OStatic

There are many reasons to love the open source approach. The events chronicled in an article on NetworkWorld surrounding an exploit affecting Firefox outlines, quite elegantly, how open code outwardly appears risky, and -- well, wide open -- and how that same quality generates faster fixes and stronger applications.

A security researcher discovered that Firefox is vulnerable to remote memory corruption, enabling attackers to execute malicious (or at least very much unauthorized) code within the context of the browser. While security researchers spend countless hours searching out bugs and vulnerabilities, it's not usually the case that the offending attack finds its way into the public eye. Yesterday, however, this little exploit was published on several security sites. The vulnerability affects Firefox versions 3.0 through 3.0.7, on all platforms. In less than 24 hours, developers issued a patch for the vulnerability, to be included in next week's 3.0.8 release.

Digital Arts Online has a thorough break down of some of the snags the Firefox development team has encountered as it continues work on the browser's 3.1 release. TraceMonkey, the JavaScript engine that's responsible for the browser's performance boost, seems to be what's holding its actual release back.

According to the forum posts the article points to, both Firefox developers and those focusing specifically on TraceMonkey agree that a decision has to be made -- but whether it's better to release Firefox 3.1 without TraceMonkey, release Firefox with TraceMonkey disabled by default, or give the developers a set amount of time before making the decision at all -- might be a sticking point.

On Monday, the Mozilla team announced the general availability of Firefox 3.1 beta 2 for testing. Aside from increased localization support, a new Private Browsing mode, new tab switching and preview behaviors, and support for a number of new web technologies (such as the W3C Geolocation API and offline applications), the new beta release uses the TraceMonkey JavaScript engine by default, and has made tweaks to the Gecko engine to speed content rendering.

Not long ago the Moonlight development team announced that the Linux Silverlight adaptation was drawing ever nearer to the 1.0 release. On December 1st, the Moonlight 1.0 beta version was released.

The Moonlight beta installs easily, and works quite well (though some sites respond better than others, this seems to hold true with Silverlight in a native Windows environment as well). The few hiccups I encountered during installation had more to do with network congestion and user error than the application itself.

The Moonlight team has announced that the first beta release of Moonlight 1.0 is nearly ready for testing. Moonlight is an open source implementation of Microsoft's Silverlight product.

The project hopes to get new contributors to come aboard as it finalizes the 1.0 release and pushes forward to Moonlight 2.0. Developer Chris Toshok points to some of the upcoming development tasks, and says that because the 2.0 release will be larger and features numerous self-contained subsystems, developers have more opportunity to make a solid impact on the project.

In October, Mozilla witnessed a surge in Firefox 3's market share as it continued its plan to decommission Firefox 2 -- and the Gecko engine that powered it -- before the end of December.

For two weeks in October, Firefox 3 claimed 20% market share, something that web metrics company Net Applications predicted might happen within a month of the new version's June release. Stalled growth, and Chrome's appearance caused some backslide, but Firefox 3's pulse is getting stronger.

The Mozilla Foundation has posted its financial statements and tax info for 2008, and a FAQ on the topic for those of us with short attention spans. While plowing through financial statements may not be the most exciting topic for Free and Open Source advocates, it's worth taking a look at what Mozilla has achieved as an independent project, where it's going, and how other projects might be able to emulate Mozilla's success to fund more and more FOSS development.

The good news is that, as of the end of their 2008 fiscal year, Mozilla is weathering the lousy economy pretty well. According to Mitchell Baker's post, reported revenues were up 5% from 2007, and the bulk of that revenue comes from the Firefox search functionality linking back to Google, Yahoo, Amazon, and eBay. But Moz got dinged by the financial crisis in 2008, losing nearly $8 million of its long-term portfolio.