Hacking for Christ

Gerv Is Away

As mentioned a couple of days ago, I am away doing a Christian camp in the Loire Valley in France from Thursday 29th July to Saturday 7th August. I will not be checking email during this time. So if you haven't heard from me, that's why.

Netscape 7.2 Coming

Netscape 7.2 is on its way. But how can this be? Netscape laid off all its employees, didn't it? Perhaps they contracted someone else to do the release for them. I wonder who it was...

Undetectable document.all

My view, for anyone who isn't following the bug: the "undetectable" part removes some of the major objections in "Proprietary Features Bad" but still, the negative part of the message this sends out outweighs any evidence I've seen of a technical benefit. Even bclary, Tech Evangelist extraordinaire, admits that it doesn't make all that many document.all-using sites he's looked at work.

But, if we must have it based on an argument of "legacy pages that no-one is around to update", we should have it only in quirks mode, and not in standards mode. Other compromises we've had to make in the past notwithstanding, we should do our best to support only standards in standards mode, and keep backwards-compatibility behaviour restricted to quirks mode. This would also have the significant advantage of making it much less likely that anyone would code new pages using document.all.

Followup to the DOM newsgroup.

Open Source Myths?

As noted on Slashdot, Neil Gunton has attempted to "rebut some open source myths". Unfortunately, most of his comments miss the point of the "myths" he claims to be debunking.

"Open Source software allows you to get under the hood and fix problems": He has missed the emphasis in this sentence; the emphasis is on "allows", not on "you". If you don't have the necessary skills, you can hire someone else to do it for you. The usual analogy is the car a mechanic can fix vs. the car with the bonnet/hood welded shut. You can't do that with proprietary software.

"All software should be free": He confuses the two meanings of "free" massively here. He needs to address RMS' assertion that if all software was free, engineers would still get paid, just as lawyers are.

"Open Source software is always better than closed, proprietary software": He is knocking down a straw man. I don't think anyone ever argues the point that he is arguing against - that Open Source software is always technically better. People do claim that free software is morally better - but that's an argument which he doesn't address.

"Scratching the personal itch": I'm not quite sure what he's saying here. He seems to be saying it's not a myth at all, but it's not a good idea. Perhaps, but what is this point doing in an "Open Source Myths" document?

"More choice is always better": He doesn't address the issue of who the choice should be presented to. "More choice is always better" and "Linux distributors should make choices on behalf of their users" are not incompatible viewpoints.

If this is any guide, it seems to me that people who don't agree with these statements don't understand what others mean by them :-)

Absence Warning

Just a piece of advance warning: soon I'm going away for a week on camp to teach little kids about the importance of knowing Jesus (and have lots of other fun too :-). I leave on Thursday evening, so if you want to get in touch with me about something, do it before then...

EuroFoo

A couple of weeks ago, I was surprised to find in my inbox an invitation to EuroFoo, the European version of Tim O'Reilly's "Friends Of O'Reilly" (FOO) camp which happened last year in Sebastopol, CA. Basically, a whole bunch of geeks get together for a weekend and discuss anything that comes to mind. I'm not sure what I've done to merit an invite, but I'm very honoured to get it.

Needless to say, I've booked my flight and a hotel room. All I now have to do is figure out what, if anything, I can contribute to such a heavyweight gathering of free software intellects...

Mozilla CVS analysis

This may have been pointed out when it first came out, I don't know. The Libre Software Engineering group at the Universidad Rey Juan Carlos in Madrid, Spain, has done some analysis on the CVS repositories of several large free software projects, including Mozilla. The analysis goes up to August 2003.

It's split up primarly by modules, which isn't very helpful because almost all of Mozilla is in a single module.

There's a big list of all the people who've checked in anything to CVS. This bookmarklet for sorting tables numerically (thanks to Jan Moesen; Jesse's bookmarklet sorts in alphabetical rather than numeric order) may well come in useful if you look at that.

The problem with this sort of thing is automated checkins and relicensing. For example, it appears that I'm around about sixth in the overall rankings for lines or files changed - when obviously the vast majority of that is not code contributions, but automated licence changes.

The Penultimate Virus

ESR has recently written a piece of science-fiction called "The Final Virus", in which he imagines a world where some virus writer finally decides that they are going to write one which does some real damage, and wipes out most of the world's Windows machines.

I think that, sadly, there's a strong chance of that happening eventually - but before that time, we'll see the "Penultimate Virus" - one which attacks a specific section of the Internet community. (I've blogged about this before.)

