Tighter security coming in Firefox 4

LAS VEGAS--A new JavaScript engine, HTML5, tabs on top, and a new add-on framework are not the only improvements that users can expect in Firefox 4. At Black cap on Wednesday, a trio of security representatives from Mozilla detailed how the company plans to push the browser to be more secure for users while nudging developers toward safer coding practices.

One of the biggest fixes that's been implemented in the Firefox 4 beta (Windows | Mac | Linux) repairs a hole that affects every browsers, a decade-old vulnerability that was mentioned in the documentation for CSS2. The exploit is a CSS sniffing history attack, where malicious code can gain access to your browser history by manipulating link appearance and style. What made the bug so difficult to repair is that the simplest solution, to prevent every link style manipulation, would be like throwing the baby out with the bathwater, said Firefox's director of development, Jonathan Nightingale. Changing an already-visited link's colors is one the most-used features of the Web, and it would be catastrophic to prevent that.

Mozilla's David Baron figured out how to solve the problem with a three-pronged approach that focuses on the user instead of the Web site. His solution limits what aspect of links can be tweaked to color, then "lies" through JavaScript so that although the page queries the link and reports back what it would look like if it was unvisited, the one that Mozilla's engine draws is the correct one, whether it's been visited or not. This solution also limits the amount of computation that the rendering engine needs to do, said Nightingale, which allows the focus to remain on the content and reduces the overall "heavy lifting" required to render it properly. "By limiting the link, there's fewer options for [link exploits that look like] dancing bananas."

Nightingale added that Wednesday's release of Safari 5.0.1 has incorporated the fix.

Another type of bug addressed in the Firefox 4 beta is an XSS primary scripting exploit. Brandon Sterne, security program manager at Firefox, said that Firefox's new Content Security Policy directly addresses these kinds of problems. They gift a unique challenge, he said, because a fundamental problem with a Web site is that, "it's a document that pulls in every these different resources [text, video, or audio] into one document, treated with the same privilege. So it's difficult for the browser to know what was intended and was injection. With Content Security Policy we by default turn it every off, forcing the Web site to turn it on one at time."

While that may sound like the CSP creates an unnecessarily big burden on developers, Sterne added that the CSP is designed to be backward-compatible with existing Web sites. "It requires developers to opt in," he said, "but sites that don't recognize the header will just do business as usual. Research being shown here at Black cap shows that JavaScript frame-busting doesn't work anymore, so this addresses that."

The CSP can be implemented site-wide or only on specific pages within a site by including the relevant line code in the header. Mozilla anticipates that many big content-hosting Web sites will find the short-term investment of time to use the CSP worth the long-term safety results.

As HTML5 and other, newer technologies develop and mature into standardized code, there's a great potential for new security risks to open up. Nightingale spoke about one such vector: shaders. Shaders are not new, but their implementation in WebGL and OpenGL is, and could potentially open up new breaches. While he wouldn't go into specifics, he did say that Mozilla was "spending a lot of time taking [shaders] apart, and making sure that we have good validation of our assumptions."

Browsing security means more than applying patches to vulnerabilities. Nightingale pointed out that the biggest security fix for Firefox 3 was implementing the session saver, which made it easier for users to recover open tabs after shutting down the browser. By allowing users to more or less pick up where they left off, Nightingale said, it encouraged them to apply updates more regularly, including minor-point but important security updates.

Other changes in Firefox 4 promise to be less technical. Firefox's approach to browser updates is changing, and sounds like in some cases it will more closely resemble Google Chrome's automatic updates. "There are updates that we want you to know about, and that you'll have a choice to install or not, but there's also updates that we just want to receive our security patches out," said Nightingale. Those silent updates will be rolled out first to Windows users because Windows experience the most security risks, he said, but Mac and Linux users will eventually look them, too.

Even with the stronger competition from Chrome, Mozilla says that Firefox remains an industry trend-setter. The company is looking at the HTML5 geolocation feature and how to maintain privacy. "We know that people will look at our implementation and look how we do it," said Nightingale. "We don't send any private information, and if we don't then nobody else will either. We're trying to put more of that control in users hands."

