How the Mozilla Sniffer Backdoor Was Discovered 201
An anonymous reader writes "Mozilla pulled one of their Firefox add-ons earlier this week for containing a backdoor which stole passwords from its users. Netcraft has taken a closer look at how the rogue extension worked, and how it was discovered by chance rather than through any code review process. Mozilla are working on a new security model to stop this kind of backdoor happening again."
BlueHost (Score:5, Interesting)
Looks like the stolen data was being sent to a hacked BlueHost account. Figures.
Re: (Score:2)
Advertised purpose? (Score:2, Interesting)
What was the addon supposed to do?
Re: (Score:2)
Security penetration testing. Isn't that just alanis.
I'm thinking it wasn't backdoored, they just pointed it the wrong way around.
Re:Advertised purpose? (Score:5, Informative)
In addition to modifying several existing files, the author added a file called tamperPost.js that very deliberately sends every form submission to a remote server. You can see some of the code of this on the Netcraft article in the summary (or or a direct link to the image [netcraft.com])
When you see the image, you can see that it was obviously a deliberate attempt to steal credentials.
Re: (Score:2)
Isn't that just alanis.
That's probably the most obscure musical reference I've ever seen and actually picked up on.
Bravo sir.
Informative article (Score:4, Informative)
Re: (Score:2)
Re:Informative article (Score:5, Informative)
An add-on called “Mozilla Sniffer” was uploaded on June 6th to addons.mozilla.org. It was discovered that this add-on contains code that intercepts login data submitted to any website, and sends this data to a remote location. Upon discovery on July 12th, the add-on was disabled and added to the blocklist, which will prompt the add-on to be uninstalled for all current users.
Re: (Score:3, Insightful)
Would it have been so hard to have written "Mozilla pulled one of their Firefox add-ons, Mozilla Sniffer, earlier this week..." in the summary though.? Most of the people here have a hard enough time reading the summary, let alone the actual article linked to.
Re: (Score:2)
Click The Fine Linky. Hell, it's Netcraft, so it's probably good reading anyway.
Oh, right, /. Where "tl;dr" is a way of life.
Re: (Score:3, Funny)
“Mozilla Sniffer”
Seriously?
With the evil and nefarious scheme of stealing login info, this was their best attempt at hiding the true nature of the add-on?
Re:Informative article (Score:4, Insightful)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
As per above. Someone downmod the OP and give some points to the AC.
wait, add-ons don't have a permissions model? (Score:5, Insightful)
Do you mean to say that, when I install a Firefox add-on, Firefox won't give a list of requested privileges? Why has it taken 30 years for people who think in Unix security terms to not catch up to the VMS "fine-grained privileges to executables for users" security model?
The whole regular user / root thing is awful. Microsoft is still doing it wrong because, while the NT kernel may approach the right idea, it builds atop it a mess of get-out-of-jail-free paths.
It's not impossible.
(1) By default, allow nothing;
(2) Never allow everything - require software to specify exactly what it needs;
(3) Classify permissions so the user is alerted more violently for more risky permissions - this may depend on the circumstances (e.g. a browser add-on usually shouldn't be asking for the same sort of privileges as backup software);
(4) Software which needs an unusually privileged environment may benefit from auditing and signing, but never make this compulsory because this pisses off everyone;
(5) But, by default, refuse in such circumstances and indicate why. The user needs to make a conscious effort to override a reasonable set of auto-refusal defaults;
(6) Distinguish explicitly between once, occasional, time-limited and forever permissions. To take a particularly insidious example: iPhones ask if you want to give permission for your app to read your GPS location. This isn't permission for the next 15 minuts or day; it's permission forever. That is wrong. Looked at from the other end, don't do a Vista and ask every time. This is worse than not asking at all.
More thoughts, guise?
Re: (Score:2)
Re: (Score:2)
And (unsurprisingly) Chrome handles extension permissions like this as well.
Re: (Score:2)
This is part of the reason to switch to the new Jetpack [mozilla.org] extension API from the old JavaScript code soup extension model.
From the Jetpack FAQ [mozillalabs.com]:
Re:wait, add-ons don't have a permissions model? (Score:5, Interesting)
In this case, for instance, the extension was explicitly stated to be(and, as I understand it, was) an extension for examining and modifying HTTP/HTTPS headers, including stuff like GET requests, and the like. Because it was malicious, it was, in addition to whatever modifications the user was making, also issuing a separate little request of its own, with the contents of form fields, to an IP controlled by the author.
