Category: Tech

Posted on
by

NetscapeIt’s been a long time coming, but AOL has officially decided to shut down the Netscape web browser. The final security updates for Netscape 9 will go out in February, and then that’s it.

It’s been on life support for a while now, as AOL has tried repeatedly to revive it. After they dismantled the Netscape team in 2003 (just before spinning off the Mozilla Foundation), everyone expected that would be the end, but they came back with a surprise update, Netscape 7.2, the following year. Then they hired an outside company to reinvent it as a mash-up of Firefox and Internet Explorer, producing the Netscape 8 chimera. And just a few months ago, they went back to the well and released the Firefox-based Netscape 9, trying for the Flock model of integration with social networking sites…but only integrating with their own.

So what killed it? Netscape was arguably the pioneer, building on Mosaic’s success to create the first widely-used browser on the fledgling World Wide Web.

  • Internet Explorer being pre-installed on every Windows desktop
  • The commercial-to-freeware transition. Back in the 1990s, the only business model for giving away a free web browser was to subsidise it with revenue from other products. This led to selling the company to AOL, and opening the source code.
  • The missing Netscape 5. IE5 was considerably better than IE4, and arguably better than Netscape 4 in some areas. And Netscape didn’t have a new version to compete, because…
  • The transition to open-source took a lot longer than expected, leading to…
  • The disastrous Netscape 6. While there’s something to be said for meeting deadlines, Netscape 6 was a prime example of why not to release early. The program just wasn’t ready (Mozilla actually declared the code to be 0.6), and it turned off many users who might otherwise have stuck around a little longer for a stable release.
  • Fundamentally, though, AOL never seemed to know what to do with it. Is it a product? An exploitable brand name? A threat to brandish during contract negotiations with Microsoft?

FirefoxIt’s interesting that, as I made this list, I realized that the transition to open source really didn’t help Netscape, the company. But it led to the formation of the Mozilla Foundation and the release of Firefox, one of the most visible open source success stories out there. The company and brand name withered, but the code itself flourished.

Like the demise of IE/Mac, it’s more of a symbolic end than one of substance. In my opinion, the true “heir” so to speak of the early Netscape has been Mozilla, and now Firefox, for quite some time.

Update: Asa Dotzler has a somewhat less nostalgic take on the matter, as well as a link to commentary at TechCrunch. I can’t believe I forgot to mention the crippling/crufting of Netscape 6-7 as compared to Mozilla.

Update 2: More comments at Slashdot. Gee, I wonder who submitted that story? 😉

Update 3: Some commentary from the Web Standards Project, with a somewhat familiar-looking title.

(via Opera Watch)

Posted on
by

Forklift Driver Klaus (a.k.a. Staplerfahrer Klaus)- a parody of work safety films in which a forklift driver blunders through his first day on the job, maiming fellow employees left and right. German with English subtitles. (via TV Tropes: Scare Em Straight)

And, on a more serious note, the Internet Storm Center is reporting on people finding malware pre-installed on digital picture frames, memory cards, etc. Something to watch out for with portable devices that can connect to your computer.

Posted on
by

Organization for Transformative Works – dedicated to protecting the expression of fan fiction, fan art, etc. (via Naomi Novik)

Open Standards, One Web, and Opera – Just why are standards important, anyway? (via Opera Watch)

Speaking of Opera, their EU antitrust complaint against Microsoft has been making waves. Responses at CSS3.info, Web Standards Project, Slashdot (edit: more Slashdot), Asa Dotzler, Opera Watch, plus a Q&A w/ Haarvard. My take: Good luck on unbundling, but if they can force Microsoft to catch up with the rest of the market in terms of standards support, I’m all for it.

Nissan vs. Nissan. On my way to work I saw a bumper sticker on an XTerra that said “In support of our freedom, it’s my last Nissan.” Huh? There was clearly a web address below it, but it was too small to read at that distance. So I looked up the phrase, and apparently there’s been a long-running dispute over the domain name nissan.com, between a small computer business named after its founder, Uzi Nissan, and the Nissan car company. The dispute was eventually resolved (correctly, IMO, since he has a legit reason to use the name) in favor of the little guy. On the other hand, I don’t see why the site makes such a big deal about Nissan’s “French Connection” to Renault.

Posted on
by

I recently noticed that the mail server was experiencing 4 times the typical number of SMTP connections. It didn’t seem to be under any stress, though, not as far as server load went. So I watched the log file trail, and saw a bunch of messages coming in to nonexistent users with the pattern, FirstnameLastname@alternativebrowseralliance.com.

My first thought was that someone was running a dictionary attack against the domain, trying many different addresses to see which might be valid. Then I noticed that they seemed to be coming from <> — in other words, they were bounce notices.

Great. A Joe Job.

I enabled a catch-all temporarily. That did cause the server to slow down, as it was now actually processing the quadruple load instead of kicking back 3/4 of it with a “User unknown” error. (I hadn’t thought to disable spam scanning on the domain first.) In the 30 seconds before I turned it off again, it picked up 25 non-delivery notices. And those are just the ones that got past the spam filter.

As it turned out, they were just random junk. Some spammer had picked the domain and was using it to forge random From: addresses, and we were getting the bounces. In the old days they made up the whole address, but it’s easy to check whether a domain exists. So now they pick some real domain and make up a fake address. That’s harder to detect unless the domain in question uses some sort of verification system like SPF or DKIM.

So it wasn’t a Joe Job: no one was trying to besmirch the site’s reputation. It still meant extra traffic to the mail server, though.

This problem is called backscatter, and it exists for two reasons:

  1. The sender address on an email message is easy to forge, like writing a fake address on an envelope.
  2. Many mail systems will accept a message first, then process it. If it then decides to reject it, it can’t respond to the actual sender, only to the one listed in the message—and in the case of spam, it’s usually forged (see #1).

I don’t send any mail using the domain. The only reason it even has mail pointed anywhere is so that I can receive mail sent to the webmaster for the Alternative Browser Alliance. I suppose I could set up a -all (no servers are authorized) SPF record, and hope some recipients decide not to send bounces. But I’m not sure how much it would actually accomplish.

Anyway, the two lessons to take away from this are:

  • Reject messages to bad recipients in the initial SMTP transaction. It’ll protect your server from backscatter (and dictionary attacks), because you won’t have to queue and process all the extra junk.
  • Don’t generate bounce messages after the fact based on something as easily forged as the supposed sender. Otherwise, you’ll be contributing to backscatter.

Posted on
by

The Internet Storm Center has an insightful response to the statement, “There is nothing on my computer that a hacker would be interested in.” Let’s leave aside the question of your personal data for the moment. Just the fact that you’ve got a computer with an internet connection could prove very useful to someone who wants to cover their tracks or just add more power to their own distributed system.

»All pages site-wide with this tag