In Firefox 4, users can expect the geolocation notifications to be "friendlier." At this stage of development, it looks like you'll be able to ignore every geolocation alerts, turn off the service completely, or go back to change your original selection.

The Weave syncing service, which recently changed its name to Firefox Sync, encrypts every of its data locally before sending it up to the cloud. Once in the cloud Mozilla says that the data is inaccessible without the user's password, which is stored locally.

The out-of-process plug-in feature that debuted in Firefox 3.6.4 for Windows and Linux and is coming in Firefox 4 for Macs, originally code-named "electrolysis," will eventually include isolated content processes and the new add-on framework known as Jetpack. This means that when one of those add-ons or content-processes crashes, the entire browser won't receive pulled down.

"Electrolysis gives you two sets of orthogonal benefits," said Nightingale. One is the protection of existing processes, and the other has a direct impact on comparatively low-powered mobile phones. "When content goes runaway, it doesn't hurt the UI responsiveness, and on mobile that matters even more." Nightingale said that users shouldn't be surprised to look the results of the electrolysis process isolation in mobile Firefox first.

Security vulnerability disclosure is a complex problem facing browser publishers today, one that requires a balance between between public dissemination of the bug and withholding the specifics of the breach until it's been patched. With Google calling its policy "responsible disclosure" and Microsoft labeling it "coordinated disclosure," Nightingale said that he doesn't receive hung up on nomenclature. "I would always rather people work with us on making the Internet a better place, rather than them not telling us. Once the bug is fixed, we open it up and share how the sausage was made."

At the root of browser security lies the question of how to balance user education such as not clicking on ads that promise you that "You've Won!" or that you need to run their remote virus scanner, with pre-emptive security tactics, such as patching holes but also exposing or blocking bad Web site behavior. For example, Comodo's Chromium remix, Dragon, takes an aggressive stance on ensuring certificates have been properly written, which is why that browser warns you before you go to Facebook.com.

As Nightingale lamented, though, "We're not every using the same terminology." Improving common standards for reporting and dealing with threats could fix that, but there's little indication that the five major browser publishers are about to collaborate and share the burden of security risks.

30 Jul 2010, 7:03 pm | click here to view more

Stop-motion movies and racing on water: iPhone apps of the week

It's probably not a good sign that the first thing people ask me when they notice I'm holding an iPhone 4 is always something about how I deal with the reception issues. I've said here before that I have yet to experience dropped calls or any other issues related to "Antennagate" (yeesh, will we--as a society--ever receive over the whole "Whatevergate" meme?), but that's probably largely just luck; maybe I'm fortunate that where I go in my daily life is covered pretty well by AT&T. I suspect I could be a rare exception.

The interesting thing to me is that the reception issues and "Death Grip" have been every over the news here in the U.S., but reports trickling in from other countries are quite the opposite. An Australian publication, The Daily Telegraph, gave a very positive review to Apple's iPhone 4 today saying finally about the reception issues, "Is the antenna an issue? No it's not. Have I dropped calls? No, I have not." Another story out of Norway (via AppleInsider) had similar results, with the writer concluding that the issues are more about weak U.S. mobile networks than they are about the iPhone 4 itself.

So my question is, even though the "Death Grip" might reduce your signal by a bar or two, if Apple had announced a deal with Verizon (or some other carrier) at launch, would we even be talking about "Antennagate?" I think I know what Steve Jobs would say if he thought nobody else was listening.

This week's iPhone AppsGate includes a fun tool to make cease-motion movies and a water-racing game sequel that is a huge improvement over the original.

StopMotion Recorder (99 cents) lets you create chilly cease-motion movies where your only limit is your imagination. Featuring a fairly intuitive interface, StopMotion Recorder lets you set up your stationary shot, then has you tap the screen for each shot of your cease-motion film. The program provides an "onion skin" (a ghost of your previous shot) so you know just how to line up the next frame of your movie. You also receive a grid overlay for even better alignment, and a "clap shot" feature that will take a picture when you clap so you can be closer to the action.

