fedora core 4 test 1 || MAIN || zip builds

March 23, 2005

firefox 1.0.2 is out

Firefox 1.0.2 is a proactive update to fix a bug that makes users vulnerable to a buffer overflow in GIF image processing. We don't know of any exploits in the wild that take advantage of this bug, but the Mozilla Foundation, and all of the mozilla.org projects, take security very seriously, so we're happy to be able to provide rapid turnaround on issues like this.

We've worked hard to build a reputation for delivering secure products. That reputation wasn't earned by some billion dollar PR effort with catchy phrases, it was earned because we've attracted great talent from all over the world and they are continuously examining our open source code, and testing our releases and developer builds, helping to find and fix software flaws before they become security exploits.

This is one of the areas that proprietary software has a difficult time competing with open source and the discovery and fixing of this GIF buffer overflow is a perfect example. Because security experts have direct access to the code as it's being developed, and have a direct line into our development and testing process, these kinds of issues usually get reported directly to us.

So grab the new Firefox 1.0.2 bits :-)

Posted by asa at March 23, 2005 10:00 AM
Comments

So Firefox 1.0.2 is out. And who takes cares about localized versions? Any schedule on that (also asking for Thunderbird and Mozilla Suite)?

Remember, in Germany Firefox holds a market share of 22 Percent!! Donīt let your bravest supporters down! Take care of the international community. One of the leading german computer magazins "Chip" is offering the english version of TB as a "german" version. Think about the fuzz thatīs gonna be brought by installing an english version over a localized one. All the Moms and Dads who are going to dicard FF because it doesnīt speak their language anymore since version 1.0.2.

At least make an announcement about the timetable for localized versions. (FF, TB, MOZ).

Posted by: big_surfer on March 23, 2005 09:54 AM

Apologizes, just saw that there indeed are localized versions of FF. Good work!

But what about TB and Mozilla?

Does the automatic update function for FF work now?

Posted by: big_surfer on March 23, 2005 09:59 AM

Installs fine. I *hate*, though, that the installer conveniently offers to change my homepage to the Firefox start page and checks that option by default. Not only on the first install, but for every upgrade as well.
Makes it look like a piece of adware...

- Michael

Posted by: mscha on March 23, 2005 10:03 AM

Agreed, that check box is pretty bad. I always have to remember to uncheck the dumb thing when I install.

Posted by: Jafe on March 23, 2005 10:16 AM

My browser history was wiped clean somewhere between uninstalling the 1.0.2 release candidate and installing the final version.

Posted by: Programmerman on March 23, 2005 10:17 AM

Why do I have to download all 4.7MB when it's only .01 better than 1.01?!

Posted by: _intrepid_ on March 23, 2005 10:49 AM

What's the recommended way to install?

I'm specifically talking about the bug that installing 1.0.1 over 1.0 leaves both entries in the Windows "Add/Remove Software" control panel. I've got bit by this (as, no doubt, have countless others). Do I just install 1.0.2 and get 3 entries, or try to remove one or the other (or both?) of the old versions?

Ick.

Posted by: Some Guy on March 23, 2005 10:57 AM

Bug: Bug still present: Firefox 1.0.2 just released (which I reported on Asa's blog thread for Firefox 1.0.2.RC1):

"Bug: Toolbar menu item "Release Notes" content stale.
For: Firefox 1.0.2.RC1, EN, Mac.

"Stale content:
"Mozilla 1.5 Release Notes

These release notes describe system requirements, installation instructions, and known issues for Mozilla 1.5. These notes are updated when we receive feedback, so please check back for new information. Consult our releases page to download the source and the latest version of Mozilla for your platform.
...

Copyright Đ 1998–2005 The Mozilla Organization

Last modified June 7, 2004 ..."
"Posted by: Eddie Maddox on March 18, 2005 06:03 AM "

Eddie Maddox

Posted by: Eddie Maddox on March 23, 2005 11:04 AM

So how long before this update shows up when I check for updates?

Posted by: David Schontzler on March 23, 2005 11:12 AM

Asa, the security bugs haven't been unlocked yet, but are linked to directly from the Security Advisories page.

Posted by: Cusser on March 23, 2005 12:00 PM

Also, I think you need to revise the MoFo position on zip builds that Chase recently announced on his blog. Discontinuing the zip builds has the following disadvantages:

1) Users who already have the zip installations can't upgrade using the exe, which is now all you're offering.

2) It makes it more difficult for users to install in environments where they do not have administrative privelidges.

3) Indirectly encourages the use of nightlies for mainstream use, which may not be an advantage.

4) Indirectly encourages third-party zip releases, which also may not be an advantage.

I think it's a fine stop-gap measure, but it's not a permanent solution. Also, I'm wondering why there's a difference between the releases, and if so, why can't those differences be resolved?

Zip and exe should be delivery vehicles, not versions in their own right, or at least, that's the convention that other applications follow. I'd be interested to read your comments on this.