You could, on a permissions basis, do things like segregate "extensions that modify browser chrome and only browser chrome" and prevent them from modifying pages at all, and you certainly can(and should) draw a line between "extensions that muck about with pages" and "Extensions that do stuff to the local filesystem"; but given that most of the useful extensions tend to muck around with webpages themselves, that introduces a very difficult security problem.
With conventional permissions setups, you are applying permissions to a set of objects(usually files; but can also be database values, APIs, etc.) that you created and thus know the sensitivity of. A webpage, though, is a collection of objects that some third party created. Unless you have some very clever ideas about how to parse a webpage and automatically categorize the "sensitivity" of various parts of it, it is virtually impossible to meaningfully assign a permissions structure to it. An extension rewrites a script on a webpage: is it making the user more secure(by preventing doubleclick from learning something)? is it making the user less secure(by diverting information to a malicious host)?
Fine grained permissions are a good thing; but you really can't create a useful permissions system(no matter how well designed and granular it may be), if you have no useful way of knowing how valuable the various resources to which you are allowing/denying/conditionally allowing access are. Since web browsers do most of their useful work on masses of objects provided by third parties(currently without any sort of value metadata, and even if there were an adopted standard for providing such, 3rd party value judgments still wouldn't be at all trustworthy.) it is a really hard problem to build a permissions model that is actually useful rather than merely strict.
Re: (Score:2)
Why isn't it possible?
It is possible to define such a thing. Quick example (off the top of my head):
Permission to modify headers - which headers
Permission to send request - originating IP, domain, other domain
Permission to modify web page - content, meta-content, scripts
Permission to access local store - read/write, and how much
Permission to use ports - port, read/write, and how much
Permission to execute local programs - which ones
Permission to modify local GUI - window, menu, status, button-bar
Default: NON
Re: (Score:3, Interesting)
What I'm saying is that, because it is extremely difficult to know what elements of an arbitrary 3rd party webpage are sensitive, and what elements aren't, attempting to apply a meani
Re:wait, add-ons don't have a permissions model? (Score:5, Insightful)
I have a feeling that the Mozilla guys don't think in Unix security terms. Mozilla/Firefox is targetted more heavily towards Windows than Linux, and it shows in a lot of places that a lot of the developers think that way too.
e.g. The use/implementation of "profiles", which are a work-around to the problem of running on a system that does not support multiple user accounts (well), or where it is expected that multiple users use the same user account. Last I used Mozilla and Firefox on Windows, these were still pretty prominent. They're also included in Unix-based builds, where they're mostly pointless, instead of being IFDEFed out by default on those platforms.
See also the automatic updater. This is required on Windows, which does not have a centralised update system for 3rd party apps, and assumes each user will install their own copy of the software, or will have write privs to system software locations, or will have the Administrator password. It's redundant and useless on most Unices/Linux distros, but the code is still included by default.
It also prefers to bundle its own copies of 3rd party libraries, common practice on Windows where dependency handling doesn't exist, and 3rd parties generally do not bother to try to maintain backwards ABI compatibility between DLLs. Again this is contrary to the Unix way of doing things, where dependencies are well defined, and library authors take pains to ensure backwards-compatible ABIs. But still Mozilla software ships private copies of 3rd party libraries by default on Unix.
Mozilla software appears to be primarily written for Windows by Windows-based developers. Yes, it does work on Unix/Linux systems, but that's not how the developers think, and it shows.
Re: (Score:2)
Profiles are incredibly useful on any platform. I have three profiles
Re: (Score:2)
Or, you could just create ~/.mozilla-standard/, ~/.mozilla-ebay/ and ~/.mozilla-testing/, and point a ~/.mozilla symlink at whichever profile you want to use, like you can do for ... any other program at all. Again making the "profiles" feature completely redundant on Unix-like systems.
If your distro is like this with security updates for any package, not just Firefox, you sho
Re: (Score:2)
running on a system that does not support multiple user accounts (well)
1996 called. They want their anti-Microsoft rant back. This hasn't been true since NT 3.5.1 was released. The NT series of the Windows operating system has always supported multiple users very well (I would say better than *nix-like systems because of the more robust ACL model). End-user applications, on the other hand, have in the past not supported multiple users well (e.g. sticking configuration in %WINDIR% or HKEY_LOCAL_MACHINE instead of per-user locations) .
