From: Rowland McDonnell on
Woody <usenet(a)alienrat.co.uk> wrote:

> Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:
>
> > Peter Ceresole <peter(a)cara.demon.co.uk> wrote:
> >
> > > Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:
> > >
> > > > Gremlins, I told you, bloody bloody gremlins.
> > >
> > > I really don't know; all I *do* know is that (I think) I am using the
> > > default installation. Because it just works. I certainly never turned
> > > off java.
> >
>
> <snip>
>
> > Anyway, back to the point:
>
> > I would have thought the interesting point here was the distinctly odd
> > nature of the fix - obviously, there's some sort of fault inside Firefox
> > to have caused the symptoms I've seen, some sort of glitch in the code.
>
> What your fix would suggest to me has happened is that upgrading left
> your javascript preferences in an indetermined state, which appears to
> be all off (ie, virtually no permissions).

Those prefs were set in that state manually by me. IIRC, that is.
Maybe - I do know that I have set a lot of JS stuff to `off' over the
years.

Perhaps the prefs file was somehow `not right', but I had done a prefs
syntax check before the fix turned up, and that reported all prefs files
as okay.

I've had other oddities since upgrading to Firefox 3.6 so I suspect
you're on to something - it's /an/ explanation that seems to make some
sort of sense, and so better than my previous `Haven't a clue'.

> I guess another state must
> have gone in that wasn't there previously.

How do you mean.

> By changing something (anything, it isn't important which), firefox set
> that preference to the state you had on the UI, and thus right. So it
> worked again.

I can't see how it could have messed up that which was messed up, but
`It works now' so that's okay.

> > Obviously, it's useful for people to know about this,
>
> <snip>
>
> It is. It would be probably handy if you raised it as a bug with the
> firefox chaps. No, I don't know how to do that but I am sure they have a
> big bugtracker somewhere. It is an important thing to note.

I've never managed to work out how to send bug reports to such places
that result in the bug report being dealt with in any way other than
`We're not going to deal with this problem'.

So I don't bother any more - I don't know how to get these people to pay
attention, y'see. I don't speak their language. You do, so you'll
probably say that the real problem I really meet doesn't exist.

But it does.

> <snip>
>
>
> > Now, Peter, some of use the non-default installation because the Web is
> > unusuable without ad blocking and because it's horribly slow without
> > flash blocking and because it's insecure without control over scripting
> > and so on.
>
> Its insecure anyway.

And so you would advise that I take no care to protect my computer from
on-line interference via Web browsing, and should act recklessly when
on-line, on the basis of that?

Would that be more sensible?

You know, acting recklessly rather than taking a few sensible
precautions based on where the real risks really are?

Should I just throw all caution to the winds and so on?

> there are currently some known flaws in the firefox
> you are using,

I'm using 3.6.2 - are there any Web browsers with fewer known problems?

> and any form of flash introduces a security risk.

I know, which is one reason I block flash and control cross-site
requests as well as controlling JS quite tightly.

>The
> javascript switches less so.

Think `gaming the user' attacks.

> Although it certainly isn't unusuable with the default settings,
> although it may be to you.


--
Remove the animal for email address: rowland.mcdonnell(a)dog.physics.org
Sorry - the spam got to me
http://www.mag-uk.org http://www.bmf.co.uk
UK biker? Join MAG and the BMF and stop the Eurocrats banning biking
From: Peter Ceresole on
Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:

> Now then, since your happy with your semi-functional bog standard
> Firefox, you carry on using it.

It's fully functional.

As is OS10.

As far as I am concerned, you are wrong. And you're getting abusive
again. Bye.
--
Peter
From: Woody on
Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:

> Woody <usenet(a)alienrat.co.uk> wrote:
>
> > Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:
> >
> > > Peter Ceresole <peter(a)cara.demon.co.uk> wrote:
> > >
> > > > Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:
> > > >
> > > > > Gremlins, I told you, bloody bloody gremlins.
> > > >
> > > > I really don't know; all I *do* know is that (I think) I am using the
> > > > default installation. Because it just works. I certainly never turned
> > > > off java.
> > >
> >
> > <snip>
> >
> > > Anyway, back to the point:
> >
> > > I would have thought the interesting point here was the distinctly odd
> > > nature of the fix - obviously, there's some sort of fault inside Firefox
> > > to have caused the symptoms I've seen, some sort of glitch in the code.
> >
> > What your fix would suggest to me has happened is that upgrading left
> > your javascript preferences in an indetermined state, which appears to
> > be all off (ie, virtually no permissions).
>
> Those prefs were set in that state manually by me. IIRC, that is.
> Maybe - I do know that I have set a lot of JS stuff to `off' over the
> years.