Posted by: Cusser on March 23, 2005 12:08 PM

Not to mention, Portable Firefox/Thunderbird won't exactly work without a zip build. What about those of us who have multiple builds of Firefox on their system for testing purposes?

I think it is a lousy change and just Mozilla.org's way of saying "this is too tough to solve so everyone's happy, so let's take the easy way out and let everyone figure out what to do on their own."

That doesn't even get into the fact that this wasn't announced by anyone until after the fact and only in a blog post of someone I have never heard of before and a brief 1 sentence comment by Asa on his blog.

I personally don't use the zip builds, but I know people who do and they aren't happy about it.

Don't give me the "use nightlies instead" comment. The nightlies are sometimes not as stable as the final releases.

Posted by: Chris G. on March 23, 2005 12:27 PM

Does anyone know if Bug 283730 - "Save As" dialog tries to overwrite link/shortcut (.lnk) file instead of opening the directory/folder is fixed in 1.0.2?

I can't upgrade from 1.0 until it's fixed because those shortcuts are how I access all the parts of my computer where I store things -- browsing is not an option, as it would add hours of work to my day, each day.

Posted by: Block Sheep on March 23, 2005 12:29 PM

Chris, the aviary 1.0.1 nightlies on or around the same date as the official releases are exactly as stable as the final releases, since they contain the same code.

However, to correctly identify the build that you really want requires understanding of the differences between versions (i.e. aviary, branch, trunk, etc). This is what I meant by my comment #3... having to look through the FTP to find zip builds makes it easy to stumble upon trunk nightlies that will traditionally be of an uncertain quality.

Posted by: Cusser on March 23, 2005 12:31 PM

Will someone update the torrents on http://bittorrent.mozilla.org/, maybe even with TB?

Posted by: moj on March 23, 2005 12:38 PM

Still, even if I wanted to download Firefox 1.0.2 in a zip file, I would want the exact copy of the final release...I wouldn't want a nightly, even if they are "around the same date" so they probably (but not definitely!) are exactly the same as the installer version.

Which doesn't really help if you don't know what date 1.0.2 was made on (the 17th according to the About dialog, but someone who uses a zip build isn't going to download the installer, install it, check the about menu, uninstall it, and then download the appropriate zip of that nightly)...seeing how it was released today on the 23rd, that is little longer then "around the same date".

Posted by: Chris G. on March 23, 2005 12:38 PM

Chris, I agree... If nothing else, when the nightly folders are updated with the release exe, they should be updated with an equivalent zip, even if the release folders are not.

Posted by: Cusser on March 23, 2005 12:53 PM

No, the shortcut-overwriting bug is still there in 1.0.2. Of course, since bug 283730's status is NEW, you probably kinda knew that!

Posted by: toby on March 23, 2005 01:26 PM

I've got the 1.0.2RC, do I need do download the final release?

Posted by: Rishi M on March 23, 2005 02:20 PM

I installed 1.0.2 and all of my bookmarks are now gone!!!!How do I get them back? I see that it happened to someone else above. HELP!

Posted by: Naila on March 23, 2005 02:50 PM

I installed the Swedish version, and the about dialog looks like this. At the top it claims to be 1.0.2 (which it is) but the UA string says 1.0.1. How come?

Posted by: David Naylor on March 23, 2005 03:05 PM

David Naylor, I don't know how that happened. Have you modified your user agent with a pref or installed an extension that might have done that? Where did you get that build and how did you upgrade?

- A

Posted by: Asa Dotzler on March 23, 2005 03:18 PM

Now that I think about it, it must be my fault for doing seriously strange things:

I haven't modded the UA string with an extension or in any other way - not now, not ever. I upgraded by uninstalling... hmm... actually it's kind of a long story. I had two copies of FF101 installed in seperate folders. (On a side-note, the second copy was for modifying into an Opera look-a-like(*), inspired by the FirefoxOpera project) However, I had forgotten about the second copy, so I went to add/remove programs and selected Firefox (only one FF in the list) and uninstalled it. It turned out that it only uninstalled the copy which I installed last of the two.

I then (without thinking at all, and for now sane reason) copied the contents of the not-uninstalled FF folder to the 'FirefoxOpera' folder. I then installed 1.0.2 into the original FF folder... (I deleted the contents first.) So, I don't think the two different version numbers is anything anyone need worry about... :-) They must be due to a whole lot of strange behaviour on my part.

*) Since the program icons are in the program folder I had to create two copies to be able to use the Opera icon. Otherwise it hade sufficed to use two profiles.

Posted by: David Naylor on March 23, 2005 04:24 PM

To answer your second question: Official sv-SE build from moz.org.

ps. Great that the localized builds were out on 0-day

Posted by: David Naylor on March 23, 2005 04:28 PM

Sorry for triple-posting, but it seems the 1.0.1 UA string is tied to my original FF profile. The 'FirefoxOpera' profile OTOH, with a huge number of extensions, is showing 1.0.2 in the UA string.

