Planet Mozilla2009-11-21 Trunk builds

Fixes:

  • Fixed: 407875 - Unprivileged users are not notified of security updates.
  • Fixed: 260264 - Popups from a site that is in the "Allowed List" (whitelist) are blocked, starting with the n-th popup (dom.popup_maximum).
  • Fixed: 521905 - Make extensions.checkCompatibility be per-application-version. (Mossop's blog post)
  • Fixed: 396392 - Support for getClientRects and getBoundingClientRect in DOM Range.
  • Fixed: 503481 - Implement async attribute of script element.
  • Fixed: 517804 - Try to avoid reflows and new invalidations during painting. (On Mac, this makes warm startup 13% faster.)
  • Fixed: 452319 - border-collapse rewrite.
  • Fixed: 519357 - Only load known components from app directory. (DevNews post)
  • Fixed: 524904 - [Windows] Add support for generic DLL blocklist.
  • Fixed: 525103 - [Windows] Block npffaddon.dll (malware) and old versions of avgrsstx.dll (AVG SafeSearch).
  • Fixed: 497665 - Images are downloaded multiple times if defined multiple times, on Shift-Reload / Ctrl+F5.
  • Fixed: 517224 - Firefox downloads CSS background images that it doesn't need (from overridden CSS rules).
  • Fixed: 77882 - getComputedStyle returns incorrect font-weight value if |font-weight:bolder| or |font-weight:lighter|.
  • Fixed: 512645 - Only clamp nested timeouts.
  • Fixed: 510082 - Silverlight 3 plugin elements don't repaint correctly.
  • Fixed: 520178 - [Windows] Minimized windows appear offscreen when restoring from session store.
  • Fixed: 499816 - [Windows] Minimizing Firefox does not release window focus.
  • Fixed: 440486 - [Windows] The FAX dialog disappear and Fax cannot be done from Firefox, but works otherwise.

mozilla-central pushlog for 2009-11-03 04:00 to 2009-11-21 04:00

Windows builds: Windows nightly (discussion)

Mac builds: Mac nightly

Linux builds: Linux nightly

Planet MozillaDroid Almost Does

I purchased a Droid when they came out.  It's my first Android device, and it's been an interesting experience.  I am not a fan of the iPhone, and I've been using a Blackberry for the past few years (an 8700 first, then the original Curve, then the updated 8900).   The Droid is a great looking device; I like the industrial look, with my only complaint being that the big gold-coloured area on the D-pad is way too garish; it would also have been nice had that area been a trackpad-like virtual trackball.  The keyboard leaves a lot to be desired, though.  It's a physical keyboard, which is nice, but it's no match for a Blackberry keyboard.  Typing on it is slow and cumbersome, given the very wide layout, and some keys are very oddly placed.  (I found it amusing that while the Blackberry has a dedicated unshifted key for "$", the Droid has a dedicated key for "?"...)

The feel of the OS is pretty nice, although some things are more sluggish than they really should be on an OMAP3 device.  Stuart keeps telling me that Fennec has smoother panning in the browser, and I think he's right.  It's not a deal breaker though; I find myself using the browser a lot to do all sorts of things that I never would have considered on my Blackberry (because, wow, the web browser situation there is awful), but that was a frustrating experience on my iPod Touch as well.  I've spent a while "browsing the web" on my phone, which I've never been able to say I've done before.

But, it's still a phone, and while the voice portion isn't all that important to me, the overall communication package is.  Coming from a Blackberry, the overall messaging situation on the Droid is simply horrible.  Email, whether Exchange or IMAP, is a disaster.  The email client seems designed for simple "lol r u there" type of messages, and even the message lists don't seem intended for people who get more than 5 messages a day -- turning a message list into landscape mode is worthless as you only get to see about 3-4 messages in the list (same view as in portrait mode, just along the much smaller axis of the display), no IMAP IDLE support etc. are all very strange on a top-end phone.  Exchange support works ok for Calendar sync, but for email sync it would only download the first 1000 bytes or so of a message, including headers; this meant that I often only got to see the first sentence or two of an email.  I don't know whether this is a problem with the Droid or our Zimbra Exchange connector, but switching to IMAP for work mail fixed that problem.

An recently-released version of the open-source K9 Email Client that works on the Droid resolves many of these issues, though it needs some polish.  I might write some code there, since it's close to becoming a pretty good email solution.

The Gtalk client is probably in worse shape than email.  It's almost as if Google entirely ignored Gtalk on this device (and I can't believe that would be Verizon's fault, since things like Google Voice work just fine).  First, it's in general buggy -- it's crashed on me multiple times, often freezes when returning to it from another app (after clicking a link to the browser, for example), and often shows contacts as offline with a big red message despite the contact clearly having a green dot next to their name and responding to my messages.

In the browser and in other apps, you can share a web page with someone using a "Share with" button.  The list you're presented is conspicuously missing Gtalk, despite having Facebook, Email, Messaging (SMS) and a random Twitter client I installed on there.  What gives?  All of these features are available on the Blackberry; I'm not sure if it was RIM that did the Gtalk app there, but can we get whoever it was to rewrite the Android one?

One of the best things about the Blackberry is the unified messaging; there's a single view where I can go to see all my emails, my gtalk conversations, my SMS messages, app updates, and whatever else.  No such thing exists on Android.  The closest thing is the notification bar, which requires a swipe down to use, and then only shows things that have come in since the last time you looked.  I'd prefer a more time-based list that contains both old and unread items.  Sounds like the Sony-Ericsson X10 might be doing some interesting things there, and I hope that someone figures out how to create an app like this.  What it comes down to is that anything to do with communication is faster and simpler on my Blackberry, which is really strange; you'd think Google would have spent some time working this out, as everything else about the device is far superior to my 8900.  I understand that more "enterprise oriented" customers (which apparently means those that like to use email a lot?) aren't necessarily the target market here, but they could've really attacked that market with some simple work that wouldn't have affected anything else.

The good news is that all of these are fairly straightforward software issues.  The hardware is solid, and Google has shown that they'll do frequent upgrades of the OS.  Given that the Droid is a "Google Experience" device, those updates should find their way to the device quickly.  Some fixes, combined with getting Firefox Mobile on the Droid and other Android devices, will make this a great phone.

Planet MozillaOpen Source Education in Brasil

Last Summer I got the chance to visit several Universities while traveling around Brasil. One of the stops was to meet up with Prof. Fabio Kon and students at the University of Sao Paulo and the FLOSS Competence Center. For...

Opera Desktop TeamSomething for the weekend?

Isn't it nice getting builds? So nice in fact we thought you might want one for the weekend! ;)

The main fix here is to DSK-271546 (After signing up for a new account, Opera isn't automatically logged in after restart), so please make sure this is working for you.

Thanks in advance for the testing!

Download

Planet MozillaMozilla Launches Facebook Security Quiz

Picture 2

Are you up for the challenge?

This week Mozilla launched the security quiz on Facebook. We encourage you to take the quiz and see how much you know about web security!

Similar to our plugin checker, the security quiz is a part of our larger effort to raise awareness about web security.

Help us spread the word and make the web safer for everyone. And don’t forget to check your plugins!

Planet MozillaStatus update

Was stubbornly fighting the flu for part of the week, so I didn’t get as much done this week as I had hoped.

Tab matches in Awesomebar

Status

Loose ends

  • Waiting on feedback

Next steps

  • Unit tests
  • Respond to feedback

Target for next week

  • Unit tests

Binding for untrusted text in security dialogs

No change.

Miscellaneous

  • Helped with some lightweight theme bugs for 3.6

Reflections

  • Sometimes, there is no good solution. But there is a best solution.

Related posts:

  1. Status update
  2. Status update
  3. Status update

Planet MozillaRaindrop & Jetpack

The other day I did a quick hack using Raindrop & Jetpack to get new mail notifications from Raindrop.  In total it took me less than an hour.  It’s no Joe Shaw hack, so I don’t expect to get in the paper for this but I figured I’d share anyway. :)

This Jetpack checks Raindrop to see if there are new messages and bubbles them up as notifications if there are.  Here’s the source code:

var messages = {}; 

function checkMail() {
 var api="http://localhost:5984/raindrop/_api/inflow/conversations/home?limit=10";
 jQuery.getJSON(api,
               function(data, textStatus){
                 jQuery.each(data, function(i,item){
                   if (item.unread) {
                     if (!messages[item.id] || messages[item.id] != item.messages.length) {
                       var n={title: item.subject,
                              body : item.messages[0].schemas["rd.msg.body"]["body_preview"],
                              icon : 'http://localhost:5984/raindrop/inflow/i/logo.png'};
                       jetpack.notifications.show(n);
                     }
                     messages[item.id] = item.messages.length;
                   }
               });
 });
}
setInterval(checkMail, 10000);

To try this out you’ll need Raindrop installed and running and Jetpack installed in Firefox.

Go to about:jetpack and copy the above code into the Develop tab, then click the try out this code link just below the Bespin editor.

If you don’t want to do all that you can just watch the video below (no sound, so you might want to play some music)

<object height="304px" width="650px"><param name="allowfullscreen" value="true"><param name="allowscriptaccess" value="always"><param name="movie" value="http://vimeo.com/moogaloop.swf?clip_id=7733464&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1"><embed allowfullscreen="true" allowscriptaccess="always" height="304px" src="http://vimeo.com/moogaloop.swf?clip_id=7733464&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1" type="application/x-shockwave-flash" width="650px"></embed></object>
View on Vimeo.

Planet Mozillaupdate on HTTPS security

Version 2.0 of my Force-TLS add-on for Firefox was released by the AMO editors on Tuesday, and in incorporates a few important changes: It supports the Strict-Transport-Security header introduced by PayPal, and also has an improved UI that lets you add/remove sites from the forced list. For more information see my Force-TLS web site.

On a similar topic, I've been working to actually implement Strict-Transport-Security in Firefox. The core functionality is in there, and if you want to play with some demo builds, grab a custom built Firefox and play. These builds don't yet enforce certificate integrity as the spec requires, but aside from that, they implement STS properly.

The built-in version performs an internal redirect to upgrade channels -- before any request hits the wire. This is an improvement over the way the HTTP protocol handler was hacked up by version 1 of Force-TLS, and doesn't suffer from any subtle bugs that may pop up due to mutating a channel's URI through an nsIContentPolicy. I'm not sure that add-ons can completely trigger the proper internal redirect, since not all of the HTTP channel code is exposed to scripts, and add-ons would need to replicate some of the functions compiled into the nsHttpChannel, opening up a possibility of obscure side-effects if the add-on gets out of sync with the binary's version of those functions.

Edit: The newest version of NoScript does channel redirecting through setting up a replacement channel in a really clever way -- pretty much the same as my patch. It replicates some of the internal-only code in nsHttpChannel, though, and it would need to get updated in NoScript if for some reason we change it in Firefox.

