Slightly Interesting Javascript Benchmark

I have an Asus CG5275 desktop, and decided to try out the Mandelbrot JavaScript benchmark at http://alexey.radul.name/ideas/2013/cleverness-of-compilers/ with the three browsers I use most, Chrome 29.0.1547.57, Firefox 23.0, and Opera 12.16. I expected Opera to be the slowest, and was not disappointed.

The mild surprise was that Firefox was almost four times as fast as Chrome. Here are my timings on the Asus with the above-mentioned URL and browsers:

Browser             Size    Time      Relative

Chrome 29.0.1547.57 500x500  9562 ms  3.86

Firefox 23.0        500x500  2478 ms  1

Opera 12.16         500x500 19464 ms  7.85

Opera took just about twice as long as Chrome, and Firefox was almost 4 times as fast as Chrome. This is on an Intel i5 at 3.2 GHz running Linux Mint 15, Mate, kernel 3.8.0-29-generic. It's a 4-core machine, which makes me curious about the almost 4x speedup of Firefox vs.. Chrome.

[ Note added about 15 minutes after original posting: Mate's System Monitor makes it appear that all three versions use just a single core. No real surprise--this is JavaScript, after all. ]

Amusement in Advertising from Google

Web access seemed sluggish this morning, so I hopped over to http://www.speedtest.net/ to look at the results. They were okay:

However, this was with Firefox, and the ad suggested results would be faster with Chrome. Really? I have Chrome, and use it often. Here are my Chrome results:

Faster? My throughput with Chrome was just a little slower but the ping times suggest a lower RTT with Chrome, which could possibly suggest a faster scripting implementation. However, this was from two different servers, one reportedly in Frederick and the other in DC, and just one shot each. Perhaps a more detailed study is warranted, but not now.

HTTPS Everywhere Rule Set for userpages.umbc.edu

Many of the servers at  UMBC do not support HTTPS, but userpages.umbc.edu, the server(s) for user home pages, does. However, probably few people access it securely. For those using HTTPS Everywhere, I wrote an extension for HTTPS Everywhere:

<ruleset name="userpages-UMBC">

  <target host="userpages.umbc.edu" />

  <rule from="^http://userpages\.umbc\.edu/" to="https://userpages.umbc.edu/"/>

</ruleset>

I haven't figured out how to install this in my Chrome profile, but it works fine with Firefox HTTPS Everywhere. Tips would be appreciated.

First, HTTPS Everywhere must be installed. Most people should install it anyway. The EFF is doing great things for the public, which is why I donate annually.

Second, the file must be installed "in the HTTPSEverywhereUserRules/ subdirectory in your Firefox profile directory" (see the EFF page). Then restart Firefox. On my Xubuntu system, this directory was

~/.mozilla/firefox/xxxxxxxx.default/HTTPSEverywhereUserRules. The penultimate part of that path will vary from system-to-system.

[ Originally omitted; added 2013-06-09 ]:
Third, the file name must match the domain name, userpages.umbc.edu in this case.

Get HTTPS Everywhere from the EFF here.

My Preferred Firefox Extensions

• CS Lite Mod (1.4.8): cookie management
• Download Statusbar (0.9.10)
• HTTPS-Everywhere (3.0.4)
• NoScript (2.6.3)
• Padlock (0.5.0)
• Web Developer (1.2.2): reliable referer blocking

Useless crap Ubuntu adds to Firefox that is easily disabled, but not so easily uninstalled: 

• Global Menu Bar Extension
• Ubuntu Firefox Modifications

Opera Address Bar Tip

There is a user interface design flaw in Opera 12.02 where, by default, the full URL of a web site is not shown. Here's an example:

Now suppose I want to select and paste this address, and click at the right edge of the displayed "URL." This is the result:

As can be easily seen in the image, if as user is not careful, a critical portion of the URL is lost. Even an attentive user still must repeat the select operation. Either way, time and effort are wasted.

Fortunately, though this is a bad UI decision, there is an option to force Opera to correctly display the URL correctly. Navigate to Opera|Settings|Advanced|Browsing. The penultimate checkbox under this tab is Show full web address in address field. Check this and the address bar will function correctly:

Similarly, Firefox no longer displays URLs correctly. The fix is here.

A sign of the times

Firefox's US English spell checker doesn't come pre-loaded with the word 'bookstore.' They still exist, really.

Firefox Add-Ons in Mint 11

I had two add-ons in Firefox 8 that I was able to disable, but not to remove. There was no remove button next to either add-on in the add-on manager. These were Stylish 1.0.2 and the Unity global menubar extension. I have neither run nor installed Unity since my latest fresh install, and so that was puzzling. Actually, both were puzzling, since I never installed either. Someone's been messing with Firefox. Anyhow, this will fix both:

sudo apt-get remove mint-stylish-addon firefox-globalmenu

Chrome: Blocking HTML Referer [sic]

It's easy to block HTML referrers in  Firefox: visit about:config and set network.http.sendRefererHeader to zero.

