An anonymous reader writes: Vice reported at the end of March that the FBI and the U.S. Department of Justice are fighting tooth and nail to keep a Tor Browser exploit hidden from the public eye. Computer experts were quick to point out that this Tor Browser exploit, technically speaking, is a Firefox exploit, since Tor's browser is based on Firefox's ESR platform. Taking into account that Firefox follows open-source philosophy and reveals all security flaws reported, the effort which the FBI puts into restricting access to its exploit leads to only one conclusion, and that is that the FBI is hoarding a Firefox zero-day, currently unpatched in the browser's core -- something it hopes to use once again.

An anonymous reader writes: Mozilla seems to think a new future for Firefox [lies in Chrome]. While they claim that it is only about new ways of browser design, it is also an open secret that they are running into more and more problems lately with web compatibility. [Senior VP Mark Mayo caused a storm by revealing that the Firefox team is working on a next-generation browser that will run on the same technology as Google's Chrome browser. The project, named Tofino, will not use Firefox's core technology, Gecko, but will instead plumb for Electron, which is built on the technology behind Google's rival Chrome browser, called Chromium.] The benefit of Chromium/Electron would be that it is a solution they could pull much faster forward than their own Servo plans [Servo being Mozilla's Rust-based web engine]. What the real outcome of all this will be, only Mozilla knows so far. But inside Mozilla there is much resistance against such plans... Interesting times are ahead.

An anonymous reader writes: Security researchers claim that NoScript and other popular Firefox add-on extensions are exposing millions of end users to a new type of vulnerability which, if exploited, can allow an attacker to execute malicious code and steal sensitive data. The vulnerability resides in the way Firefox extensions interact with each other. From a report on SlashGear, "The problem is that these extensions do not run sandboxed and are able to actually access data or functions from other extensions that are also enabled. This could mean, for example, that a malware masquerading as an add-on can access the functionality of one add-on to get access to system files or the ability of another add-on to redirect users to a certain web page, usually a phishing scam page. In the eyes of Mozilla's automated security checks, the devious add-on is blameless as it does nothing out of the ordinary." Firefox's VP of Product acknowledged the existence of the aforementioned vulnerability. "Because risks such as this one exist, we are evolving both our core product and our extensions platform to build in greater security. The new set of browser extension APIs that make up WebExtensions, which are available in Firefox today, are inherently more secure than traditional add-ons, and are not vulnerable to the particular attack outlined in the presentation at Black Hat Asia. As part of our electrolysis initiative -- our project to introduce multi-process architecture to Firefox later this year -- we will start to sandbox Firefox extensions so that they cannot share code."

An anonymous reader quotes a report from VentureBeat: On top of the slew of news coming out of Microsoft's Build 2016 developer conference, a story broke yesterday that Microsoft was building an ad blocker into its Microsoft Edge browser. While this would be a big deal, it apparently isn't true. "We have no plans to build a native ad blocker into Microsoft Edge," a Microsoft spokesperson told VentureBeat. Microsoft was originally referencing the extension support it is building into Edge, which would allow ad blocking to work exactly like any other desktop browser. For those hoping for an Edge browser with built-in ad blocking, well, you're stuck with 'niche browsers' like Brave from Mozilla cofounder Brendan Eich and Adblock Browser.

Reader itwbennett writes: A Trojan program, dubbed USB Thief by researchers at security firm ESET, infects USB drives that contain portable installations of popular applications such as Firefox, NotePad++, or TrueCrypt, and it also seems to be designed to steal information from so-called air-gapped computers. "In the case we analyzed, it was configured to steal all data files such as images or documents, the whole windows registry tree (HKCU), file lists from all of the drives, and information gathered using an imported open-source application called 'WinAudit'," the ESET researchers said. The stolen data was saved back to the USB drive and was encrypted using elliptic curve cryptography. Once the USB drive was removed, there was no evidence left on the computer, the ESET researchers added.

itwbennett writes: The Tor Project, which provides more anonymous browsing across the Internet using a customized Firefox Web browser. is fortifying its software so that it can quickly detect if its network is tampered with. To address worries that Tor could either be technically subverted or subject to court orders, Tor developers are now designing the system in such a way that many people can verify if code has been changed and 'eliminate single points of failure,' wrote Mike Perry, lead developer of the Tor Browser, on Monday. 'Even if a government or a criminal obtains our cryptographic keys, our distributed network and its users would be able to detect this fact and report it to us as a security issue,' said Perry.

prisoninmate writes: What's ubuntuBSD? Well, it's not that hard to figure out yourself, but just in case you're not sure, we can tell you that ubuntuBSD promises to bring the power of the FreeBSD kernel to Ubuntu Linux. The best part of using the FreeBSD kernel is that you'll end up using the famous Z File System, or ZFS. Xfce is also included along with the popular Firefox, LibreOffice, and Ubuntu Software Center apps. ubuntuBSD is inspired by the Debian GNU/kFreeBSD project, it is hosted on SourceForge, and has been created by Jon Boden.

