Asa, why is there no mention of the Shell security fix on any of the main Firefox or security pages? It's great that the vulnerability was fixed so quickly, but regular users won't know about it by checking the mozilla.org pages:

http://www.mozilla.org/products/firefox/
http://www.mozilla.org/download.html
http://www.mozilla.org/projects/security/known-vulnerabilities.html (the last update is from Nov 2003)
http://www.mozilla.org/projects/security/index.html

Which is worse, voting Republican (US) or using Internet Explorer?

blonker, our prior Mozilla 1.x release start pages advertise the prolem and the fix. All current full product downloads contain the fix. The tech press have given mozilla.org/security/shell.html quite a bit of exposure. We've had over 1 million downloads of the shell.xpi fix in less than 1 week. When Firefox is closer to 1.0 we hope to have the update mechanism, which will include user notification of important fixes, in better working shape. It's not quite far enough along in 0.9.x to roll out fixes via that rout. Yes, the known-vulnerabilities page could use updating, but there are probably no more end users reading that than reading the shell.html page. As a matter of fact, I have the web stats in front of me and known-vulnerabilities has never had even 1/10th of the daily hits that security/shell.html is getting. I'd also like to get something for the Firefox start page but we've done quite a bit to notify users via our website and the million plus downloads of the shell fix XPI this last week suggest that we're hitting a substantial percentage of the people who come to our site looking for this update.

--Asa

ps. security issues (even ask asa security issues) get extra-quick turnaround at Mozilla ;-) Everyone else will have to wait a few days for their answers :D

I'm curious what your take is on this article, which suggests a total redesign of the Firefox home page. I've seen a couple different opinions ranging from "insightful" to "idiot", so I'd like to hear what a Mozilla person thinks.

Mark:

The problem with andkon (who wrote the article you linked to) is that in his early days he was famous for writing flamebait articles along the lines of Mozilla promoting communism, so a lot of people now will ignore his views based on past experience.

However, he seems to have grown up and with the advent of Firefox now even seems to like Mozilla.org products. So before when I'd just read his articles for the comedy value they now do contain some valid points so are worth reading.

There's some relatively decent points there, it'd be good to have demos of some of Firefox's features and (when 1.0 is released at least) the front page should be pointing people towards the premier products (usually choice is good but when people are unfamiliar with the product it can be confusing - I remember someone saying on IRC (not the mozilla.org IRC server) that they liked the built in mail client and irc client of Firebird (as it was then) but hated how it looked like Netscape 4, obviously they heard about Firebird went to mozilla.org and got the wrong one).

Asa, what exactly was the goal of the download.com marketing initiative, and has it been achieved? As I understand it, some of you folks had been talking to the c|net people -- what did they say? I really hoped that Firefox would make it onto the front page; it did for a day, but nothing more.

So the 1,200 reviews won't do a lot of good, as they'll only be seen by people deliberately hunting down Firefox. If there was a way to get it on the front page, that'd be infinitely more effective.

Here's my question: What were the Mozilla.org birthday celebrations yesterday? Just a webpage update? Tapping a Keg? Bonfire?

Is there ever any hope of getting Firefox to support the mdac crap IE does so I can once and for all time toss my IE? I still have two apps one being an accounting app that has ties to the evil browser. (Let me just say a. I did not select said app, and b. replacing it isn't an option) Those 2 items aside is there any hope of a plugin or something allowing us to use firefox instead of IE for that app. I use it for everything else on my work computer.

Thanks,

John aka Minezamac

is update.mozilla.org going to get Visual Identityified, cos the current site is totally sound technically, but its appearance is not in line with most of the rest of the mozzila identity?

Javascript, Flash player 7, XPconnect, Firefox.

Can the first use the third to talk to the second, in the fourth?

Are there plans to reactivate the ,CCK project ? I would like to know what the Foundation/yourself think about it. On june 22, 2004 somebody wrote: "On the plus side, we're now totally focused on the CCK market and building tools explicitly for the needs of that market."?, at http://www.mozilla.org/projects/cck/history.html What does it mean?

