Comments for meandering wildly http://blog.johnath.com johnath in blog form Thu, 26 Jan 2012 13:11:15 +0000 hourly 1 http://wordpress.org/?v=3.3.1 Comment on Bringing Android Native Firefox to Beta by Robert Kaiser http://blog.johnath.com/2012/01/25/bringing-android-native-firefox-to-beta/comment-page-1/#comment-216161 Robert Kaiser Thu, 26 Jan 2012 13:11:15 +0000 http://blog.johnath.com/?p=707#comment-216161 To be fair, it actually rides the train, but we're deciding to pick up mail, passengers and cargo while the train is on the go, which can be tricky but we manage. And we'll be extra careful with Beta and Release (i.e. we'll see when the train pull into those stations). But that said, there will no special effort for it to "get back on the trains", we only need to stop picking up things while the train is going. :) The fun is, we're not stopping trains, we're just doing some unconventional things with them, just like you see in the movies. And given what comes out of all this, let's hope it'll be an action-packed, awesome movie with a strong and happy ending! ;-) To be fair, it actually rides the train, but we’re deciding to pick up mail, passengers and cargo while the train is on the go, which can be tricky but we manage. And we’ll be extra careful with Beta and Release (i.e. we’ll see when the train pull into those stations).
But that said, there will no special effort for it to “get back on the trains”, we only need to stop picking up things while the train is going. :)
The fun is, we’re not stopping trains, we’re just doing some unconventional things with them, just like you see in the movies. And given what comes out of all this, let’s hope it’ll be an action-packed, awesome movie with a strong and happy ending! ;-)

]]> Comment on Bringing Android Native Firefox to Beta by Bill Gianopoulos http://blog.johnath.com/2012/01/25/bringing-android-native-firefox-to-beta/comment-page-1/#comment-216158 Bill Gianopoulos Wed, 25 Jan 2012 22:40:16 +0000 http://blog.johnath.com/?p=707#comment-216158 The problem here is that although the native version might not be ready, the move everyone form the xul based nightly and aurora builds to the native ones to get more test coverage on the native builds has resulted in very few (if anyone other than me) testing the xul builds. The problem here is that although the native version might not be ready, the move everyone form the xul based nightly and aurora builds to the native ones to get more test coverage on the native builds has resulted in very few (if anyone other than me) testing the xul builds.

]]> Comment on Bringing Android Native Firefox to Beta by Mark Finkle http://blog.johnath.com/2012/01/25/bringing-android-native-firefox-to-beta/comment-page-1/#comment-216157 Mark Finkle Wed, 25 Jan 2012 21:20:29 +0000 http://blog.johnath.com/?p=707#comment-216157 @Eugene Savitsky Native widget Firefox for Android is really focused on phones, not tablets. That said, please file bugs for the tablet issues you see. @Eugene Savitsky

Native widget Firefox for Android is really focused on phones, not tablets. That said, please file bugs for the tablet issues you see.

]]> Comment on Bringing Android Native Firefox to Beta by Eugene Savitsky http://blog.johnath.com/2012/01/25/bringing-android-native-firefox-to-beta/comment-page-1/#comment-216156 Eugene Savitsky Wed, 25 Jan 2012 21:18:33 +0000 http://blog.johnath.com/?p=707#comment-216156 Latest Aurora builds are unusable at all. Trying on Asus Transformer (first model). Latest Aurora builds are unusable at all. Trying on Asus Transformer (first model).

]]> Comment on Know Thyself – NSID 2011 by Nukeador http://blog.johnath.com/2011/11/30/know-thyself-nsid-2011/comment-page-1/#comment-216107 Nukeador Thu, 01 Dec 2011 10:18:12 +0000 http://blog.johnath.com/?p=688#comment-216107 Wow, each year your initial post about NSID is getting more and more philosofical, we are like the new sophist school of the beards. Wow, each year your initial post about NSID is getting more and more philosofical, we are like the new sophist school of the beards.

]]> Comment on Rapidity by Mozilla: Market Share Isn't Everything | ConceivablyTech http://blog.johnath.com/2011/08/26/rapidity/comment-page-1/#comment-216105 Mozilla: Market Share Isn't Everything | ConceivablyTech Mon, 10 Oct 2011 01:50:19 +0000 http://blog.johnath.com/?p=657#comment-216105 [...] Jonathan Nightingale recently published some notes on Firefox and its competitive field. His thoughts were the most encouraging in awhile [...] [...] Jonathan Nightingale recently published some notes on Firefox and its competitive field. His thoughts were the most encouraging in awhile [...]

