It's not just me - Firefox doesn't like Windows Presentation Foundation either

You may have seen this "Add-ons may be causing problems" window recently.

It seems that there's plenty of evidence to suggest that Microsoft's .NET Framework Assistant and WPF add-ons cause serious instability and can leave your computer vulnerable to remote code execution.

If I'd installed these add-ons, I'd say fair enough - uninstall them for now, wait until MS patch them, and install the patched versions.

I suppose I happened to visit a site with some (or lots) of Silverlight content. I was told that I needed these add-ons to allow the content to be displayed properly. I allowed them, restarted and the content was loaded. Presumably. To be honest, I don't even really remember doing it. Perhaps I didn't.

It seems that these pesky parasites latched on to my lovely browser when I installed .NET Framework 3.5 SP1. They are slipped in the back door, without so much as a by your leave. For most of us that have these add-ons, they were installed around February this year. That's eight months of risk.

So, there they were, and they were leaving our browsers vulnerable to crashes, and worse.
They're disabled now, and I'll be uninstalling them shortly. I'm not impressed that the warning came from Mozilla and not from Microsoft. I imagine that Mozilla noticed them in user-submitted crash reports and opened a ticket with Microsoft's security team to say that their .NET / WPF add-on / plugin was causing crashes. MS probably said it was a browser issue, for Mozilla to sort out, and so on...

You might like to take a look at Mozilla's list of dodgy add-ons - you'll also see the Apple QuickTime Plugin, v7.1.*, which also can allow remote code to be executed on your machine. I have version 7.6, so I guess that's safe, for now.

You can also view the details on these add-ons, and the .NET / WPF add-on thread on Bugzilla is especially illuminating. It pretty much says that Microsoft advised Mozilla to just go ahead and block the plug-in, probably because they missed it in the Patch Tuesday roll-up, and the next one is still some way away.

David Baron [:dbaron]  says:

It does show up in
http://people.mozilla.org/~dbaron/crash-stats/20090929-interesting-addons ,
although the correlations that show up aren't necessarily signs of causation. 
However, that shows that it's quite common in the wild: it's installed for the
users submitting 48% of our Windows crash reports on Firefox 3.5.3.

If Microsoft is recommending disabling it (all versions, or just some?) because
of security vulnerabilities, then I'd strongly support adding it to the
blocklist.

I'm was not too impressed that MS didn't quickly release a patch themselves - but reading further down in that thread, you can see that there is some doubt creeping in - perhaps they did?

George Robert said:

Is there a particular reason why these are being blocked two days after
Microsoft released a fix for this issue?

MS09-054 was released on 10/14/2009, which the linked technet article in
comment #23 very clearly states resolves this issue for both IE and Firefox

Yay! So I'm safe and I can enable it again? Well, no:

Matthias "matti" Versen said:

Read
http://blog.mozilla.com/security/2009/10/16/net-framework-assistant-blocked-to-disarm-security-vulnerability/
MS agreed to the plan to blocklist it according to the security post.

It seems that the reason they had to put a blanket ban on all versions of the WPF plugin, is because:
a) There is presently no way for Firefox to hook into the OS list of installed MS patches
b) MS don't bother putting version numbers on their WPF libraries - they are just called NPWPF.dll
c) MS didn't put a new version # on the WPF plugin or .NET add-on to indicate that it was downloaded / installed after the patch was applied

Ultimately, this decision to add them to the blocklist was arrived at by mutual consent, which is clearly stated by Mozilla's Mike Shaver. This is the final word on the matter, and I'm satisfied that Mozilla did the best they could in the situation, even if some administrators in the field who got Firefox approved as the browser of choice in their company, and use some of the affected technologies will be very put out.

So, tough luck for MS.  Now most Firefox users will have a slightly lower opinion of them than they did before and this is another setback for WPF, its advocates and users.

Oh, and while all you Firefox on Linux users are welcome to have a little chuckle about it, you'd better check if you have Moonlight 2.0 (BETA) installed first.

