StackOverflowRecently modified
News and other things I find interesting
Visual Studio 11 Express - No support for building desktop applications nor metro style enabled desktop browsers
Last modified: Sunday, May 27, 2012
Microsoft announced last week that Visual Studio 11 Express will not have support for building Desktop applications, by extension this also means that it will not have support for building metro style enabled desktop browsers.
The workaround is to install Visual Studio 2010 and use the Windows 8 SDK. This isn't a good solution, but it's even worse when you consider metro style enabled desktop browsers. This workaround won't work for metro style enabled desktop browsers that need the Visual Studio 11 compiler. The Windows 8 SDK no longer ships with a compiler of its own.
Firefox can be built with a configuration option to disable the metro bits, so you'll still be able to use Visual Studio 2010 Express to develop on Windows 8, but not if you want to work on Metro related things. In that case, you'll need to use a paid version of Visual Studio 11.
As we've seen with Visual Studio 11 though, who itself can't target Windows XP, this will eventually become a problem as Windows versions increase if no change is made by Microsoft.
I hope that Microsoft will come out with an edition of Visual Studio 11 Express for desktop development, because it hurts open source projects that want to develop for Windows 8 and beyond.
If you also think this will hurt open source development in the long run, you can vote to add support for desktop development back into Visual Studio 2010 Express. Vote it, tweet it, blog it, add comments to it.
Microsoft has previously claimed that it loves open source:
"We love open source," says Jean Paoli of Microsoft in a recent interview with Network World. "We have worked with open source for a long time now."
Actions speak louder than words, please show us.
Tags: mozilla firefox visual-studio windows8
Add a new comment | 2 comment(s)
|
Long-term, have you considered migrating Firefox to build with a MinGW toolchain instead? |
|
We do have some contributors building that way but it's not currently the primary way people build. And our Nightly builds and tests all run with builds made with Visual Studio currently. That wouldn't help with the Metro related bits problem also. |
DirectX and XAML interop - Great feature, but not for metro style enabled desktop browsers
Last modified: Saturday, May 26, 2012
The Windows 8 Consumer Preview introduced a great new feature called XAML interop for DirectX applications. Since Firefox on Metro is a Direct X application, we took advantage of that feature.
Using XAML interop made the following things easier:
- Platform integration features
- Input related work
- The appbar
- Edge detection
- Other areas where we would use XAML based WinRT APIs
We ran into a bug in Windows where our process would crash on suspend though. This bug was confirmed in Windows 8 and was expected to be fixed for the release preview. Unfortunately since then, it was decided that this functionality would not be supported for metro style enabled desktop browsers.
This doesn't cause us major pain, but does take some extra time. We need to backout the XAML interop support. I'll be working on doing that this weekend, and expect to be finished by Monday.
We are currently using XUL for UI, if we ever did decide to switch to native UI like Android did, then this may be a problem. The appbar support will be reimplemented in XUL.
Tags: windows8 xaml directx firefox mozilla
Add a new commentImportant change to UAC when disabled with process integrity in Windows 8
Last modified: Saturday, May 26, 2012
User Account Control (UAC) is a security enhancement in Windows introduced in Vista.
It makes applications that run by administrators, by default, only have access to what limited users would have access to.
Another way to say this is that applications run at medium integrity level by default.
If an application needs more privileges, it need to request it, and Windows will show a UAC dialog. If you press Yes to elevate on the UAC dialog, the process is said to be running as a high integrity process.
UAC can be disabled, and when it is, applications in Windows Vista and Windows 7 run as high integrity processes by default.
This changes in Windows 8, if UAC is disabled, your applications will no longer run as a high integrity process, they will run as a medium integrity process.
Applications can request elevation to a high integrity process when UAC is off explicitly and no UAC dialog will be shown.
We first realized this in Firefox because we noticed the update service was being used for all updates in Windows 8, even when UAC is off.
We designed the update service to only use the service when UAC is on though.