Planet MozillaReady for your close up?


Are you a Firefox fan?  Or even better, a Personas fan?  If so, we’d like you to star in a video we’re creating to showcase Personas.  Here are the details:

  • Date:  Monday, November 23, 2009
  • Time:  12:00 p.m
  • Location:  Mozilla HQ, 650 Castro Street, Suite 300, Mountain View, CA 94041
  • Sign up sheet (create an account to add your name to the wiki or comment below to sign up)

Come as yourself – no fancy costumes needed – and meet other Firefox fans.  We’ll treat you to lunch and make it worth your while!  And, we promise none of these antics…

Jump up and Dance by Gary Pauck (Firefox Flicks)

Planet MozillaDehydra Testsuite Passes on GCC 4.5

I spent couple of days fixing the remaining test-suite failures on GCC 4.5 trunk for Dehydra. Since the last time I looked into this, GCC went from crashing all over the place to only crashing if I did something bad. It was nice to discover that as a result of switching to 4.5 Dehydra users will get saner .isExplicit behavior and more precise location info.

Treehydra will take more work due to me misunderstanding GTY annotations.

By the way, I am really grateful for all of the people who contributed GCC 4.5 fixes so far. You guys have been a big help in getting Dehydra testsuite to 100% on 4.5. Looks like I will meet my goals to finish De+Treehydra by the end of the year in time for GCC 4.5 release and my “Introducing Dehydra to the Developer World”-type talk at LinuxConf.au.nz 2010.

Startup
I reduced my focus on startup speed at the moment to catch up on Dehydra. I plan to work on reducing xpconnect overhead during startup next, ie more of this bug.

Planet MozillaFirefox Startup Performance Weekly Summary


Current numbers are available on the Performance Snapshot page.

Summary, relative to Firefox 3.5:

  • Warm startup: For Mac, 36% better on 3.6 and 35% better on 3.7. For Windows, 5% and 5%. Flat on Linux. Also, Warm startup for Mac on 3.6 is a whopping 13% better than last week, due to the landing of bug 517804.
  • Cold startup:  For Mac, 20% better on both 3.6 and 3.7. For Windows, not measuring yet. For Linux, we’re seeing a regression of ~9% across branch and trunk in the snapshot but not on the graphs, so I need to figure out where the discrepancy is.

This week’s activity:

  • Dirty-cold-Ts went live this week, thanks to Alice and Lukas. Example: cold startup with a large places.sqlite on Mac.
  • Joel is making progress on making a super-static Firefox in bug 525013.
  • Ben is making progress on the fastload replacement in bug 520309.
  • No updates on Windows cold-startup testing for Talos on bug 522807. I need to test on Vista, and turn off Pre/Superfetch.
  • Taras has patches up for service caching (bug 516085) and super-fast-path-ing of Components.* (bug 512584), however the latter he’s hit a wall, passing on to Blake or someone else who knows that code.
  • Ted landed rebasing on Windows in bug 484799.
  • Jonathan Kew has a new patch in bug 519445 for further reductions in Mac startup time spent in font system initialization, just about there…
  • Ryan Flint put a patch to minify JS on bug 524858, not working yet, but significantly reduced the size of shipped JavaScript files.

Projects in a holding pattern:

  • JARification: David abandoned moving JS modules into a JAR file, since those files are fastloaded. However, since we want things like post-extension-install restarts to be fast, and those cause fastload cache invalidation, we might want to do things like this anyways. I filed a bug for the same treatment for components. These are lower priority, since they’re not the normal startup case. Follow along with all JAR-ification via the tracker bug.
  • Startup Timeline: No updates, still not landed. Add [ft] in the whiteboard of your bug w/ the function names you want timed and David will generate it and update the bug.
  • Static Analysis: No progress on bug 506128. David needs to file a bug with the final log of named-yet-uncalled functions.
  • Dirty Profile Testing: No progress. Need to list scenarios, file bugs for each, generate Talos config patches and profile data, and then move it into Rel-Eng territory. Also, need to get a separate Tinderbox tree, since it’s going to cause a bazillion new columns.
  • Joel Reymont noted in bug 513076 that there are serious drawbacks to getting our libraries in the dyld shared cache on Mac, so has deprioritized that work.
  • No updates on Zack’s CSS parser changes in bug 513149.

As usual, more details and links are available on the project wiki, and we’re available to answer questions in #startup on irc.mozilla.org.

Planet MozillaProduct Shots of Firefox on N900


CNET UK recently reviewed Firefox running on the Nokia N900 (see Firefox Mobile on Nokia N900 hands-on photos: Fire in your trousers).  I liked their  product shots of Firefox in action (who wouldn’t?) and wanted to share some of those shots with you all today.Nice pic of the Firefox start page.  We’ve incorporated a mini animation to help guide first-time users to navigate around the UI.

…A quick slide to the right reveals open tabs in thumbnail view so you can easily see what website you want to select. Tap on the corner of the thumbnail to delete the open tab, or tap on the button below to open a new one.

…A quick slide to the left shows the stowed away controls: bookmarking, back and forward, as well as preferences. Bookmark a page you like with one touch and edit the tag if you’d like.

Next to the new tab button is the WeaveSync button. Tap on that button and WeaveSync synchronizes and delivers your open tabs from your PC.  This is a great example of how you can work away at your desktop, get up and go, pull out your mobile, and have everything waiting for you (browsing history, saved passwords, bookmarks, as well as open tabs) just as you had left it.

By tapping on the Tools button and going to your preferences in Firefox, you can select the add-on button to search and install your favorite add-ons from your mobile device.  You can also manage your search engines here that appear at the bottom of the screen when you’re conducting a search with the Awesome Bar.

Ah yes, the glorious Awesome Bar in action. We know typing is hard so the Awesome Bar helps you get where you’re going in only a few keystrokes. With WeaveSync, the Awesome Bar gets that much more powerful as it recalls your browsing history from both your PC and mobile. See the search engines below so you can narrow your search further. Quick access to Wikipedia gets me one step closer to winning Bar Trivia Night. ;)

Hope you enjoyed the photos…I know I did. I’ll continue to post the latest and greatest screenshots on my Flickr stream: http://www.flickr.com/photos/missylooney/

 

Planet MozillaIE’s XSS Filter Creates XSS Vulnerabilities

Internet Explorer 8’s famous XSS filter can be exploited to perform successful XSS attacks against web sites which would be otherwise safe. In other words, XSS “protection” is helping XSS attackers, oh the irony.

Well, this is not exactly news among security researchers, but those aware of the details (including Microsoft of course, Eduardo “Sirdarckcat” Vela and myself) have kept a low profile so far. Check, for instance, slide #17 in my OWASP presentation, given two weeks ago.

However, after Microsoft left it unfixed for many months, someone apparently decided to whisper this dirty little secret in Dan Goodin (The Register)’s ear.

To Microsoft’s credit, this problem has no quick fix: in fact, it’s way worse than a simple implementation bug. Its root is a flawed design choice: when a potential XSS attack is detected, IE 8 modifies the response (the content of the target page) in order to neuter the malicious code. This is, incidentally, the only significant departure from NoScript’s approach, which modifies the request (the data sent by the client) instead, and is therefore immune.

Anyway, here’s the juice: IE 8’s response-changing mechanism can be easily exploited to turn a normally innocuous fragment of the victim page into a XSS injection. The attacker just needs a certain degree of control on the content of the web site to be injected: social networks, forums, wikis and even Google Apps are good prey. To be fair, Google Apps are not vulnerable anymore, since Google’s properties wisely choose to deploy the X-XSS-Protection: 0 header, which is the “safety switch” disabling IE 8’s XSS protection.

So, web site owners’ dilemma is, opt out or not opt out?
For browser users, there should be no dilemma at all ;-)

Planet MozillaApp update status – week of 11/20

It has been a good couple of weeks. There are several bugs I am relieved that are now fixed for Firefox 3.6… especially that we now check if Firefox is in use prior to updating and prevent launching Firefox during an update. Also, checking for updates for users that aren’t able to apply updates. Beltzner did his usual beltzner thing by catching what I see as a major usability flaw in that the original patch notified users repeatedly for the same release until Firefox was upgraded which I was able to fix. I’m still kicking myself for not catching that myself.

Progress:


  • WOOT! Landed on trunk and 1.9.2 branch – Bug 407875 [Toolkit] – “Unprivileged users are not notified of security updates [All]“. The next bugs to fix that are similar are the dependent bugs of Bug 318855 [Toolkit] – “App update should provide method to update when the user doesn’t have privileges [All]“.
  • Landed on trunk and 1.9.2 branch – Bug 510501 [Toolkit] – “not granting UAC permission to updater.exe causes full update to be downloaded [Windows]“. The next bug to fix that is similar is Bug 336267 [Toolkit] – “If software update is disabled or “ask” after an update has been downloaded, the update should be disabled or asked [All]“.
  • Created a wiki page for the work on Bug 410639 [Toolkit] – “Provide ability to change update channel within the application [All]” and emailed dev-apps-firefox / dev-platform (followups to dev-apps-firefox) for this proposal.

Future targets (short work week so no way this will all get done):


  • Bug 336267 [Toolkit] – “If software update is disabled or “ask” after an update has been downloaded, the update should be disabled or asked [All]“
  • Investigate Bug 526441 [Toolkit] – “Unable to use FileUtils.jsm in nsExtensionManager.js.in on 1.9.2 due to reftest failures”.
  • Yes, I still need to blog about the lessons I’ve learned while trying to improve startup time for app update but the Firefox 3.6 took precedence.
  • Investigate Bug 529948 [Toolkit] – “Cannot check for updates on trunk when the download server is down” along with its friends

I’m taking Wednesday off so next week is a two day work week for me since Thursday and Friday are holidays.

Planet Mozillahy-AM (Armenian) moving forward

Robert Sargsyan has been localizing Firefox into Armenian for a really long time through Narro.
He recently has contacted me to get things rolling since he has translated 98-99% (94% according to compare-locales) of the strings.

It is now my turn to get into the technical details and move it to mercurial. These are the steps that we have taken:
  • Robert ported the strings from 3.5 to 3.6 (Narro allows you to do this)
  • Through Narro's interface I exported the project and downloaded the zip file that it generates
  • I checked out my clone of the Armenian 1.9.2 tree
  • I overwrote my tree with the contents of the zip file
  • I run compare-locales like this:
    compare-locales /Users/armenzg/moz/repos/mozilla-1.9.2/browser/locales/l10n.ini .. hy-AM-1.9.2
  • I removed the files that were indicated to be removed
  • I pushed my changes to my repository
What comes next (if I am not mistaken)?
  • generate a langpack
  • submit it to AMO (submit page)
  • promote the add-on
  • get people's review
  • convince drivers to give us commit access
  • push the changes to the official Mozilla hy-AM repositories
We won't make it for 3.6 and I can't wait to see what the future holds for this language.

