Page 2 of 2

Coding practices

Mozilla has made significant progress in its coding practices to ensure higher quality secure code overall. Johnathan Nightingale, Mozilla's human shield, is a key part of the company's security effort, and he noted that code testing has expanded in a number of areas.

"At last count we ran about 60,000 automated tests on multiple platforms for Firefox 3," Nightingale told InternetNews.com. "Every time there is a check-in we run a new group of tests."

In comparison, the company ran only about 2,000 unit tests for Firefox 2. In addition, as of the Firefox 3 release, Mozilla has moved to a new distributed code development platform. They had been using Concurrent Versions System, or CVS (define), and are now using Mercurial, a more collaborative and distributed approach.

"The real value of Mercurial is not that it makes testing easier -- it makes it easy for small groups to put together a high-quality code base on their own and then merge it once it's safe," Nightingale said. "In the old days of CVS, that was a hard thing to do," he continued. "Mercurial makes it easier, which in turn makes our coding practices a lot safer by default."

New errors

Over the course of the last year, new errors have been popping up in Mozilla and elsewhere around the Web.

LATEST NEWS

Smartphones Advance, Subscriber Growth Slows
Google May Be Set to Depart China Soon
Alcatel-Lucent Update Wireless Network Gear
Comcast Uses Open Source for IPv6 Deployment
IBM Gains Partners for LotusLive in the Cloud

"What happened for us starting last year is we started seeing interactions between applications as a problem," Snyder said, drawing a comparison to the problem of handling Uniform Resource Identifiers, or URIs (define). "That for us was a new category," she said.

Firefox 2 was patched multiple times in 2007 and 2008 for various URI handling errors. URI allows browser to load up other applications, for example a PDF viewer or QuickTime movie player.

"Because we're an entry point into the operating system, we try and be a robust entry point, and any data we're handing off to other applications needs to make sure it's reasonable and safe," Snyder said. "We need to make sure we're seeing well-constructed queries to other applications and think about how we can be a first level of defense," she added.

Overall the idea of cross-site content and mashups are a concern for Mozilla as it tries to figure out what the safest way is to share information between sites.

"It's something that has been hotly debated at Mozilla," Snyder said, adding that the problem is for the whole Web rather than just Mozilla. "Mozilla is in a great position to influence how the Web ends up implementing that in a way that protects user privacy."

Go to page: Prev  1  2