Firefox Browser Upgrade Now Available

Version 1.5 offers improved usability, security.

Juan Carlos Perez, IDG News Service

Users will find significant enhancements in usability, performance, extensibility, security, and privacy in the test version of Firefox 1.5, the first major upgrade of the popular open-source browser since the launch of Firefox 1.0 in November of last year.

Beta 1 of Firefox 1.5 is now available as a free download, according to an official from Mozilla, the subsidiary of the nonprofit Mozilla Foundation that is charged with developing, marketing, and distributing Mozilla products.

Multiple Betas

Code-named Deer Park, Firefox 1.5 will have a second beta version slated for October 5, and then very possibly two or three follow-up releases starting in late October. A final version will probably launch in November or December of this year after the early releases, says Chris Beard, head of products and marketing at Mozilla.

However, computers running the Firefox browser could be open to remote attack as a result of a buffer overflow vulnerability reported today by security researcher Tom Ferris. Vulnerable versions of Firefox include all those up to 1.06, and even version 1.5 Beta 1 (Deer Park Alpha 2), released on Thursday, he wrote in a posting to his Web site, Security Protocols, and to the Full Disclosure security mailing list

Ferris said he reported the bug to staff of the Mozilla Foundation, the organization behind the Firefox browsers, on Sept. 4, but had no idea whether they were working on a fix for the problem. The problem is caused by a bug in the code Firefox uses to process HTML (Hypertext Markup Language) links in Web pages, Ferris said.

Links pointing to a host with a long name composed entirely of dashes can be crafted so that Firefox will execute arbitrary code of an attacker's choosing, he said. He also supplied a piece of code demonstrating the flaw. Last month, Ferris reported a critical flaw in fully patched versions of Microsoft Corp.'s Internet Explorer 6 running on Windows XP Service Pack 2. The flaw was acknowledged by Microsoft, but in that instance, Ferris did not reveal any details of the flaw or how it could be exploited.

Successful Year

The beta releases are primarily aimed at software developers for testing and feedback, but anyone interested will be able to download the software, Beard says. The follow-up versions, called "release candidates," are closer to what the finished product will be.

After years of absolute dominance over the browser market by Microsoft's Internet Explorer, Firefox has emerged as an alternative, holding between 7 percent and 8 percent of usage market share, according to various market research studies.

"We've had a pretty successful year following the launch of Firefox 1.0, and we're continuing to see very strong demand," Beard says. Mozilla estimates there are between 40 million and 50 million active Firefox users, defined as people who use the browser on a daily basis, and the browser is downloaded hundreds of thousands of times every day, he says.

Although Firefox's adopters are predominantly technically savvy users, mainstream adoption has been increasing, and version 1.5 is expected to help further the browser's popularity among the nontechnical, Beard says.

New Features

Beta 1 of Firefox 1.5 will offer faster Web site navigation, due to advanced capabilities for caching and prerendering content, Beard says.

The product's tabbed-browsing feature has also been improved, as users are now able to rearrange pages by dragging and dropping them, he says.

Improved as well is the Live Bookmarks feature, which lets users access RSS (Really Simple Syndication) or Atom content-syndication feeds. Live Bookmarks' ability to detect the presence of feeds on Web sites has been sharpened, and the browser will now flash an icon in the URL bar if the site being visited offers a feed or feeds, he says.

In terms of security and privacy, the biggest improvement is an automated update feature that makes it easy for users to keep their browser current with the latest enhancements and patches available, Beard says. For example, with the current version users have to download the entire browser again to get updates, but with Firefox 1.5 users will be able to simply download the patches, speeding the process, he says.

The updates will be downloaded in the background in bits and pieces, so as to not interfere with the browsing experience, and users will be prompted to install them once the patch has been completely downloaded, he says.

Moreover, the automated update feature also will take into account the add-ins a user has installed, to ensure compatibility between the browser updates and the extensions, he says.

Meanwhile, the browser's ability to block pop-up ads has been enhanced so that it catches more of these ads, he says. Also in the area of security, Mozilla has made it easier for users to clear private data from the browser's Web site history log, cache, saved forms, cookies, authenticated sessions, and saved passwords, he says.

Mozilla has worked with partners and community developers to create an ever increasing number of add-ins, or extensions, that users can plug into their browser to bolster a wide variety of functions, such as security, content-syndication capabilities, and Internet searching, he says.

"We're using our extension space as a virtual research and development effort to test out new capabilities for the browser before they are incorporated," Beard says.

Version 2 in the Works

Mozilla is already in preliminary plans for Firefox 2.0, due at some point next year, Beard says. As the development of Firefox continues, the project is being helped by the creation of Mozilla Corp. in August, he says.

"It lets us work very effectively with our open-source project and network of volunteers and contributors, but it also now lets us engage in commercial activities which you expect to see from a software organization," he says.