Don't forget that security vulnerabilities depend on many factors including the current configuration at the time.

If you allow scripting, activex, downloads, etc. for all sites of course you will soon be infected, since that is how most of the exploits work.


If you 'opened up' FireFox, you'd see pretty much the same result.

And why do you have to disable scripting and downloads? Because its implementation is insecure!

Other browsers do not come with ActiveX, and you don't get infected if you allow scripting and downloading for all sites.

I agree with BenoitRen on this one. disabling scripting for ALL sites is a bad idea as that will break most sites that depend on scripts and the sites will not work as expected.

ONLY thing I hate about Firefox browsers is poor cookie management. Dang those Firefox makers need to make it easier for users to control what cookies to accept and what cookies to reject (and easier access to the Cookie controls feature). The Mozilla, Seamonkey, IE, Opera browsers have far BETTER controls for cookie management and Firefox browsers lack the ability to reject "third party" cookies.

Read bitman's statement in the Spybot "Firefox 2 immunization" forum thread:
http://forums.spybot.info/showthread.php?p=65158
It's a very interesting point he made about Firefox.

Myself I agree with LLXX, it is far more preferable to only allow trusted sites to have access to activex etc than to try to rectify circumvention, just my 2 pennies worth

That option was removed from the GUI in Firefox 2 because it never worked right in the first place. It's still there in SeaMonkey 1.1, but the implementation (in Gecko) is the same. It's a false sense of security.

No site should have access to ActiveX. It's far too dangerous. JavaScript should be secure, they were never designed to be able to do higher level stuff, so trust shouldn't be an issue. As for the download thing, that's just a vulnerability that got turned into an option, just like you can allow IE to read and change your clipboard, which shouldn't be possible in the first place.

Actually, few sites actually *need* scripting, as it seems most of the time it's used for displaying ads, animations, and other unneeded items. Sometimes you can even bypass certain restrictions with scripting turned off

Also, JavaScript isn't really secure either. I wouldn't let any arbitary site use it.

JavaScript in Gecko (which is SpiderMonkey) is pretty secure. JavaScript in itself should be secure. You're just being paranoid.

Did anyone step up to the plate on the actual point of this thread?

I literally just waded through the garbage to try to find the answer... where the ***k is it?!

Does anyone here care enough to become part of the solution instead of complaining?

I don't program, but if there's ANYTHING I can do, sign me up dammit.

Come on people!!! Where the hell is your AMBITION?

The wrapper idea is awesome, as it is the method most of the user-created packages work... and it would be able to provide dam near 100% compatibility....

Keep ^---- that idea alive.

Agreed. Count me in as well. There needs to be some mini-organization though, as otherwise it'll just end in chaos. Anyone got experience in this sort of thing to take role of Team Leader? And someone to organize a properly managed forum with definite goals, tomescales, co-ordinate check-in modules, etc.

I intend to step up to the plate now that SeaMonkey 1.1 is out, but first the exams have to be over so I can have some breathing space already.

The project would be recognised as a Mozilla community project in the same way that SeaMonkey is.

Sounds good, BenoitRen! I'm looking forward to your work.

I wonder how difficult it would be to make Firefox 3/Cairo work on Windows 98? I mean, computers only do things in so many ways. They probably had to use Windows 98 to develop Windows 2000 or Windows XP in the first place, and they all their new code was probably created from some sort of standard programming functionality. So I would think it would at least be possible to make it work, even if it was difficult, right? Especially if the computer in question technically meets Windows XP system requirements, but would run it very slowly? Or is there some reason why it can't work, something underlying and immutable that I can't comprehend? It's just that I have a 500MHz Intel Pentium III with 128MB of RAM running Windows 98SE, and I don't see why I should suddenly need a 1GHz processor just as a backup computer to surf the Internet reasonably. To me, it seems like the Internet doesn't do anything it didn't do 7 years ago in terms of the data presented, they've just changed the standards to accommodate streaming media, complex style sheets, and more graphics, and somehow made them incompatible in the process of updating them. Maybe the changes don't mean much to me, because I'm not a very visual person.