Big thanks to Serge!



Creative Commons License
This work by Zambrano Gasparnian, Armen is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Planet Mozillalibconic package needed for Maemo builds has been deployed

Thanks to puppet we were once again able to fix this easily.

All that puppet told the slaves to do is to run this command:
 su - cltbld -c '/scratchbox/moz_scratchbox -p apt-get --yes --force-yes install libconic0-dev'
 

What I did to fix this was:
  1. Check that a staging slave does not have that package "pkg-config conic --libs"
  2. Check that the file "targets/CHINOOK-ARMEL-2007/usr/include/conic/conic.h" does not exist
  3. Install it using a similar command that was used in a previous bug
  4. Check that "pkg-config conic --libs" returns what is expected "-lconic -ldbus-1 -lgobject-2.0 -lglib-2.0"
  5. Check that the conic.h exists where expected
  6. At this point we have a clear command to run by puppet and a "creates" argument.
  7. Deploy the patch in the staging-puppet server
  8. Login to another staging slave as root and run "puppetd --test --server staging-puppet.build.mozilla.org"
  9. Do checks 4 and 5 to see that the puppet changes took place
  10. Ask for review
  11. Commit and deploy to production-puppet
  12. Check a production like in step 8 and 9
  13. Check an hour later if a random slave has the change as well
Thanks to mfinkle for having written such a good description of the bug.

If you want to read more details check out "Bug 529462 - Add libconic package to Maemo build slaves"



Creative Commons License
This work by Zambrano Gasparnian, Armen is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Planet MozillaCommit Access Policy Draft

Currently, Mozilla has a large number of code trees in various source code management systems, many of which have differing requirements for access. This is confusing and difficult for both developers and administrators. This document is the first draft of a vision for what a unified commit access policy might look like. Having a clear commit access policy makes the lives of developers and administrators alike easier. ...

This new unified Commit Policy is likely to need careful review and improvement; I've been working on this for a while now but I'm still sure I haven't got it right first time. Comments welcome in mozilla.governance.

Planet MozillaAMO getting serious about add-on security

Good news: AMO is finally getting serious about improving security of add-ons. Several bugs that I filed almost a year ago and didn’t have time to follow up on have suddenly seen some movement, even to the point of setting a two weeks deadline to resolve the security issues (thanks, Jorge). Sure, this approach won’t make you new friends and one add-on author preferred to remove his add-ons rather than fix them. But it is really overdue to start enforcing policies.

One particularly sore point are RSS feed reader extensions, every time I look into one I find security issues. In my understanding, an extension that regularly deals with untrusted content from the web should implement two security mechanisms:

  • Input sanitizing: remove any potentially dangerous content from the RSS feeds, particularly make sure no active content (JavaScript, Flash etc.) is allowed. Blacklist approaches like “allow everything but SCRIPT and OBJECT tags” aren’t worth anything because with something as powerful as HTML they are always easy to circumvent. It has to be a whitelist approach, there should be a list of tags and attributes that are allowed and everything else would be removed. Fortunately, nobody needs to implement this from scratch, Firefox already has the code necessary built-in and uses it for feed display rather successfully.
  • Just in case that the input sanitizer fails the feed reader should display the feed content in unprivileged context and establish a security boundary between it and browser’s chrome. I’ve written about this before.

With these two mechanisms the extension would be very unlikely to expose a security hole due to a developer mistake. Sadly, I’ve yet to see an RSS feed reader that would implement both, most didn’t even implement one properly. I hope this will change now.

Update (2009-11-20): Ouch, for Sage this comes too late. I filed a bug on this vulnerability in June 2008. So much on “We will be rewriting the sanitizer to use the Gecko parser” (the famous last words).

Planet MozillaDear ISPs

Dear ISPs,

By far the largest set of support requests that we end up seeing for Thunderbird have to do with being unable to receive or send mail. By far the largest single cause of these failures is some unilateral change by the ISP which cause previously working configurations to stop working. In other words, people come to us for help solving problems we can’t solve. It makes us feel bad, it makes you look uncaring, and it certainly doesn’t help your customers (except for those cases when we go beyond the call of duty and help them as neighbors would, guiding them through the diagnostic & fix).

In our next revisions of Thunderbird, we’ll probably work on making our error dialogs better, so that we transmit whatever wisdom we can to your users to give them a fighting chance. But we can do better for your customers, if you get involved.

Let’s figure out how to work together to provide better experiences for your customers and our users. I’m quite sure that we can come up with solutions which would save you costs compared to having your customers tie up your tech support lines only to be rebuffed by your staff who often don’t understand how email systems work. It might also help you avoid commoditization…

Here are some ideas to start the conversation going:

  • Let’s make sure that our configuration of ISP databases works for as many users as possible. We’ll likely need to evolve the format and protocol over time, but we can only do that with input (some ESPs have already joined the effort, which is great!).
  • Consider making a useful add-on that would let you inform your customers of planned service downtime, configuration changes, etc. (no marketing messages, please, or your customers will not use it).
  • If there are changes we could make in Thunderbird that would help you help your customers, let’s talk!.

Together, we can figure out how to get your customers setup with a Thunderbird that works for them, for us, and for you.

Looking forward to a productive conversation,

– David Ascher
(dascher at mozillamessaging)

Planet MozillaWhat’s up w/ MozFdn – November Update


Here is a brief status update that I shared with the Mozilla Foundation board last week. This report is based on team goals outlined here.

In addition to Drumbeat, the last two months have focused communications and community support as well as launching a new education initiative. Highlights include:

November and December will continue to focus on early Drumbeat roll out and web development, as well new fundraising push built around the Namoroka park, which is the Firefox 3.6 namesake.

Program

2009 team goal: develop a small handful of programs that go beyond software as a way to promote Mozilla’s mission (e.g. education).

  • Core Mozilla Education work with colleges and Mozilla community grew as expected in late summer and early fall.
    • Mozilla-related courses and activities now underway at 13 schools on five continents, with participation from ten professors and almost a hundred students. Students working on  Bespin, GCC optimization for Mozilla, Gecko, WebGL, Fennec, Firefox, Thunderbird.
    • Processing for the Web project particularly successful, energizing students to work on WebGL and Firefox. Ten students from Seneca College and Université d’Evry.
  • Received grant from MacArthur to fund Jetpack for Learning, a mashup of Mozilla Education and a Mozilla Labs design challenge. Launched challenge in late October.
  • Planning and early work on Drumbeat moving quickly, especially in late October. Web site mockups and year one plans have been posted, and first projects and events scheduled.

Communications

2009 team goal: dramatically increase awareness of Mozilla’s mission and public benefit nature amongst the broader public.

  • Ran Mozilla Service Week and OneWebDay campaigns in September. Significant community contributions and enthusiasm, although not as much as hoped in some regards.
  • Pointed one of five snippets on google search page to new ‘Better Internet’ page on mozilla.org, aiming to increase awareness of Mozilla’s mission.
  • Initial version of new engagement and fundraising database delivered by vendor, almost operational.

Community

2009 team goal: improve the Foundation’s ability to support, strengthen and grow the Mozilla community.

  • New Get Involved  page launched on mozilla.org and community-wide contribute group established to make it easier for new people to get contribute to Mozilla.
  • Improvements made on a number of project governance fronts including: new Committer’s Agreement, commit access policy harmonization, dormant accounts.
  • MoFo-led Bugzilla Innovation Project made first release of web-friendly API, second release almost ready. One client has already been written to use it.

Organizational Development

2009 team goal: consolidate and strengthen the Foundation team, and develop a long term vision that clarifies the Foundation’s role within Mozilla.

  • Most organization development efforts in last two months focused on Drumbeat planning, and developing budget and goals for 2010.

Posted in mozilla

Planet MozillaOpera widgets without Opera... #3

YAY !!! Still a lot to do but it starts looking ok !

wima and 3 widgets

Planet MozillaLast chance! Planet Mozilla Survey

I’m going to be closing the Planet Mozilla Survey this afternoon, so if you haven’t had a chance to respond to it yet, please do so ASAP! You can find the survey here:

Planet Mozilla survey.

Thanks!

Opera Desktop TeamUnite fixes and Opera Link

We're continuing our polishing of Opera 10.10, so here's a new build with some important fixes.

Opera Link should be working without having to log in every time you start Opera. We have also fixed a crash in the Unite setup wizard, and fixed a bug where the Unite password is remembered even if "remember password" is unchecked.

The default message in Opera Mail is now translated again.

Download

Planet MozillaOpera widgets without Opera... #2

I have created a window gadget to manage widgets.

wima gadget

Planet MozillaFosdem 2010: Fighting with the beast

Here is the abstract of my talk proposal for Fosdem 2010:

20 years have passed since the fall of the Berlin Wall. But in many places it still exists in the minds of the people. New Europe is still fighting proprietary software and the FOSS application is still very limited.

The presentation deals with the application of FOSS in several countries from the Balkans and Central Europe, what is going on with the software patents, the open source browsers’ market share and the open standards.

Examples will be given for talks with the governments on the subject. The new and important topic of open digital government, in which everyone can participate on the principle of open source and open interfaces, will also be tackled.

In about 40 minutes the Speaker will present how freedom enters in this part of Europe, even only in its technological aspect.

In the beginning there will be a demonstration, representing the results that can be achieved through the use of open standards in Europe.

Planet MozillaHelp us test search on SUMO (support.mozilla.com)

We're in the process of switching to a new (and improved) Sphinx-based search engine on SUMO (support.mozilla.com), and would *love*...

Planet MozillaReplay Debugging mochitest failures with VMWare Workstation 7

Ever since my last escapades with Replay Debugging in VMWare Workstation 6.5, I've been looking forward to improvements in this awesome technology. Thankfully the guys at VMWare have been hard at work, and now VMWare Workstation 7 now boasts improved Replay Debugging. I've found it much more robust and reliable, and Roc and I have already used it to debug some random orange bugs.

I've documented how to produce a Replay Debugging setup for debugging intermittent test failures in Mozilla mochitests, and put it up on MDC:

https://developer.mozilla.org/En/Debugging/Record_and_Replay_Debugging_Firefox

Now anyone can setup a machine to record and replay debug intermittent mochitests! A word of warning: you need a modern CPU in order to get good performance. I had poor performance when running on my two-year-old Core2Duo laptop, but replay performance is almost at real-time speeds on my shiny new Intel i7 950 box.

I still have two patches that need to be refined and then checked in, to facilitate replay debugging. The first enables the mochitest harness to loop forever on a test directory. The second enables you to set break points on specific JavaScript dump() calls, so you can break during replay close to where the action is.