Further reading

• Sneaky Microsoft Add-on Put Firefox Users At Risk (it.slashdot.org)
• Dear Microsoft, please keep your lousy mitts off my Firefox install (downloadsquad.com)
• Object Lesson: Use Firefox? Don't Let Microsoft Install Anything In It! (lockergnome.com)
• Shady Microsoft Plugin Pokes "Critical" Hole In Firefox Security [Firefox] (gizmodo.com)
• Researcher sees Patch Tuesday nightmare (infoworld.com)
• Moonlight 2.0 goes beta (thaibrother.com)

Slow Firefox Startup

Image via Wikipedia

It doesn't seem to matter what version of Firefox you're likely to still have, they are all slow to start up.
In this old post, I gushed about the greatly improved performance with Firefox 3.5, which I stand by.
However, the startup is really poor. Once it gets going, it's great, but there's very little noticeable improvement in startup times for FF 3.5 over FF 3 once you have a load of add-ons installed.
You can tweak as per this old post all you want, but the /Prefetch:n switch doesn't really do it.

As much as I hate preloaders, in the end, I had to capitulate.
The FirefoxPreloader, hosted on Sourceforge, really works and has cut down start times from 30 seconds to about 3 seconds. It loads during startup, and by the time your PC is up and running and you click on old Foxy, you'll be on your home page in no time.
I think this is well worth it if you browse for much more than 50% of your total time at the PC.

Further reading

• Install Firefox 3.6 Beta1Pre In Ubuntu For A Huge Speed Boost (slumpedoverkeyboarddead.com)
• Future Firefox 4.0 Could Feature App Tabs (slumpedoverkeyboarddead.com)
• Go Straight to Your Unread Gmail Messages with a Shortcut [Shortcuts] (lifehacker.com)
• Firefox 3.5 Reviewed; Draws Praise For HTML5, Speed (tech.slashdot.org)
• Turn your head and cough, Firefox! Mozilla's plugin check is live (downloadsquad.com)

Firefox 3.5 really is faster and better

Image via CrunchBase

I know, this isn't exactly news, but if you haven't upgraded to Firefox 3.5 by now, you probably should - and I think you'll be pleasantly surprised.

All the good things that made the majority of users choose Firefox (other than those who just blindly accepted IE because they had no idea how to do otherwise) are still there. But there are a few new features. Some are new (native JSON support, web worker threads), and some are just new to Firefox (private browsing). Other features were available in add-ons, such as Tab Mix Plus and Session Manager (closed tabs, closed windows, tab tearing).

These new or borrowed features are important factors that will contribute to Firefox staying ahead of the competition, but I think I'm not the only one who was starting to get tired of every bell and whistle slowing the browser down. Safari wasn't going to tempt me away, but Chrome - while it didn't impress at first - started to really grow on me. Thanks to Chrome View, I could set certain sites to load up in Chrome instead. I'd noticed that Firefox 3.0.x, while it felt like an improvement at first, seemed to have terrible trouble with sites with deeply nested links. It simply took a ridiculously long time to load such sites, making the browsing experience pretty unbearable in the process.

So, the main area for improvement for Mozilla to look at, for me, was speed. Chrome and Safari had it. Chrome had some neat features too (even if Safari had nothing), but it had no add-ons (and probably never will). Once I heard that Firefox 3.5.x was much faster than Firefox 3.0.x I was very nearly sold. It was just a matter of time before all my favourite add-ons were confirmed compatible with 3.5 and then I'd be on my way.

My favourite add-ons (all FF 3.5 ready :)
- Ad Block Plus (essential)
- Greasemonkey (essential)
- Personas
- Tab Mix Plus (quite redundant now though)
- Selenium IDE (essential)
- Flashgot
- Firebug (essential)
- Speed Dial (essential)
- Stumbleupon
- Forecastfox
- Zemanta

Now that I have upgraded, since all the add-ons listed above are supported, I can vouch for greatly improved performance. The claims from Mozilla were that FF 3.5 is over 2x faster than FF 3.0, while benchmark tests on many sites claim it's up to 2.5x faster. All I can say so far is that I can feel a huge improvement. Most of the frustration has been removed, and I don't think I'll be reaching for Chrome quite so often from now on.