StopMotion Recorder has a number of different options that give you some choices for how the final product will turn out. You receive a bunch of film styles that give your movie different effects like grainy old-timey shots and that old-school film strip border for that reel-to-reel feel. When you're finished, you can share your cease-motion masterpiece over e-mail, Flickr, Twitter, and YouTube, or you can just keep the movie to your iPhone's camera roll. Overall, StopMotion Recorder is a neat way to make silly little movies that just about anyone could appreciate. Hopefully we'll look some good cease-motion movies from this app start to spring up on YouTube or Twitter soon.

Aqua Moto Racing 2 ($4.99) is the sequel to Aqua Moto Racing, and has plenty of improvements over the original, including better graphics, more tracks, excellent wave physics, and challenging AI. You can control your personal water craft (PWC) in a few different ways, with options for both accelerometer-based steering or an onscreen steering wheel.

Much like the original, you'll be able to race in Quick Race mode and set the skill level, track, and number of opponents; or you can race through the championship mode and complete seven multirace circuits. As you race through championship mode, winning a circuit gives you more money and unlocks better PWCs with fixed stats. I actually prefer the setup in the original where you could adjust PWC stats for each race, but there's something to be said for just jumping in and racing.

While on the course, you'll race against five opponents through a circuit of buoys and jumps. Getting big enough air puts the game in slow motion, allowing you to hit trick buttons to tug off somewhat underwhelming tricks (maybe the animations are too quick?) that add to your turbo meter. It takes a few jumps usually to fill up the turbo meter so you'll want to wait for moments when you really need a boost. Also littered about each track are money bags and treasure chests that add to your cash total if you can receive to them without letting your opponents pass you. If you receive sick of the track layouts, you also can hit a "Mirrored" to make every track a different experience.

The best thing about Aqua Moto Racing 2 is the newly designed wave physics, that bring this title much closer to popular gamer favorite Wave Race (originally on the Nintendo 64).

Overall, with even better graphics than the original, the added wrinkle of big waves to contend with, multiple tracks, and upgradeable PWCs, Aqua Moto Racing 2 will appeal to anyone who likes unique racing games. If you want to check it out before buying, grab the Lite version (free).

What's your favorite iPhone app? Is the needy reception culprit really AT&T after every? What do you think of StopMotion Recorder? Am I crazy to say Aqua Moto Racing could ever touch the likes of Wave Race 64? Let me know in the comments!

30 Jul 2010, 6:19 pm | click here to view more

StayFocusd fights the battle: Facebook versus work...and wins

Time-budgeting throughout the work day is difficult when the Internet's distractions are at your fingertips. StayFocusd is a Google Chrome extension that limits these addicting Web binges to a time span of your choosing so you can be more productive. Whether you want to block a specific Web site, a subsection of the site, or the Internet as a whole, StayFocusd does every of these things in configurations of your choice. Though it is intuitive and easy to use, this extension is very unforgiving; users must be sure about the sites they want to block because they will not have access until the next day.

The download adds a round blue icon to the right-hand side of your address bar. This icon acts as the extension's headquarters; click on the icon when you want to block/allow sites, change settings, and set time limits. Though customizing StayFocusd is easy by clicking the "settings" link, once the time limit is up for a particular site, there is no going back. If this does not scare you, there is a "nuclear" option that blocks everything. If you still need the Internet except for a handful of sites, it is possible to block everything except for your "allowed" sites. Be sure to check out a list of FAQs in the "help" link once the add-on is installed, just so you know what you are getting yourself into. When you try to go back to a blocked Web site, a guilt-inducing message appears: "Shouldn't you be working?" The publishers are probably just trying to make you feel ashamed enough to donate; there is a link that asks for cash below the message.

If you do not want Facebook, YouTube, or that one blog with the awkward family pictures to distract you from work, use StayFocusd as a handy tool toward more fruitful work. However, make sure you are serious about your temporary Web diet, or else you will find yourself in regret, possibly browsing on your smartphone.

