This is not the first occurrence that a critical update is released shortly after a major version upgrade of the web browser. Similar updates had to be delivered after the release of Firefox 9 and Firefox 8.

Firefox 10.0.1 fixes critical issues that came to light shortly after Firefox 10 had been released to the public. This includes at least one startup crash when the browser is opened by the user, and one Java related issue that is causing text fields to hang in the browser. Firefox users can resolve that issue manually by minimizing or resizing the browser. The patch released later today will fix the issues permanently though.

The product planning summary lists additional issues that the developers are currently looking into. This includes issues with AVG’s SafeSearch extension that is blocking the enter key from functioning correctly in the browser’s address bar. While it it possible to click on the go button to be taken to the site, it is a issue that the developers want to resolve as quickly as possible.

Other issues mentioned in the summary are additional crashes, and incompatibilities with Norton products and RealPlayer Video Downloader.

The release is already available on the Mozilla release ftp server and on third party download portals such as Softpedia. It is likely that the new version will be pushed to all users later today. At that point it will also be offered for download on the Mozilla website and as an update in the browser.

Please note that both the standard Firefox 10 build and Firefox 10 ESR will receive the update to Firefox 10.0.1.

He first describes how Firefox is currently applying updates to the browser. Updates are downloaded into a special directory during runtime. The browser on next start up will check for updates in that directory and if any are found, will apply them to the browser. This process is visualized to the user with the dreaded Firefox Update: Firefox is installing your updates and will start in a few moments message.

The updater restarts the browser after the update as been completed.

The new idea is not fundamentally different. Updates will be applied to a copy of the browser files in the background while the browser is running. When the user restarts the browser the updated version is copied over the old version of the browser, a process that is noticeably faster (as there are no prompts and copying is faster than applying those updates during browser start).

Now, the reason that this approach fixes the problem is that swapping the directories, unlike the actual process of applying the update, is really fast. We are effectively moving the cost of applying the update to right after the update has been downloaded while the browser is running. This leaves only the really fast copy operation to be performed the next time that the browser starts up.

A long document is available here that details the background updates process.

• Firefox finds an update
• The update is downloaded
• Updater is launched in the background with the UI disabled
• The existing installation will be copied to /firefox/updated/
• The patches are applied to the copied version of Firefox
• Update will be aborted if errors are encountered, e.g. read write errors, running out of disk space

What about changes that you make to the browser in that time? What about add-ons that you install or configuration changes? Those in theory should not be a issue as they are stored in the profile directory and not in the Firefox directory on the system.

I can still see issues here, like high cpu, ram or disk usage when the updates are applied.

What’s your take on the new updating proposal?

Regardless of that, it shows that automatic updates can cause problems. Sometimes you may want to block add-ons from being updated automatically. Maybe because you know that a new version that is already out is causing issues on your system or adding unwanted features, or because you want to research each update before you install it.

The Firefox web browser has two options for users who want to customize the automatic add-on updating mechanism of the browser. The first option is to disable automatic add-on updates completely. This is done under Options > Advanced > Update. Here you need to remove the checkmark of the Add-ons listing under Automatically check for updates to.

For extra protection, make sure that Ask me what I want to do when updates to Firefox are found is enabled.

Sometimes you want to make sure that only some installed add-ons do not update automatically, or that some do if you have selected the do not check for automatic updates option mentioned earlier in this guide.

Open the Firefox add-on manager. You can do that by entering about:addons in the address bar. All installed add-ons are displayed under Extensions there. To configure automatic updates for a specific add-on do the following. Click on the More link next to the add-ons description.

Look for the Automatic Updates listing on the page. Default means that it will use the global automatic update options of the Firefox options. You can set automatic updates to on or off instead. It is furthermore possible to check for updates manually with a click on the link of the same name.

You can also click on the settings button at the top to perform various operations, including a check for updates, reseting all add-ons to update manually or enabling or disabling add-on updates automatically.

To paraphrase. Firefox users can keep automatic updates turned on and turn off updates for specific add-ons only, or turn off automatic updates and turn them on for trusted add-ons instead.

Firefox users who have set their add-ons to update manually only will see a new listing in the add-ons manager. Available Updates list the available updates for all add-ons set to update manually.

Have you set your Firefox add-ons to update manually or automatically?

Brian Bondy addressed one of the issues in a post entitled “Mozilla Firefox and silent updates” on his personal blog. In it he mentions that Windows’ User Account Control is a minor annoyance for Firefox users considering that the prompt will be displayed whenever the web browser is updated.

His plan is to find a way to bypass UAC prompts during updates after it has become clear that the user has enough permissions on the system to install and update the web browser.

