Firefox 3.5.1 Released, fixes Windows load time issue

http://en-us.www.mozilla.com/en-US/firefox/3.5.1/releasenotes/#

by mikeyur • 17 years ago

26 5 17 years ago

en-us.www.mozilla.com

umbrae• 17 years ago

Even more important in 3.5.1, that JIT vulnerability is fixed:

MFSA 2009-41 Corrupt JIT state after deep return from native function

http://www.mozilla.org/security/announce/2009/mfsa2009-41.ht...

blasdel2• 17 years ago

See the previous thread: http://news.ycombinator.com/item?id=696652

From what I can tell, they didn't actually remove the hideously stupid tempdir-walking rng-seeding code in NSS -- they just fixed it so it's not called on XP (at least most of the time), as they think XP's RNG is good enough for them.

They were planning to still use it intentionally on Win2k and WinCE.

Most of the stupid shit that Mozilla does has a freetard angle of some sort, and it's possible to understand their motivations. This is just plain baffling. WTF Mozilla?

derefr• 17 years ago

How do you suggest they gather good entropy on Win2k and WinCE, then? If you actually do have a better idea, I'd be willing to try my own hand at turning it into a patch, so let's hear it :)

blasdel2• 17 years ago

A) Stop being such affected crypto-wankers, and realize that they don't need more entropy than the TCP stack.

B) Given that (A) is basically untenable for them, find entropy by looking at the user's Mozilla profile.

It's bizarre that they're looking in IE's messy cache directory when they have their own tidy one that they fully control! There's all kinds of lovely compact entropy to be found there, especially with the SQLite databases that it keeps.

andrewf• 17 years ago

There's argument and reasoning in the bug (https://bugzilla.mozilla.org/show_bug.cgi?id=501605) and other items linked to from that discussion.

Long story short: some of the Windows versions that libnss runs on are unable to provide as much entropy as libnss's PRNG wants to be seeded with, without resorting to gathering it from places like the tempfiles directory.

Firefox 3.5.1 Released, fixes Windows load time issue

Related Stories