I think the state was set manually by you, but in a different version of
the software.

> Perhaps the prefs file was somehow `not right', but I had done a prefs
> syntax check before the fix turned up, and that reported all prefs files
> as okay.
>
> I've had other oddities since upgrading to Firefox 3.6 so I suspect
> you're on to something - it's /an/ explanation that seems to make some
> sort of sense, and so better than my previous `Haven't a clue'.
>
> > I guess another state must
> > have gone in that wasn't there previously.
>
> How do you mean.

well, maybe in 3.6.2 there was another setting that didn't exist before?
I don't know, I don't use firefox much, but some reason that the
settings didn't reflect what was actually the state of your browser.

> > By changing something (anything, it isn't important which), firefox set
> > that preference to the state you had on the UI, and thus right. So it
> > worked again.
>
> I can't see how it could have messed up that which was messed up, but
> `It works now' so that's okay.
>
> > > Obviously, it's useful for people to know about this,
> >
> > <snip>
> >
> > It is. It would be probably handy if you raised it as a bug with the
> > firefox chaps. No, I don't know how to do that but I am sure they have a
> > big bugtracker somewhere. It is an important thing to note.
>
> I've never managed to work out how to send bug reports to such places
> that result in the bug report being dealt with in any way other than
> `We're not going to deal with this problem'.
>
> So I don't bother any more - I don't know how to get these people to pay
> attention, y'see. I don't speak their language. You do, so you'll
> probably say that the real problem I really meet doesn't exist.

Clearly it existed.
You tried several times to access a control and it wasn't accessible. It
was a repeatable problem, you posted about it, then you did something
else and it was, something that shouldn't have had that effect, so you
have a clear problem / solution.

That means it is worth reporting.

Whether they can recreate it I don't know, but they certainly won't look
into it if they don't know about it.

It is common in this line of work for someone to say 'when are you going
to fix that thing that happens when you do <x>', and you say 'I didn't
know there was a problem like that' and they assumed you knew about it,
somehow.

> > <snip>
> >
> >
> > > Now, Peter, some of use the non-default installation because the Web is
> > > unusuable without ad blocking and because it's horribly slow without
> > > flash blocking and because it's insecure without control over scripting
> > > and so on.
> >
> > Its insecure anyway.
>
> And so you would advise that I take no care to protect my computer from
> on-line interference via Web browsing, and should act recklessly when
> on-line, on the basis of that?
>
> Would that be more sensible?

No, noone should act recklessly on line, but some of those settings dont
affect your security at all.

> > there are currently some known flaws in the firefox
> > you are using,
>
> I'm using 3.6.2 - are there any Web browsers with fewer known problems?

I think opera has fewer currently, although as of today, I think they
are all mostly in the same boat.

<http://www.theregister.co.uk/2010/03/25/pwn2own_2010_day_one/>

--
Woody

www.alienrat.com
From: Rowland McDonnell on
Peter Ceresole <peter(a)cara.demon.co.uk> wrote:

> Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:
>
> > Now then, since your happy with your semi-functional bog standard
> > Firefox, you carry on using it.
>
> It's fully functional.
>
> As is OS10.

Both claims are obvious nonsense.

> As far as I am concerned, you are wrong.

<shrug> And I know for a fact - based on undeniable evidence - that
you're wrong, probably due to your usual blinkered refusal to admit that
the software you prefer to use demonstrates any flaws at all when *YOU*
use it.

I've confirmed that your reports on software function aren't reliable -
I know that you've experienced bugs that you've deny ever seeing.

You really aren't at all reliable on such matters, Peter.

>And you're getting abusive
> again.

Peter, that false allegation is abusive of you: hypocrisy's okay now, is
it? At least, it's okay for Peter to be hypocritical, isn't it? No-one
else is allowed...

> Bye.

Peter, all I've done is ape your style of discourse as directed at me.

Where's the abusiveness in that?

I think it's hypocritical of you to make the claim that I'm being
abusive - after all, that's another false insult that you've hurled my
way.

AKA `Peter getting abusive, again' - alleging that *I* am abusive, hence
my point that you're behaving hypocritically.

What makes you think it's okay for *YOU* to make abusive posts here,
Peter?

Rowland.