Mozilla is currently experimenting with a Windows service approach. According to Brian, the Mozilla Application Updater service would be an “optional component” that users of the browser could install to automate the “software update process better”.

Those of you who follow the development of the Chrome browser may now think that this is exactly what Google is doing to update their web browser. And while both techniques have similarities on first glance, there are fundamental differences under the hood. The Firefox service for one is an optional component which Firefox users can uninstall or disable at any time. Firefox will receive updates in the future even with the service uninstalled, stopped or disables. The browser will simply switch to the old way of updating.

Mozilla tries to tackle the frequent update fatigue issue from other angles as well. The organization plans to make add-ons default to compatible during updates in the first quarter of 2012. This basically means that Firefox will no longer assume that add-ons do not work with an updated version of the browser. The benefit here is that fewer users will see the update prompt. Firefox for some time now downloads new versions of the web browser in the background and will install them as well unless add-ons are found to be incompatible. This can be changed under Firefox Options > Advanced Update.

Other methods include showing the What’s New page less frequently, increasing the time it takes before users receive notifications that an update has been downloaded and needs to be installed and to apply updates on shutdown.

If you read the comments under Brian’s post you will notice that nothing’s set into stone yet. The basic idea behind all proposals and plans is to make the updating process more comfortable to the user.

What’s your take on the development? Would you install a Firefox service on Windows for the updating of the browser?

With this guide, I would like to take a look at the features that the developers plan to add to future versions of Firefox. I’m concentrating solely on features that will make a big difference in day to day activities in the browser.

Reset Firefox (Release Target: Firefox 9)

Many Firefox users reinstall the web browser when they experience issues like crashes that they cannot fix. The reinstallation however does not fix issues that are user profile related. And creating new profiles in the browser is something that the majority of Firefox users is unfamiliar with. This is mostly due to the complicated technical way of doing it,

The Reset Firefox feature would automatically create a new Firefox user profile and migrate the user’s data, including bookmarks, history and passwords.

Third-Party Add-On Warnings (Released: Firefox 8)

One of the frustrating experiences as a Firefox user is the inability to block third party add-on and plugin installations. Mozilla tackled half the problem in Firefox 8 by blocking automatic third party add-on installations in the web browser. Users now have the option to accept or deny installation of the add-on. The feature is integrated in Firefox 8. See Firefox To Get Better Third Party Add-On Security

This falls directly in line with the feature to uninstall third party add-ons in the browser which can only be disabled but not uninstalled in the browser. There is no projected release version of Firefox yet for that feature.

Improve Responsiveness with Memory Reductions

Firefox especially over long sessions may see memory usage grows and as a result of that responsiveness issues. Mozilla is working on improving memory usage over long sessions. It is currently unclear when the improvement will make its way into Firefox.

Opt-In Plugin Activation

Plugins install automatically in the web browser currently. The user has options to block plugins only after they have been recognized by the browser. Some advanced configuration settings are available to block specific plugin locations from being scanned by Firefox. This is highly technical and still not as effective as it should be.

Mozilla plans to give the user a say before plugins are activated in the web browser. A whitelist will be used for the most common plugins.

64-bit Firefox for Windows 7 / Vista

64-bit support for Windows 7 and Vista is long overdue. The developers are finally starting to make progress in this regard, and it is likely that we will see 64-bit versions of Firefox for Windows regularly in the near future.

Mozilla Network Installer (Release Target: Firefox 9)

A lightweight, localized installed for Windows and OXS that allows a user to “select Mozilla applications and/or related components which are then downloaded in the background and installed”.

• Installation of default versions of Mozilla products (Firefox, Thunderbird)
• Installation of default versions of Mozilla products plus authorized addon(s) (combinations of extensions, search plugins, themes, and/or personas)
• Installation of default versions of Mozilla products bundled with authorized, secondary installer(s) (e.g. Network installer functions as a meta installer)
• Installation of authorized, customized versions of Mozilla products (e.g. product plus contents of distribution directory, with option for secondary installer(s))

Display add-on performance information (Release Target: Firefox 9)

This feature appears to be much like Microsoft’s Internet Explorer feature that notifies users about add-ons that slow down the browser.

Web Developer Tools

Web developers will get several new tools and features that will make their work more comfortable. This includes a Style Inspector to view CSS rules applied to a specific element on a web page, a Highlighter that highlights elements on a page, a Style Editor to see CSS changes applied immediately to the page or a Style Doctor feature which the developers intent to answer the “why doesn’t this look the way I expected it to?” question.

Verdict

Mozilla has a lot in store for Firefox users over the coming release cycles. Some features are really improving the user experience, like the ability to block add-ons and plugins before they make their way into the web browser. Interested users can take a look at the Features listing over at Mozilla Wiki for an extended list of upcoming features.