]]> Comment on Rapidity by Jason Gates http://blog.johnath.com/2011/08/26/rapidity/comment-page-1/#comment-216103 Jason Gates Sun, 25 Sep 2011 08:26:48 +0000 http://blog.johnath.com/?p=657#comment-216103 Has anyone visited the homepage of https Microsoft.com, because in IE9 it FAILS to provide or show any method to check the SSL certificate as non-secure content is included by Microsoft. I bring this up because in Firefox v6, it does show the SSL certificate, but no method is provided to confirm or validate the non-EV certificate. In addition, I loaded a SSL website that uses a known Fraudulent SSL Certificate Authority for GTE, same used for Microsoft, in IE9, as a test to see if IE9 would detect the invalid signature... IE9 FAILED, but Firefox v6 PASSED the test. The non-EV certificates can be spoofed, Java injection, MITM and worse NOT even Firefox warns the browser end user about SSL certificate mixing, iframe or popup SSL Phishing attacks. It's open season upon the Internet for MITM SSL attacks, especially with DNS redirection. Let's not forget MD5 collisions is another method of attack, which Google ought to insure all SSL certificates are using SHA512... Why isn't Firefox providing a global certificate repository, so nobody needs to depends upon the Microsoft pre-install, pre-loaded certifciate root authority in Windows? Why trust Microsoft who cannot insure Certificate Authorities around the world (thousands of them) who PAID Microsoft to ADD them into Windows? Already 50% of the certificate authorities used in Windows 7 SP1 are UNTRUSTED. And that's the discovered bad ones found, what about the unknown and unreported illegitimate certificates floating around? Everyone needs a honest system here, not a proprietary Microsoft knows best for NOT being a security company. Please do the good thing Google, Firefox and the open source community. Kick out Microsoft, end the security breaches, design a global repository letting everyone update and check instantly who is legitimate. A second benefit here would be to allow everyone to participate, no more PAYING Microsoft to distribute their own root certificates only. You get the idea.... lets see some results, okay? Has anyone visited the homepage of https Microsoft.com, because in IE9 it FAILS to provide or show any method to check the SSL certificate as non-secure content is included by Microsoft.

I bring this up because in Firefox v6, it does show the SSL certificate, but no method is provided to confirm or validate the non-EV certificate.

In addition, I loaded a SSL website that uses a known Fraudulent SSL Certificate Authority for GTE, same used for Microsoft, in IE9, as a test to see if IE9 would detect the invalid signature… IE9 FAILED, but Firefox v6 PASSED the test.

The non-EV certificates can be spoofed, Java injection, MITM and worse NOT even Firefox warns the browser end user about SSL certificate mixing, iframe or popup SSL Phishing attacks.

It’s open season upon the Internet for MITM SSL attacks, especially with DNS redirection. Let’s not forget MD5 collisions is another method of attack, which Google ought to insure all SSL certificates are using SHA512…

Why isn’t Firefox providing a global certificate repository, so nobody needs to depends upon the Microsoft pre-install, pre-loaded certifciate root authority in Windows?

Why trust Microsoft who cannot insure Certificate Authorities around the world (thousands of them) who PAID Microsoft to ADD them into Windows?

Already 50% of the certificate authorities used in Windows 7 SP1 are UNTRUSTED.

And that’s the discovered bad ones found, what about the unknown and unreported illegitimate certificates floating around?

Everyone needs a honest system here, not a proprietary Microsoft knows best for NOT being a security company.

Please do the good thing Google, Firefox and the open source community. Kick out Microsoft, end the security breaches, design a global repository letting everyone update and check instantly who is legitimate.

A second benefit here would be to allow everyone to participate, no more PAYING Microsoft to distribute their own root certificates only.

You get the idea…. lets see some results, okay?

]]> Comment on Rapidity by Tiago Sá http://blog.johnath.com/2011/08/26/rapidity/comment-page-1/#comment-216084 Tiago Sá Tue, 30 Aug 2011 23:49:40 +0000 http://blog.johnath.com/?p=657#comment-216084 Gervase Markham, I see. Thank you for point that out to me, I have heard about the UX-branch, I didn't know there were more... I'll have to rethink my whole stance on the issue now. Have no idea what to think of it... Gervase Markham, I see. Thank you for point that out to me, I have heard about the UX-branch, I didn’t know there were more…

I’ll have to rethink my whole stance on the issue now. Have no idea what to think of it…

]]> Comment on Rapidity by Daniel Glazman http://blog.johnath.com/2011/08/26/rapidity/comment-page-1/#comment-216083 Daniel Glazman Tue, 30 Aug 2011 17:25:45 +0000 http://blog.johnath.com/?p=657#comment-216083 @Randall: correct, but I still don't understand why there is a threat at all... @Randall: correct, but I still don’t understand why there is a threat at all…

]]> Comment on Rapidity by Randall "Texrat" Arnold http://blog.johnath.com/2011/08/26/rapidity/comment-page-1/#comment-216082 Randall "Texrat" Arnold Tue, 30 Aug 2011 08:17:48 +0000 http://blog.johnath.com/?p=657#comment-216082 Daniel, being more interoperable than ever doesn't mean there's no threat... Daniel, being more interoperable than ever doesn’t mean there’s no threat…

]]>