You don't even need 500 Mhz to view the web. The thing that is heavy on resources is Flash, and complex JavaScript scripts.

Since I'm already posting, here's a progress report. Sunday I got to know that Gecko internally has code that converts values to Unicode as part of internationalisation. Yesterday I picked up a C++ book from the library, so I hope to get something done in the next few days.

When will this proposed project be carried on Mozilla's website and/or made official? I can't help but think you're going to need more than a book on C++ to write something this big and complex.

Big and complex? I'm not rewriting the browser.

Many of the APIs that I have to catch are easy to do, as they differ from their Win9x counterparts only in that they return Unicode, instead of a WORD value.

Things like SetWorldTransform will definitely be harder, but I'll see. The least I can do is try, right? Who knows other people will get interested in helping when I produce the start of the shim library.

You won't be able to get people interested unless you have a functioning example, even if it's buggy or slow. You have to "wet their tongue" before they'll want to drink.

That's not going to work out... I tried to do that a few years ago. I thought it wouldn't be so difficult, so I went out and tried to learn C with a book. I figured I would start with a simple command line program that outputted a string of text. That was the first example in the book. I understood it, and compiled it. Then it told me about declaring variables, and about how to take input from the keyboard. So I created four programs, each of which took two numbers as input, and either added them, subtracted them, multiplied them, or divided them, and displayed the output. I tried to go further, into making the program branch, to make one program that allowed you choose from a menu whether you wanted to add, multiply, subtract, or divide, but it got too complicated at that point. My ultimate goal was to create a simple text editor that opened whatever ASCII file you specified after its name, allowed you to edit it, saved if you pressed Ctrl-S, exited if you pressed Ctrl-X. I never got past the four calculators.

Note that I can create menus that allow selections to be made in MS-DOS Batch files, but I just couldn't do that in C. I've looked through C source code before, and its a nightmare of workarounds, defined functions, endless libraries, and dependencies. I once edited a libc5 Tetris program designed for Linux to work on a more current one, however. All I did was view the compiler output, see what functions were undefined, and searched for them on the internet. In one case, a function had been renamed, so I just took VIM, and had it replace all instances of the old name for it with the new one. In another case, the path to the library had changed. I edited the path in the include headers of the source files. GCC compiled it, and it ran. I was lucky it didn't involve any actual programming. I've been using computers since 1994, and I know how to create batch files, edit my autoexec.bat and config.sys, compile programs on Linux using standardized commands, and edit the registry. I also picked up on Latin rather quickly. Trust me when I say that the people who program in C are vastly more intelligent than I could ever hope to be, and I'm not sure you're smarter than me. Since I can do everything but program, I imagine their IQ would be about 30 points higher than mine.

I already know C. I picked up the book to learn what C++ has added, and to learn about #define.

I've been programming since I was 12 (though in recent years I'm more involved with the web). I like to program. So it can't be said that I'm some newbie who thought he could mash something together just by picking up a book.

Well, I guess you are smarter than me, then. I just thought since you said you were going to pick up a book that you hadn't programmed before. So, right now I'm using a nightly build of Firefox 3.0a2 on Windows XP (which I'm running on my primary machine, with a 2200MHz processor), but it doesn't seem that different, except that it has implemented support for a couple of rarely used web standards it didn't support before. The implementation seems pretty good, though.

I have never actually programmed anything, but if the thing that will make Firefox incompatible is the Cairo graphics library, and more use of Unicode, wouldn't simply porting that library, and changing the source code to use the Unicode libraries available for Windows 98 solve all the problems?

The person does not need to reinvent the wheel, but modify it to go round. I hope firefox do not close the trunk down which enables people to modify its source, and enable another up to date browser to function on 9x. In my opinion it is better to try and fail than to never to try at all, if this person who is attempting to extend our os`s lifespan by allowing a choice of a web browser then I wish them success.

