Business Tech

Those keen to try out Mozilla's latest browser--and its new process to update the software more frequently--now can try Firefox 3.6 beta 1 for Windows, Mac, or Linux.

Among the features in the new version, according to Mike Beltzner, Mozilla's director of Firefox, and Mozilla evangelist Chris Blizzard:

• Personas, which lets people customize the browser appearance. Personas has been available as an add-on, so there are plenty of Personas skins to choose from.

• Faster execution of Web-based JavaScript programs, better browser responsiveness, and faster startup time. Mozilla has been working on JavaScript performance for many months, but the urgency of that and other performance improvements increased with the arrival of Google's Chrome browser.

• The ability to drag and drop files from the computer to the browser. This is useful for uploading files to Web sites, as will a feature not in the beta but planned for the final version, support for the multiple-file input tag so more than one file can be added in Web forms.

• Expanded support for geolocation technology so it can provide a Web site with an approximate physical address of the user, not just latitude-longitude coordinates.

• The ability to detect the computer's orientation for machines that offer accelerometer support.

• Video built into Web pages with the HTML5 "video" tag now can be viewed full-screen.

Mozilla also released a full list of Firefox changes developers should know about with more details.

Firefox is at the vanguard of the second generation of browser wars. Although it competes with Google's Chrome, Apple's Safari, and Opera, all those browsers are also allied in a way against Microsoft's Internet Explorer, which though dominant is relatively slow at some tasks and only now complying more fully with Web page standards of yesteryear. The rivals, meanwhile, are pushing ahead with new features in HTML5 in development right now.

Mozilla released the alpha version of Firefox 3.6, code-named Namoroka, in August.

The organization plans to release the final version by the end of the year, with Firefox 3.7 in the first half of 2010 and Firefox 4.0 in about a year.

One complication of the upgrade is compatibility of add-ons that extend Firefox's features; the new browser version makes some changes. Mozilla is debating whether to release Firefox 3.6 as a minor update automatically distributed to 3.5 users or as a major update that requires those users to actively retrieve it.

One major element of Firefox 4.0 is a new add-on technology called Jetpack that eases this compatibility problem.

Mozilla hopes to classify the upcoming Firefox 3.6 as a minor update, a move that may sound inconsequential but that in fact might have significant repercussions with Firefox users and the speed the open-source browser is developed.

Mike Beltzner, Mozilla's director of Firefox, in a mailing list discussion that he'd like to call the new version a minor release "to quickly migrate our user base to Firefox 3.6." Minor releases in the past typically have been steps from, for example, 3.5.3 to 3.5.4, but Mozilla is trying to speed up more significant changes and not just fixes for bugs and security holes.

"Firefox 3.6 will be primarily a release with security, stability, speed and capability enhancements, with no visible user interface changes over Firefox 3.5. As such, I think we should consider it as a candidate for a minor update, stretching our definition of what types of updates we can provide using that mechanism," Beltzner said.

Be default, Mozilla automatically distributes minor Firefox updates to be installed after a user prompt. Major updates initially require the user to actively retrieve the new version, though Mozilla gets more active as time passes and older versions reach the end of their support lifespans--January 2010 in the case of Firefox 3.0.

Why change the process? To keep up with changes in the browser world, Beltzner said.

"The pace of technology development in web browsers is speeding up rapidly, and we now face a challenge of ensuring that we can continue to deliver modern web browsing experiences to our users," he said.

And in a position that mirrors the rationale that Google offers for its automatically updating Chrome browser, he added, "Users' expectations of software have changed since the update mechanism was introduced in Firefox 1.5. Many applications that browser users interact with exist in the cloud, with updates pushed frequently and transparently, without consultation. That wasn't the case only a few years ago."

That sounds reasonable, right? Well, it turns out nothing is simple.

One problem is that add-ons won't work with the new version unless they're updated, too, and there are a lot of add-ons in the world. "Add-on compatibility is one of the large reasons why users do not move from one version to another," Beltzner said.

Sure enough, John Barton, an IBM employee who's a member of the group overseeing development of the Firebug add-on widely used in Web site development, raised concerns about moving quickly to 3.6 and the current version 1.4 of the add-on.

"We're a little confused by a Firefox 3.6 that can't decide if it is 3.6 or 3.5.5. If 3.6 is really minor, release it as 3.5.5. Else, well then it's not minor after all," Barton said, though adding, "I support shorter release cycles in Firefox."

Add-on compatibility problems is one reason Mozilla is moving to the new Jetpack extensions system in Firefox 4.0 next year.

One of the big new features in Firefox 3.6, code-named Namoroka, is the arrival of Personas, which lets people customize the browser appearance.

Mozilla said the first beta of Firefox 3.6 is due this weekend or early next week, and Beltzner said there currently are no plans for second beta. The final version is due by the end of the year.

In an attempt to better show what its software is up to, Google has released the source code of its Google Update software, a project code-named Omaha that can automatically install new versions of programs, including the Chrome browser and Google Earth.