--
Remove the animal for email address: rowland.mcdonnell(a)dog.physics.org
Sorry - the spam got to me
http://www.mag-uk.org http://www.bmf.co.uk
UK biker? Join MAG and the BMF and stop the Eurocrats banning biking
From: Woody on
Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:

> Woody <usenet(a)alienrat.co.uk> wrote:
>
> > Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:
> >
> > > Woody <usenet(a)alienrat.co.uk> wrote:
> > >
> > > > Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid> wrote:
> > > >
> > > > > Peter Ceresole <peter(a)cara.demon.co.uk> wrote:
> > > > >
> > > > > > Rowland McDonnell <real-address-in-sig(a)flur.bltigibbet.invalid>
> > > > > > wrote:
> > > > > >
> > > > > > > Gremlins, I told you, bloody bloody gremlins.
> > > > > >
> > > > > > I really don't know; all I *do* know is that (I think) I am
> > > > > > using the default installation. Because it just works. I
> > > > > > certainly never turned off java.
> > > > >
> > > >
> > > > <snip>
> > > >
> > > > > Anyway, back to the point:
> > > >
> > > > > I would have thought the interesting point here was the distinctly
> > > > > odd nature of the fix - obviously, there's some sort of fault
> > > > > inside Firefox to have caused the symptoms I've seen, some sort of
> > > > > glitch in the code.
> > > >
> > > > What your fix would suggest to me has happened is that upgrading
> > > > left your javascript preferences in an indetermined state, which
> > > > appears to be all off (ie, virtually no permissions).
> > >
> > > Those prefs were set in that state manually by me. IIRC, that is.
> > > Maybe - I do know that I have set a lot of JS stuff to `off' over the
> > > years.
> >
> > I think the state was set manually by you, but in a different version of
> > the software.
>
> Same prefs have been there since I started using Firefox 1.5 or
> whatever. So why a hiccup moving from Firefox 3.5.blah to 3.6?
>
> And why did `everyone else' seem to not experience it?

I would imagine that probably some other people did.
However, your installation has enough variations from standard to cause
this issue, so it is probably not common.

> > > Perhaps the prefs file was somehow `not right', but I had done a prefs
> > > syntax check before the fix turned up, and that reported all prefs files
> > > as okay.
> > >
> > > I've had other oddities since upgrading to Firefox 3.6 so I suspect
> > > you're on to something - it's /an/ explanation that seems to make some
> > > sort of sense, and so better than my previous `Haven't a clue'.
> > >
> > > > I guess another state must
> > > > have gone in that wasn't there previously.
> > >
> > > How do you mean.
> >
> > well, maybe in 3.6.2 there was another setting that didn't exist before?
>
> In which case, the upgrade process should deal with it seamlessly.

It should. But it didn't, and that is why there should be a bug report.

> But there was no new setting visible in that particular bit of the prefs
> - the same controls at that point that Firefox has had since I started
> using it, and the same controls that iCab has. And probably most other
> Web browsers, if I could be bothered to check.

I doubt it has exactly the same settings, unless they are all built from
the same code.

> > I don't know, I don't use firefox much, but some reason that the
> > settings didn't reflect what was actually the state of your browser.
>
> <puzzled> AFAICT, the settings *did* accurately reflect the control the
> browser exerted over Javascripts.

I thought you said it didn't work even though the settings you had
shouldn't have stopped it?


> > Clearly it existed.
> > You tried several times to access a control and it wasn't accessible. It
> > was a repeatable problem, you posted about it, then you did something
> > else and it was, something that shouldn't have had that effect, so you
> > have a clear problem / solution.
> >
> > That means it is worth reporting.
> >
> > Whether they can recreate it I don't know, but they certainly won't look
> > into it if they don't know about it.
> >
> > It is common in this line of work for someone to say 'when are you going
> > to fix that thing that happens when you do <x>', and you say 'I didn't
> > know there was a problem like that' and they assumed you knew about it,
> > somehow.
>
> Yes, but it's more common for a reported problem to never be fixed and
> for me to get spammed for taking the trouble to make the bug report in
> the first place - spammed hugely for years...

I have had that with a couple of places, although I got off those lists.
I don't know what the firefox people are like.

> So I'm not going to report bugs to an outfit like Mozilla. A one man
> operation, maybe - if they look trustworthy. But I won't make bug
> reports to big projects (erm, TeX-related stuff excepted - the TeX world
> is pretty benign).

One large team I assume is like another.

> > <http://www.theregister.co.uk/2010/03/25/pwn2own_2010_day_one/>
>
> That's one reason I have security add-ons for when I go browsing.
>
> And even with them - well, I've managed to pick up some malware. On the
> other hand, if a Web page (from a space news site - obviously got
> hacked) that I've saved happens to contain a JS that'll clobber Windoze
> via IE 6 and ActiveX and a buffer overflow attack, what do I care?


I have been lucky with a lack of malware. No reason you should care, as
long as it isn't your browser.

--
Woody