Indistinguishable from Jesse

Firefox 1.0.x reached approximately 50,000,000 downloads today. That's an average of almost 300,000 downloads per day since Firefox was released on November 9, 2004. Spread Firefox is celebrating with a photo contest, which already has several winners. It's great to be involved in such a successful project.

I don't have anything against the convention of celebrating numbers that have a lot of zeros at the end when written in base 10, but I'd like to make fun of it by pointing out that Firefox is likely to reach 0x3000000 (50,331,648) downloads within a week.

Entering a single-line comment on the last line no longer causes a syntax error. Updated shell, updated bookmarklet.

New features and bug fixes in JavaScript Shell 1.2:

• Multiline input. You can now insert line breaks using Shift+Enter and paste multiline scripts. Edward Lee ("Mardak" on irc.mozilla.org) added this feature.
• Fixed the bookmarklet version to work in Firefox 1.0.3 (it was broken due to the fix for bug 289074). Edward Lee was the first to point out this problem and helped me fix it.
• Fixed print() to not bring up the File > Print dialog.
• Fixed blink() to work in IE (using border instead of outline) and Opera.
• Made the feature that lets you click anywhere to focus the input box work in Opera. It still doesn't work in IE.
• Fixed multiline output in Opera. It still appears all on one line in IE.
• Fixed the bookmarklet version to have a vertical scrollbar when needed on Firefox trunk. (I might be working around a bug in Firefox trunk.)

I'm aware of several new problems introduced by the multiline input feature:

• In Opera, Enter inserts a line break and *then* submits.
• In IE, multiline output isn't broken over lines.
• In Firefox 1.0.x, but not on trunk, a scrollbar appears if you have a few dozen lines of input.

JavaScript Shell 1.1 is still available.

My second user script, BugSort, lets you sort Bugzilla bug lists (example) without contacting the server. I have tested it with Greasemonkey 0.2.6 on Firefox 1.0.3 and with a prerelease version of Greasemonkey 0.3 on Firefox trunk.

My first user script for Greasemonkey is Check Range. It lets you check or uncheck a range of checkboxes by clicking the first checkbox and then Shift+clicking the last checkbox. I have tested it with Hotmail and Yahoo! Mail. I have only tested it using Firefox 1.0.2 because Greasemonkey does not work on the trunk for me.

From: Google AdSense
To: Jesse Ruderman
Subject: Google AdSense Account Status
Date: Tue, 8 Mar 2005 21:56:17 -0800

Hello Jesse,

We regularly review sites in the AdSense program for compliance with our program policies.

While reviewing your account, we noticed that you are currently displaying Google ads in a manner that is not compliant with these policies. We've noted that you are in violation of the following program policies on www.squarefree.com/extensions/adbar:

- We've found that you're displaying Google ads in a manner that does not comply with our program policies. According to Google AdSense program policies, no Google ad or search box code may be pasted into any software application, even if it is modified to not show ads through your AdSense account. In order to comply with our policies, please remove the Google ad code from the software provided in your site.

Thank you for your understanding. Once you've made the necessary changes, please reply to this email so that we may review your account again.

We also suggest that you take the time to review our program policies (https://www.google.com/adsense/policies?hl=en_US) and Terms and Conditions (https://www.google.com/adsense/localized-terms?hl=en_US) to ensure that all of your pages are in compliance.

Sincerely,

Heraldo
The Google AdSense Team

Dan Veditz has updated the Mozilla Foundation Security Advisories page with information about holes that were fixed for Firefox 1.0, Thunderbird 0.9 and 1.0, and Mozilla 1.7.5.

None of the holes were arbitrary-code-execution holes, which surprised me. The worst hole fixed for Firefox 1.0 was the javascript: Live Bookmarks hole, which required some user cooperation and allowed attackers to steal cookies and sometimes execute arbitrary code. In contrast, many previous Mozilla and Firefox releases included new fixes for memory management holes such as buffer overflows. Exploits for memory management holes are harder to write, but they allow attackers to execute arbitrary code without getting any cooperation from users.

I have trouble completing personal projects that take longer than a weekend. I often lose interest after doing the interesting parts and procrastinate indefinitely on completing the projects since they have no deadline. In August 2004, I set a goal compatible with my attention span: "start and finish one interesting project every weekend". This goal helped me write a bunch of Firefox extensions and one or two Firefox patches, but of course it didn't help me finish longer projects. Now I have several half-finished longer-than-a-weekend projects piled up.

I'm hoping that this "coming soon" post will make me finish at least some of these projects soon. Also, you can tell me which projects you want me to finish first.

• A novel attack against something that was proven secure using a what I think is a poor definition of security.
• A proof that a popular puzzle is NP-complete.
• A list of some of Firefox's weaknesses, design elements that can lead to security holes.
• Security tips for Firefox users (current version). Since this document is already 7 printed pages long without screenshots, it may be more effective at pointing out critical user interface flaws in Firefox and Windows than at educating users.
• Security tips for web application developers (current version).
• Security tips for Firefox developers and extension developers (current version).