michaelkirkland.org/blog


QT now LGPLed

I'd been hoping this might happen ever since Nokia bought Trolltech, but now it's happened.

Qt, the cross platform library most widely used as the base for KDE can now be used by all projects, regardless of the license they use. Qt is an awesome library, and Trolltech was certainly justified in charging for commercial licenses, but it effectively nixed any non-open source activity on the KDE platform. If you just needed Qt for KDE support, the licensing fees were just too onerous to consider. (They stopped advertising them at some point, but IIRC they were about $4k per developer per year.)

This didn't nudge people to opening proprietary software, it just pushed them away from KDE to Gnome/GTK. Now that this hurdle is gone, both projects can compete on their merits rather than their licenses.

12 Comments >> Bookmark and Share

Google releases a browser

Today Google released their new browser, Chrome. It's very pretty, sleek, and it implements an idea that's a been sorely needed in the browser space for a long time.

Chrome separates each tab into its own process, so if a page or plugin (*cough* Flash *cough*) causes a crash, it can only take out that tab. The rest of your tabs and browser instances keep going on their own.

This has been desperately needed in browsers for years. Most people keep at least one, and often several browser instances open at all times so it's quite a nuisance when some silly plugin brings the whole show down. Firefox has made some kludges to handle this, like the ability to restore a session after a crash, and they probably would have moved in this direction eventually.

Chrome also has a new, streamlined Javascript engine, v8. This, along with the robustness that a multi-process browser brings, makes Chrome an excellent platform for the web applications (like Gmail and Google Docs).

That's what Chrome is really about. If they can get it installed widely, they (and anyone else) can make an end run around Microsoft's OS monopoly. The clincher is an open document standard, which is why Microsoft has been fighting the Open Document standard so viciously, and trying to force their proprietary format through the ISO process. Without that, Microsoft can hold on to their OS monopoly by withholding Office from any serious competitors.

There are a few disappointments with Chrome. There's no ad filtering, and as yet no extension mechanism to implement it (though they've promised to rectify the latter).

Google is, of course, not going to be terribly keen about people stripping advertisements from the web, but they also will have to face the fact that it's necessary. I realize they have to walk a fine line with this, but they're in a great position to help mediate between the extremes of filtering absolutely everything (as many Firefox users do with Adblock Plus and EasyList/Element) and the downright offensive lengths some advertisers will go to to annoy the crap out of people.

Google could start a clearing house for web advertising with a voluntary code of conduct requiring advertisers to tag their ads appropriately for filtering by the browser. Public key encryption could be used to verify that an ad is released by a member in good standing. Users who don't want to see animated ads, ads with sound, ads for porn or whatever could filter those and let less obnoxious advertising through to support the sites they visit. There could even be an automatic negotiation between the browser and ad server. A user who may be willing to accept text ads could be presented with those instead of being forced to block all ads to keep the annoying ones out.

59 Comments >> Bookmark and Share

Slashdot on Firefox's SSL mess

Slashdot has picked up on Firefox 3's terrible certificate management system, pointing to this article. While I'm rather critical of Mozilla's handling of this, they're in the right in this case.

The article in question points out several sites with expired certificates getting terrible error messages. This is the right thing to do, those sites should trip a giant "OMGWTF" flag in browsers. They're broken, and the lax treatment they've gotten from browsers in the past has not prompted their admins to fix them.

The problem isn't with legitimate security issues like lapsed certificates, it's the fact that Firefox has effectively banned self-signed certificates for technical illiterates. There are many use cases where commercially available Certificate Authorities are not practical or even outright impossible.

Hardware firewalls, for example, cannot use CA signed certificates. For one, their final sale price is often at or below that of a CA signed certificate for a single year, and for another they won't have a permanent, externally accessible DNS name to certify. It's fine to say that users of commercial grade equipment should be able to add exceptions, but your average Mom & Pop with a $50 Linksys firewall probably won't manage.

This change won't result in better security. It can only result in either people deciding Firefox doesn't work, or that configuring their routers is just too hard. Hundreds of thousands of identical systems running with default passwords open to the wider internet will not make the world a better place.

0 Comments >> Bookmark and Share

On Firefox's antipathy to encryption

Overall, Firefox 3 is a great update. It's faster, leaner and though others may disagree, I love the Awesome Bar. Unfortunately, it's extremely hostile to secure web browsing and makes it all but impossible for regular users to use encryption for non-commercial purposes.

Previously, Firefox 2 would warn the user when accessing a secure site that didn't prove it's identity (a self-signed certificate), but it would let them through. Firefox 3 throws a screaming hissy fit, and forces the user through not one, but four confusing and intimidating gauntlets, none like the other. The stereotypical grandma simply isn't going to be able to make her way through that. Firefox 3 will not allow her to use encryption anywhere but her bank.

Phishing is a problem, but solving it does not justify banning all non-commercial encryption outside the nerd ghetto.

24 Comments >> Bookmark and Share