An anonymous reader writes: The developers of the Palo Moon browser are thinking of scratching their current codebase due to the fact that it doesn't support many of today's current Web standards, and because future Firefox plans will introduce incompatibilities within its codebase. The team plans to build a new browser from scratch, which they'll use to replace Pale Moon when it reaches a stable version. As with the old Pale Moon, the browser will keep Firefox's pre-Australis interface and still support many features removed in Firefox, like Tab Groups and full themes.

An anonymous reader writes: The growing trend of closed content silos -- publishing platforms that require a login in order to view the content is a step away from a more open web. Back in December of last year, Facebook launched its own in-app browser, which is basically a web-view that loads links you tap on using the Facebook app. Although in-app browsers may be convenient for some, such features are primarily designed to keep users inside of the application for a longer duration, which translates to more advertising exposure (and, thus, more money). This kind of feature can be challenging to the goal of keeping the web open, not only because the feature overrides the end user's default mobile browser, but also because it keeps users in a closed ecosystem (versus exploring the web). Additionally, the Instant Articles feature doubles down on siloed content by working with publishers to make articles available nearly instantly within the app, loading much faster than they would through a mobile browser. This sounds good, and it is convenient. But it also sets up a path for monetizing content that would otherwise be viewable outside of the closed silo, and, because you're using the app to browse the web inside this silo, there are privacy concerns. Unlike using a browser such as Firefox or Chrome, which has a private browsing option, a user of Facebook's in-app browser does not have the same privacy control. It's no secret that Facebook has been trying to create what appears to be a closed version of the internet. The social juggernaut's Free Basics initiative, for instance, offers users with free access to select websites. Facebook gets to be the gatekeeper of the platform. This is something that didn't sit well with some privacy advocates in India, who played an instrumental role in banning Facebook's initiative in the country. Facebook is not just a social networking website where people go to talk with their friends and family, Facebook has become a mammoth platform that offers the ability to upload videos (mimic YouTube), and send money to your friends (mimic PayPal) among other things. It is almost scary to see the rate at which Facebook is expanding and trying to absorb everything that comes in its way.

An anonymous reader writes: Four major web browsers have announced support for the near-native compiling technology WebAssembly, and collaborated to bring an initial common game demo of Angry Bots, running via Unity and WebAssembly, to experimental builds of Chrome, Firefox, Microsoft Edge and, shortly, Safari. WebAssembly was launched last year in a joint project between Microsoft, Mozilla, Apple and Google as a potentially more efficient route to assembly-level performance than asm.js, which is in itself a low-level subset of JavaScript.

An anonymous reader writes: Mozilla has announced it is releasing the first alpha versions of its Servo browser this upcoming June. The project uses browser.html for the browser's UI and Rust for the browser's core. There's a similarity between how Microsoft launched Spartan (Edge) and how Mozilla is launching Servo now. While many might think Mozilla is sneakily working on a Firefox replacement, Mozilla has also invested quite a lot in Firefox these days, like WebExtensions and e10s, and it may be more plausible that Servo might slowly be integrated in Firefox to replace Gecko, rather than replace Firefox altogether, like Microsoft did with Edge to IE.

An anonymous reader writes: Firefox 45, set to be released today, will remove the Tab Groups feature, a feature that many people used, but Mozilla decided to ask due to buggy code. The good news is that a developer created a perfect replacement for this feature as an add-on. Users that use Tab Groups on a daily basis are urged to install the add-on before upgrading to Firefox 45. The add-on will take over from the browser's Tab Groups feature without any complex configuration. Users that update to Firefox 45 will have their tab groups moved to their Bookmarks as folders, which may be difficult to move back into the Tab Groups add-on later on, especially if some people have hundreds of URLs.

mikejuk writes: Mozilla has been clarifying some of its plans to convert the Firefox OS project into four IoT based projects. At a casual glance, this seems like a naive move that is doomed to failure. Project Link is a 'user agent' for the smart home, that helps the end user set preferences for device interaction, and automates those connections for the user in a secure environment. Next, Project Sensor Web will be a pilot project for crowdsourcing a pm2.5 sensor network. Project Smart Home is focused on bridging the gap in IoT smart home providers between completely boxed solutions like Apple HomeKit, and completely DIY solutions like Raspberry Pi. Finally, Project Vaani is a voice interface for IoT access, which Mozilla credits as the 'most natural way to interact with connected devices.' With Firefox losing market share and projects like Firefox OS, Thunderbird, Shumway, and Persona closing down, perhaps Mozilla should try and find its way back to core concerns. All four of the projects need significant AI expertise and a powerful cloud computing resource neither of which Mozilla is likely to be able to afford.