The most effectively discerning attack would probably be one which checks the Windows UI language, and wipes the hard disk at a specified time if it finds a particular one. Virtual ethnic cleansing. Scary. Imagine the economic damage to a country if the virus is stealthy enough to not get detected before zero hour.

Purely by looking at the number of people who have a grievance against Israel, and the uniqueness of their language group, if I were a betting man, I'd bet on Hebrew being the target. Either that, or US English - which would probably catch a lot of UK computers as well.

Dev Day Lineup Complete

The talk line-up for the Mozilla Developer Day on 6th August is now complete. Here's what you'll be getting:

• Mozilla Foundation Update (Mitchell Baker/Chris Hofmann)
• Roadmap Overview (Brendan Eich)
• The Road to Mozilla 2.0 (Mike Shaver)
• New Layout and Rendering Features for Gecko (Robert O'Callahan)
• Accessibility Intro for Mozilla hackers - Why, What and How (Aaron Leventhal)
• Hello, World - Application Opportunities with Mozilla's XUL (Nigel McFarlane)
• How to Improve Web Site Compatibility Using Mozilla (Bob Clary)
• Backwards Compatibility in Gecko (Robert O'Callahan)
• Forumzilla (Myk Melez)
• Firefox Rollout Plans/Marketing Plan (Rafael Ebron)

What are you waiting for, west-coasters? Register today! I really wish I could be there. it had better be recorded, or there'll be trouble...

Portable Ogg Player

I've just become the proud owner of a 256MB IOPS music player from ISM Technology, as mentioned on Slashdot a couple of months ago, and now available in most of Europe from Pixmania.

This particular model has several appealing features:

• Ogg Vorbis playback (I just finished ripping my CD collection to Ogg)
• FM Radio with auto-tuner
• Record from radio or built-in mic
• USB Mass Storage interface - so works well with Linux
• Small and cute (weight < 50g)

As far as I'm aware, this is the first Flash-based (and therefore reasonably-priced) Ogg player with non-beta firmware available in the European market. (The iRiver players were available earlier, but I heard bad things about firmware stability from the xiph.org VorbisHardware wiki page, which has now been down for months.)

I only had two problems. The first was that Pixmania wanted me to fax them my passport(!), driving licence(!) or a utility bill to prove I lived where I lived. I faxed them an electricity bill, although I'm not sure what it proves. If I was a fraudster, faking one up would be the work of a few minutes.

The second was that the documentation is all in French :-( Still, my schoolboy French, the online version and Babelfish combined to come to my rescue, and I've now figured out how to work the thing. The only nit I've found so far is that it doesn't seem to support reading embedded Ogg tags.

Mountain Climbing

Gemma has followed aebrahim and jesus_x with her thoughts on the recent discussions about the nature of God. A must-read.

I sometimes think of learning about God by studying the Bible as like climbing a mountain. It's hard work, but the higher up you get, the more impressive and amazing the view is. I've just finished studying Hebrews over a year with some friends, and I feel I've got a much better view of God's redemptive plan over the whole of history. But what's particularly exhilarating and encouraging is when you realise that there's someone else standing there, admiring it with you.

So much so, in fact, that only three things prevent me jumping on the next plane to JFK with a large bunch of red roses. a) she's engaged, b) she (wisely) doesn't reveal her address, and c) she doesn't use capital letters when she writes. So (particularly because of that last point) it could never be.

But, I know we will meet eventually, and I'll be able to thank her in person.

A Year of Progress

The Mozilla Foundation is a year old today, and so I think it's appropriate that we take a moment to look back at all we've achieved.

At the time of the Founding, things were in a pretty sorry state. Firefox was still called Phoenix, Thunderbird was known as Minotaur, Sunbird didn't have a name at all, and Chimera was taking its first tottering steps as Camino. In the last year, we've successfully managed to change all those names, some of them twice! And we've even written tools so you too can do this in the privacy and comfort of your own home.

Truly, a year of progress.

Update: OK. A year and a half of progress. I got my dates slightly out. Pendants ;-)

Relicensing Help Wanted

As many of you know, mozilla.org is in the process of relicensing the Mozilla codebase under the MPL/LGPL/GPL tri-licence. This process started in autumn 2001, and is still not finished.

In previous stages, I've had a fantastic amount of help from other people, and I now find myself needing to call on your help again.