Re: (Score:2)
Sorry, I didn't mean to imply that I thought Windows doesn't currently support mulitple users well. Rather, that when Mozilla was first developed, the lack of good multi-user support in the versions of Windows in wide use at that time was the reason why profiles were initially developed.
Re: (Score:2)
It was experimental, warnings were there (Score:5, Informative)
Not only that, but the author couldn't even use proper English in the addon description:
Given that, I hate to say that "people had it coming", but I figure people had ample warning that they were trying something that could be malicious.
Re:It was experimental, warnings were there (Score:4, Funny)
I think you're missing the point that there's probably quite a few people on the Internet today who read that description and -- at least to them -- there wasn't anything grammatically wrong with it.
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Addon called "Mozilla Sniffer" (Score:5, Insightful)
Re: (Score:2)
It could have been called "Steal all your passwords and send them to the Russian Mafia" and still some people would have installed it.
Re: (Score:2)
I have a bold statement for you: ;)
The evil one here is the Mozilla team. For removing that thing.
It is obvious that this this was just natural selection at work. Hurting everyone who is so dumb that he can’t really be called a human anymore.
Just like the lion kills the zebra that fails at being a zebra by being slow and dumb as hell.
Meanwhile keeping the whole herd healthy.
We humans are zebras without lions. We constantly remove all lion-like things from our lives.
And then we complain that the Idiocr
To perfect this hack... (Score:5, Interesting)
1) Obscuring the code, so that it lasts longer, even upon scrutiny of the source.
2) Obscuring the password delivery mechanism to reduce the likelihood of detection of the code execution.
3) Obscure the password retrieval, to reduce the likelihood that the perpetrator would be caught, even if the authorities discover the code.
Much has been written about item 1, obscuring code. But I haven't seen much research describing items 2 or 3.
If I were writing the code, I would integrate the password theft and remote delivery into the main purpose of the code. For instance, say you wrote a plug-in whose function was to report to the user some information retrieved from Google and other sites. e.g. "This plug-in helps with Search Engine Optimization, by reporting potential keywords that can be added to the web page to increase results". With that sort of purpose, hits to Google and other sites wouldn't be suspected.
Some of my hits to Google would be to locate an open log file, with a Google Query like this query: "get / http/1.1" 200 mozilla filetype:log [google.com]
Once I found a web server with a log file that was openly being displayed on the web, I'd pass the stolen information (stolen user name, stolen password, and site that this information can be used on) in the form of a URL, possibly encoding the payload information (I don't encode it below, for clarity).
Then my rouge program would request a few more pages from other sites that have open log files, just to obscure my activities, specifically requesting the log file page itself (and disposing of the results). I'll explain why this step is important later...
Example: Using my Google query above, I can see that bullyentertainment.com has its logfile exposed (sorry, bullyentertainment, you're just the first one on my list of hundreds of thousands of open logfiles). That means that my trojan horse can request a page on bullyentertainment.com, (like www.bullyentertainment.com/stolen_info?user=myuser&pwd=hunter2&site=gmail.com [bullyentertainment.com] it will log my hit into that file - logging the stolen user name, password, and site information into a remote innocent bystander server. If my rouge program requests a page on bullyentertainment.com with some information encoded in the URL, I can effectively transfer the secret stolen information from the infected PC to an innocent bystander (bullyentertainment.com).
Then later, back at secret spy headquarters, I can use the same Google Query to locate log files that have my secret information in them, like www.bullyentertainment.com/logs/access.log [bullyentertainment.com] which was a log file shown by my Google Query. I can follow the same pattern as the infected PC - first hit a page passing some URL containing secret information, and then retrieve the log file - so my activities ALSO look like an infected PC. But by retrieving the log file, I have retrieved all of the stolen passwords.
This technique is a way to pass stolen information back to the hacker without detection, by going through an intermediary. Because spy headquarters uses the same procedure as a hacked PC, it cannot easily be detected as the destination of the information. Use of proxies can further hinder attempts to catch the hacker. In a real hack, I'd encode the secret information, so that only I was able to easily decode it. But you get the idea.