Posted by: David Naylor on March 23, 2005 04:31 PM

May we have updates to the Bittorrent seeds on http://bittorrent.mozilla.org/ ?

Thanks in advance!

Posted by: Paul Mischler on March 23, 2005 06:37 PM

Received my en-GB update today through the auto-check, was most supprised by the little messege slide-up in the corner of my screen. When 1.1 is released, will it clean up the Add/Remove list automatically? Also, will 1.1 include the new update architecture (i.e. better update checking/downloading)?

Posted by: Kroc Camen on March 24, 2005 02:12 AM

Hmm, I'm getting an auto-update thingie in my browser, but when I click it and it starts checking, it seems to hang at about 90%. Does anyone know what might be up with that?

Posted by: Manuzhai on March 24, 2005 02:17 AM

I really love that fact that installing the new update (via the software update) added a new item to my "add/remove programs" menu. I also love how running a patch required installing a new program fron scratch.

This is Version 1?

Haha, You're way off.

PS. I've been a Firefox (firebird) fan since the 0.4, but if you ever hope to compete with MS it needs to be more seamless. This latest update was a pain in the arse.

Posted by: Johno on March 24, 2005 02:33 AM

Johno: You're harsh, but unfortunately, right. The update mechanism simply hasn't lived up to the simplicity and quality users have gotten used to when using Firefox.

Posted by: David Naylor on March 24, 2005 02:46 AM

Some feedback on the FireFox 1.0.2 installer: I used to be able to click-click-click straight through the FireFox installer to update, which was awesome. I used to point to FireFox as an example of a very user-friendly installer.

Now I can't click through the installer quickly because on the last step it tries to modify my home page. I don't know about other people but I'm thinking that's not so good. It may be better not to select this checkbox by default.

Posted by: Ryan Lowe on March 24, 2005 06:13 AM

@Ryan Lowe,

For us techies, yes this is annoying. However cast your mind to mum&dad types - what is their start page usually, given that they do not know how to change it?
It will be one of the following:

* Home page of their ISP, almost rivalling Netscape for spam sometimes
* MSN Home page from MSIE (God forbid)
* Spyware refirect to any hovel-of-a-homepage on the Internet

Quite frankly, I'm glad it's ticked to start with.

Posted by: Kroc Camen on March 24, 2005 01:59 PM

Kroc Carmen: I never thought of it that way. I guess it could be good to have it checked as default. The Firefox Google start page sure is a great start page for most people.

Posted by: David Naylor on March 24, 2005 03:17 PM

Official release 1.0.2 for OSX file is dated March 19th -- right? Nothing newer?

Posted by: Hank Roberts on March 24, 2005 04:48 PM

@Kroc Camen

I have no disagreement using a Firefox page for the default start page if it's a new install of Firefox. It's when by default Firefox tries to change the home page I've had for over a year on an upgrade where it gets inconvenient.

But the homepage issue itself is not the point. The point is that the installer *was* nice to use and now it's not. This is the first time I can ever remember having to untick a box in a Firefox installer. Now Firefox's installer is just like every other installer out there -- trying to get me to do stuff I don't want to do -- and that's a shame.

I know it's a trivial thing but this is how much I care about Firefox. Firefox seperated itself from Mozilla by simplifying and taking care of details. This is one tiny detail that slipped. Please slip it back.

Posted by: Ryan Lowe on March 25, 2005 12:07 PM

i have to agree with johno. i am not updating again until the process is fixed. i'm thinking that the developers are thinking only in terms of barebones firefox, with no extensions, no bookmarks, no themes installed.
i've upgraded 4 times, each a nightmare. after the second i swore i wasn't going to do it again, but then i'd think, "they must have addressed this basic issue by now".
the other basic issue that continues to be overlooked, is the upper half of the context menu disappearing when right clicking links at the top of a page. damn that's annoying.

Posted by: firq krumpl on March 25, 2005 09:33 PM

@Ryan Lowe

thanks for pointing that out, I hadn't thought of the issue of the FF installer prompting to replace start-page when installing an upgrade and you're correct that this is very annoying. There would be no reason to change your start page after you've already been using Firefox for months :P

For the first install, having the Google Firefox home page is all part of having Firefox, it'd look odd to not have that as the start page! I don't know how to use bugzilla, but does anybody know where the bug for this is, and if it can be marked to block 1.0.3 or 1.1?

Posted by: Kroc Camen on March 26, 2005 02:47 AM

I can only agree with what has been said above about the installer stealing the home page, and - even more - about the double (triple, quadruple, etc.) item in the "Add/remove" menu.
On that last point, for all of those who follow the advice and uninstall the previous version first, it should probably be pointed out in the first dialog in the uninstaller, when one is asked "Are you sure that you want to uninstall Firefox AND ALL ITS COMPONENTS?", that this does not include extensions, profiles, themes, history, bookmarks, etc. It's quite scary the first time one does it...

Posted by: eyolf on March 26, 2005 04:50 PM

Post a comment