So this change broke that design choice, and to fix it we need to check if the process is running on Windows 8 and if UAC is off.
If those conditions are met we would elevate our process which would not produce a UAC dialog.
Overall this is a great change by Microsoft though. It makes Windows more secure when users disable UAC. It's good to know about if you develop software for Windows.
Tags: firefox mozilla uac windows8
Add a new comment | 5 comment(s)
|
Moving the UAC slider to the button no longer disables UAC in Windows 8. UAC is still on! This was done because Metro apps CAN'T run if UAC if OFF. If you disable the EnableLUA setting in the registry UAC is off and you have full admin token but all metro apps can't be launched. |
|
Could you expand on the last paragraph? I fail to see how this change improves security. Sure, a process that has been compromised (buffer overflow or whatever) won't have highest privileges automatically. But if UAC is off it will be able to request them at any time nevertheless. Effectively, it's the same situation as in Windows 7 with UAC off, only one more step required. And I don't see why malware authors would be afraid of doing that step. |
|
Why does it matter whether you use the service or a free elevation? |
|
Aren't they basically just removing the ability to turn off UAC? Presumably they can afford to do that now applications have learnt to deal with the UAC restrictions, whereas if they had done it when they launched Vista then lots of applications would have been incompatible. |
|
> Could you expand on the last paragraph? It's better to have your non malware process run as medium integrity. Sometimes things can be exploited where arbitrary code cannot be executed, but there is still an exploit to be had. That's a good point though that if you can run arbitrary code through the exploit, then they are equivalent. > Why does it matter whether you use the service or a Security has asked that we only use the service when we need to so that updates only run as SYSTEM account when needed. Personally I think it's the same since any admin can install a service and start it which would run as SYSTEM account. Free elevation is a new concept though only introduced in Windows 8 so this hasn't been discussed explicitly. Maybe the second sentence in the above answer to the previous question is a reason why it's better to run the process only as SYSTEM when needed, and I think that's what security would say. > Aren't they basically just removing the ability to In a way but this run as medium with free elevation concept is new. So whether you call that the new disabled or the new level when not disabled is up to you :) |
Frequently asked questions for Silent Updates in Firefox
Last modified: Tuesday, May 22, 2012
I will answer some commonly asked questions relating to the series of tasks that make up the silent update project in this post.
Will silent updates first land in Firefox 13?
No, the silent updates work is a series of tasks, and some of it has already landed.
Three of the biggest pieces of work in this new series of tasks are:
- Add-ons default to compatible.
- The Mozilla Maintenance Service, which gives truly silent updates on Windows.
- Background updates, which applies updates in the background while Firefox is running on all platforms.
Add-ons default to compatible landed in Firefox 10.
The Mozilla Maintenance Service fixes the problem of updates not being truly silent on Vista and above due to UAC prompts. Silent updates will occur without this UAC prompt as of Firefox 12.
Firefox 15 will have background updates.
Are background updates the same as silent updates?
No, background updates is a task that makes silent updates better, it is a component of the silent update project.
In Firefox 12, updates will be silent, but they will still be applied at startup. Meaning when there is an update, it will take slightly longer to startup.
In Firefox 15, updates will be applied in the background while Firefox is running. Meaning when there is an update, it will take about the same amount of time to startup as normal.
Will Firefox force me into silent updates?
No, you have always been able to configure how you get updates.
Simply go to: Options -> Advanced -> Update.
These options are not changing, in fact you will have more control over how your Firefox updates as of Firefox 12.
You can choose to:
- Automatically download and install updates
- Check for updates but don't install them without permission
- Don't check for updates
Furthermore, you can specify whether or not to use the Mozilla Maintenance Service to apply the update. If checked on, you will not have a UAC prompt.
If I uninstall the Mozilla Maintenance Service will the next update just reinstall it?
No, the Mozilla Maintenance Service will only be installed once. If you uninstall the service after that, it will never be installed via an update again.
Will Firefox silently install other things than updates?