PS If you test the above links, no harm, but your IP address will be logged (just as it is with any click), but it will be visible to other users on an exposed log file. No big deal, but I thought I'd mention it.
Re: (Score:2)
And then, when you are in your headquarters, recovering the information from Google, your search will be recorded and later indexed by 'internet cops' or whatever.
Make sure you don't do this from your headquarters directly.
Re: (Score:2)
I think you missed the point that at headquarters you are doing the same actions that a compromised PC would be doing.
That's the cover. Sure, your actions would be logged, but so would the hundreds of thousands of compromised PCs. Your activity would be obscured through sheer quantity of people doing the same actions.
Re: (Score:2)
you think your activities will look the same as activities of infected PCs, but they won't. Something will stand out and you'll get caught, it's better not to do it from your own PC.
What I don't get: (Score:2, Funny)
An add-on called "Mozilla Sniffer" was uploaded on June 6th to addons.mozilla.org.
That’s like uploading a add-on called “Windows Virus”. Who the hell would install that?
I mean even Joe DontKnowShit would think twice before installing something that reminds him of a TLA agent or spy trying to get a look at his privates.
74.220.219.77/~beverlz5 (Score:3, Informative)
jwhois 74.220.219.77
[Querying whois.arin.net]
[whois.arin.net]
OrgName: Bluehost Inc.
OrgID: BLUEH-2
Address: 1958 South 950 East
City: Provo
StateProv: UT
PostalCode: 84606
Country: US
So has law enforcement been notified?
Re:Native features in browser (Score:5, Insightful)
there is no way some rogue developer could hide password stealing code in them.
And since Opera is not open source, there is no way to be sure of that.
Re:Native features in browser (Score:5, Insightful)
Re:Native features in browser (Score:5, Insightful)
Unless you go through all the code yourself, there's no way to be sure of anything. And unless you're uber-bad-ass, its going to be really hard to understand every line in a massive code-base someone else wrote, let alone all they all play together. So, even if you do your own audit, you can't really be sure. Life's a bitch, isn't it?
Re:Native features in browser (Score:5, Insightful)
Unless you go through all the code yourself, there's no way to be sure of anything.
Only thing that can be made about that statement is to point to a nice little presentation by Ken Thompson. Take a look at 'Reflections on Trusting Trust'. Almost certain you haven't seen it given your comment.
Re:Native features in browser (Score:5, Informative)
No, I've seen it. I used to have a pretty decent email pen-pal thing going on with Ken about 10 years ago. He's a pretty cool dude. The point is, yes, even if you see the code, unless you have the code to the compiler and build it yourself, then you can't trust the binary. Basically, you can't trust anything you don't create from scratch. There could also be back-doors in ROM in the hardware. Which is why I go on to say how even if you do your own audit you can't actually trust anything. Either you won't understand everything, you'll have taken in too much information and miss something vital or,as per your example, the real root of the problem will be so obscured from view that it doesn't even matter what you're auditing.
Re: (Score:2, Informative)
Source is ok ... but can you trust your compiler [scienceblogs.com]?
Re: (Score:2, Funny)
Source is ok ... but can you trust your compiler [scienceblogs.com]?
Yes, that's what we're talking about. Thanks for being the retard who points out the obvious.
Re: (Score:2)
>>>Either you won't understand everything, you'll have taken in too much information and miss something vital or,as per your example, the real root of the problem will be so obscured from view
>>>
Sounds like a good argument for keeping code as short-and-simple as possible. I recently tried the Kolibri OS that fit on a single floppy. Obviously that means it has limited function, but it's also easy to review and understand the code because it's so short. Another more useful example is Utor
Re: (Score:3, Interesting)
Re:Native features in browser (Score:5, Interesting)
Reminds me of a line in Doctor Who's last season:
Amy: You don't always tell me the truth.
The Doctor: If I always told you the truth, I wouldn't have to ask you to trust me.
Trust is not a state of absolute certainty or God-like understanding. In the end, it's a process of establishing your own comfort. You have to decide which risks matter to you personally, and which assurances are sufficient.
Trying to guarantee that every component and piece of software in a computer is "benign" to everyone is a fruitless, endless process.
But I certainly appreciate the complications you bring up. In the final analysis, all trust must be conditional, and revocable.