Yes, as I learned earlier today, not only a shim library, but some work on Cairo too has to be done to achieve Win9x compatibility. But that won't be easy, because of API calls like SetWorldTransform, and such.

I don't know how many W APIs are implemented in Microsoft's Layer for Unicode, and would prefer to avoid it if possible. As I said, Gecko already has the necessary functions to convert to Unicode and back.

Good news: one of the developers who was instructed to participate in removing Win9x support is going to help me put it back. And he only lives one time zone apart.

That's excellent news!

This is indeed a great news! BenoitRen, big thanks for your try.

Good luck to you BenoitRen! Let us all know when you have tacked on to a firefox website project, or set-up a web page. I guess there will be some way provided for others to comment/help-out?

If this project is successful, it should also resolve the SVG issues with Firefox and Windows 98, because they also have to do with Cairo.

Furthermore, it could help other applications that use Cairo with Win9x compatibility, for example GTK+.

What do you mean? Cairo hasn't been used in any final releases as of yet. The problem is the VC6 compiler, it compiles parts of the SVG library incorrectly.

Hmm, I'm not quite sure, but I was referring to this:
http://developer.mozilla.org/en/docs/SVG_in_Firefox

OK, I asked on IRC, and Cairo is indeed used for SVG since Gecko 1.8.1 (that's Firefox 2.0 and SeaMonkey 1.1, folks). Cairo has always been used for canvas, though. Before Gecko 1.8.1, GDI+ was used for SVG.

Looks like it's mainly the text rendering part of Cairo that is incompatible with Win9x.

new official releases of Firefox versions 1.5.0.10 and 2.0.0.2 have been posted:
http://www.mozilla.com/en-US/firefox/2.0.0.2/releasenotes/
http://www.mozilla.com/en-US/firefox/releases/1.5.0.10.html

I'm beta testing firefox 3.0 alpha 2 (aka Gran Paradiso) on my WinXP home ed. machine

Preserving 98 reminds me of keeping that old classic car around.
Why throw years of experience in an OS away, when it still works?

Noticed this too: Firefox Version 4.0

On October 13, 2006, Brendan Eich, Mozilla's Chief Technology Officer, wrote about the plans for Mozilla 2.0, the platform on which Firefox 4 is likely to be based. These changes include improving and removing XPCOM APIs, switching to standard C++ features, just-in-time compilation with JavaScript 2 (known as the Tamarin project), and tool-time and runtime security checks.

Rainmaker, I wonder if you would like to try out Firefox 3.0 alpha 2 on a Win98 machine.
get it here:
http://download.mozilla.org/?product=granp...&lang=en-US
firefox 3 is code named "gran paradiso"

Gran Paradiso [Firefox 3] alpha 3 now available:
http://developer.mozilla.org/devnews/index...e-for-download/

Is this topic -- developing Firefox 3 for win98SE - going to have a dedicated website, or an enlarged forum for contributors?

Newbies please note: Firefox 3 won't work on win98SE.

Depends on if I heard right that MoFo will allow such a project to be hosted. By the way, it's all about Gecko. And Cairo, named Thebes in the source.

I got side-tracked, and now I have exams again. I'll resume work soon. I was in the process of documenting what needed to be done.

Hi BenoitRen!

It would be great if you could get through the initial phase of the project (i.e. document what exactly needs to be done and hopefully start up a devoted page on www.mozilla.org) while Firefox 3 is still in Alpha stage. Of course nobody can "demand" anything from you, seeing as you are the only one who has voluntarily shown some initiative regarding this issue.

Alpha 5 of Gran Paradiso now available:
http://www.mozilla.org/projects/firefox/3.0a5/releasenotes/

SeaMonkey switched to the toolkit back-end on the trunk recently. That's extra incentive for me to get back to work. Just one more exam to go, and I'm free for two months!