We're far from having a fully automated record and replay setup, but we've made a start!

Planet MozillaNew Reports Furnish Metrics to Our Localization Community

From the hard work by Mozilla’s Metrics team comes localizer metric reports that will show growth and usage data for each of our Firefox locales.  The l10n-drivers team has been asking in meetings if we could show the impact that our volunteers are having with reports like the one sampled below.  If you click the following link you will download a sample report.

Initially, I sketched out what I thought would be valuable information for the report, ran it by the l10n-drivers, and sent it to the metrics team to start implementation.  In my opinion, an effective report provides both download and active daily user information to our localizers about their locales AND the geos in which their locales are being used.  Let’s review the contents for those who might need a guide.  Feel free to reference the attached screen shots as you read.

Locale-specific information

We are presenting both the download and active daily user (ADU) information (usages statistics and pie charts) for versions of Firefox.  ADUs are based on the blocklist pings we track.  (More on blocklist can be found at Mogamic’s post.)

Geographic-specific information

Each report will show both the download and blocklist for the top five locales inside a country where the localizer’s translated Firefox is most prominently used.  In many cases, this is easy to map.  Locale code “fr” is probably most prominently used in France.  “de” in Germany.  “es-ES” in Spain.  In some cases, we’ll have to make guesses, like for our Kurdish localizers.   Finally, we will provide a list of the top ten countries (by average blocklist pings) where the localizer’s Firefox is being used.

For the first time, our community of l10n volunteers will have a more comprehensive set of data points to help measure the progress and spread of their work.  By providing both locale and geographic information, these reports illustrate the impact that each localization teams is providing.

Below are two images of a sample two page report.

Sample Localizer Report (page1)

and

Sample Localizer Report (Page 2)

ShareThis

Planet MozillaPalm Pre: Always hot

So I borrowed a Palm Pré that we had at Mozilla to see what it was like. I was at first very excited, I remember before the Pre was released there was a lot of talk about how awesome-fantastic it was going to be. The stories of awesomeness sort of died, and I had thought nothing of it.

Immediately upon using the Pre I figured out why. In short, it's a crappy phone. It makes a very good attempt to do a lot, but it does them with such piss-poor performance, that nothing good is noticed.

I am disappointed. It's not even in the same class as an iPhone - maybe a future generation of Palm devices will be, but not this one. I was hoping WebOS would be a good alternative to the iPhone. It looks like Google will be doing that, though their phones haven't impressed me much either. I am hoping that maybe this phone is just a dud.

Here's what I didn't like: * The Palm was always hot. * The first run experience is painfully slow. * The first run was an indicator of things to come, startup and shutdown are ridiculously slow. * Every application is slow to render. * Not all elements of an app render. * The keys are too small. Some people aren't migrating from a Treo and aren't used to mini keys. * No soft keyboard. * The palm website doesn't let you use plus-style addressing * Media Mode was not self explanatory - and forced the phone to not work. * Network would constantly drop out. Couldn't use a lot of the data features. * Phone calls didn't work so great. * Did I mention it was ass slow, even the dialing program was slow. * The battery dies quickly * I could only cut/paste when composing, but I couldn't cut a string of text from an email. * Felt too much like an old palm

Despite the sadness there were a few good things:

  • When it did fetch email, and other notices, it displayed them nicely
  • The unification of Facebook and Gmail was pretty cool - it also made me want to trim some of those friends from highschool off my facebook - I ain't ever gonna call em.
  • The Icons were pretty.
  • The card interface was interesting.
  • The travel charger could be modified to work in non US chargers fairly easily.

All in all, I'm glad that I had a chance to try out this device. It showed me, that user interfaces above all need to be very fast and responsive. Furthermore, everything you try to do should be done exceptionally well. I'm hopeful that software updates can alleviate some of the problem, but I think the root of the problem is slow hardware.

Planet MozillaIs Firefox Approaching 50% Market Share?

At least in one large region of the world, the answer is “yes”.

The folks at Gemius have been kind enough to aggregate their individual country data (e.g., www.en.ranking.pl/) into a single view across their entire sample – a sample totaling more than 60 Billion page views each month.  For an overview of the various market share providers and their samples, please read here.

We’ll eventually look to expand the conversation around this data, but for now, we’ll highlight just one breathtaking view.  The chart below shows weekly browser market share data since the beginning of 2007 and it includes aggregated data from across nine countries – Czech Republic, Bulgaria, Estonia, Hungary, Lithuania, Latvia, Poland, Russia, and Ukraine.

gemius_aggregate

Planet MozillaFennec Quality Update – The Team MOQA Effect


It’s been awhile since the last Fennec QA Update by Joel, so we felt that now was as good a time as any to provide another update. This is especially true as we’re getting closer to a final release with the Fennec 1.0 Beta 5 out the door now. Team MOQA has been really busy making Fennec the best mobile browser it can be over the past few months. With all the effort we’ve put in for quality execution on manual and automated testing, we knew the project was getting somewhere. But we had no idea how far until we started playing around with Bugzilla’s report charts tool. Here’s what we found:

Basically, we literally and figuratively went crazy in August and September with the number of bugs verified, but it opened up a whole bunch of usability issues in the project that started to bring the quality of the project around in October. The number of bugs fixed per week in the project before August was 7-8, but since August its gone up to 37-38. Now, this can be attributed to a whole bunch of things, but at the end of the day a person has to ask themselves if the overall quality of the project they’re working on has gotten better through their hard work. I think its safe to say that such a huge jump in bugs in a fixed state was attributed to developers having a larger number of bugs to work on that could be fixed…and that’s something we can hang our hats on.

With that said, we’re not done yet. Team MOQA has a couple more things up our sleeves that will really shore up some of the loose ends relating to quality and they’re coming hard and fast. So be ready for some hawtness with your Mozilla-powered mobile browsing in the near-future.

Things to Look For:
- WinMo Talos up and running soon
- Developing an extension to developer browser-chrome tests

Things Done:
- A robust system to move test and performance automation to any new platforms that crop up in the future (oh, and they will on the mobile front).
- xpcshell unit tests up and running
- We now have Release Test Tracking Pages for every release
- A String Guide (It’s a subgroup within the testrun) for localizers to find Fennec UI elements that correspond with the strings they localize in .dtd and .properties files within the mobile-browser source code.

Raw Stats (By Team MOQA since Joel Maher’s last Fennec QA Update on 6/30/09):
- 1092 bugs verified
- 276 bugs filed
- 64 Bugs filed in Testdays

Planet MozillaMozilla Security Quiz Live on Facebook!

Today, we released the Mozilla Security Quiz to the world! We're very excited to share the application with everyone.

You can go take the quiz here: http://apps.facebook.com/mozillasecurityquiz

Months ago, we sat down to talk about how - in addition to the work we were doing with security research and technical communities - we could have a direct role in educating users about online security. We saw an opportunity to communicate information that we felt was very important - key tips for keeping people safe online.

While we were working through the concept, the marketing and web development teams were in tight coordination with Mozilla's world-class security experts to make the survey adhere to Mozilla stringent privacy requirements. Where most Facebook applications allow developers a lot of access to personal data, we wanted to collect as little information as possible. In fact, we only wanted to see how people did on the quiz, we didn't care about location, gender, education, etc. To make sure we weren't collecting any secondary information, we hashed the Facebook user ID. This means that neither Mozilla, nor anyone else, can tell who answered which questions or what their responses were.

Please go check out the quiz and let us know what you think!

Big thank yous to:
Sarah Doherty
John Slater
Mike Morgan
Johnathan Nightingale
Brandon Sterne
Laura Mesa
AllWidgets
Elise Allen

Planet MozillaGo Take Our Mozilla Facebook Security Quiz!

I’m really excited to announce the launch of the Mozilla Facebook Security Quiz!

A few months ago, we sat down with our security team to talk about how we could reinforce our thought leadership beyond security research and technical audiences and have a direct role in in educating users about online security.

At Mozilla we are always interested in new ways of reaching our audience and directly communicating.  With our Facebook group reaching close to 600,000 members, we thought this was a unique way to get in front of our non-technical web users (regardless of what web browser they use) and share some great information on how to help stay safe while browsing.  Since this is our first foray into the world of Facebook applications it will not be localized and will only be available in English.

Most Facebook applications are notorious for capturing lots of user data.  One of the coolest things about our app, is that we have made sure that there will be no personal data captured by Mozilla.  We even go the extra step of hashing out the Facebook user ID.

Like all projects, this was a wonderful collaboration from many people both internal and external to Mozilla.  I wanted to give a huge thanks to our security and web dev teams, AllWidgets, Elise Allen, John Slater, Melissa Shapiro and Mike Morgan, Jonathan Nightingale, Brandon Sterne, and Laura Mesa.

So please, go out and take the quiz.  Share it with your friends.  Post to Twitter and your favorite social networking sites and let’s get this party started!

Planet MozillaTake the Mozilla Security Quiz on Facebook!

This afternoon, we’re excited to release a brand new Mozilla application on Facebook. The app is a 5 question quiz designed to teach users some quick tips about how to stay safe online.  At the end of the quiz, you’ll be prompted to go check out our newly refreshed security page on the Mozilla website.

Facebook applications are notorious for capturing lots of data about the user.  That’s simply not how we roll at Mozilla. We took the extra step of hashing the facebook user ID to ensure that if you take the quiz all of your personal data will stay with you.  The only thing we’ll know is how quiz-takers (in aggregate) scored on the quiz.

Go take the quiz and find out if you’re a security ninja or a security newbie!


Planet MozillaMozilla Scheduled Downtime – 11/19/2009, 5pm – 11pm PST (0100 – 0700 11/20/2009 UTC)

We will have a scheduled maintenance window tonight from 5:00pm to 11:00pm PST. The following changes will take place:

  • 5:00pm PST (0100 UTC) addons.mozilla.org update. We’ll be updating addons.mozilla.org to pick up code updates (bug 529600). Duration 30 minutes.
  • 9:00pm PST (0500 UTC) getpersonas.com GLB DNS change. We’ll be making DNS changes to move getpersonas.com to our Zeus GLB servers (bug 525908). No downtime expected.

Please let me know if you have any reason why we should not proceed with this planned maintenance. As always, we aim to keep downtime to as little as possible, but unexpected complications can arise causing longer downtime periods than expected. All systems should be operational by the end of the maintenance window.

Feel free to comment directly if you see issues past the planned downtime.

Planet MozillaAndroid Hacking (Part 1 of probably many)

I've been looking to understand the Android OS better, so that I can answer some questions and create plans for getting Gecko/Firefox running on Android-based devices.  One of the first questions I asked was, "How do Android apps start?"  They're clearly separate processes while they're running, but it wasn't clear how they were launched.  It turns out, there are a couple of pieces here.  I'm going to describe what I've discovered here, in case it's useful for someone else; I haven't been able to find much of this information, largely because I don't think many people need to know any of this.