Performance index comparative (OS: Win Vista) from lfie.net

Futher reading

• Tab Mix Plus Beta For Firefox 3.5 (techie-buzz.com)
• New hint of gallery for Chrome themes emerges (thaibrother.com)
• Firefox 3.7a1pre Portable lets you try before you install (downloadsquad.com)
• Google building 3D hardware boost into Chrome (thaibrother.com)
• Firefox 3.5 performance 250% (lfie.net)
• Top 5 Killer Features in Firefox 3.5 (mashable.com)
  

MS .NET 3.5 users: beware fix pack 1

I don't use the .NET 3.5 framework myself, I'd rather stick pins in my eyes, but for those who do: watch out for fix pack 1 - it'll open up a security hole. The vigilant will probably notice that you have a new add-on in Firefox that can't be uninstalled without some registry diddling. I'm sure it'll be patched some time, perhaps next month.

Of course, if you're one to install the .NET framework in the first place, you're probably not the type to check these things.

Here's a particularly inflammatory post about it.

Related articles

• Microsoft .NET Framework: Making Firefox Just as Vulnerable as IE (blippitt.com)
• Do You Trust Microsoft? (q-ontech.blogspot.com)
• Microsoft cannot be trusted! (dvorak.org)
• MS Issued a Fix For Its Unwanted FireFox Extension (yro.slashdot.org)
• Did Microsoft Install A Firefox Extension On Your System? (lockergnome.com)
• Think Firefox is Safer than IE? Microsoft Doesn't Want It That Way (lockergnome.com)

Improving Firefox Performance

You may or may not have noticed, but since the heady days of late FF2, Firefox has apparently gotten slower on some websites with deeply nested links. I don't know why this is, but it just seems to hang for (sometimes) several seconds on such sites. Friends and work colleagues have complained of exactly the same thing, on exactly the same sites.

This bugs me. There's not much I can do about it (except wait) and I've moved to FF3 now, like most people, so I'm not too enamoured with downgrading. IE7 and 8 are simply awful, Chrome is... I'm not really sure yet, and SeaMonkey, Flock and the rest are not at all bad, but not great.

I suppose what I'm saying is that I'm an add-on junky, and I'm not going to go cold turkey no matter how slow it gets.

FF3 is also woefully slow to start up. So what to do about it?

For the slow startup:

• Add /Prefetch:1 to your the end of your FF3 shortcut target, e.g. right click on the shortcut, click properties, add /Prefetch:1 after the target (put a space between them)

For the general slowness:

Open a new tab, type about:config in the address bar. You can either change the following values (if they exist) or change them:

• Enable pipelining to get pages to load faster - it might not work well for you, so if changing away from the default settings, be sure to take note of them so you can revert to them later if needed:

1. network.http.pipelining : true
2. network.http.proxy.pipelining : true
3. network.http.pipelining.maxrequests : 8

• Change the initial paint delay to get the page to render faster:

1. nglayout.initialpaint.delay : 0

Now, if any of these parameters don't exist, you'll have to create them. Simply right click and select the relevant parameter type, e.g. 'boolean' for a parameter that can have a true or false value, and 'integer' for a parameter that takes a numerical value. Much less common is 'string'.

Finally, I recommend this add-on:

Tweak Network

You'll see FasterFox in the search results too, but I don't really recommend it, since with the manual tweaks and Tweak Network you have it covered, and I thought it messed with FF3 a bit too much, seemingly making things worse on some occasions. Tweak Network also gives you some extra benefits when a page doesn't load, bringing up some diagnostic tools on the offending page. Try it out, it's pretty smart.