--
Toro
Re: (Score:3, Interesting)
Re:Native features in browser (Score:5, Interesting)
LOL
Extension of trust works as follows:
If you trust Bob, and Bob trusts Alice, you trust Alice.
However, no one ever fully trusts Bob.
So, more explicitly, extension of trust is as follows:
If you trust Bob to a degree, and Bob trusts Alice, you trust Alice to the same degree that you trust Bob.
But this is incorrect as well. Because Bob's trust relationship with Alice is also "to a degree". Let's try this again:
If you trust Bob to a degree, and Bob trusts Alice, you trust Alice only to the product of the two degrees.
Trust does degrade with each step in the relationship chain.
One of the most common "degrees" of trust is a restriction on forwarding that trust. We never actually "trust" Bob, we simply authorize him (as a supplier of code, a maintainer of data, etc.) to access our shit because we need to get shit done. The "trust" relationship is not freely given - privacy and access are sold in exchange for access to various services.
Thus, the degree of trust in an actual relationship is not a measure of actual trust, but a measure of what you are willing to risk.
The claim against the "you can only trust yourself" argument is that if you trust Bob, you must trust Alice in the same manner, because you are trusting Bob's integrity (who he chooses to trust). The claim is bullshit, because we never "trust" Bob - we simply accept a certain level of risk, and built into our threshold of acceptable risk is the restrictions on who Bob can extend that trust to.
The bottom line is that we can indeed choose to trust Bob completely and choose to not trust Alice at all. This is because the "trust" relationship is never actually based on trust - it is based on risk.
Re: (Score:3, Insightful)
This is where the "many eyes" comes into play for open source...
Re:Native features in browser (Score:4, Informative)
Jon: This is great, good work.
Jane: Clean and efficient, great addon.
*Create account: Jack*
Jack: Yeah, awesome stuff! Jim, Jon, and Jane are all correct.
*Create account: James*
James: I love this addon! No viruses here
Re: (Score:2)
This is where the "many eyes" comes into play for open source...
Can you name "many" people who have a complete in-depth understanding of the mozilla codebase? Can you even name one?
Many eyes is excellent for small simple projects, but for something the size of the mozilla suite I doubt that *anybody* really understands 100% of it, and so, even with many people looking at their own parts, there is still room to sneak in bugs where the parts join.
Re: (Score:3, Informative)
Unless you go through all the code yourself, there's no way to be sure of anything.
you mean unless you go through the code, compile it yourself using a compiler whose code you've also audited and itself was not compiled by an unaudited compiler [bell-labs.com]
Re: (Score:2)
Even then you'll need to do it all with a CPU which you've either built yourself, or at least verified that it matches the schematics. After auditing the latter, of course.
Re: (Score:2)
Re: (Score:2, Insightful)
Every line of source code? That's just silly. Who can be sure of anything that way? I inspect every packet going into and out of the computer by hand.
Re:Native features in browser (Score:5, Interesting)
In this case, for instance, the malice was flagged by somebody watching network traffic, which is pretty trivial on any platform that doesn't have a bad case of being a console/iProduct. A purely binary, closed source, application could have been caught in exactly the same way.
Re:Native features in browser (Score:4, Insightful)
Uhhhmmmm - yeah, I think. I guess I'm a freetard. Now and then, I'll fire up Wireshark, and just watch the traffic. Yeah, I can see that my deviant son is browsing a porn site. I can see that the wife is checking her email and the banking. I can see that the other kid is looking for car parts. And - the other other kid is playing games. But, why on earth does he have packets going to http://xxx.xxx.xxx.xxx/ [xxx.xxx] ??? That isn't a game site - he's not browsing, or there would be a lot more packets. Hmmmmm. A little checking, and I holler at him. "Have you installed anything lately? Have you done a virus scan on your stupid Windows laptop? What is this site?" He looks at it, tells me it's nothing HE ever heard of, goes back to his machine, and does some checking. An hour or so later, he admits that he was testing some stupid schitz that one of his buddies recommended. One of the features happens to be a trojan.
I don't bother making reports - I guess if I did, I might get my name attached to some zero day thingy. Hmmmm. That might not be good either. The better known you are, the harder it is to stay anoynymous when you really WANT to be anonymous!