No, the only things that will be silently installed, if the silent update option is on, are Firefox updates. The updates cannot be tampered with, if they are, they will not be installed.
Will the Mozilla Maintenance Service slow down my computer?
No, the Mozilla Maintenance Service will take up a small amount of disk space and only be run during an update. If an update is not in the middle of being applied, the service will not be running and will have absolutely no effect on the performance of Firefox and your machine.
Will the Mozilla Maintenance Service make updating less secure?
No, we have worked closely with the security team to ensure this feature was delivered securely. Firefox will only apply updates issued by Mozilla designed specifically for Firefox.
Is updating more often less secure?
No, if you are not updating your browser, then you do not have the most recent security fixes. These are the most dangerous security problems because they are well known and can be exploited.
Will I see the effects of the silent update service in Firefox 12?
No, although the Mozilla Maintenance Service will first be installed in Firefox 12, users will not experience the benefits of the service until the first update after Firefox 12.
The update that installs Firefox 12 will install the service, and so the service itself can't be used to install that update.
The next update after Firefox 12 may be Firefox 13 or may be a minor update after Firefox 12.
Tags: silent-update firefox mozilla
Add a new comment | 10 comment(s)
|
Hello. Is it possible to set a proper update server? (in corporate e.g.) |
|
So how will the maintenance service work when there are multiple versions of Firefox installed on a single machine, each tied to a separate profile? I assume the service looks in the profile settings to determine whether or not to update, so only selected versions would be upgraded. However, suppose there are two profiles used by a single Firefox install. (I do this frequently: I have my own heavily-customized profile, and then a "guest" profile from an out-of-the-box install I use for testing.) Now suppose one is configured to use the maintenance service, and the other is not. What will happen then? |
|
Each installed product's updater.exe will start the service and ask it to perform an update. The service will in turn run the same updater that called it as an elevated process to perform the update. So there are no profile access from the service. This works even if you install the same product and channel at 2 different locations and use the same or different profiles. |
|
If Firefox is installed on a Windows TSE server on a Citrix server, how will it work? The updates, that should be desactivated for each Windows user account (and only activated for the admincount), will be desactivated again for each account? If I have 300 account, I should manage it manually? And I will have to validate all the extensions for all the accounts, each time I will do an update? |
|
> Hello. Is it possible to set a proper update server? (in corporate e.g.) I think you can run your own update server, and make your own update MAR files. I don't know how though and I don't think this is supported officially. |
|
> If Firefox is installed on a Windows TSE server on a Citrix server I'm not sure exactly how your setup works but please feel free to try the beta to see: http://www.mozilla.org/en-US/firefox/beta/ Should you have some feedback please post a bug at http://bugzilla.mozilla.org/ under the category Toolkit / Application Update. With the service if there are any failures, it will fallback to the old way of updating, so I think the worst you will have is that the update won't be silent and will have a UAC prompt. |
|
Okay, I see -- so the service doesn't perform the update, it just re-invokes the updater program with higher privs. So the profile determines whether to run the updater alone (as it works today), or to run the updater and have it call the service (to run silently), or not at all. Either way, if multiple profiles are using a single Firefox install, whether it gets updated is determined by whichever of those profiles is in use -- exactly as it exists today. Thanks for the clarification! |
|
That's the general idea of it, yup. |
|
What if I have UAC disabled? Will I still need the service for silent background updates? |
|
> What if I have UAC disabled? Will I still need the You will still have background updates once background updates is released. The service would not need to be used in that case. |
Windows 8 on ARM users need browser choice too
Last modified: Thursday, May 10, 2012
In case you missed it, Harvey Anderson - Mozilla General Counsel, just published a great blog post about what's going on with Windows on ARM support.
Without competition there is no innovation. You can read the post here:
Windows on ARM Users Need Browser Choice Too
To be clear, we will still have a Metro browser as previously blogged about on non ARM platforms.
To see why ARM matters, see Asa's post here: Why Windows Classic on ARM Matters
Tags: windows8 firefox mozilla
Add a new comment