At boot time, a special instance of the Java VM is launched, called the Zygote.  This process loads a bunch of the core Java classes and performs initial processing of them, making it possible to avoid this step for each app launch.  Once the initial work is done, the process listens to a socket and waits for requests.

To launch an app using the Zygote process, a command-line tool called "dvz" can be used.  It sends its arguments to the Zygote, which will fork and then start executing the main method in a given class.

So, we have these steps, dealing with the Zygote process:

But, that's not fully how a new Android Activity is started.  It's a bit of a roundabout process.  To launch a new Activity, the ActivityManagerService is notified with an activity start request, including things like the name/class/etc. of the activity.  It puts that information in a list of activities to run.  Then, a new process is started with the main from ActivityThread.  This new process then contacts the ActivityManagerService and asks, essentially, "what app am I?".  The service then gives it the name of its activity class and other info, which is then loaded, and a message is enqeued on the main thread to instantiate the new activity and send it an onCreate() message.

This is interesting because it means that apps are not launched directly, but instead somewhat indirectly through specializing a generic "Activity" process for a specific activity.  A side effect of this is that I couldn't find a way to actually register an app with the ActivityManagerService if it wasn't launched by it.  So, to be a full Android app, you have to go through this normal startup process.

JNI Bridging

One of the difficulties in porting Gecko to Android is that the Android platform is built around Java, whereas Gecko is very much all native C/C++.  However, there is a fairly good native bridge layer, JNI, which is fairly heavily optimized by Dalvik.  So, the simplest way to connect these two is to write a shell app in Java, which bridges events, messages, paint requests, etc. to the native code for handling.

As a proof of concept of this, I wrote a simple test app.  It's fairly straightforward, with a few wrinkles.  Most of this stuff can be done with the stock Android SDK and NDK -- except painting.  The only API that the NDK exposes for graphics is OpenGL ES.  This is fine, but in some cases you may want to access Skia directly from native code.  This is possible, but requires version-specific code to accomplish.  You can ship multiple versions of your JNI glue layer, optimized for each Android version (or even platform), and load the right one during your app startup on the Java side.

This is, of course, not very portable, robust, or guaranteed to continue to work by Google, but it's possible.  There are some very rough hacks in the test app, but for the most part it demonstrates that this approach can work fine.

Next up, I'll probably blog about porting issues for large native apps, including library compatibility, Bionic, and integrating into a non-ant-based build system.

Planet MozillaTestday tomorrow on Firefox 3.6 with the L10n and QA Communities!

This is a quick reminder that a test event will be held tomorrow from 7AM - 5PM PDT on Firefox 3.6 with the L10n and QA communities joined together! The plan is to play around with the new features and performing exploratory testing as well. For those that are interested, this will be a chance for people to possibly sign up and own the testing of these new features for the next release!.
 
Our Fx3.6 Test Lead, juanb, tchung as well as sethb and Pike will be available through IRC Chat ( channel #testday  on irc://irc.mozilla.org ) to help with any of your questions/comments/suggestions.As for where you can find the latest beta build, go to http://www.mozilla.com/en-US/firefox/all-beta.html
 
For more information, here's our event details page:
http://quality.mozilla.org/events/2009/nov/20/testday-l10n-and-qa-test-f...

Planet MozillaCould Mozillians help reinvent local news?


Recently, I noticed Knight Foundation and Sunlight Labs blogging together. The topic: rallying Sunlight developers to join the Knight’s efforts to reinvent local news for the internet era. And, in particular, to join the Knight News Challenge.

By collaborating with Sunlight, Knight is reaching out to developers and designers who are using internet thinking to change how government works. If these people are good at coming up with ways to internet-ize government, why not see if they can do the same for local news? Smart.

This got me to thinking: could Mozilla or Mozillians play a role in Knight’s efforts to create sustainable, inspiring local news that looks and feels like the internet? Certainly, the Knight Challenge criteria align well with Mozilla’s values:

The Knight News Challenge projects meet three criteria: 1) use digital, open-source technology to 2) distribute news and information in the public interest 3) to a local, geographic community.

Open source. Public benefit. Community. And, there a number of people who’ve participated in the past feel more ‘Mozilla’ than ‘local news’:

Past Knight News Challenge winners include leading innovators at the intersection of technology and information – folks like Sir Tim Berners-Lee, inventor of the World Wide Web and a 2008 Knight News Challenge winner, and Adrian Holovaty, co-creator of the Django programming framework and originator of one of the first Google Maps mashups, which evolved into his 2007 Knight News Challenge award.

While I’ve only just glanced at all the Knight and Sunlight stuff quickly, it does feel like there could be some useful connections here. Maybe simply by developers or others from the Mozilla community proposing ideas to Knight? Or maybe, at some point, through a more joint initiative through Drumbeat? I’m going to think on it a little and possibly post again. In the mean time, I’d welcome comments / brainstorms / proposals from any Mozilla people reading this post.

PS. The current Knight News Challenge deadline is December 15. If you have an idea, enter. It’s a really simple, short process. The web site is: www.newschallenge.org

Posted in mozilla

Planet Mozillaweb developer survey: 5,000+ responses from 119 countries!

A few weeks ago, we launched a new survey for Web developers. We wanted to learn more about what you are interested in to build the Mozilla Developer Network tailored to your needs.

Thanks to your help in spreading the word about the survey, we surpassed our goal of 5,000 responses!  The survey is now closed and we’re processing the data. We’ll post results here on the hacks blog and tweet about them on @mozhacks in the next few weeks.

Given the positive feedback about this initiative, we’re planning to repeat the survey on a regular basis to show trends in the Web developer world over time. For example: what tools and technologies are most popular at a give time around the world? The next iteration should be coming in a few months, and we’ll ask for your help again to make sure the participation is as broad as possible.

Thanks for joining this effort, and stay tuned for the results!

Planet MozillaState of Mozilla and 2008 Financial Statements

Today we are posting our audited financial statements and tax form for 2008. We have also posted our FAQ. As in past years, I’ll use this event as an opportunity to review both our financial status and our overall effectiveness in moving the mission forward.

Financial

The financial highlights are:

  1. Mozilla remains strong financially despite the financial crisis of 2008. Our investment portfolio was somewhat reduced, but overall revenues remained steady and more than adequate to meet our needs. We continue to manage our expenses very carefully.
  2. Mozilla remains well positioned, both financially and organizationally, to advance our mission of building openness, interoperability and participation into the Internet.

Our revenue and expenses are consistent with 2007, showing steady growth. Mozilla’s consolidated reported revenues (Mozilla Foundation and all subsidiaries) for 2008 were $78.6 million, up approximately 5% from 2007 reported revenues of $75.1 million. The majority of this revenue is generated from the search functionality in Mozilla Firefox from organizations such as Google, Yahoo, Amazon, eBay, and others.

2008 revenues include a reported loss of $7.8 million in investments in the Foundation’s long-term portfolio (approximately 25%) as a result of economic conditions and investment values at the end of 2008. Excluding investment gains and losses, revenues from operational activity were $86.4 million compared to $73.3 million in 2007, an annual increase of 18%.

Mozilla consolidated expenses for the Mozilla Foundation and all subsidiaries for 2008 were $49.4 million, up approximately 48% from 2007 expenses of $33.3 million. Expenditures remain highly focused in two key areas: people and infrastructure. By the end of 2008, Mozilla was funding approximately 200 people working full or part-time on Mozilla around the world. Expenditures on people accounted for roughly 58% of our total expenses in 2008. The largest concentrations of people funded by Mozilla are in the U.S, Canada, and Europe with smaller groups in China and New Zealand and individuals in many parts of the world.

Total assets as of December 31, 2008 were $116 million, up from $99 million at the end of 2007, an increase of 17% to our asset base. Unrestricted assets at the end of 2008 were $94 million compared with $82 million in 2007, a 15% increase. The restricted assets remain the same as last year: a “tax reserve fund” established in 2005 for a portion of the revenue the Foundation received that year from the search engine providers, primarily Google. As noted last year, the IRS has opened an audit of the Mozilla Foundation. The IRS continues to examine our records for the years 2004-2007. We do not yet have a good feel for how long this will take or the overall scope of what will be involved.

Total grants, donations, and contributions in 2008 were approximately $1 million matching the approximately $1 million of 2007. Mozilla supported projects such Mozdev, Software Freedom Conservancy, and accessibility support for the jQuery library, HTML 5 video, and Firebug.

We believe that Mozilla’s financial setting will continue with relative stability. We continue to use our assets to execute on the mission.

Moving the Mission Forward

2008 was another exciting and robust year for Mozilla. Our scope of activities continued to grow, our community of committed contributors and users expanded, our geographical diversity deepened, and our effect on increasing openness, participation, innovation and individual empowerment in Internet life is significant. Here are some examples.

In February we launched Mozilla Messaging to develop Mozilla Thunderbird as well as new possibilities in the broader messaging arena. 2008 was primarily a start-up year for Mozilla Messaging. In 2009 we’re starting to see the Mozilla Messaging team deliver on the promise. The final version of Thunderbird 3 –- a vastly improved product — is due to be released shortly. In addition the initial developer version of Raindrop — a prototype for a new way of integrating different kinds of messages — has been released.

In 2008 we developed a set of two-year goals (the “2010 goals”), setting out major areas we’d like to see the Mozilla project address in 2009 and 2010. The 2010 goals build upon the Mozilla Manifesto, which articulates the values underlying the Mozilla project and our products. Two of these are familiar — openness in general and continued vitality of Firefox. Two are newer: the mobile web and helping people manage the explosion of data around us. These reflect our desire to see the values of the Mozilla Manifesto infused into these areas of Internet life.

We began an on-going process of strengthening some of the Mozilla project’s basic assets. We began broadening our “module ownership” system beyond code to include governance activities. We began a long-overdue update of the mozilla.org website. In September Mark Surman joined as the new Executive Director of the Mozilla Foundation. These activities continued in 2009, along with new Education and Drumbeat programs.

We expanded the scope of our innovation efforts under the “Mozilla Labs” banner. We launched a range of projects including our first Design Challenge, Test Pilot (user testing program), Ubiquity (natural language interface to browser interaction), and a Developer Tools program. We also expanded existing projects like Weave, Personas and Prism. This focus on innovation continues during 2009.

The activities of Mozilla’s support, localization, campus representative and design communities expanded significantly through 2008 and 2009, reaching more people in more ways.