Gran Paradiso (Firefox 3) alpha 7 now available:
http://www.mozilla.org/projects/firefox/3.0a7/releasenotes/

the next major version of Seamonkey (2.0) will also be using the Gecko 1.9 runtime. I may be testing the alpha versions of seamonkey 2 later this month.

Just out of curiosity. Did anyone get 3.0 to work on Windows 98se?

Hi BenoitRen,
any progress on your end? We are probably nearing Gecko 1.9 Beta stage soon, and the more delay, the less of a chance that Mozilla folks will provide help (at least that's my fear).

Nope, no progress, sorry. Exams keep bugging me, and I'm always distracted by other pet projects of mine.

I was bored, so I figured I could continue with the documentation. I got updated on the state of things by the developer that offered help last time.

Almost everything got its Win9x support code ripped out. At this point, the shim library idea that was proposed a year ago likely wouldn't do the trick. The way to go would be to make a Win9x-only build. To do this, I'd have to go through bonsai and revert the changes.

The real work will be making Cairo, the new rendering front-end, compatible with Win9x. I have the impression that emulating the SetWorldTransform API would be crucial in doing this.

I still haven't got room for my new PC to do all this on, though...

I have been doing some reading.

Is it possibly to use the windows xp application program interface in windows 9x?
This way to fool firefox3 to install thinking it is xp, when it is really windows 9x?

What got me thinking of this is if Axcel216 has a program that can replace windows 98 with the windows me shell without installing windows me it called 982se2me
http://www.mdgx.com/

By using the program, he was able to install windows movie maker to run in windows 98se thinking it was windows me.

I do not see why you can not do this with api.

This program can also replace other windows 98se files with windows me files.



My complaint
I have at least a 10 year old computer. It is still working.
It could be upgraded to xp pro but I would rather stick with windows 98se. Vista would not work on this computer.

I never did like xp when I had it. That computer broke down after 1 year of service.

well the thing about 98se2me by mdgx on this forum is that 98se and me are of the same windows line where as xp is part of the nt line.

the problem isnt fooling the installer to install that can be done fairly easy it is the apis that are important and they have to be implemented

As it is probable that developing Firefox 3 for win98SE is going to be more difficult than originally envisaged, would it not be an idea to look into extending Firefox 2 as a parallel activity?

My thoughts exactly


What gains will we get from Firefox 3 that makes us really want it?

Honestly I think it would be a better idea to make a list of APIs Firefox 3 needs that are unavaliable in Windows 98, and then help Xeno86 implement them in KernelEx, so there would be no need to maintain a special Firefox version for Windows 98.

There's a whole bunch of stuff scattered around on that topic. Here's one reasonably comprehensive link:

http://www.mozilla.org/projects/firefox/3.0a3/releasenotes/

My thoughts are (roughly) as follows:

1. Firefox 2 does everything one could wish for (at present).

2. Assuming official support for it drops in 2009 (?) there's still at least nearly two years of using it left.

3. Need to keep an eye on any emerging "must have" feature being brought into Firefox 3 and see if FF2 can be adapted to support it -- much like the approach to win98SE in this forum.

4. Security updates...what happens when official support ends?

5. Conclusion: If (3) and (4) can be dealt with/resolved adequately, there's no reason I can see why FF2 might not be used for a number of years yet.

6. FF3 for win98/win98Se/ME is a great idea. But has anyone looked into the feasibility? Who would be responsible for security aspects?

On a old system. Which would be a better bet use an insecure Firefox2 or an insecure IE?

I would go with a insecure Firefox.


Technically all browsers are not secure and neither is any operating system. No mater how many updates or patches are installed.

It's not about Firefox, it's about Gecko.

Gecko.

GECKO.

Gecko 1.9 will bring a lot of new things to the table, the most important being a better rendering engine.

Security vulnerabilities are in Gecko, Mozilla will be responsible for security, as always. This doesn't need to be a concern for the people who want to maintain a Win9x-compatible build.