didn't go "we really got punked!!! LOLOLOLOLOL! you win teh internets!" Bottom line. Don't be an asshole, or you will pay for it.
He should be fired, prosecuted (Score:5, Insightful)
http://blog.washingtonpost.com/securityfix/2006/1
It actually turns out that Mischa Spiegelmock and Andrew Wbeelsoi are closely related. As we all now know, Misa works for LiveJournal. Andrew Wbeelsoi is part of Bantown, who claimed responsibility for a Javascript attack on LiveJournal (see http://blog.washingtonpost.com/securityfix/2006/0
The two are obviously related, and LiveJournal should consider immediate termination of their employee Mischa, as he is in league with Wbeelsoi, who attacked LiveJournal members themselves.
Here as some nice quotes from the article:
"We do have exploits for all the stuff we're going to show you," the 21-year-old calling himself Wbeelsoi said. "We'll give them away to anyone who proves their actions are going to be politically motivated. We don't care what side you're on as long as you commit yourself to destruction."
"We were just trying to have some fun up there," Spiegelmock said.
Mozilla should really consider civil, if not criminal actions. Damage to the Firefox brand has already been done, regardless if the exploit is real or not.
Re: (Score:3, Interesting)
Actually, there's more than enough supposition to imply that SixApart's software is contaminated with trojans. Face it, you have someone who wants to claim they have a flaw, and they want to make a secret communications network. The best way to do it is to use sites like LiveJournal and people who use software like
Re:Moo (Score:5, Interesting)
Actually not, it's trademark violation, and it's only if you release it under the name of "firefox". Call me the day when I can fork Internet Explorer and release my patched version as "Intarweb Implorer" without getting sued though.
Parent
Re:NoScript (Score:5, Funny)
But...
Web 2.0!
*splutter*
Parent
GMail and JavaScript (Score:3, Interesting)
You can use GMail just fine without JavaScript. It complains and writes you a message at the bottom of every page saying something like 'To take full advantage of Gmail, use a supported browser...'
It does however still work just fine without it.
Re: (Score:3, Informative)
Re: (Score:2)
IE can be used safely if it is patched and you don't have the habit of visiting random websites (most people visit only a handful of sites anyway), but FF+AdBlock simply trumps everything else. I know about Proxomitron and all the other solutions for IE, but they simply can't come close to AdBlock.
Paired with a few other must-have extensions like TabMix Plus and CustomizeGoogle, I will happily live with Firefox
Re: (Score:2)
It all comes down to using the right tools for the job. For a while now Firefox has been the right tool for browsing the web on Windows, in my opinion. Maybe that will change later when IE7 is released. Who knows.
Re: (Score:2)
We could if it *were* a hoax. Since it's reported by decent folk all over the place, I don't think we can.
If the problem really is just extensions, then Mozilla *still* needs to do something about it. Don't list them on the official extensions list until they are fixed. As somebody in the thread you linked to mentioned, what's the point of using FF if you can't use extensions?
Re: (Score:2)
Re: (Score:2)
The point of what?
The situation is: lots of people complain about FF memory usage to this day, including 1.5+, how the memory usage grows over time while the program is open and being used. FF developers say "no it doesn't!" or "it's the extensions' falut!"
My point is, even if it is the fault of extensions, at a minumum FF needs to respond by not listing these extensions on their official list on their website. For many, many users the whole point of using FF i
Re: (Score:2)
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
That's unusual, I'll grant you, but I regularly see FF using 150-200MB of RAM. It's gotten to the point now where I rarely bother checking; I just shut it down every day or two on general principle.
Re: (Score:3, Interesting)
[Slashdot requires you to wait between each successful posting of a comment to allow everyone a fair chance at posting a comment.
It's been 4 minutes since you last successfully posted a comment.]
Follow that link at your own risk (Score:3, Informative)