We have a relicensing script (in Python; orginally written by Scott Collins, now re-written and maintained by Trent Mick of ActiveState) which has done most of the hard work. Today, 92.82% of the code in a nmake -f client.mk pull_all is either tri-licensed or has no license (and therefore, I assert, assumes the licence of the code around it; we may make this more clear eventually). A further 5.41% is code which has been relicensed on the tip, but Mozilla currently uses an older branch (c-sdk/ and security/). This problem will go away in time. So we have 2% or so left.

However, those left are nasty or irregular in some way. So, I am looking for people who I can give a list of files to, and they will check the license on them and, if necessary, produce patches to make those files tri-licensed. There are 785 files in the Mozilla part alone (before we get to Firefox, Thunderbird and Camino) - which is a lot of work for one me, but not very much work for 20 of you. :-)

So, if you are capable of pulling the Mozilla CVS tree and making patches without needing your hand held, and have an hour or two to spare to help us reach this goal, please get in touch. Thanks!

Enter Credit Card Number Here?

Neal Turner has a summary of the new features in Firefox since 0.9. He says:

If you’re connected to a secure site, then the address bar will have a padlock by the arrow on the right and the background will turn yellow. The padlock also appears on the status bar as normal. Therefore, if the address bar isn’t yellow, then it’s not safe to give over credit card details.

He's right, up to a point. If the address bar is not yellow, it's certainly not safe to put in your credit card details. But a key observation is that if the address bar is yellow, it's still not safe to put in your credit card details either. All the yellow says is that you are connected over SSL. It doesn't say who you are connected to. It could easily be https://evilsite.com - or, more practically, https://www.mybank.com.long.domain.name.no-one.reads.these.evilsite.com.

That's why I continue to insist that we need to display the domain in the status bar next to the lock, for secure sites, and why I hope to get a chance to update my patch to that effect soon, and persuade Ben to include it.

Update: patch updated. Result: no more confusion about the source of pop-up windows.

Anyone Got A Spare £500?

The next Mozilla Developer Day will be on Friday, August 6th, at the Google Campus in Mountain View, CA, USA. That's over 3000 miles away, and requires a trans-Atlantic plane flight. I'd like to go. Hence the title of this post.

(Actually, to be honest, I'll be helping on a Christian camp in France at that time. But I could still do with £500 if anyone wants to give it to me...)

Lies, Damn Lies, and Logfiles

At the end of June, dbaron noticed a problem with the www.mozilla.org weblogs, which had been happening regularly since about February. The problem was that we were only rotating our logs daily, and the logfile was getting larger than 2GB. When that happened, the webserver just threw it away and started a new one. This means that Webalizer was dramatically under-reporting the amount of traffic.

You can see this clearly by looking at February's daily usage stats (most of which are obviously truncated) or by comparing April's hourly usage chart with July's. The April one is clearly distorted, because most of the time, the logs from the early part of the day were getting thrown away.

So, what's the real picture?

Well, the July stats are accurate. we currently do 30 million hits a day, consisting of about 90GB of data. For comparison, that's about the same amount of traffic as Slashdot or ZDNet. And there's only one direction our traffic numbers are going in...

Controversy Squared

My post-hospital blog entry stirred up rather a commotion, and led aebrahim and jesus_x to write responses. Those who followed the original controversy may be interested in their takes, and the ensuing discussion.

And, in case people think things are still too quiet, I just want to have a quick rant about abortion law.

<deathly silence>

The current law in the UK is that abortion is legal at under 24 weeks if two doctors consent, stating that to continue with the pregnancy would present a risk to the physical or mental health of the woman or her existing children. Millions of abortions are performed legally each year.

Now, there is a proposal to change the limit from 24 weeks to 12. This is apparently because medical advances mean that babies born prematurely at 24 weeks can now be kept alive.

Er, hello? How does an increase in doctor's knowledge change the essential nature of the humanity of an unborn child? Either an 18-week-old foetus is a person or it isn't - it doesn't start becoming one just because doctors get cleverer and technology has improved!

It's also been reported that people are rethinking their view on abortion because of new pictures which have been published, showing a baby in a womb much more clearly.

Er, hello? How does a set of pretty pictures change the essential nature of the humanity of an unborn child? People who are changing their minds because of this should feel ashamed - their attitude was just the same as that of the western world's towards genocide in Africa. "If we can't see it happening, we don't need to worry about it."

Grr!

Astroturfing?