Re: (Score:2)
Were any "respectable" software to be operating maliciously, this would probably be the easiest way to exfiltrate captured data. Because the phoning ho
Re: (Score:3, Interesting)
There's no way to be sure of anything, but as far as risk goes, you have to admit that trusting one vendor with a financial stake in not having a privacy loss scandal is a lot easier than trusting any random person in the world who can submit a plugin to the mozilla site.
I'm a software developer, but I'm not going to go over every line of source code for the applications or plugins that I install on my computer. Seriously, even if you did, have you ever read along with or participated in code obfuscation c
Re: (Score:2)
Re: (Score:2)
There's a pretty big difference between asshat corporate behavior of going over the line by misusing your private data on Facebook vs creating a plugin whose hidden purpose is to keylog so that the developers can drain your bank accounts.
Re: (Score:3, Interesting)
Seriously, even if you did, have you ever read along with or participated in code obfuscation contests?
Any obfuscated code, especially if it's FOSS, should be suspect. Either they have something to hide, or they're a shitty programmer. Either way, I don't want their code on my hardware.
Re: (Score:3, Insightful)
Re: (Score:2)
Obfuscated code is often difficult to even spot... because it's obfuscated.
Re:Native features in browser (Score:4, Informative)
>And since Opera is not open source, there is no way to be sure of that.
Sure there is, you can reverse-engineer it to see what it does. You know, just because all you have is the binary doesn't mean you've suddenly entered a magic land where nothing can be understood.
(I'm going to ignore "but can you trust your tools" asshatery)
Re: (Score:3, Interesting)
>>>And since Opera is not open source, there is no way to be sure of that.
I think we can trust the Opera developers. They've been around long enough (15 years), and they are the #1 browser in eastern Europe and Russia* so someone would have caught them by now, if they were thieves. ----- My main complaint about Opera's built-in features is it creates a memory hog. I don't need AdBlock or Bittorrent or Mail in my web browser. Using Firefox allows me to have a leaner program that is stripped of
Re: (Score:2, Insightful)
And since Opera is not open source, there is no way to be sure of that.
So slashdot. So retarded.
When was the last time YOU PERSONALLY read and understood EVERY LINE OF CODE you run?
Did you fabricate your own CPU too?
Shit being open source isn't some magic blanket of security. In fact, just the opposite: People blindly trust open source code thinking "someone else reviewed it". Who? Do you know their name? Do you know their review process? Do you know they're competent, and not just some 19 year old in a dorm room killing time between beer runs and WoW raids?
If Opera mal
Re: (Score:3, Informative)
Re:Native features in browser (Score:4, Insightful)
[...] Opera comes build-in with all the features I need [...]
FTFY. I prefer Firefox's way of offering a basic browser and moving extended or niche features to optional extensions to monolithic blocks like Opera. Of course there is a risk associated with this model, but in my case the benefits far outweigh that risk.
Re: (Score:2)
I prefer Firefox's way of offering a basic browser and moving extended or niche features to optional extensions
I've come to suspect that what a geek means by a "basic browser" is the browser that does everything he wants to do and nothing that others want to do - aka "bloat."
Plug-ins like Flash evolved because the browser was a convenient way to access online games, music, videos and so
on. Integration of these features makes sense for a whole lot of reasons.
Re: (Score:3, Insightful)
I prefer Firefox's way of offering a basic browser and moving extended or niche features to optional extensions to monolithic blocks like Opera
Theoretically, I prefer that too; but somehow opera with more features than the entire mozilla suite is still smaller, faster, and more stable than a barebones firefox :/
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Can someone point me to a nice lean browser that can run in 32 megabytes (like utorrnt) but is not text-only (like Lynx). It doesn't seem to exist.
Re: (Score:2)
Client-side scripting and DOM manipulation puts a damper on that fairly quickly. The number of websites that don't work at all without client-side scripting is growing, and will only continue to grow.
maybe Dillo? (Score:3, Informative)
You could try Dillo [wikipedia.org].
Re: (Score:3, Insightful)
History is retarded, I've had it disabled since I first started using browsers with the "feature". Bookmarks should also be an add-on since most home users really don't need it to save their Facebook and Hotmail links.
Re: (Score:2)
AwesomeBar is one of the things I miss now that I switched to Chrome. (Nuke Anything is another, I'm not seeing an extension that can right click -> Remove This Object. Really helpful on sites like slashdot where shitty html makes invisible divs float over the top of the text like that <div id="slug-Bottom"> that's over the bottom 2-3 comments on every slashdot page.)
