Firefox still sucks.  I don’t care what everyone else in the world thinks, and I know it’s an unpopular opinion, but it’s the truth.  While they bitch about “standards” all the time, the fact is, 95% of what Firefox calls “a standard” isn’t even ratified yet.  When developers can’t tell a “Standard” from a “Request For Comment,” all sorts of malady ensues.
     It’s also disingenuous on the part of Web Developers to say, “It won’t render right in IE because IE sucks!” when the fact is, any Web Developer worth their salt would make an attempt to make a page render right in the predominant browser and its inferior counterpart.  Yet, for some reason, the call is to “blame Microsoft” every time a Developer makes a stupid mistake or doesn’t know what the Hell they’re doing…

     There’s also this ridiculous assertion that Firefox is inherently bullet-proof as far as being hackable.  The case is that IE is the predominant browser, so it makes sense to use it as the target for widespread attacks.  Firefox is an even more broken mess from a Security standpoint, and the veracity of its issues span across multiple platforms, despite claims otherwise.

     A nice little case in point of “shitty code” in Firefox is this attack vector I found two years ago and apparently still isn’t fixed…

     Get out your favorite PHP editor, and send an image in a stream… but in the header, use these two lines instead of something normal:

echo "Content-type: image/jpg";
echo "Content-length: 0";

     Now, with every other user-agent in the world, this won’t work for two very important reasons:

1. “image/jpg” is not a valid content-type.  “image/jpeg” is.
2. A connection-length of zero bytes tells the user-agent not to receive any data.

     Firefox, on the other hand, will go ahead and render the invalid content-type, zero-byte image at whatever size the Server streams to it, proving that it doesn’t care what’s actually being received from a possibly malicious host.

     Can you say, “Exploitable,” boys and girls?

     I knew you could…

I haven’t done an Asshat of the Day Award before but given the situation it seems warranted.

At 7:05AM EDT, a Denial of Service attack started from multiple open proxies from across the globe using a brute force password attack against a previously open service. This has been going on for weeks so it’s not a huge surprise that it eventually succeeded. At 7:21AM EDT, our “fan,” known only as “1 hAppY pUppY,” logged into a shell account and edited some critical files.

[ Edit by Mark : WTF?  Pulled out the IP.  See comments! ]

Our brainiac (and I use this term with utmost facetiousness) came from 67.187.xx.xx (Hostname: c-67-187-xx-xx.hsd1.wa.comcast.net, Aliases: c-67-187-xx-xx.hsd1.tx.comcast.net, c-67-187-xx-xx.hsd1.tn.comcast.net).

Thank you, Random, soon-to-be-ex, Comcast Employee.

To try and pass your skill off as a script (“bl0GituD3 d3fAc3R 1.0b5 bY jT”) while making numerous typos is the mark of a true Genius. And leaving the logs, backup files and history was a brilliant move in that we would expect a hacker to cover his tracks. Leaving the “i” instead of changing it to a “1” in “bl0Gitud3” was a truly brilliant, personal touch. You went far to look like a dolt that we might underestimate your “mAd sk1LLz.”

No. I can’t even say that with a straight face.

You’re an Asshat.

Not the brightest bulb on the Christmas tree are you? You’ve only proven yourself to be a disingenuous coward. A brute-force script shows that you have neither skill nor finesse, and far too much time and personal anger on your hands.

Mark said it best the other day.

Some people need to get lives.They should start by getting off the Internet a few hours a day… The real world can be quite … titillating.

I think it should have read:

“Some people need to get laid.”