Asa and blake recently started a drive to get Firefox users to tell c|net what they think of the browser.

aebrahim suggested that this activity counts as astroturfing. I'm not sure I agree - astroturfing is artificial grassroots - ours are genuine. :-)

But I do think I have found a case of astroturfing. This article encouraging people to switch to Firefox was apparently written by a "Paul Corkery". But, have a look, and tell me - haven't we seen this face before?

Asa Dotzler	Paul Corkery

Are they related? I think we should be told.

Bugzilla 2.18 Release Candidate 1

We're currently in the last throes of releasing Bugzilla 2.18 Release Candidate 1. After 2 years, we are finally nearly there. :-)

I wonder if releasing software is anything like giving birth? Well... it's definitely agonising (albeit only mentally), and protracted, and tiring, and just when you think it's all over, there's more to do. And once it's done, nothing is ever the same again.

Hmm. No, that doesn't work, really.

Chat with the IE Team

aebrahim has a blog post containing an IRC log of a chat with the IE development team, which they hope to be the first of many.

A few years ago, it would have been unthinkable for any Microsoft development team to hold webchats with all-comers. It seems that they are attempting to take some things from the open development model. Interesting, though, how the old way of doing things shows through - the chat was run by a "Product Manager on the Communities team".

Most of it seems to be hedging about the "standards support", "transparent PNG" and "improved security" questions, and batting off feature requests to make IE more like Firefox. However, there are a few interesting points:

Q: what factors weigh into the IE teams' considerations for new fixes and features for upcoming versions? Popular demand is one thing but I'm interested to know what else goes into the decision-making

A: Obviously, security has recently become a top consideration when considering the features we add and how they're implemented.

(Emphasis mine.) Enough said.

Q: How much progress has been made on the patch [for the shell: protocol issue]? Is it going to be 1 week or a month... How close are you?

A: Sorry, I can't offer specifics. Please understand that there are a lot of super complex issues... briefly, we have to make sure that we protect against variants of the exploit not just the immediate exploit. We need to make sure that the fixes don't regress other functionality and "break" parts of the web for consumers, corporations, or developers. We have to support over 400+ IE, OS, and language combinations and make sure they are all of good quality. Of course, the team works around the clock to make this happen as quickly as possible.

The comparison with how simple and quick this issue was to fix in Mozilla is instructive. OK, we don't have such a large backwards compatibility problem - but this is a rod Microsoft made for their own back by implementing shell: in the first place.

Jana_MS : Regarding someone's post about Robert Scoble using FireFox, I just emailed him and here is his response "I do use Firefox and have said so on my blog. But only 40% of the time. I still like IE better."

Looks like Scoble's coming under some internal pressure and being forced to backtrack...

Q: What is yout opinion for webpages that say "Only viewable with IE", isn't that discrimination? Isn't information supposed to be for all?

A: These statements are a decision made solely by the web designer. You are certainly free to complain to the webmaster when you see such a message.

Now there's a quote for the Tech Evangelism team to show around. "Microsoft suggests complaining about sites which are IE-only."

Q: Will there be interim updates of IE between now and Longhorn, means updates that fix outstanding issues, incl stuff like CSS2 and PNG transparency?

A: Hi Tom, At this stage we can't make any commitments. The timeframe for Longhorn does not actually give us very much time to undertake a great amount of work especially given teh amount of testing we need to undertake to ensure a quality release that does not break the internet or many intranets and web applications.

Good news for us. Even the IE shipping with Longhorn (several years off) won't be much better than the current one. By that stage, we'll be out of sight.

"Patriarchal colonizer!"

And now for something a bit different.

I wouldn't normally blog about net-circulated jokes, but I came across a copy of this (warning: bad language) on my hard-drive and thought that I must re-share it. It has the twin distinctions of being both one of the best circular emails I've ever received, and one of the least common. I only ever got it once.

My copy wasn't entitled "The lowest-rated Jerry Springer show ever", and I definitely think that's a bad title. I never watch Springer, because I think what he does is truly sick, but I'd bet he'd get a whole new audience if the average episode went anything like that...

Last GIF Patent Expires... Probably

The last of Unisys' patents on LZW (the compression scheme used in the GIF image format), the Canadian one, expires today (July 7th 2004). The US one expired last year; the European ones have been expiring on various dates over the past two weeks.

