Linked by Thom Holwerda on Thu 18th Dec 2008 10:24 UTC
Privacy, Security, Encryption Most of the attention has been going to Microsoft and its Internet Explorer web browser for having a severe zero-day security hole fixed, but Microsoft wasn't the only one hastily fixing its browser. Both Mozilla as well as Opera had to issue quick patches to fix several security flaws in their browsers.
Order by: Score:
Mozilla not rushing
by georgios on Thu 18th Dec 2008 11:19 UTC
georgios
Member since:
2008-12-18

It seems that 2.0.0.19 will not be the last release for Firefox 2. Something went wrong and there will be a 2.0.0.20 (what a terrible naming scheme!) released around mid December.

Mozilla has been scheduling the 3.0.5 update for at least 40 days. They certainly didn't rush anything!

Edited 2008-12-18 11:21 UTC

Reply Score: 1

RE: Mozilla not rushing
by Johann Chua on Thu 18th Dec 2008 11:24 UTC in reply to "Mozilla not rushing"
Johann Chua Member since:
2005-07-22

Just upgraded to Firefox 3.0.5 in Ubuntu. I'll reboot into XP and upgrade Firefox and the other browsers.

Reply Score: 2

RE[2]: Mozilla not rushing
by MaxKlokan on Thu 18th Dec 2008 12:50 UTC in reply to "RE: Mozilla not rushing"
MaxKlokan Member since:
2007-12-04

Sorry, but what is the point of your post?

Reply Score: 6

RE[3]: Mozilla not rushing
by Johann Chua on Thu 18th Dec 2008 13:05 UTC in reply to "RE[2]: Mozilla not rushing"
Johann Chua Member since:
2005-07-22

Huh?

Maybe I shouldn't started a new thread...

Reply Score: 1

RE: It seems that 2.0.0.19 will ...
by glarepate on Fri 19th Dec 2008 09:04 UTC in reply to "Mozilla not rushing"
glarepate Member since:
2006-01-04

... be available on Dec. 18th from mirror sites such as ftp.osuosl.org

Reply Score: 2

'chances are'
by Darkelve on Thu 18th Dec 2008 11:26 UTC
Darkelve
Member since:
2006-02-06

"So, whatever browser you're running, chances are you're going to need to update this week. Enjoy."

Actually, I'm running Firefox 3.0.4 on OpenSUSE 11.1 - I don't think that's affected, or is it?

Edited 2008-12-18 11:27 UTC

Reply Score: 1

RE: 'chances are'
by Thom_Holwerda on Thu 18th Dec 2008 11:27 UTC in reply to "'chances are'"
Thom_Holwerda Member since:
2005-06-29

...?

Reply Score: 4

RE[2]: 'chances are'
by Darkelve on Thu 18th Dec 2008 11:29 UTC in reply to "RE: 'chances are'"
Darkelve Member since:
2006-02-06

I mean since I'm not running it on XP is it crucial to upgrade it right away or not? On the other hand I guess I'll notice if it shows up in online updates...

Reply Score: 1

RE[3]: 'chances are'
by Thom_Holwerda on Thu 18th Dec 2008 11:35 UTC in reply to "RE[2]: 'chances are'"
Thom_Holwerda Member since:
2005-06-29

I mean since I'm not running it on XP is it crucial to upgrade it right away or not? On the other hand I guess I'll notice if it shows up in online updates...


The flaws are cross-platform.

Reply Score: 5

v RE[4]: 'chances are'
by Johann Chua on Thu 18th Dec 2008 13:07 UTC in reply to "RE[3]: 'chances are'"
RE: 'chances are'
by Punktyras on Thu 18th Dec 2008 11:30 UTC in reply to "'chances are'"
Punktyras Member since:
2006-01-07

Yes, it is

Reply Score: 3

RE: 'chances are'
by poundsmack on Thu 18th Dec 2008 19:43 UTC in reply to "'chances are'"
poundsmack Member since:
2005-07-13

lets see if there is a security update avalible from Lynx for my browser. hmmm nope ;) maybe Dillo

Reply Score: 3

RE[2]: 'chances are'
by BSDfan on Fri 19th Dec 2008 04:08 UTC in reply to "RE: 'chances are'"
BSDfan Member since:
2007-03-14

I use lynx... it doesn't support Javascript, very hard to create exploit payloads with a markup language alone.

Reply Score: 2

Comment by Kroc
by Kroc on Thu 18th Dec 2008 12:24 UTC
Kroc
Member since:
2005-11-10

New with Firefox 3.0.5 is the about:rights page that does away with the EULA when you install Firefox for the first time.

This is an excellent move by Mozilla that I applaud!

Reply Score: 2

RE: Comment by Kroc
by Johann Chua on Thu 18th Dec 2008 13:09 UTC in reply to "Comment by Kroc"
Johann Chua Member since:
2005-07-22

I wonder why the Windows version of VLC, for example, treats the GPL as an EULA (i.e., you must agree with the license to use the software).

Reply Score: 1

RE[2]: Comment by Kroc - because it is an EULA
by jabbotts on Thu 18th Dec 2008 13:35 UTC in reply to "RE: Comment by Kroc"
jabbotts Member since:
2007-09-06

The General Public License is an end user license so treating it like any other EULA is not too strange. The difference is that the GPL lists a bunch of things that users and developers may do provided they remain within the broad boundaries of the license where the traditional consumer EULA is a long legal document detailing what one is not allowed to do.

Permissive versus oppressive.