See the latest on the Browser Wars

Google Chrome is not doing so well, but it's steadily growing and has overtaken Opera. Interesting to see that some people still use Netscape too. One mystifying thing is the absence of Seamonkey and Flock - unless they are counting them under the umbrella of Mozilla. It's also interesting to see that Safari still has 7%, which, by today's standards makes it a major player (?).

DO NOT download Tor Button

Here's an amusing post on Privoxy and Tor

But seriously, I've just discovered that the tiny Tor Button add-on stops Google Talk Gadget from loading in the sidebar... Bizarro!

Flock goes from strength to strength

Despite being another gecko based browser, there's something different about Flock. Features like mini toolbar, Media Streams, My World, Photo Uploader and Blog Post (which, as you probably guessed, I'm using to post this) feel more substantial than the average "add-on". The general browsing experience is good - as you'd expect from any Mozilla "flava", while the bugs are few and far between.

So it's great then. Wonderful. But is it as good as Firefox or Opera? Well, no. Firefox just rocks, thanks to being the biggest, meanest gecko on the block. If you want to be able to do something, chances are that there's a Firefox only add-on that will do it for you. You can harden Firefox up and tweak it just about as much as you could possibly need and there's the real sense of ownership you get when you take that basic Firefox shell and customize it to the hilt. On the other hand, Opera puts everything you could realistically need right at your fingertips without there being the slightest suggestion of clutter or claustrophobia (which is probably Flock's ultimate failing). Opera fills you with a warm glow and puts a serene smile on your face that makes passers-by think you've gone all weird and enlightened on them. So many Firefox add-ons are just trying to mimic something that The Big O does natively, while the IE7 extension suite IE7Pro tries desperately to turn IE into Opera - and pales in comparison (plus, they can't do anything about IE's continued instability and dismal CSS support).

It's an extremely pretty and useful browser: definitely better than Internet Explorer 7 (but let's face it, IE7 sucks something awful), possibly better than Seamonkey (but we like that one for it's plain, no-nonsense approach) but still not as good as Firefox or Opera. The great thing about browsers is that you can find a use for them all, and Flock has found it's niche in the area of photo account management and social browsing. I use it to keep tabs on my Photobucket and Flickr accounts and upload new photos there. Firefox is my general use browser and Opera is for mail and blogging (it has the best password wand in the business, so it's great for switching accounts).

Perhaps I should be comparing Flock to Maxthon... but I'll get to that browser in another post.

Blogged with Flock

Free popup killer

Someone asked me today if I knew any programs that did a good job of killing popups.
I made three recommendations:

1. Switch to Firefox, or better still, Opera
2. Make sure popup blocking is enabled at the browser level
   
3. Install Ad Block Plus (a Firefox add-on)*

As for a program that will kill popups for you - this simply isn't necessary. If you have money burning a hole in your pocket, then get Spysweeper - it is a great anti-malware program that monitors your system for changes and blocks popups, amongst other things. Whether you have the moula or not, however, there is a no-cost solution for Windows users:

Edit the hosts file
Win XP: Click Start, Run and type "notepad c:\WINDOWS\system32\drivers\etc\hosts"
Win 2k: Click Start, Run and type "notepad c:\WINNT\system32\drivers\etc\hosts"
Now edit the file to map the domains of the nasty popups you want to block, like this:


Note the lines are composed of two columns. The left column is the IP address you want to map the hostname to, while the right column is where you enter the hostname/domain name.

The hosts file is basically a text file that maps hostnames to an IP address - it will be the first place your computer will look when a hostname needs to be resolved, so it overrides anything obtained from the DNS server.

So, when a popup from www.partypoker.com is triggered, it maps to 127.0.0.1, which is your computer's loopback or localhost address, but since the page does not in fact reside there, it cannot load, and you will at most see a page not found instead of a nasty, annoying and potentially malicious popup.

The downside with this approach is that it is manual, and you have to get the popup at least once to add it to the list of "blocked" domains. The upside, of course, is that it is free.

* if you insist on persevering with Internet Explorer, then get "IE-Spyad", a registry file that will add a massive blacklist to your restricted sites list in IE.