However, IBM still holds a patent on LZW which expires on the 11th of August 2006. As it covers exactly the same things as the Unisys one, it's almost certainly invalid, and IBM has certainly never tried to enforce it. Still, sadly, it provides extra fear, uncertainty and doubt.

Still, practically, I expect this means that packages like The GIMP will start shipping GIF modules as standard now. Of course, anyone who hasn't yet switched to PNG for their website is a muppet. :-)

A Quarter of a Million And Still Going

Further proof, if any was needed, of the scalability of Bugzilla, mozilla.org's most popular web application. About an hour ago, the 250,000th bug was filed in bugzilla.mozilla.org ("b.m.o."), the oldest and largest known Bugzilla instance in the world.

The machine which runs b.m.o. is called "mecha", and it runs all of the following services for mozilla.org single-handedly:

• Bugzilla
• The Mozilla Foundation's internal Bugzilla
• Bonsai (this eats most of the CPU)
• Tinderbox (this eats most of the disk space)
• cvs-mirror (this eats most of the bandwidth, with Bugzilla running a close second)
• despot

Despite that, mecha's specs are only that of a high-end Intel server:

• 2 x 2.8 GHz Xeon Hyperthreaded processors
• 90 GB of HD (in two partitions)
• 4 GB RAM
• Red Hat Linux Advanced Server release 2.1AS (Pensacola)

The Bugzilla installation itself has the following statistics:

• 4.7 GB database
• 250,000 bugs
• 152,000 attachments (3.3 GB)
• 2,195,000 comments (1 GB)
• 145,000 registered users
• 2,407,000 recorded changes

The Bugzilla application directory is 4 GB. 3.7 GB of that is duplicates data dating back to April 2001. (We don't store the data which backs duplicates.cgi in the database; that was a mistake I made when I was young and foolish.)

We aren't actually completely problem-free - we have run into a couple of scalability problems with bugmail. Bugs tend to go a bit funny when more than about 600 people or so need to be emailed when a change happens (and there's currently 5 or 6 bugs on bugzilla.mozilla.org of which that is true). This should be fixed in the next release :-)

I'm Back...

Well, that was quite an experience. :-)

I got a pain in the lower right side of my stomach on Thursday evening, so I went to see my doctor on Friday morning. It turned out to be appendicitis. Fortunately, it was quite mild, so I wasn't in very much pain, but they decided it was best to remove my appendix rather than attempt antibiotic treatment, because if that doesn't work, things can get quite nasty quite quickly. So, I now have another scar to add to my growing collection.

It'll take me a couple of weeks to recover, so please be patient if my turnaround time for mail is even slower than it normally is.

Thanks to my friend Richard for posting to let you guys know what was going on. And thank you to all of you who commented wishing me the best. I must first stress that the sentiment is very much appreciated in all cases. One of the reasons I love working with free software is the friendliness and kindness of the community. However, I'm afraid I'd have to respectfully disagree with a couple of the theological statements. It may offend people to say it, but it's true - anyone praying who wasn't praying to the one true God of the Bible was wasting their time.

But, as He promises to do, He looked after me. I know that in everything, He works for my good, and I'm sure this situation will be no exception.

Gerv's not very well!!

Gerv's currently in Hospital, but he will be back soon.

Those Christians among you, please pray that he would trust continually in Christ as his strength and as his Creator!

Psalm 28:7

Gecko Market Share

The browser market share graph in the latest Google Zeitgeist for May shows a significant uptick in the "Netscape 5.x+ (incl. Mozilla)" line.

The graph has no scale, so we have to do a bit of work to figure out what the numerical percentage is. Assuming that all the figures add up to roughly 100%, then 100% is about 140 pixels. Our line is at 7 pixels (up from 5.5 pixels a couple of months ago), implying a 5% market share. IE 6 has about 75%. The other players who register on the graph, IE 5.5 and 5.0, are falling steadily.

Taking a conservative estimate of 300 million web users, and assuming they are all equally likely to use Google, that means 15 million people are using Gecko-based browsers.

I predict that a major driver moving people to Firefox will be the latest round of bank-specific IE exploits. In the last week, at least one IE Browser Helper Object (BHO) has been discovered (follow that link; the write-up is fascinating reading) which silently installs itself and captures any usernames and passwords sent to a long list of banking sites. As soon as the first person goes to the papers with "I had all my money stolen because I used IE", the mozilla.org download servers are going to melt. Hey, even CERT now recommends that people switch. Maybe we need a campaign like Apple's...