It's easy to block referrers in Opera: Make sure "Send Referrer Information" is unchecked at Opera | Settings | Quick Preferences

So how about Chrome? The man page is incomplete, not saying how to do this.

Googling sent me to a a Chrome extension. I have no reason to trust the author of that extension, so I looked a little more.

The answer is, surprise, in the Chrome help forum,  http://www.google.com/support/forum/p/Chrome/thread?tid=63a866565ba8664f&hl=en

The thing is, I don't usually start Chrome from the command line, and I don't recommend doing so. If Chrome (or Firefox, or Evince, etc.) are given a command shell, they dump gobs of junk to, probably, stderr. So it's necessary to change the shortcut from which Chrome starts. Gnome instructions follow; Windows instructions, untested, are here. [ Note added 2012-09-10: I think the following is incorrect and that Firefox does require an extension to block referers. Bad Firefox, bad. Original text: I do not endorse their method of blocking referrers in Firefox, as it is simply not necessary to install an extension to do this. ]

In System | Preferences | Main Menu | Internet (your system may vary) right-click on Google Chrome. Add --no-referrers to the end of the command line. Kill Chrome. Restart Chrome through the updated shortcut.

On referrers: this is from a time when the Internet was a less dangerous place. I have trouble seeing how this was ever a good idea, but now it is simply an invasion of privacy. It isn't likely that any subsequent version of HTML will drop this, but it would be nice if browsers would default to not sending referrer information.

A note on the misspelling 'referer': the word was misspelled in RFC 1945 (!996 Berners-Lee, Fielding, Frystyk), which is a bit odd since they spelled 'referred' correctly. Wikipedia says the misspelling originated in a different document, by a different author. Fielding says that neither 'referer' nor 'referrer' were in the UNIX spell program at the time. I thought by 1990 everyone was using ispell or aspell; okay I never actually thought that. Paper dictionaries weren't available at the time? I'm just happy to not have my name as prominently associated with a dumb little mistake like this. Of course, it is just a dumb little mistake.

Stupid Chrome Tricks

I'm using Chrome 14.0.835.15 dev on Ubuntu 10.04 LTS and I viewed a web page today, the bottom left of which looked like this:

Chrome wasn't rendering the ñ in enseñar correctly. However, I took this screen shot with the mouse pointer hovering over the link to enseñar.jpg, and at the bottom, it was rendering the word correctly. So Chrome halfway knew what encoding was in use. I went to Wrench|Tools|Encoding, and it claimed a UTF-8 encoding. Odd, this word should be rendered correctly with that encoding. I changed the encoding to ISO 8859-15, which was no better. Then I changed it back to UTF-8 since as default encodings go, that seems a good choice. Voila! The page was rendered correctly.

Apparently Chrome only said it was using UTF-8 initially, but after changing away from UTF-8 and then back, it suddenly really was using UTF-8.

Firefox 3.6.18 on the same system worked fine.

Another amusing thing is that Chrome on a Windows 7 system I occasionally use, when rendering the same page, says the original is in Afrikaans, and offers to translate it to English. Does Spanish look that much like Afrikaans?

Zombies, Firefox, Chrome, and all That

I've been noticing a lot of defunct or zombie evince processes lately and decided to take a couple minutes figuring out what's going on. In the Linux world, evince is a good PDF reader, certainly better than the one freely-available from Adobe. The problem isn't with evince: zombies cannot be held accountable.

All the zombies I had on my system this morning had one of two parent process IDs, that of Firefox (3.6.18) or that of Chrome (13.0.782.56 beta). When a process forks a child, it is supposed to wait() for the child. This can be done asynchronously, so it's little inconvenience for the parent process, and not much for the programmer of the parent process, if said programmer knows what he is doing. The child process, evince in my case, hangs around the process table as a zombie until the parent issues a wait(). This allows a parent process to keep track of the status of its children. Once the parent checks on the child, the child can go away.

Firefox and Chrome are apparently not checking on their children.

Printing to PDF, Firefox, Ubuntu

Off and on I've been irritated that Firefox print-to-file functionality defaults to postscript with the filename before the .ps extension blank. What's up with that? This is more of an issue now that I have a Kindle, and thus print to PDF much more often than to paper, so tonight I poked through about:config, shrugged, and turned to Google. I found one useful page, http://ubuntuforums.org/showpost.php?p=7890849&postcount=7, but prefer "my" way to his, simply because my filter places exactly the right configuration lines on the screen, leaving nothing to manual hunting.