In Firefox I had AwesomeBar trained pretty good. "Q" brought me to my comments page, "f" pulled up the firehose, set to display jou
Re: (Score:2)
Re:Native features in browser (Score:4, Insightful)
This is why I love that Opera comes build-in with all the features you need and a lot more
As a geek, I enjoy complexity to an extent. It's cool to have a gadget with lots of nifty features and shiny buttons. But even I'll admit that at some point it can become unwieldy.
I personally prefer a basic browser with a plug-in model that allows me to extend the functionality in whatever way I feel necessary. That way I can add all the shiny buttons I want, without having to deal with the unwieldy stuff that other people want.
Not only are they made using the same quality standards and conventions, there is no way some rogue developer could hide password stealing code in them.
Actually, there is.
One of the Opera developers could go rogue. Or some machine in their development environment could be compromised, which could lead to the distributed software being compromised.
And since Opera is not open source, we'd have to rely on the Opera developers themselves to find the issue. An open source model means that basically anyone with the time/inclination/skills can go in and take a look at the code.
Re: (Score:2)
Re: (Score:2)
From what I understand (never actually used it myself), Opera's adblock features are pretty weak compared to Firefox add-ons like adblock plus.
You understand incorrectly. Opera's adblocking is just as capable as AdBlock+. Just use a good block list such as the one maintained by Fanboy [fanboy.co.nz].
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
I like most people as well!
The only issue with Opera is that they keep adding retarded things like BitTorrent downloading and built in web servers. It also doesn't help that they try to change the entire UI with every milestone.
I still don't see myself switching away any time soon.
Re: (Score:3, Interesting)
This is why I love that Opera comes build-in with all the features you need and a lot more.
Except that it doesn't. I heavily rely on Firefox extensions to, for example, manage my tabs. It's entirely possible for me to work on three projects, each with ten to thirty tabs associated with them, while simultaneously using the same browser for personal stuff, which incurs further tabs. Having fifty or more tabs open at the same time is not unusual for me. Does Opera have an easy way of organizing a huge amount of tabs without having to use additional windows (which break the way I partition my screen)
Re: (Score:2)
That tab grouping sounds like a really useful feature. What is the extension you use for that? I found a number of them that seem similar...
Re:Native features in browser (Score:4, Informative)
In case you're a beta user: Tree Style Tabs says it's 4.0b1-compatible; TabGroups Manager doesn't but works apart from a cosmetic issue (the tab group bar appears below the tab bar instead of above it).
Re: (Score:2)
opera? no browser comes with all the features we need. If we did, it'd be the only browser we used. What a stupid statement.
Meanwhile, is there a consensus between browsers? No, in fact it's leaning quite the other direction - some like safari, chrome, firefox, ie, etc.
Firefox however, like the others, warns you to be careful of addons and warns what they do. So it's good that they caught this.
Re: (Score:2)
Re:It was bound to happen eventually.. (Score:5, Informative)
Nothing in that process would detect any but the most blatantly unsubtle malice(and, given that reviews tend to occur fairly quickly, something as simple as recording the date of first run, and not doing anything evil until 1 month has passed would probably count as "subtle" for the purposes of this exercise).
If malice is detected by a third party, or by some after-the-fact spot-check; both Apple and Android have practically identical capabilities to "unpublish and remove" an application from any device that hasn't been divorced from the mothership. For that matter, Mozilla can also issue FF updates that disable add-ons(as they did a while back for that MS
seeing the recent fraud commited (Score:3, Interesting)
on Apple's store your suggesting we avoid Apple products? I figure you were going to imply Android as being less safe, but the only recent story about market safety I have seen is someone exploiting iTunes accounts to the benefit of a single developer.
though it would be interesting to have two bad apps released simultaneously into both markets and see which one gets caught first
Re: (Score:2)
Simples (Score:3, Funny)
This guy is a native English speaker with a good education and almost surely a security professional trying to see how far he can get. The typos he has NOT made give it away, among other clues: (1) "it's" is always correctly used (2) looks like he deliberately added plurals making it look as though his English is poor (3) John "Devid" (4) "check it out" (5) "don't" is correct (6) no other spelling characteristic Eastern European mistakes
Just my opinion, I could be wrong.
Simples [comparethemeerkat.com]