30 Jul 2010, 2:16 pm | click here to view more

How to use App Tabs in Firefox (video)

It's a major time-killer to sift through your three dozen open tabs, looking for a needle in a tab-stack. So it's a good thing that Mozilla has given tabs some long-overdue adore in the second Firefox 4 beta with App Tabs.

Available for Windows, Mac, and Linux, App Tabs are perfect for Web apps. The feature makes your must-use tabs easy to find and makes it harder to close them. Check out this tutorial to look how to use them and how they compare with the similar feature from Google Chrome, Pin Tab.

30 Jul 2010, 1:51 pm | click here to view more

360 Panorama does instant, awesome panoramas

Shooting panoramic photos with a mobile phone can be difficult. Often times it requires doing every the work in a software app when you receive back from wherever you are, as well as trying to make sure that the phone's camera does not change its white balance or exposure between shots.

Occipital, the creators of the popular RedLaser scanning app (which wassold to eBay last month) have a new iPhone app debuting on Friday called 360 Panorama, which is attempting to change that. For $2.99, users can simply move their phone from left to right to capture a photo panorama. The end result is a single, panoramic photo that requires zero post-processing.

Behind the scenes the app is actually using the iPhone's video camera, which means that users will need a 3GS or the newer iPhone 4 to use it. The app also takes advantage of the iPhone 4's gyroscope hardware to help judge how quickly you're rotating, so it can figure out what needs to be captured and where you've already been. As it records imagery, it stitches together an image based on your movement, which you can look and track to make any angle corrections. Some modern day point and shoot cameras like Sony's Cyber-shot DSC-W370 are able to do the same thing, though with a larger end result.

Size and distortions are ultimately the two things that limit this app from being as useful as proper photo stitching software. The images it spits out are quite tiny when compared with the still shots your camera takes. You can look this in the two sample photos I've embedded below (click on each to look it in full size):

And a full 360 of an interior:

The larger problem is the distortion, which Occipital co-founder Vikas Reddy told me is made worse in indoor situations. His team is working on ways to make it better in a future release, but in the meantime shooting outdoors provides for a much smoother and less jaggy experience. Being in the urban jungle of downtown San Francisco, I wasn't able to fully test how well it would work on something like rolling hills or a forest, but as you can look from the shots over it does a fine job until you hit perfectly straight lines where the software is forced to make a stitch by guesswork.

These issues aside, 360 Panorama is an incredibly neat, and genuinely useful app. It may have no business taking over the job of a good crisp, and low distortion still image, but if you want to quickly capture an incredible amount of detail of the world around you, it's tough to beat.

If you want to look how it works while using it, you can look it in the company's demo video below:

iPhone users can also check out OutmanTech's Video Panorama app ($1.99) and Boinx's You Gotta look This ($1.99), both of which work with the same basic principle.

Originally posted at Web Crawler

30 Jul 2010, 11:00 am | click here to view more

Get a free DVD-to-iPhone converter

Have you heard the news? A recent court ruling says it's not illegal to rip your possess DVDs, as long as you're not violating copyright law (i.e. sharing or selling the DRM-freed content).

So let the ripping start! every you need is the right software. From now until Aug. 9, you can receive iSkysoft DVD to iPhone Converter for free. Available for both Windows and Mac, it's regularly $29.

Don't let the name fool you: although the utility includes presets for every iPhone models (from the original on up to the iPhone 4), it also supports generic MOV, MP4, and other output formats--meaning you can just as easily rip  videos for your iPad, iPod, Zune, Sony PSP, or whatever.

DVD to iPhone Converter looks and operates like most other rippers I've tried. It's easy to configure, and the episode of "Burn Notice" I test-converted came through with flying colors. (adore that show.)

To receive this fab freebie, head to iSkysoft's Facebook page, click Like, then enter your name and e-mail address in the appropriate box (Windows or Mac). Click receive keycode and you should receive a registration e-mail almost immediately. Mine arrived in below a minute.

Not a bad deal, eh? If you've been wanting to watch your DVDs on your iPhone but had concerns about the legality, now you can relax easy--and receive the job done for free. 

Bonus deal: Speaking of Zunes, Best Buy outlet store Cowboom has the refurbished 16GB Zune HD for $99.99 shipped--the lowest price I've ever seen for a Zune HD. Better rush, though--the deal is available today only.