An anonymous reader writes: Mozilla has banned the popular (250,000+ installs) YouTube Unblock add-on that allowed users to view YouTube clips blocked in their country. The reason for this move is because the add-on was caught disabling a Firefox security setting (code signing) which the allowed it to silent-install another add-on, which Avast (antivirus software) was detecting as malware. Earlier in 2015, the same plugin was again caught cheating when it was using an self-contained update system that was bypassing Mozilla's add-on review process.

WheatGrass writes to note that the company T-Platforms has introduced the first mass production unit based upon the Russian Baikal-T1 processor, mentioned here last in 2014. The new Baikal-based workstation is called the "Meadowsweet terminal," according to T-Platform's official website; the feature list says it's running a Debian-based Linux distro. "Congratulations, Russia," Says WheatGrass. (According to Google's translation of this Russian-language story at RG.RU Digital, "[Y]ou can install many conventional applications, such as the LibreOffice office suite, Firefox web browser, and so on, the developers say," but the main use seems to be as a thin client.)

An anonymous reader writes: If an application can embed fonts with special characters, then it's probably using the Graphite font processing library. This library has several security issues which an attacker can leverage to take control of your OS via remote code execution scenarios. The simple attack would be to deliver a malicious font via a Web page's CSS. The malformed font loads in Firefox, triggers the RCE exploit, and voila, your PC has a hole inside through which malware can creep in.

darthcamaro writes: For the last decade, the Pwn2own hacking competition has pitted the world's best hackers against web browsers to try and find zero-day vulnerabilities in a live event. The contest, which is sponsored by HPE and TrendMicro this year, is offering over half a million dollars in prize money, but for the first time, not a penny of that will directed to Mozilla Firefox. While Microsoft Edge, Google Chrome and Apple Safari are targets, Firefox isn't because it's apparently too easy and not keeping up with modern security: "'We wanted to focus on the browsers that have made serious security improvements in the last year,' Brian Gorenc, manager of Vulnerability Research at HPE said."

An anonymous reader writes: There's a German security researcher that is arduously testing the installers of tens of software products to see which of them are vulnerable to basic DLL hijacking. Surprisingly, many companies are ignoring his reports. Until now, only Oracle seems to have addressed this problem in Java and VirtualBox. Here's a short (probably incomplete) list of applications that he found vulnerable to this attack: Firefox, Google Chrome, Adobe Reader, 7Zip, WinRAR, OpenOffice, VLC Media Player, Nmap, Python, TrueCrypt, and Apple iTunes. Mr. Kanthak also seems to have paid special attention to antivirus software installers. Here are some of the security products he discovered vulnerable to DLL hijacking: ZoneAlarm, Emsisoft Anti-Malware, Trend Micro, ESET NOD32, Avira, Panda Security, McAfee Security, Microsoft Security Essentials, Bitdefender, Rapid7's ScanNowUPnP, Kaspersky, and F-Secure.

AmiMoJo writes: Four years ago Mozilla moved to a fixed-schedule release model, otherwise known as the Train Model, in which we released Firefox every six weeks to get features and updates to users faster. Now Mozilla is moving to a variable 6-8 week cycle, with the same number of releases per year but some flexibility to 'respond to emerging user and market needs' and allow time for holidays. The new release schedule looks like this:

• 2016-01-26 – Firefox 44
• 2016-03-08 – Firefox 45, ESR 45 (6 weeks cycle)
• 2016-04-19 – Firefox 46 (6 weeks cycle)
• 2016-06-07 – Firefox 47 (7 weeks cycle)
• 2016-08-02 – Firefox 48 (8 weeks cycle)
• 2016-09-13 – Firefox 49 (6 weeks cycle)
• 2016-11-08 – Firefox 50 (8 weeks cycle)
• 2016-12-13 – Firefox 50.0.1 (5 week cycle, release for critical fixes as needed)
• 2017-01-24 – Firefox 51 (6 weeks from prior release)

ewhac writes: Among its other desirable features, Firefox included a feature allowing very fine-grained cookie management. When enabled, every time a Web site asked to set a cookie, Firefox would raise a dialog containing information about the cookie requested, which you could then approve or deny. An "exception" list also allowed you to mark selected domains as "Always allow" or "Always deny", so that the dialog would not appear for frequently-visited sites. It was an excellent way to maintain close, custom control over which sites could set cookies, and which specific cookies they could set. It also helped easily identify poorly-coded sites that unnecessarily requested cookies for every single asset, or which would hit the browser with a "cookie storm" — hundreds of concurrent cookie requests.

Mozilla quietly deleted this feature from Firefox 44, with no functional equivalent put in its place. Further, users who had enabled the "Ask before accept" feature have had that preference silently changed to, "Accept normally." The proffered excuse for the removal was that the feature was unmaintained, and that its users were, "probably crashing multiple times a day as a result" (although no evidence was presented to support this assertion). Mozilla's apparent position is that users wishing fine-grained cookie control should be using a third-party add-on instead, and that an "Ask before accept" option was, "not really nice to use on today's Web."