An example is comparing Mandriva's EULA to Mirosoft's:

Mandriva:
- you can do this
- you can do this
- you can do this
- thank you for trying our distribution

Microsoft:
- you can't do this
- you can't do this
- you can't do this
- we can do this without warning
- we can do this without warning
- we can do this without warning

Reply Score: 7

Soulbender Member since:
2005-08-18

But what is the GPL EULA doing in a binary package?

Reply Score: 3

ba1l Member since:
2007-09-08

I've never understood the tendency for Windows versions of GPL-licensed apps to use the GPL as an EULA either. OpenOffice does (or at least, did - I've not tried 3.0 on Windows yet) the same thing, except it forces you to scroll through the entire license before you can continue.

As far as I see it, the GPL is a distribution license, not a usage license. In fact, the GPL itself says this:

Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.


Surely then, the GPL only applies if you're redistributing GPL-licensed software, whether modified or not. If I'm using a binary package, why should I have to agree to any of the provisions of the GPL? It doesn't apply to me. I'm not required to do that on any Linux system, for example.

If you stuck the GPL as a EULA on a package that installed source code, or development libraries, then I'd understand it.

Reply Score: 3

xiaokj Member since:
2005-06-30

Well, the GPL-used-like-EULA-for-binaries is valid because you can redistribute the binary and its derivatives, and as such, you will have to abide by it.

Reply Score: 3

jabbotts Member since:
2007-09-06

"Surely then, the GPL only applies if you're redistributing GPL-licensed software, whether modified or not."

What's not to say that a person who is using GPL'd software will not give a copy to a friend.. aka.. redistribute it?

Reply Score: 2

jabbotts Member since:
2007-09-06

GPL does not state that it can only be displayed in the source header. It states that the source code must be made available for download. The pogram licensed under the GPL may be, and usually is, distributed as a compiled and installable binary.

.deb, .rpm, .zip/.exe (for the windows folks), .squish (not sure the Apple package type).. those are all packaged binaries.

Now, if you prefer to only download uncompiled GPL'd software then by all means.. go get yourself the tarballs and compile it all up as you like. I'm personally happy to use the precompiled binaries and resort to tarballed source code only when required (and rarely is it required).

Reply Score: 2

Soulbender Member since:
2005-08-18

GPL does not state that it can only be displayed in the source header.


Yes, but WHY does VLC et al show it? It's not shown when I install a binary package on Linux.

Reply Score: 2

DrillSgt Member since:
2005-12-02

"Yes, but WHY does VLC et al show it? It's not shown when I install a binary package on Linux."

So you have something to complain about?? ;)

Reply Score: 3

jabbotts Member since:
2007-09-06

I'm guessing that by installing it through your linux repository, the idea that you realize you are using GPL software is assumed. I'm guessing on that one though.

Actually, I don't know of any of the various packages that presents the GPL. The only *nix installs I've seen that do so are binaries packages in tarballs such as the VMware Server install. Unzip the tar.gz, agree to the license, follow the install wizard; no real difference from a win32 installer except for the lack of useless GUI makeup (it is server software after all).

On the other hand, why is it such an issue that the win32 install of VLC does show the license? My personal guess that way would be because showing the license accounts for it being installed on a machine that may not include other software based on the same license.

In either case, you'd have to ask the VLC developers why they chose to present the license during the win32 install. Unless there are members of the VLC project reading the forum, you'll get nothing more accurate than guesses.

Reply Score: 2

Vanders Member since:
2005-07-06

The General Public License is an end user license


No it isn't. Refer to the GPL itself & the FSF for more information.

In answer to the original question, it's because the Microsoft installer tools such as Installshield generally require an EULA to be displayed, and it's easier to display something even if it's not quite correct, rather than trying to change the dialog configuration in Installshield to remove the unnecessary EULA dialog.

Reply Score: 4

jabbotts Member since:
2007-09-06

I see the technical limitation in the windows installer requiring some sort of document to display.

In terms of not being an end user agreement.. does the end user not have to abide by the freedom to redistribute binary or source for programs they use? An end user license does not only have to be a long legal and restrictive document does it?

Reply Score: 2

DrillSgt Member since:
2005-12-02

"I see the technical limitation in the windows installer requiring some sort of document to display. "

What limitation? When I make an installer file using wither the standard windows tools or Installshield, I just check a box not to display anything.

Reply Score: 2

jabbotts Member since:
2007-09-06

"In answer to the original question, it's because the Microsoft installer tools such as Installshield generally require an EULA to be displayed"
- Vanders

Then you should talk to Vanders as to why the install packager he/she is using requires it.

Reply Score: 2

Almafeta Member since:
2007-02-22

No it isn't.


Yes it is.

Being directly (and reversably, depending on what compiler options you use) modified from GPL code, compiled code counts as a "covered work" under the GPL, and as such its use is subject to the terms of the GPL.

Reply Score: 2

v IE is not fixed , Thom is misleading
by Moulinneuf on Thu 18th Dec 2008 16:41 UTC
Thom_Holwerda Member since:
2005-06-29

Unauthorized Remote access and proven trojan insertion is not the same as " a possibility of elevated privilege in some software or script".


The Firefox flaws also allow for code execution, it literally says so on the Mozilla advisories. The fact that it's not being exploited is something completely different, and entirely unrelated to whether or not the vulnerability is as severe as another.

You know there's something wrong with you when you apply more spin than the organisation/product you're defending.

But heck, I use Chrome, and I run as a limited user, so for now I'm "safe" anyway.

Reply Score: 3