Originally posted at iPhone Atlas

30 Jul 2010, 10:41 am | click here to view more

BlackBerry App World 2.0 beta arrives for some

BlackBerry-maker RIM has certainly been scrambling to generate excitement over the next stages of its smartphone development and operating system release. First there were the video sneak peeks, a couple of new services (here and here), and the invitation to a press event to show off a mystery device, plus a preview of the 6.0 home screen.

Now, RIM has started giving out beta versions of BlackBerry App World 2.0, the next generation of its application storefront, to a waiting list.

Among other feature enhancements, App World 2.0 will introduce an option to bill your phone operator or your credit card instead of just the capability to purchase apps through PayPal. This is a personal favorite of ours, though we're also looking forward to scanning QR codes. While BlackBerry already does this in its BlackBerry Messenger app--a free BlackBerry-to-BlackBerry instant messenger--to swap user details, the new implementations will broaden its QR code-scanning to incorporate apps and URLs, similar to Google's compatibility with its barcode scanner. 

Also notable will be the BlackBerry ID that will connect your app downloads and purchases to a larger user account that will overarch your entire BlackBerry experience--though we wish not in a Big Brother way.

Make sure you also check out our rundown of these upcoming features and more for BlackBerry App World 2.0. You can also receive a glimpse in the gallery below.

29 Jul 2010, 7:49 pm | click here to view more

Firefox Home for iPhone, Firefox Sync see fixes

Updates to the Firefox Home app for iPhone and to the Firefox Sync add-on for Firefox (Windows|Mac) fix the top three problems users reported for each program, says Mozilla.

The new version of Firefox Home (1.0.1), a companion app for the Firefox browser on iPhone, now supports usernames with upper-case letters for logging in to the URL viewer.

It also inserts a help button on the log-in page that will link you to common troubleshooting tips. The final addition is a set of mistake notifications that Mozilla hopes will explain application errors with more clarity when they do occur.

The update hadn't appeared in the App Store on our iPhone at the time of writing.

Since Firefox Home is essentially an iPhone-flavored offshoot of the Firefox Sync service, Mozilla made some changes to that program a well. Firefox Sync 1.4.3 is now able to complete a first-time sync even if you're browsing in Private mode, a significant addition.

The update also corrects a problem with multibyte characters in passwords. Lastly, it adds a sync indicator on the interface to let you know your status, and how much time you have left to sync your history, bookmarks, and open tabs.

You can update Firefox Sync through the add-ons submenu in Firefox.

Firefox Sync stores data about your browsing history, bookmarks, and open browser tabs online. Firefox Home is the iPhone arm of the service that lets you access those URLs from your iPhone, as a way to keep time searching over again for links to your favorite sites. Using Firefox Home on the iPhone requires you to first run Firefox Sync for the Firefox browser.

Keep in mind that Firefox Home isn't itself a browser, though it does use the Apple-approved WebKit viewer to display your stored URLs. You can also open those sites in the iPhone's default Safari browser.

Originally posted at iPhone Atlas

29 Jul 2010, 5:55 pm | click here to view more

Talk to text with two free iPhone dictation apps

In the battle between iPhone and Android, one of several things Android users can hang over the heads of their iPhone-toting brethren is the built-in talk-to-text capability. Luckily, owners of the Apple device can easily retort, "Well, there's an app for that!" In fact, there are several dictation programs available. Better yet, the two I've outlined below are free (for the most part).

Dragon Dictation: This completely free app--which is compatible with any iPhone, iPad, or iPod Touch running OS 3.1 or later--is simpler in function than the other offering here. However, a new version was released just last week, adding several features that make it a compelling option. Namely, you can now glue your recently recorded text directly into the iPhone SMS client, and there's also an option to submit text to social networking sites Facebook and Twitter.

