The Mozilla Foundation has confirmed the existence of a critical zero-day vulnerability in its popular Firefox web-browser – but says a fix won’t arrive before the end of the month.

Posting on its official security blog, the Foundation confirmed a vulnerability which it has “determined to be critical and [which] could result in remote code execution by an attacker.”

The good news? The Foundation has already developed a fix, which is currently undergoing quality assurance testing prior to a general roll-out. The bad news? That roll-out isn’t due for at least a week, potentially leaving Firefox users vulnerable to attack.

The bug, originally discovered by security researcher Evgeny Legerov last month, was posted publicly but without the code required to carry out an attack. However, it appears that Legerov was reticent to provide detailed information to Mozilla – with ARN pointing to a now-deleted post on the researcher’s blog admitting to “ignoring e-mails” from the foundation and refusing to provide enough detail for the Foundation to reproduce the exploit.

Thankfully, the Foundation says that Legerov has now provided “sufficient details to reproduce and analyse the issue,” meaning the flaw can be fixed and the patch prepared for a planned 30th of March roll-out. Those who are itching for a fix and don’t mind running code that isn’t as well tested as a standard release are advised to grab a copy of the nightly build of Firefox 3.6.2, which contains the patch to prevent the exploit from running.

Link to article: Mozilla confirms 0-day Firefox flaw

It’s the bane of Web designers everywhere, and it makes most modern Websites look broken and horrible. So why are 20% of web surfers still using it?

Today was supposed to be a great day for the Web. As of March 1, 2010, Google will no longer support Microsoft’s Internet Explorer 6 browser-a decade-old dinosaur engineered to navigate the Web as it existed in the year 2000. Why would this be cause for celebration? Because IE6 is barely capable of navigating the modern Web and a total nightmare to build sites, services and applications for.

But ten years after its release, it’s still being used by an estimated 20% of surfers. And while Google’s move is one in the right direction, I’m not breaking out the whiskey and noisemakers for IE6′s funereal wake quite yet. Sadly, IE6 isn’t going away for good anytime soon.

Those unfamiliar with the Internet Explorer 6 saga might be wondering what the big deal is. How could the life or death of one browser be so critical to the future of our increasingly Internet-based lives? When compared to browsers of today, IE6 is a standards-incompliant antique. It debuted during a dark, dark period in Web history; In the summer of 2001, Microsoft had soundly beaten Netscape into submission for a 90% lock on the browser market and was in the uniquely powerful position to decide which Web standards it would ignore, which it would integrate, which it would halfway adopt and which it would simply make up.

And IE6 is the bastard child of this hubris. It doesn’t behave like any other browser on the market because it doesn’t interpret Cascading Style Sheets or JavaScript according to the universal standards set by organizations like the W3C. I’ve heard of developers spending anywhere between 20% and 50% of their time on a project making a site work in Internet Explorer 6. I know of many others who simply chop out advanced features, enhanced interactivity and slick design elements altogether, just so their work doesn’t “break” in IE6.

Why do they bother? Because nearly a decade after it shipped with Windows XP, IE6 still commands a mind-blowing 20% market share for browsers, according to the most recent statistics compiled by NetMarketShare. That’s more than double the shares of Chrome and Safari combined, and just shy of Firefox’s 24% piece of the pie. And that’s only Internet Explorer 6. Combined with its better-behaving but by no means perfect descendants, IE7 and IE8, Internet Explorer as a whole owns 62% of the browser market. Now, browser market share is not an inexact science and the numbers vary widely from site to site and country to country, but you get the picture.

The longevity of IE6 is the result of a perfect storm of unfortunate factors. First among them: Microsoft’s IE division simply fell asleep. Having emerged the undisputed victor of the late ’90s browser wars, Microsoft had virtually no competitors and so no incentive to fix any of IE6′s bugs. It took Microsoft more than five years to release IE7, which was an improvement over IE6, but still a disappointment for Web designers and developers. Five years! In the five years between 2004 and 2009, Mozilla released three versions of Firefox (actually, 3.5 versions to be exact). Meanwhile, Chrome has gone through four iterations in just over a year. In those five years between IE6 and IE7, technological progress on the Web was severely hobbled to say the least. After all, who cares if Firefox can do something really cool if only a handful of users will ever see it?

But Internet Explorer 7 did eventually come out, and so did Internet Explorer 8, Firefox, Safari, Chrome and new versions of Opera. And yet, IE6 remains the second most popular browser in the world (behind IE8). What gives? The chief reason Internet Explorer 6 keeps hanging on is because people are using it at work or on work computers.

As anyone who’s ever used a computer furnished by their employer can attest, IT departments are slow to make any changes that might disrupt the delicate balance of their electronic ecosystems. And they sure as hell aren’t going to let you upgrade or install anything yourself.

Making matters worse, Internet Explorer 6 is deeply embedded in the infrastructures of countless corporations worldwide. Back when IE6 was the only game in town, businesses invested in Intranets and browser-based apps that functioned only in IE. Why bother with anything else? Five years later, of course, a lot of businesses learned the hard way that “IE-only” actually meant “IE6-only.” Oops. Now, ask yourself how much interest corporations have in re-investing more capital to fix something that, in their eyes, isn’t broken. The answer is: not much.

A recent article on Dell’s IT Expert Voice blog cited another reason your company doesn’t upgrade to IE8 or another browser: user control. Your bosses don’t want you on Facebook and YouTube, and they know that the experience of visiting these sites with IE6 will be painful enough to limit your time on them. They effectively block you without coming off as overtly Orwellian. Win win.