I believe there's no way for Mozilla to succeed in the enterprise without this kit. If the CCK is coming back to life, I'd find it the most important event of the year for Mozilla, second only to Firefox 1.0.

Also if it's being considered to add a Mozilla app development tool to Mozilla product line, any time soon. Time passes and it *seems* nobody is going to create it. So it would remain being Notepad (or a cousin) vs. Visual Basic/JBuilder/other when evaluating development alternatives.

A moderately strong development environment may be the difference between having Mozilla technologies confined to extension development and entering the applications market.

greetings,

Percy

Can we call you Answering Asa?

Do you personally have any 'pet' bugs in any Mozilla products?

Hi

Have you seriously thought about what the plans are after firefox 1.0. What concrete plans are there. How about talks with OEM vendors?. what are the next big things

How do you turn off URL autocompletion in Firefox? Please lay out the steps to accomplish this.

Just to be clear:
* I'm not interested in killing or disabling my history.
* I would prefer to do this without an extension. Tweaking a preference is better because it's one less thing I have to keep up with later on.
* I don't care how helpful Firefox is trying to be on this issue or how the machine learning software works. I'm sure the technology is impressive, but I'm not interested in this feature.
* I don't want to see a list of previous URLs I've typed. I don't want to use the arrow keys to scroll through a list of similar URLs. I just want the feature to be turned off.

This is one feature that keeps me on Mozilla suite.

Thanks.

In the previous "ask asa" I asked if there was something I could do as a non-programmer and you suggested go check the bugs with status unconfirmed.
I looked a bit around and suddenly I did a query on bugs that were on "unconfirmed" and not changed since 01-01-2004. The result was almost 4000 bugs.
Then I changed that to 01-01-2003 and I still got 234 bugs left.
Today I queried for unconfirmed bugs who haven't been changed sinceb 16-07-2004 and I discovered there are 5 of them.

So my question for Ask Asa: Can't we launch a "Big Bugzilla Cleanup Day"? All bugs that haven't been worked on for the last 12-18 months get closed (or given some priority) and their owners, memebers, voters get notified that the bugs have been closed because they are too old?
Maybe some volunteers are willing to retest if the bugs are still present in the latest Mozilla versions?

Or is this not feasible?
Thomas

this just HAS to be a coincidence, right?
http://www.wnbc.com/askasa/

I've watched that from time to time since i get that channel in NY

Asa,

Does Mozilla.org give any money to Mozillazine to help support the huge bandwidth costs they face ? If not do you not agree this would be a nice gesture as they have a hugely positive impact on the community, especially the bug finding/triaging side.

Jack

Hey Asa,

I'd like to know how much contact you Moz guys have with the Konqueror guys, and if you ever thought about comparing notes and taking the best from each browser to ameliorate both.

What Do You think will be Mozilla in the next years? How do You Imagine Mozilla organization and Mozilla products e.g. in 2006-2008?

Having volunteered in QA for some time, I've noticed that most of our QA efforts are concentrated on the front end (i.e. the UI), browser layout and program functionality. I'm curious as to whether there is any testing done against Mozilla's internals (API's, XPCOM components); e.g. white box testing, unit testing, integration testing, etc. How is this testing done, if it is done at all; who does this testing, and what tools and expertise does one need in order to succeed?

Thanks,

Alex

On July 7th you mentioned that there are over 100,000 registered Bugzilla accounts. I'm wondering how many of these accounts are still active, and how many of them contribute on a regular basis.

For example, what percentage of these 100,000 accounts have had any type of activity in the last two months. What percentage have submitted a bug? What percentage have submitted a bug that *wasn't* a dupe, invalid or wontfix?

I'm just trying to understand what 100,000 user accounts means in real terms.

Dear Asa,

Is there any way to have a link to the mirrors page added to mozilla.org or mozillazine?

http://www.mozilla.org/mirrors.html