The Tell Web sites I Do Not Want To Be Tracked option is an opt-in option which means that it is disabled by default. Firefox 4 Beta 11 or newer users find the option under Tools > Options > Advanced. It is not clear why it has been moved to the advanced tab and not the privacy tab where it feels more natural.

The feature activates a Do Not Track header that will signal websites that the user wishes to opt out of behavioral tracking. Websites have to interpret the header correctly and advertisers need to abide by it for it to have a positive effect.

The second change is only visible in pre releases of Firefox 4 Beta 12 or later. Mozilla has finally changed their mind and moved the link url information from the Firefox 4 address bar back to the bottom of the browser screen. The urls are now displayed in a Google Chrome like fashion in the lower left corner of the screen. Users who have the add-on bar enabled will notice that the link information are posted above the toolbar.

The move is definitely a step in the right direction considering that felt alienated by the decision of the development team to move the information in Firefox 4 to the address bar. It is interesting to see that the team is reverting some of the design and interface changes they did introduce in earlier development builds of the browser. Interested users can download the latest official beta from the Mozilla website.

The major advantage of silently updating Firefox with security fixes is an accelerated deployment of those patches in the Firefox community, which in turn reduces the number of Firefox users who work with insecure or instable versions of the browser.

Alex Faaborg, Mozilla user experience designer, added more details about the planned Firefox 4 feature:

[..] I think the majority of users would prefer an application that doesn’t bother them with what they view as little details (where a little detail is a minor update, major updates that include UI changes are different).

We get a lot of complaints that Firefox updates too often, people can’t see even see the difference with the new version (it was actually a security patch), that we change our mind too much and should just ship one version (it was actually a security patch), etc.

For Firefox 4 minor updates will occur automatically. Users can change the setting in Options > Advanced > Update. We’ll only be using the major update dialog box for changes like 4 to 4.5 or 5. Unfortunately users will still see the updating progress bar on load, but this is an implementation issue as opposed to a UI one (ideally the update could be applied in the background). We will also be able to prompt the user if they haven’t restarted in a very long time and there is a particularly bad security vulnerability that need to be patched.

Unlike in Google Chrome, where users have no choice, the Firefox developers are implementing an option to turn off silent updates in the browser. Good news for users who prefer to – or have to – research updates and their impacts on the browser and system before deploying them.

Robert Strong, the Mozilla developer working on the implementation of the feature in Firefox mentioned that Mozilla is well aware of the controversy surrounding silent or forced updates, stating that “there is no one size fits all behavior for this that will please everyone just as the current behavior doesn’t please everyone.”

He added that silent updates “might not make Firefox 4″, even though the goal is to release the updating mechanism with the Firefox 4 final.

A quick second release usually indicates a severe problem that needs to be addresses asap, often stability or security related.

The Mozilla Developer Center blog offers an explanation. Firefox 3.6.8 fixes a single “stability problem that affected some pages with embedded plugins”.

Users who have not received the update notification yet, can download the latest version of Firefox directly from the Mozilla website instead.

This downloaded version then needs to be installed after the download to the local hard drive has finished.

The Firefox 3.6.8 update is offered for all supported operating systems and languages.

In the blog posting Mozilla “strongly encourages” users of Firefox 3 and Firefox 3.5 to upgrade to the latest Firefox 3.6 branch.

The new Firefox 3.6 release is currently distributed to mirror servers worldwide to ensure that it can be distributed to Firefox users without performance problems as soon as the release has been officially announced on the Mozilla website and through the web browsers’s update checker.

It is likely that popular download sites like Betanews or Softpedia will pick up the release before it is officially announced at the Mozilla website. Users who do not want to wait a second longer can download the English version of Firefox 3.6 for all supported operating systems from Mediafire where we have uploaded the files for them.

What’s new in Firefox 3.6

Lots of things have changed in Firefox 3.6 including

• Improved performance, security and stability
• Users can now change their browser’s appearance with a single click, with built in support for Personas.
• Firefox 3.6 will alert users about out of date plugins to keep them safe.
• Open, native video can now be displayed full screen, and supports poster frames.
• Improved JavaScript performance, overall browser responsiveness and startup time.
• Support for new CSS, DOM and HTML5 web technologies.

Users who are still working with either Firefox 3.1x or 3.5x might want to consider moving to the new Firefox 3.6 as it provides a better performance, security and stability.

The new version of Firefox fixes 140 bugs of which two have been rated as blocker and 21 as critical. It is therefor recommended for Firefox 3.6 beta users to update their web browser as soon as possible to fix the bugs and make the web browser more stable. Most of the bugs – if not all – seem to be stability bug fixes that fix possible crashes that can happen under certain circumstances in the older beta versions.