Finally, there are the countless folks who simply don’t know any better-a contingent I was reminded of by David Walsh, a developer for the Mootools Javascript framework (for which IE6 support remains a priority). “When it comes to Internet Explorer 6, developers ask, ‘God, why do people choose to stay with it?’” he says. “But, I like to remind them that users don’t care and shouldn’t have to care. The one example I give is my grandmother. She doesn’t know what a browser is. She just knows that when she clicks the little blue ‘e’ on her desktop she gets to see the Internet.”

It’s not just grannies, either. I was using the computer of a 30-something year-old friend recently and mentioned my surprise to see him still using IE6. He asked me why it even mattered.

If people aren’t allowed to upgrade or have no idea that they need to, then does the Google announcement inch us any closer to an IE6-free Web today than we were yesterday? “It’s an important first step that I’m quite happy about,” Walsh says. “But, I don’t think it would be wise for developers to say, ‘Well, Google is doing it so I’m going to do it too.’ I foresee at least another year or two of having to support Internet Explorer 6.”

I’m less optimistic than Walsh, and that’s thanks mostly to Microsoft’s pledge to support IE6 until April 8, 2014-the day it officially ends support for Windows XP, the OS it was bundled with. As much as it pains me, I have to give Microsoft a tiny bit of respect for doing this. Though the company wouldn’t provide comment for this story, it pointed me to a blog post explaining the method behind this madness. “Dropping support for IE6 is not an option because we committed to supporting the IE included with Windows for the lifespan of the product. We keep our commitments. Many people expect what they originally got with their operating system to keep working whatever release cadence particular subsystems have.” Microsoft is basically taking the exact opposite approach to upgrades that Apple takes, which is to upgrade quickly at the expense of its users (Snow Leopard on G5, anyone?).

For its own part, Microsoft would be happy to see you stop using IE6, too. In another blog post, the company says, “Think about what technology and the Internet were like in the year 2000 – and consider how they’ve evolved since then. In 2000, ‘phishing’ was something that happened at the lake, not online. There was no social networking, no RSS feeds, and no real blogs. It was a different time – and people’s browsing needs were different.”

The post goes on to explicitly recommend moving off of IE6. The problem is, corporate IT departments won’t do so until they absolutely must, which may be well after the April 2014 death knell sounds. If Microsoft was smart, it would actively help businesses upgrade their IE6-based systems to IE8 (and future versions). And they would do it for free.

Why? Because IE’s very survival could be at stake. If Microsoft doesn’t, then Google could certainly afford to offer similar support for companies to move their systems over to Chrome. Overnight, we could see Chrome’s market share balloon to 30% and all versions of Internet Explorer shrink to below 40%.

Walsh points out that Explorer’s market share is being further threatened by empowered Web developers and a more educated Web-going public. “There’s this assumption that people are going to go straight from Internet Explorer 6 to Internet Explorer 7 or 8,” he says. “But, the thing we have to realize is that browsers as a whole have become more popular. Five years ago, most people probably didn’t know what a browser was, but more and more they’re able to indentify them. And as Web sites drop IE6 support, developers are going to steer people toward the browsers they like. Firefox, Chrome and Safari are going to be pitched a lot more than IE and I think those browsers have a good chance at being the next step for people.”

But IE6 is something many Web developers will have to tangle with for years to come. For any Web site considering following Google unto the breach, I ask you to remember a few things. First, Google.com isn’t going to suddenly stop working for folks using IE6. By dropping support, Google is saying that future upgrades to sites and services like YouTube, Gmail and Google Docs will no longer prioritize IE6 compatibility. Second, let your user base determine your course of action. David Walsh’s blog, for example, is targeted at professional Web designers and developers. “My Website is 1% IE6,” he says. “So I don’t really care about it.” (Only 5% of PopSci users are on IE6). But, you can believe a site like the New York Times will care about IE6 until the bitter end. No matter what you do, consider this comment to one the above-mentioned Microsoft blog posts:

“I work for a large financial services company with 40,000+ employees. And yes, every desktop PC and laptop runs WinXP and IE6. More than 85% of all browsing is intranet. Basic news sites etc deliver the information without the frills. For our vendors who offer Web portals (eg home loan valuations, stationery suppliers etc) – we’ll simply dump them if we can’t access their sites after a ‘no-IE6 revamp.’”

So, there it is. Continue at your own risk. And in the meantime, IE6′s celebratory funerals might be in haste.

Link to article: Inside the Excruciatingly Slow Death of Internet Explorer 6

Google is continuing its campaign to gently encourage users to upgrade from the severely out-of-date Internet Explorer 6 to a more modern web browser that properly supports web standards and features such as HTML 5 – and it’s using YouTube as its primary weapon in the fight.

As reported over on ReadWriteWeb, the advertising giant is looking to end support for Microsoft’s aging Internet Explorer 6 web browser – the default browser in Windows XP, replaced by Internet Explorer 7 in Vista – and hopes to encourage users to upgrade via a nag screen.

The message – which will appear every two weeks for IE 6 users – warns that support will officially end on the 13th of March, and offers download links to several alternative browsers. While anyone aware that Google owns YouTube will be unsurprised to see the Chrome browser headlining the list, links are also offered for Opera 10, Internet Explorer 8, Safari 4, and Firefox 3.6 – all browsers which support the HTML 5 standard.

With Google already pledging heavy support for the new HTML standard – with the first project being to move its flagship offline browsing API Gears to HTML 5 – it makes sense that it would want to implement the technology across its video streaming services, which it will struggle to do if users refuse to upgrade their browser.

Interestingly, the company has stated that IE 6 users will still be able to watch videos via YouTube after March, but that certain “new features” will be unavailable until a newer browser is used.

Link to article: Google sounds death knell for IE 6