"Some users can be surprised to find this program running, and at Google, we don't like disappointing our users. We've been working hard to address these concerns, and releasing the source code for Omaha is our attempt to make the purpose of Google Update totally transparent," Myles Jordan of Google's software engineering team and Michael Smith of its product management team said in a blog post Friday.

Google believes in automatic updates of software so security vulnerabilities can be patched quickly, and Google Update is the tool that permits automatic downloading and installation of a new version in the background so it's ready to run the next time the program is launched.

Sharing source code can allay concerns about what exactly software is up to, but Google also hopes that others will be able to use Omaha.

"Keeping software up-to-date is hard. So if you're thinking of developing your own auto-updater, or have already started, we hope that the code we are releasing today will be helpful to you," the Google employees said.

The company also released an Omaha developer guide for those wishing to use the software. Omaha is governed by the Apache License 2.0, Google's preferred open-source software license.

Google released a new beta version of Chrome Tuesday, offering a better balance between software that's stable but out of date on the one hand and cutting-edge but crash-prone on the other.

The new version offers a number of new features, including zooming that increases or decreases the graphics as well as text; autofill to ease the chore of re-entering information in Web site forms; and new tab-dragging features that let you dock browser windows to the sides of the screen. The new beta version is essentially the same as Chrome 2.0.169.1 that was released last week to the Chrome developer preview channel for less-tested versions of the browser, Google said.

The feature Google chose to spotlight in a blog post announcing the new Chrome beta, though, is better JavaScript performance from a new version of the browser's V8 engine. "It's 25 percent faster on our V8 benchmark and 35 percent faster on the Sunspider benchmark than the current stable channel version and almost twice as fast when compared to our original beta version," Chrome product manager Brian Rakowski said in the blog post.

JavaScript is used to power elaborate Web applications such as Google Docs and refinements on countless more ordinary Web sites, and Google, Mozilla, Apple, and Opera all are racing to improve how well their browsers handle it.

Since releasing Chrome 1.0 in December, Google has essentially offered only two of the three promised versions of its browser: that stable version, which has received only minor tweaks, and the very rough-around-the-edges developer preview version where Google tries out new features. The beta version just tracked the stable version.

I've been using the developer preview version for the most part, despite the fact that several earlier incarnations were prone to becoming unresponsive and the latest one triggers an objection from Flickr's Organizr tool. Recent Chrome developer preview bug fixes have helped, but it's still not for most folks.

The better-tested beta, though, means many of the new features will be available to those with a lower tolerance for flakiness.

New how-to document for extensions
One big advantage Firefox has over Chrome is its ability to accommodate extensions that endow the browser with new features. Google is working on the extensions for Chrome, though, and on Monday Google programmer Aaron Boodman published a how-to document for writing Chrome extensions.

"Right now extensions can only really contain content scripts, so that is all this doc covers. But we'll be expanding it over time as more features develop," Boodman said in an e-mail announcement of the how-to document.

Adobe Systems released an update to the flagship CS4 version of Photoshop to squelch a number of bugs that could crash or slow down the image-editing software.

The 11.0.1 update (downloads available for Windows and Mac OS X) deals with the following issues, according to Adobe:

• A number of issues that could cause slow performance have been addressed.

• Pen barrel rotation with Wacom tablets now works correctly.

• Photoshop now correctly recognizes 3D textures edited by a plug-in.

• The quality of the results of Auto-Blend Layers (Stack Images) has been improved.

• A problem that could result in a crash when pasting formatted text has been fixed.

• A crash that could result from a corrupt font no longer occurs.

Google offered a new developer build of Chrome.

(Credit: CNET News)

Google released a developer-oriented update to its Chrome Web browser on Wednesday that fixes some crashes and video playback issues.

Chrome is still in beta testing, and for those who have an even higher tolerance for rough-around-the-edges software, Google also offers developer versions. Chrome 0.3.154.3 is the latter; see our earlier post on how to subscribe to the Chrome Dev channel.

"Release 154.0 (the most recent publicly released Chrome developer build) had a few browser crashes, including a crash on startup on tablet PCs running Windows Vista. We fixed the new crashes, and 154.3 should be much more stable," Mark Larson, Google Chrome program manager, said in a mailing list posting Wednesday evening.

The browser wars are back in force, albeit in a more standards-compliant and collegial way, and a major thrust of the resurgent competition is higher performance for faster, more sophisticated Web applications. The first beta version of Firefox 3.1, released Tuesday, brings significant improvements to JavaScript, the programming language that underlies many such applications. Microsoft is on the verge of releasing Internet Explorer 8 (though it still hasn't convinced innumerable people to upgrade even to the current version 7), and the Webkit project that forms the foundation of Apple's Safari browser is being fitted with a new JavaScript engine called Squirrelfish Extreme.