Firefox users who are interested in all the fixes in this new version can check out the detailed bug lists over at Bugzilla. About a quarter of the installed add-ons were not compatible on our test system including popular add-ons like Greasemonkey. It was however no problem to force compatibility with the Nightly Tester Tools add-on.

The Mozilla Firefox beta page lists downloads for all supported operating systems and languages.

Update Notifier (via Cybernet News) automates the process by removing the user input from add-on update installations. The add-on can be configured to automatically check for Firefox add-on updates and install those add-ons automatically without user interaction. This includes an automatic restart of Firefox after downloading and installing the add-on updates.

Update Notifier comes with a few additional settings like configuring the check interval or displaying update notifications in the Firefox status bar. The Firefox add-on takes another burden away from Firefox users who can use the add-on to automatically update add-ons in Firefox without user interaction.

The developer of the Fast Dial add-on did add malware like features to his add-on according to hundreds of angry commenters on the official add-on page at Mozilla. The latest versions of the Fast Dial add-on changed the default search engine and removed the first three fast dial fields with links pointing to websites selected by the author of the extension. The add-on did also change the browser’s homepage to a Fast Dial page. What makes the matter worse is that there is no dialog to notify the user about the changes and no way to opt out during the installation.

The problems with the automatic update of add-ons and themes are therefor the following:

• There is no telling what changes are made to the system. No direct display of a changelog or information about the changes.
• There is no lock on system settings, add-ons can change various user defined settings without notification
• A backup is missing which could be used to restore the old properties prior to the installation

It would be really great to see a System Restore like feature in Firefox so that it would be possible to undo changes done by add-ons, themes or even Firefox updates.

The update is a security update that fixes two critical security vulnerabilities that allow remote code execution and the opening of multiple tabs if Firefox is not running. Take a look at the Mozilla Foundation Security Advisory articles here and here if you want to read up on the vulnerabilities.

The latest version of Firefox can be downloaded right from the Mozilla website which includes versions for all supported operating systems and languages. Automatic upgrades will be available in the next 24-48 hours as well.

That page is unfortunately down at the moment as are the release notes for that new version. Not exactly sure what’s going on currently because the main pages and the developer news website with the announcement is reachable. The update can also be installed by checking for updates in Firefox 2. This can be done in the HELP menu.

The website is working again. The direct download link and the release notes are now accessible. The update fixed four critical, four high, 2 moderate and 2 low security vulnerabilities. Make sure to update asap.

As usual things take a while and users who download the releases directly from ftp will be the first to have the latest version up and running. Firefox 3 RC3 is available for Windows, Linux and Macintosh and all language versions. Just follow the link given above and navigate to the release that you need.

The only information available at this moment is a blog post over at Zdnet that is mentioning a bug in Firefox 3 for the Apple Macintosh that was caused by the recent update and that this release candidate is practically being created for the Mac. I’m off to install the new version and we hopefully will be able to access the release notes for Firefox 3 RC3 soon.

I suggest you update your version of Firefox 2 as soon as possible, users of Firefox 3 seem safe for now and do not have to do anything. The same issue will also be fixed in upcoming releases of Thunderbird and Seamonkey which are not yet available for download.

The release notes have not been updated yet and I was not able to locate them for this release. Just head over to the official mirror sites to download the new version or wait until it becomes officially available on the homepage and in Firefox.

I would like to thank the Win Addons website for breaking the news.

Some other mirrors who already list the new release do not seem to have this protection build in yet which means the download from those mirrors (like Utah) goes through without errors. This version does seem to be a stability and security update but the release notes do not go into any more detail.

They have not been updated and still show information about the release candidate 1 of this version. This new release is not yet available on the Mozilla homepage or through the update function in Firefox.

Add-ons have to use a secure method for auto-updating from now on which means that they either have to be delivered using SSL or digital signatures. The real progress can be seen when you look at the list of bugfixes from alpha 7 to the current version. More than 1100 bugs have been fixed in that time which is quite an achievement.

Several bugs prevail on the other hand. One for instance prevents that Firefox 3 is starting in Windows Vista if parental controls are enabled. If you have been using prior alpha versions of Firefox 3 you should definitely download the new one and replace the old alpha with it.

Read More:

Firefox 3 Alpha 8 Bugfixes
Firefox 3 Download

The new version is fixing one critical and one moderate security vulnerability that I listed below for your convenience. Make sure you update to Firefox 2.0.0.6 as soon as possible.

MFSA 2007-27 Unescaped URIs passed to external programs
MFSA 2007-26 Privilege escalation through chrome-loaded about:blank windows