Marco Trova's weblog

Sending usernames and passwords in clear text over HTTP, especially in the URL of the HTTP GET request is so ridiculously insecure I can't believe anyone actually put that in an RFC without it being an April 1st joke.

Post talks about the style how this solution was implemented, not what it was resolved.

Marco, the problem is that those URLs do not follow standards and if Mozilla builds itself as a standard compliant browser then it should not be sending user names and passwords in URLs. Mozilla developers are not smarter, they're just ignorant.

I agree with Jerry - I thought that one of the big things that the Mozilla people were always harping on is how much more standards-compliant their browser is than IE.

Well, they're purposely introducing non-standard behavior with this fix.

And do you really believe that Aunt Tilly (or Abby) will understand that www%2emicrosoft%2ecom really doesn't go to microsoft.com?

They see all sorts of wierd url encodings in the command line, people tend to ignore them.

Better to cut the bad behavior off before it starts.

I agree with all of you, but I have to comment about how different is the approach to solve the problem.

Mozilla developers have at least started a discussion how to solve the problem.

Bug 240754 comments tells this is not the solution of bug, but only shows these _wrong_ types of URLs in an encoded format.

Marco, you don't get the point - the only problem there is that there are browsers that allow you to specify user name and password in a URL, which is breaking the standards. Encoding those is not a solution, removing the functionality is the solution. It should've never been there.

If it is not a RFC standard, it was implemented for years in ALL browsers.. Developers has been using this hack for years. Right or no, this patch has broken those wrong web applications.

We, developers, that have to mantain these bad developed web application we have to explain to our customers that a Microsoft patch has broken their work. :-S

The solution could had be different, I think. Only this.

So you're saying that no matter what Microsoft does they're always going to be wrong. If they follow standards they're wrong, if they don't follow them they're wrong as well.

If you're going to argue that they should do what majority does then you should apply it both ways, Mozilla should do what majority of browsers used does, such as support ActiveX (which they do, it's just not as simple and secure as with IE), render pages that are not standard HTML, render invalid CSS, implement broken box model for transitional HTML and so on...

^_^,Pretty Good!

Pingback from  Mozilla developers smarter than IE developers

If Mozilla is so smart, WHY did the new version COMPLETELY DIE ON ME? Nothing works now!!