Mozilla continues to grow ever more global. In June 2008 Firefox 3.0 launched simultaneously in 46 languages. A year later, Firefox 3.5 featured 70 languages. In 2008 Firefox became the majority browser in specific countries. This started with Indonesia, which passed 50% in July 2008, and grew to include Slovenia and Macedonia by the end of 2008. Since then, Slovakia, the Philippines, Poland, Hungary, Latvia, Bosnia Herzegovina, and Ghana have joined this group. Our local communities also work with other Mozilla products and activities such as Thunderbird, Seamonkey and Service Week (in 2009).

We intend to continue to invest significantly in global participation.

Product and Competition

The number of people using Mozilla products increased dramatically throughout 2008 and 2009. This user base makes Mozilla relevant to the Internet industry, helping us move the Internet to a more open and participatory environment. It also helps us build public benefit, civic and social value as components of the Internet’s future.

The number of people using Firefox on a daily basis increased from 28 million in 2006 to 49 million in 2007. In 2008 we moved up to 75 million daily users. As of November 2009 the daily number has grown to 110 million, bringing the total number of users to approximately 330 million people.

Our market share rose to approximately 21.69% in December of 2008. This breaks out into U.S. market share of approximately 20.2%, and more than 32% in Europe. Our statistics for Asia are similar, with our own estimates around 20%. Our South American market share rose to 27% by the end of 2008. These numbers have all continued to rise in 2009 as well. In February, 2008 we crossed the half-billion download mark; in July, 2009 we exceeded 1 billion downloads. As of November, 2009 Firefox’s market share worldwide reached 25%.

In June 2008 we released Firefox 3.0, bringing dramatic improvements to the online browsing experience. These improvements included features to help users quickly navigate to favorite websites, manage their downloads more easily, and keep themselves safe from malware attacks. Firefox 3 was downloaded over 8 million times in the first 24 hours, earning Mozilla a Guinness World Record. In June 2009 we released Firefox 3.5, with additional performance and feature improvements. In November 2009 we celebrated the fifth anniversary of Firefox.

Work on Firefox for mobile devices began in earnest in 2008 with the first development milestones released. We expect to release the first product versions late in 2009. The mobile market has many challenges for us, in particular the fragmentation of the development platform (a plethora of operating systems, handsets and carriers) and a market where touching a consumer directly is more difficult. However, the market is beginning to change and a great, open browser will both help that process and benefit from it. We have much more to do, but have laid a good foundation for long-term contribution to the mobile Web.

SeaMonkey remains a vital project with millions of users. Bugzilla continues as a backbone tool for numerous organizations. A revitalized Thunderbird 3 should ship in 2009.

Looking Forward

The past few years have seen an explosion of innovation and competition in web browsers, demonstrating their critical importance to the Internet experience and marking the success of our mission. In 2008 not only did Microsoft and Apple continue developing their web browsing products, but Google announced and released a web browser of its own. Competition, while uncomfortable, has benefited Mozilla, pushing us to work harder. Mozilla and Firefox continue to prosper, and to reflect our core values. We expect these competitive trends to continue, benefiting the entire Web.

The Internet remains an immense engine of social, civic and economic value. The potential is enormous. There is still an enormous amount to be done to build openness, participation and individual opportunity into the developing structure of the Internet.

Hundreds of millions of people today trust Mozilla to do this. This is an accomplishment many thought was impossible. We should be proud. We should also be energized to do more and to try to new things. It’s a big challenge. It’s important.

We’ve made this opportunity real. Let’s go surprise people once again by showing how much better we can make the Internet experience.

Planet MozillaFirefox on Playstation 3?

There's a rumor out that Sony is looking into bringing Firefox to the PS3 platform:

"We recently received a tip from a source very close to Sony who says that they have been in talks with Mozilla lately about possibly porting firefox over to the PS3. That said, our source made sure to point out that they were unsure if any deal had actually been reached at this point, but it is great news none the less considering the complaints Sony has been getting about the lack of reliability with their current built in PS3 web browser."

Read more

Opera Desktop TeamFaster photo sharing, and more

Here's another Unite build for you to test.

This time we have worked on making image generation in the Photo Sharing application faster (DSK-271038), and as you can see there are a few other tweaks as well. Give it a spin, and let us know if you find any regressions since the previous build.

Download

Planet MozillaConférence à l'INRIA Sophia-Antipolis

Je serai le 25 novembre au matin à l'INRIA Sophia-Antipolis pour donner une conférence d'une heure intitulée "Browser War 2009". Seront également présents avec moi des employés du W3C dont Bert Bos (co-inventeur des CSS, ancien chairman du CSS WG, Style Activity Lead au W3C et actuel W3C Staff Contact du CSS WG) et probablement d'autres. Si vous êtes intéressé par l'état de l'art des standards du Web, que vous voulez voir quelques démos assez bluffantes du futur que les navigateurs Web nous préparent, ou si vous avez envie de vous renseigner sur le W3C et savoir pourquoi vous devriez rejoindre le World Wide Web Consortium, l'entrée est gratuite (dans la limite des places disponibles évidemment...). Nota bene important : la conférence sera donnée en français, comme le tite l'indique bien ;-)

A mercredi !

Planet MozillaSunlight Foundation Hackathon


The Sunlight Foundation is a nonpartisan organization dedicated to making information about our government’s shenanigans more easily accessible, for the sake of transparency and accountability and all that good stuff. They do great stuff like document all the connections between the pharmaceutical lobby and the members of congress working on health care reform.

They’re having a hackathon Dec 12-13. Mozilla is going to be holding one of the events. I’m going to do a project for it.

But what? I’ve got several vague ideas, but I don’t know for sure what I’m doing yet. Some kind of interactive mash-up or data visualization or cool map based on publicly available governmental info; something that makes a strong point with data and that hasn’t been done before.

One idea that I’d love to see made into reality is that of a “revision control history” for bills and laws. This one that was done for the stimulus bill was cool, but it was a one-off; I would love to see a generalized solution that would automatically update, track all bills, allow search and browsing via the web, and would have an API allowing it to be used as a building-block for further mash-ups. I know I’m not the only one who wants this. I need to do some research into what the state of the art is in this area and what obstacles exist to taking it further.

I’m also looking for other suggestions for projects, so let me know if you can think of any correlation/visualization you’d particularly like to see!

(P.S. this is not an invitation to turn the comment thread into a political flame war. Thanks.)

Planet MozillaRandom Thought on GPS navigation using your phone

Ok, so one of the downsides about using your mobile phone for driving directions is that it can't have a comprehensive set of maps stored like a regular GPS unit would. How about some sort of external hard drive you can hook into? It would like you have extra movies, map data, whatever. That way you can pre-load a lot at home before you get on the road.

Personally, I'd want to be able to use my phone to download over Wi-Fi, but I have no desire to pay to download over the EDGE/3G/4G network.

Planet MozillaJetpack for Learning

Help turn the open Web into a rich learning environment and explore new possibilities for using Firefox add-ons to support learning online, as part of the the Jetpack for Learning Design Challenge sponsored by the Mozilla Foundation with support from the MacArthur Foundation.

Designers, educators and software developers who want to turn their innovative ideas into working prototypes will learn to use the new Jetpack technology from Mozilla Labs to create Firefox add-ons to support learning on the open Web, using standard web technologies like HTML, CSS, and JavaScript.

The creators of the most promising add-ons will be invited to an intensive three-day Jetpack for Learning Design Camp (to be held in conjunction with SXSW Interactive in March 2010), where they’ll further refine their work and the best add-ons will be publicly recognized.

Learn more at the Jetpack for Learning website.

ShareThis

Planet WebKitWebKit nightlies support HTML5 noreferrer link relation

WebKit nightlies now support the HTML5 noreferrer link relation, a neat little feature that allows web developers to prevent browsers from sending the Referrer: header when navigating either <a> or <area> elements.  Just add noreferrer in the rel attribute of a link like so:

<a href="www.example.com" rel="noreferrer">noreferrer!</a>

When example.com receives the HTTP request generated by clicking this link, the HTTP Referer field will be empty, as if the user had navigated from about:blank.

When rel=”noreferrer” is used in conjunction with target=”_blank”, WebKit will also set the window.opener attribute to null.  This usage is interpreted as a request from the web page author that any scripts on the destination page should be run in a new context, even if the destination page would normally be considered to be of the same origin.

The noreferrer link relation is one of many link relations defined in the HTML5 spec, and the first to be implemented in WebKit.  We hope it will make life a little easier for web developers who have concerns about user privacy and security.

Planet MozillaHelp the Firefox team

There are a few bugs that the Firefox team is asking for help with. If you’re experiencing any of these bugs or are helping users with these bugs on SUMO, they’d love to get in contact so we can get more information or try workarounds.

  • Crashes with the @_woutput_l signature that have FFTMUFEHelper.dll in the crash stack or the module list. These are probably the TrendMicro Toolbar. We’d like some specific information about the users’ TrendMicro install and put them in touch with TrendMicro so they can figure out what’s causing the crashes. See bug 511756.
  • Crashes for users in Turkey. If any users would like to help in debugging these crashes (the current thinking is they’re related to DNS servers in Turkey, please have them post in bug 508292.
  • Lost or missing downloads. We saw a few reports of downloads in Firefox being deleted as soon as they finished downloading. Now we’re looking for more information. This is most likely do to some kind of security software — we’re just not sure which. Try to get the users’ antivirus software, version and if they’re still getting updates. Please comment in the Contributors’ forum if you find out anything.
  • Firefox closes/quits (no Crash reporter) when closing AOL mail windows. We’re looking in particular for steps to reproduce and also their Firefox version and window/tab settings. Again post in the Contributors’ forum or pass along any contact information. Bug 515679 has more information.
  • Firefox 3.6 has two changes just pushed in beta 3 that affect some users: 1) Third party software in the components directory of the install folder will need to register itself 2) Users who tweaked a preference to disable extension compatibility checking in Firefox will find that it now needs to be set for every version of Firefox.  If you come across legitimate software that is using the components install pathway or websites giving the old compatibility checking advice for 3.6 please let us know in this Contributors’ forum thread.

Getting help on these bugs would go a long way towards improving Firefox and fixing issues. If you’re passing along information from a Firefox user who comes to support, please make sure that you ask their permission and be sure to convey along our thanks for all their help.

Planet MozillaOpera widgets without Opera...

Take an arbitrary Opera widget like this one. Have a xulrunner package (to be launched by Firefox 3) to handle it. And here's the result, on my Mac OS X desktop:

Gecko running Opera widgets.

I'll release the code as soon as I can.