Other fixes addressed problems with plug-ins such as a bug that could hang video playback after a second or a plug-in priority issue that cause the browser to become unresponsive. Chrome can use the Mozilla Firefox versions of plug-ins such as Adobe Systems' Flash.

In the security department, Chrome requires more manual intervention before users can save executable files with .exe, .bat, and .dll extensions.

Chrome is open-source software, and Google credited two outside programmers for their contributions.

For a full list of changes, see the Chrome 0.3.154.3 release notes.

Updated 1:44 p.m. PDT with details that Chrome automatically updates itself with no notification or choice for the user.

Google has quietly begun releasing a hastily prepared update to its Chrome browser to fix some security problems.

The new version, 0.2.149.29, replaces the 0.2.149.27 that was released when Google launched the Chrome beta version last week. Google started releasing the update Friday, initially to a small number of users, but didn't make much of an announcement about the change.

To check if an update is available, click the wrench icon in Chrome's upper-right corner, then select 'about Google Chrome.'

(Credit: Josh Lowensohn/CNET News)

"149.29 is a security update and we released it as fast as we could," said Mark Larson, Google Chrome program manager, in a mailing list posting on Sunday. "We would've liked more time to prepare things, but some of the vulnerabilities were made public without giving us a chance to respond, update, and protect our users first. Thanks for being patient as we work out the kinks in all of our processes."

However, Google isn't revealing details yet about what security issues it's fixed.

"All users have not received the update yet, so we cannot discuss the details of the security issues that were addressed, but we plan to disclose more information once the update has reached all of our user," the company said in a statement Monday.

To check if an update is available, Chrome users can click the wrench icon in Chrome's upper-right corner, then select "about Google Chrome." That will show both the version number and a message indicating whether an update is available.

Google knows best
Without a manual check, Chrome will update itself automatically, Google said. "Google Chrome will automatically checks for updates approximately every five hours. If an update is available, it will be downloaded and applied at the next browser restart," Google said.

Google believes it's best if Chrome applies security updates not only without a description of what's changing, but also without an opportunity for users to decide whether to accept the patch.

"Users do not get a notification when they are updated...When there are security fixes, it's crucial that we update our users as quickly as possible in order to keep them safe. Thus, it's important for us to not require user intervention," the company said in a statement."There are some security fixes that we'll keep quiet because we don't want to disclose security vulnerabilities to attackers."

The automatic update policy applies to security and bug fixes. "For major version updates, when feature changes are involved, we'll explore options for providing users with more details about the changes," Google said.

Microsoft and Mozilla encourage users to download and apply updates automatically to Internet Explorer and Firefox, respectively, but users can chose not to do so.

Automatic updates can cause indigestion in corporations where internal administrators often want control over what software is running or not for compatibility, security, and other reasons. But browser browser vulnerabilities loom larger as more applications move to the Web and more people rely on those services, and automatic updates can help nip attacks in the bud.

Open-source redactions
Don't look for clues about the vulnerabilities in the Chrome source code. The open-source Chromium project has publicly available mailing lists and source code, but many recent changes to the code base are redacted to show only a blank page rather than the detailed changelog notes of other changes.

"Most of the changes are visible, aside from security changes, which we must keep private in order to keep users safe," Google said of the changelog.

Programming fans also won't be able to glean any insights from the Chrome update plug-in, which is proprietary.

"We use this updater and the server architecture it interfaces with to update across many of our products, some of which are not open source," Google said. "It's not that we are trying to hide anything; rather, it's just that this update infrastructure is not intended to be used by others who may distribute their own versions of the browser based on Chromium code."

Reported vulnerabilities
One security problem found in Chrome version 0.2.149.27 is a carpet-bombing vulnerability that could help an attacker install malicious software on a user's computer without giving the user a chance to accept or reject the download. Google assigned the problem a top priority.

Another reported issue in Chrome 0.2.149.27 is a buffer overrun that could allow an attacker to run arbitrary code on a user's computer and thereby take control of it, according to Bach Khoa Internet Security.

The company was willing to discuss some other details about the update, though. For one thing, the company updated a JavaScript problem that could cause problems using Facebook. For another, it fixed a problem that would crash the entire browser if a person typed "about:%" into the address bar. Google called the problem "non-exploitable, but very annoying," reflecting the removal of the "security" label from the bug report.

Canonical's update service for the Ubuntu operating system had more downtime than Apple's or Microsoft's services.

(Credit: Pingdom)

A company that measures Internet service reliability has given Microsoft the top score in a test of operating system update services.

Microsoft's Windows Update was available 100 percent of the second quarter of 2008, Pingdom said in a blog posting Friday. Apple's service was down 2 hours and 34 minutes, with 99.9 percent uptime, and Canonical's Ubuntu version of Linux was down 1 day, 5 hours, and 45 minutes, for 98.64 percent uptime.

"Microsoft wins this one hands down," Pingdom said. It noted that Ubuntu's service also is available through mirror sites, however.

The company tested the three services every five minutes.