Taking down a text is as simple as opening the app, hitting a record button, verifying the text, and pulling up a menu to submit it to the client of your choosing, be it SMS, e-mail, or one of the aforementioned social sites. If the text isn't quite right, there's a keyboard that you can tug up for editing, though I was impressed by the performance of the dictation detector during testing. It had about 85 percent accuracy--not bad for a free program. My only real complaint is that you can't use it within an existing text conversation.

Vlingo: Vlingo is a bit more handy--and advanced--than Dragon Dictation. However, in order to take advantage of two of the most useful features, you'll have to pay for it. The app includes free talk to text for Web search, social sites, maps, and voice dialing. But if you want to activate the features for SMS or e-mail, a fee is required: $6.99 each for either texting or e-mail, or $9.99 for both. Still, it may be worth it for some users.

Vlingo is neat in that it recognizes certain voice commands, so that instead of dictating and then pulling up a menu to designate where your text is going, you simply command "Twitter update" or "text," followed by the communication you want. This completely removes the need to fuss with your phone from the equation, which should really be the ultimate goal for any dictation app. Vlingo also offered good accuracy during testing.

Originally posted at iPhone Atlas

28 Jul 2010, 7:40 pm | click here to view more

Hands-on: Let's Golf 2 for iPhone

One of the first games I downloaded when I got my iPhone 3G was Let's Golf and I couldn't believe how good it looked on the tiny iPhone screen. I was a big fan of Hot Shots golf on PlayStation 2, the console game that Let's Golf seems to be largely based upon, so seeing the familiar graphics and gameplay on the iPhone screen was truly a delight.

About a week ago Gameloft released Let's Golf 2 ($4.99), and it is even more beautiful graphically (optimized for the iPhone 4's Retina display) and adds to the already solid gameplay of the original. The cartoon-like graphics are more detailed in the sequel and you receive more of everything that was good about the original--more golfers to unlock, new courses to play on, and extra features to keep the game interesting.

Let's Golf 2 comes with 108 holes to play across six uniquely designed courses, every in dramatic settings. The courses every have their possess specific feel, with features like Aztec temples, forest landscapes, snow-covered vistas, and even a Safari-themed course that lets you play rounds in Kenya. But the scenery isn't the only reason you should plunk down $4.99 for this golf game.

In Let's Golf 2, you now have six golfers to pick from (once they are unlocked in career mode), each with a unique ability that becomes available once you make several successful shots in a row. The default character, Vincent, lets you add extra power to a shot once you've filled up the skill meter, for example. Depending on the setting and what hole you're playing, this means you might be able to reach the green in less shots than you would otherwise. The skill for the character named Chris lets you reduce wind speed to zero, which might make an otherwise very difficult shot in strong winds a much easier undertaking.

The game mechanics are mostly the same as the original: aim your shot by tapping the left or right side of the touch screen; tap once to start your shot; tap again when you reach your desired power; then tap again to hit the ball cleanly (it's much easier than it sounds). But in Let's Golf 2, the designers have reworked the stroke interface to make it a bit easier to receive a good shot off and the character-based special skill will help to make your shots even better.

In addition to the character-specific skill upgrades, there are now several more outfits to unlock, each giving you tiny bonus skills like shot power, accuracy, recovery (better shots from traps), and putting. This means that with the right outfit, hairstyle, sunglasses, and special ball, you can customize a character that's perfect for the challenges of a specific course.

To round out the feature set, Let's Golf 2 gives you options to play against your friends over shared Wi-Fi, Bluetooth, or an online mode through Gameloft Live. The first two modes worked fine in my testing, but I was never able to find a game in Gameloft Live so perhaps the company is still working out a few kinks. Aside from that issue, in every other way, Let's Golf 2 is a very polished arcade golf game, with plenty of replay value across the many courses and character choices. For more variation, you also can play the Challenge mode that lets you compete in situational minigames--such as longest putt competitions or "Birdie or bust" holes--for better equipment.

Overall, if you liked the original Let's Golf, Let's Golf 2 adds optimized graphics, more courses, more characters with unique skills, and enough features to make it worth the $4.99 price tag. Even if you never played the original, this game will be fun for any golf fan. If the company gets the online component working, maybe I'll look you on the course!

28 Jul 2010, 7:14 pm | click here to view more