Planet MozillaWoMoz Update

Quick update about the Women & Mozilla project:

  • 1rst official meeting today on the Mozillawomen IRC channel, at 18:00 UTC. Topics:
    • Work on survey: Why so few women in open source? Do they leave or not join in the first place?
    • Discuss about what women find that's been difficult when they join Mozilla (this can be stretched to FLOSS and more in general to non-Mozilla contributors).  And what things have been helpful?
    • Discuss how to get organized: who wants to do what?
    • Quickly discuss bugzilla/dev ml idea
    • What's next? (our priorities concerning the next actions we should undertake)
  • Upcoming actions:
    • Bugzilla or dedicated mailing list for issues concerning the WoMoz Website redesign / content / organization / etc.
    • Written and video tutorials online
    • Organize our existing tools
    • Collaboration between MIAGE women students of Évry University (France) and interested WoMoz contributors to work on improving / developing WoMoz Website and project.  
    • Evangelist team + mentoring program: contributors can help curious people in their first contribution
    • Visit our Actions page and our TODO list to stay tuned with our current actions

Planet MozillaThunderbird 3 is coming out soon, and it’s accessible!

The release of Thunderbird 3 is just around the corner. Aside from all the great new features Thunderbird 3 has in general, its accessibility story is also one which should be celebrated once the release has happened.

Thunderbird 3 is based on the Gecko 1.9.1 platform, which is the same version that Firefox 3.5 is based on. As such, Thunderbird 3 has learned all the great new features of the platform, many of which have a significant impact on users with disabilities. Please allow me to highlight the major improvements and new features.

Support for new accessibility APIs

Thunderbird 3 supports the IAccessible2 standard on Windows. IAccessible2 is a major enhancement to Microsoft Active Accessibility (MSAA), which allows assistive technologies to directly interact with the rich content an HTML e-mail message can have, through a defined set of APIs. Screen readers for the blind, for example, no longer need to rely on old-school screen-scraping methods to try and guess what the application is showing. Instead, headings, block quotes (such as in quoted messages) etc. are all identifiable without question. Font and styling information is available as well. NVDA 2009.1, Window-Eyes 7.1 and JAWS 10 and above take advantage of these technologies already and offer a hugely improved experience for their user bases over what Thunderbird 2.0 had to offer.

This also includes support for in-line spell checking. If enabled, screen readers can identify misspelled words just like in Firefox, and users can go and correct their mistakes on the fly without having to invoke the extra spell checking dialog.

Accessibility on the GNOME Desktop

Thunderbird 3 is accessible to Orca users on the GNOME desktop in Linux. While Thunderbird 2 offered close to no accessibility support, Thunderbird 3 offers a wide range of accessibility to visually impaired users.

Also, the support for ATK/AT-SPI allows other assistive technologies such as GOK (GNOME On-screen Keyboard) to interface with Thunderbird and allow the use by people with motor impairments.

Tabbable and properly labelled message headers

When reading messages, most of the header fields of a message are now reachable via the tab key. This is a huge improvement for any keyboard user. Access includes the “star” that allows to quickly add a contact to the address book or to edit a previously added contact.

All these fields and controls also have proper accessibility labels so that screen reader users immediately know what they’re interacting with.

One known problem is that the multi-functional “reply” control currently isn’t part of the tab order.

Better support when composing messages

Aside from the above mentioned API improvements, the UI also received some love to better communicate the happenings when filling out the from:, to: etc. fields while composing a message. Selecting a different field type now also does not throw newer versions of screen readers into limbo or confused states any longer. Working with the Contacts side bar is also supported.

Over-all UI improvements

Over-all, the various dialogs in Thunderbird such as Tools/Options, Tools/Account Settings and others have received a major accessibility overhaul esp with regards to properly labeling textboxes, radio groups and other XUL widgets so screen reader users get accurate information while tabbing through. Infact, a Thunderbird XUL UI fix was my very first patch when I started contributing to Mozilla. :)

New UI features were also made accessible

New UI features such as the all-new facetted search were also made largely accessible. The new Search, for example, makes heavy use of WAI-ARIA to allow both an appearance that’s visually appealing and keyboard and assistive technology communication that’s accessible. The one exception in this new piece of the product is the graph that shows the search results over time. This is based on SVG, which is totally inaccessible at the moment.

A call-out to Thunderbird extension developers

With the above improvements now being in place, it is equally important for Thunderbird extension developers to follow these simple rules to make their extensions accessible, as it is for developers of extensions for Firefox. DOM Inspector offers an accessibility view which allows you to check whether your XUL has proper labels for textboxes and other good markup! Also, don’t be shy to ask questions! The accessibility team hangs out on the #accessibility channel on irc.mozilla.org and will be happy to assist!

A few known problems remain

As always, nothing can be perfect, but we’re striving to be as perfect as possible. Having said that, there are a few issues that remain, but for which fixes are already visible on the horizon:

  • When viewing messages as threads, the fact whether a thread is expanded or collapsed is not yet communicated to screen readers. This will be different once a new version of Thunderbird switches to using Gecko 1.9.2 or later, which includes the all-new tables support.
  • The same is true for the “subscribe” dialog for newsgroups and IMAP folders. Right now, screen readers do not yet get the state whether a certain folder is checked or not. This will also change with a switch to the new Gecko platform.
  • Folders in the folder pane cannot be navigated to using first-letter navigation. I’m hoping we’ll find a solution to this often voiced request in the future.
  • The picker for rearranging the columns in the message list isn’t accessible via the keyboard yet. You can use the mouse emulation of your screen reader to get to that button to the right of the column headers to access options.

Thanks!

I’d like to thank everyone who has been writing to me over the past two years pointing out Thunderbird accessibility issues. As was expected, these actually made up a higher volume than Firefox since there were more UI-related issues. Keep the feedback coming!

I’d also like to extend a huge thank you to the team at Mozilla Messaging and the voluntary contributors who all helped with implementations, reviews, suggestions and advice while improvements for Thunderbird 3 were requested, triaged and acted upon. I really feel that accessibility is being taken seriously, and I honestly hope that a lot of users worldwide will show their appreciation by downloading and using Thunderbird 3 when it comes out! I’ve been using it for over 2 years now while it was being developed and haven’t regretted making the switch!

Keep up the good work!

Planet MozillaLinux (FC12) wake-on-LAN woes

I just spent the last two hours or so trying to get wake-on-lan to actually work on Linux. Sadly, most of the HOWTOs (assuming the link isn't broken) aren't actually that useful. Here's what I can observe

  1. Wake-on-LAN is enabled in the BIOS.
  2. Shutting down with "poweroff" or "shutdown -h" leaves the network card powered (the link light is on).
  3. Sending a magic packet to the machine doesn't power it on.
  4. If I hit the small black button on the back of the power supply once, it makes a slight noise, and after that sending a magic packet does power on the machine.

So my best guess so far is that poweroff puts the power supply into a state from which the NIC can't wake it up. I have no idea what that state might be, nor how to change this behavior. I welcome any ideas!

Update: To be clear, I've tried all the power management setting combinations in the BIOS. Most have the behavior I describe above; the rest power down the network card as well.

Update: To forestall more comments from people who aren't reading item 4 above carefully, the network card itself reports that it'll do wake on magic packet when you ask with ethtool. It DOES do wake on magic packet, in fact, but only after I press that button on the power supply. And honestly, try to give me some credit for actually trying the one thing all the howtos on this have in common, that being ethtool.

Planet MozillaInstalling Raindrop on Dreamhost

It turns out that installing Raindrop is really hard. Here’s what I didtried to get it running on Dreamhost. Hope it helps anyone else who wants to play around with it, and I hope they can get further than I did.

Directory structure

In my home directory, I created a new folder called opt.
mkdir opt
You’ll also want to add the following lines to your .bashrc file:
export CFLAGS="-I$HOME/opt/include -L$HOME/opt/lib $CFLAGS"
export CXXFLAGS="-I$HOME/opt/include -L$HOME/opt/lib $CXXFLAGS"

I also created a sources directory, where I’ll be putting all of my source files in.
mkdir sources
We’ll want to be in the sources directory as we install everything.
cd sources

Installation Fun

Install python

wget http://www.python.org/ftp/python/2.6.4/Python-2.6.4.tgz
tar xvfz Python-2.6.4.tgz
cd Python-2.6.4
./configure --prefix=/home/sdwilsh/opt/
make
make install

Install OpenSSL

After you get the source from a mirror and untar it, enter that directory, and run these commands:
./config --prefix=/home/sdwilsh/opt --openssldir=/home/sdwilsh/opt/openssl shared
make
make install

Install Erlang

Note: I had to bump my memory on my PS up to 304 MB (from 150 MB) in order for this to compile. I just doubled it, so you may be able to get by with less. This also takes a while to install.
wget http://erlang.org/download/otp_src_R13B02-1.tar.gz
tar xvfz otp_src_R13B02-1.tar.gz
cd otp_src_R13B02-1
./configure --prefix=/home/sdwilsh/opt/ --with-ssl=/home/sdwilsh/opt/
make
make install

Install ICU

wget http://download.icu-project.org/files/icu4c/4.2.1/icu4c-4_2_1-src.tgz
tar xvfz icu4c-4_2_1-src.tgz
cd icu/
chmod +x runConfigureICU configure install-sh
./runConfigureICU Linux --prefix=/home/sdwilsh/opt
make
make check
make install

Install autoconf-2.13

wget http://ftp.gnu.org/gnu/autoconf/autoconf-2.13.tar.gz
tar xvfz autoconf-2.13.tar.gz
./configure --prefix=/home/sdwilsh/opt/
make
make install

Install Spidermonkey

Note: You many need to install Mercurial. I used easy_install to do.
hg clone http://hg.mozilla.org/releases/mozilla-1.9.2/
cd mozilla-1.9.2/
hg update -r FIREFOX_3_6b3_RELEASE
cd js/src/
autoconf
mkdir build-release
cd build-release
../configure --prefix=/home/sdwilsh/opt/
make
make install

Install libssh2

wget http://www.libssh2.org/download/libssh2-1.2.2.tar.gz
tar xvfz libssh2-1.2.2.tar.gz
cd libssh2-1.2.2
./configure --prefix=/home/sdwilsh/opt/ --with-openssl
make
make install

Install curl

After you get the source from a mirror and untar it, enter that directory, and run these commands:
cd curl-7.19.7
./configure --prefix=/home/sdwilsh/opt/ --with-libssh2=/home/sdwilsh/opt --with-ssl=/home/sdwilsh/opt
make
make install

Install couchdb

After you get the source from a mirror and untar it, enter that directory, and run these commands:
./configure --prefix=/home/sdwilsh/opt/ --with-erlang=/home/sdwilsh/sources/otp_src_R13B02-1/include --with-js-include=/home/sdwilsh/opt/include --with-js-lib=/home/sdwilsh/opt/lib --with-erlang=/home/sdwilsh/opt/lib/erlang/usr/include
make
make install

Note: I feel like I may have messed up how I installed erlang given the strange place it put its header files, but I wasn’t about to recompile it.

Change Permissions & Run

CouchDB suggests you create a new user for to run it is, but this is hard to do it seems, so I skipped it. I did change the permissions, however.
chmod -R 0770 /home/sdwilsh/opt/etc/couchdb
chmod -R 0770 /home/sdwilsh/opt/var/lib/couchdb
chmod -R 0770 /home/sdwilsh/opt/var/log/couchdb
chmod -R 0770 /home/sdwilsh/opt/var/run/couchdb

And now to run CouchDB:
couchdb -b
Sadly, this was taking something close to 500MB of memory. This is far to high for my server to sustain, so I haven’t gotten any further. If anyone has any ideas, I’d be glad to hear them.

Planet MozillaFirebug 1.5b4

getfirebug.com has Firebug 1.5X.0b4. It passes all of our tests on Firefox 3.5 and 3.6b4pre. Two case fail on FF 3.7; one is a changed error message, one looks like a change in Firefox. (We’re only aiming for 3.5 and 3.6 for now).

Next we aim to improve the quality by identifying important bugs from among those that have test cases and tagging them with with “blocks1.5“. If you have a favorite bug, we welcome your input on what gets fixed before we decide Firebug 1.5 is done.

We are also reaching out to Firebug extension authors to update for 1.5. We already have some progress, with updated versions of FirePHP, Rainbow, FireQuery, and FireLogger.

This release is dedicated to Steve Roussey for his contributions to the HTML panel editing and entity display. A lot of the closed issues below came from his work.

Changes since 1.5b3:

  • New locale hr-HR/Croatia
  • Update locales ro-RO, es-AR, is-IS, sl-SI, js-SP
  • Issue 2464: Network panel showing total size of requests as 0 KB
  • Issue 2471: appShellService.hiddenWindow causing problems embedded in an SWT Browser
  • Issue 674: long variable contents are cut off in tooltips
  • Issue 2467: timeline bars don’t show
  • Issue 2374: Firebug not work in SeaMonkey 2.0rc1
  • Issue 2448: Firebug HTML panel encoding display and editing
  • Issue 2481: ‘Add watch’ on 2nd expression of a multi-conditional will use incorrect expression
  • Issue 2454: Light up the tab whenever break on next is selected
  • Issue 1466: Changing any User Agent CSS makes firefox go grazy and after a while crash
  • Issue 2285: support for content-type: multipart/x-mixed-replace
  • Issue 1440: Net tab is showing XHR logs with size of “?”
  • Issue 2489: When inspecting in an iframe, you can’t see any parent frames
  • Issue 2067: Open in a new Window fails with tab switching once Firebug is minimized
  • Issue 838: HTML specialchars not shown correctly
  • Issue 1138: nbsp elements rendered in the DOM as spaces
  • Issue 1488: Uninformative message when command line fails while NoScript enabled
  • Issue 1980: < > does not get encoded while editing element content
  • Issue 2250: Firebug generates invalid (X)HTML for displaying empty elements in the HTML panel
  • Issue 2359: Zero-width spaces (ZWSP) HTML characters are not displayed in the HTML tab
  • Issue 2435: Show whitespace on text nodes that have sibling element nodes displays ? instead of text
  • Issue 2438: Show Full Text option only works on text node that does not have a sibling element
  • Issue 2439: Editing a text node with whitespace and the option Show White Space gives wrong result
  • Issue 2453: When MathML nodes are edited the rendered MathML is not updated
  • Issue 2470: HTML panel does not show namespaces
  • Issue 1414: “Copy HTML” feature does not respect explicit end tags in XHTML

jjb

Please post followups to the newsgroup

Planet MozillaWeave Web UI Design Challenge

Design Challenge Logo

In early September we invited the wider community to develop concepts for the question “Visualizing your browser data – How can we provide intuitive and useful visual representations of your browser data (such as bookmarks, history, tabs, stored credentials etc.) on a web page?”

A total of 17 solutions were submitted in the first phase of the Design Challenge and analyzed by the Weave team. After an long round of discussion and carefully going through all submissions, the Weave team decided to return to the drawing board and better clarify the experiences Weave wants to enable, instead of moving this challenge to the second phase. The submissions significantly helped the team to identify potential interaction models and design directions.

The submitted concepts were (in order of submission date):
Luciano Lobato, Sridutt YS, David Little, Eshed Zachevsky, Shubham Sinha, Ely S, Silvio Fachinotti, Anil Chaudhry, Miyoung Yoon, Vijaya Ramanujam, J Newengland, Brennan Moore, Murray Thompson, Scott Fitchet, Maureen Hanratty, a mal.

You can view all entries with short explanations of the respective concept on the ChallengePost website.

Planet MozillaCamino 2.0 Released!

I am very proud to announce today's release of Camino 2.0, available for download from our website. This release represents the culmination of over a year of hard work by our developers, testers, and localizers and easily surpasses the high quality bar we have set in past releases.

I want to stress that this is a product of our community, including our users, who provided valuable bug reports and feedback along the way. I am constantly impressed with the community's enthusiasm for the project and the care and thought put into every feature. They should be proud of this product and their contributions to it. I think it says a lot about the community that an open source project can have such high quality and attention to detail. Remember, none of these folks are getting paid. This is solely a labor of love.

I won't spend a lot of time listing features, since you can easily see them on the website, but many of the changes are under the hood. We're using a much more up to date version of Gecko (though not the latest for various reasons), and that will improve web page rendering and compatibility significantly from previous versions. If you find no other reason to upgrade, do it for the new Gecko.

Give it a spin, I'm sure you'll enjoy it!

Planet Mozilla☢ alert

If you’re reading this, it means that yet another major version of Camino is now in the wild. Today we released Camino 2 (codenamed ☢, because our first choice of “kittens” didn’t have a Unicode glyph) after over a year in development. There are a number of major architectural changes under the hood that should make your overall browsing experience much better, and on top of that we’ve added a number of exciting new features. It has, once again, been a long(er-than-expected) journey, but we’re very proud of all the work we’ve put into Camino 2 and are pleased to offer you a new stable release.

The road to Camino 2 began in April of 2008 when we wrapped up work on Camino 1.6, although we had been performing architectural maintenance and related work to keep up with Gecko 1.9 changes since late 2007 (and some of the changes in Gecko itself were made all the way back in 2005, after the MOZILLA_1_8_BRANCH was cut on August 12, 2005). Over the last year and a half, we’ve fixed more than 450 “bugs” (problems or new features), and 16 different people contributed patches for this release (Stuart Morgan again led the way with 119 fixes). Sean Murphy implemented three major features this release (tab dragging, phishing and malware protection, and rewritten Full Keyboard Access support in the browser window), and Christopher Henderson and Ilya Sherman showed up to implement full content zoom and Growl notifications for downloads, respectively, and stuck around to fix over four dozen other bugs between them. Big thanks also to the one-third of that list of patch contributors who aren’t regular Camino developers; every little fix helps make Camino a better browser.

In some ways Camino 2 isn’t the revolutionary release we hoped it would be when we wrapped up Camino 1.6, but it’s still a vast improvement over Camino 1.6 and a triumph for an all-volunteer, all-free-time development team in today’s world of corporate-sponsored browsers.

Thanks to our hard-working localization teams, Camino 2 is available today in US English and 13 other languages, with Polish expected to join that list as soon as our Polish localizer’s Mac is repaired. Sadly, we had a few languages that shipped in Camino 1.6 disappear on us, so if your language is missing, please stop by the caminol10n mailing list and see how you can help bring these localizations back. (As I mentioned earlier this year, the work doesn’t require much specialized computer/software knowledge; you and a friend can bring Camino to thousands of users in your language! For Camino 2, new contributors successfully revived the Danish localization, which was in Camino 1.0 but disappeared from Camino 1.5.)

This year I again went to bed the night before release while fearless webmaster Samuel Sidler stayed up putting the finishing touches on the home page, the Features page, and implementing the new website design from the folks at Clearleft. One of these years both Sam and I are going to get a full night’s sleep before a major release, but this was not to be that year. Aside from a few things here and there, it seems like the website and webserver bits went more smoothly this release than with 1.6.

What’s next? Those of us who have been working on the website and release details for the past month or so are going to take a little rest. Parts of the development team, which wrapped up development with a late-October push, are already starting to work on new features for Camino 2.1. Nightly builds already include Dan Weber’s 2009 Summer of Code work on location bar autocomplete, and we have some early plans for other features in Camino 2.1 (we’re always looking for contributors, so if you’re interested in helping make a great Mac browser, stop by the Contribute page or find us on irc).

In the meantime, enjoy Camino 2.0 and let us know what you think!

Planet MozillaEasing Orange: Jetpack for Correlating Tinderbox Test Failures with Bugs


This is a Jetpack feature for finding out if a bug is already filed for a test failure on Tinderbox. When viewing log files for failed test runs, the Jetpack will add a link next to the test failure summary at the top of the log, that looks like “(maybe bug XXXXXX?)”. This allows sheriff’s and other awesome community members to easily mark known-oranges, and update the bug with log’s URL.

Install the Jetpack feature.

Notes:

  • So far it only pulls file names out of error text, so won’t match leaks, crashes or oranges without a filename in the summary.
  • Only searches the bug summary, and only searches known orange bugs (ie: has “[orange]” in the bug whiteboard).
  • Scrapes bugzilla.mozilla.org, since the new REST api is very very slow, so might break with bugzilla upgrades.
  • It doesn’t run until the log has completed loading, which sometimes can be a while. Load that shit in a background tab and be patient yo.

Let me know if this helps you out, or any bugs or improvements you’d like to see!

Planet MozillaCamino 2.0 Released!

After over a year of hard work, the Camino Project is proud announce Camino 2.0, a major new update to the Camino web browser.

Camino 2.0 includes a number of new features and enhancements, including rearranging tabs by drag-and-drop, a new Tab Overview feature, phishing and malware protection, full content zoom, Growl notifications for downloads, improved support for Full Keyboard Access in the browser window, and displays web content using Mozilla’s Gecko 1.9 rendering engine. For a list of features in Camino, visit our features page. Also, see the release notes for more detailed information about changes in Camino 2.0.

Camino 2.0 is available today in 14 languages:

  • Chinese (Simplified)
  • Danish
  • Dutch
  • English (US)
  • French
  • German
  • Italian
  • Japanese
  • Norwegian (Bokmål)
  • Russian
  • Slovenian
  • Spanish (Castellano)
  • Swedish
  • Turkish

One other language, Polish, is expected to be available in the near future.

As always, you can download Camino 2.0 in English (or the multilingual version) from our website, and existing Camino users will receive this release via software update. Camino 2.0 is available for users of Mac OS X 10.4 or later.

Footnotes

Updated: .  Michael(tm) Smith <mike@w3.org>