1) Enter about:config.
2) Type print_to_filename in the filter bar.
3) Place exactly the same path, file name, and extension in each setting.

This is what mine now looks like:

Needless (I hope) to say, different folks will have different printers, and so my entry for an HL-2040 will be atypical and most other people will have printers not shown here.

There is no generally-useful file name, so indicating the application that generated the PDF seems a reasonable choice. IMHO, /tmp is the only reasonable directory to use so that the user's home directory isn't littered. Littering $HOME is an unfortunate tendency of Linux developers.

Useful "New" Firefox Feature

I am not a fan of GUI-based spellcheckers since it is so easy to miss a misspelling. I much prefer ispell within emacs. In particular, ispell does a great job (compared to any GUI I've seen) of suggesting alternatives, emacs and ispell together do a great job of accepting words for a session across multiple documents, and emacs understands various file formats and doesn't try to tell me that, for example, an HTML tag is not a valid English word. Well, it has long been a common opinion that GUIs are great for beginners but don't particularly reward more experienced users with better productivity. I particularly dislike spell checking within OpenOffice, since when adding to the dictionary one has to always specify which dictionary to save a word to, even if there is only one dictionary. Make the common case fast? I don't think that's a concept OpenOffice developers are familiar with.

So how can one make it less likely to miss misspellings before sending an e-mail, submitting a form, etc? Firefox 3.6 and newer has a nice feature that's a pain to enable, ui.SpellCheckerUnderlineStyle. See http://kb.mozillazine.org/Ui.SpellCheckerUnderlineStyle. I particularly like option 4, which places a double line under each misspelled word. But the article just cited does not give explicit instructions for enabling the feature.

1) Open about:config
2) Right click in the list of preferences and select new.
3) For the new preference name, use ui.SpellCheckerUnderlineStyle.
4) For the type, use integer.
5) For the value, use your preferred value from the MozillaZine article. 5 is the default, a wavy red line. My preference is 4, a double line.

Migrating UMBC E-mail to Gmail

Some months ago UMBC began migrating e-mail to the Google cloud. This migration has been voluntary, but everyone will be moved over in January. I like Gmail, and considered moving some months ago, but decided not to because it was unclear whether there would be a solid wall (psychologically as well as logically) between my personal Gmail account and my UMBC Gmail account. This will not be an issue for a number of reasons:

(1) The accounts are separate, one reached via mail.google.com and the other via gmail.umbc.edu. I can reach both via the traditional mail.google.com URL, but with two different user names. I plan to explicitly go via (and link to) the gmail.umbc.edu address.

(2) I usually use Chrome for Gmail, but use Firefox for UMBC (myUMBC) services. Firefox add-ons allow me to selectively turn off undesired scripting within myUMBC and Chrome does not display PeopleSoft slop properly (I suspect it really does, however, and that PeopleSoft is simply not following web standards, but this is something for future investigation). So I will continue to use Chrome for personal Gmail, and will use Firefox for UMBC mail.

(3) I use different themes for the two Gmail services, and so my work and my personal screens look very different.

(4) The UMBC Gmail has "myUMBC" prominently displayed in the upper left.

(5) If all of that is not enough, I can simply return to an IMAP client for UMBC e-mail and continue to use the browser for personal Gmail.

The one drawback I have seen in my initial look is that Google says it may take several days for my old e-mail to migrate to Google. Since I have switched, I can no longer access UMBC Squirrel mail, and so none of my old e-mail folders are currently available via the web. Since grades are due in a couple weeks, this could become sufficient motivation to temporarily configure an IMAP client on my laptop. However, I do not foresee much inconvenience here except possibly delaying my grading of assignments submitted via e-mail.

I do suspect there is still a way into squirrel mail, but do not plan to spend any time finding the way.

Quick Note on Address Bar Auto-Completion

Firefox and Opera, by default, have a search field (it's a text field but Firefox calls it the search bar) to the right of the address bar. I've removed mine--it's redundant and cumbersome (or so I thought, but see point 3 below), and an information leak.

I often have students in my office for advising and typically go over their online records. This means they look at my web browser. This also means they can read titles of tabs (fine, so be it) and contents of the search bar. I'd hate to have a student read too much into the fact that I've recently searched for Shaun Cassidy. So in my office I removed the search bar and just open a new tab (^t) and hit the g key. This takes me immediately to Google.

(1) Most of my searches are Google searches. I played with Bing when it first came out, but Bing's results don't seems as good, and Bing seems to use a fair amount of client-side scripting, which I'd rather avoid. Google does too, but they already know everything about me.

(2) I may sometimes prefer a Wikipedia search or some such, but very often the appropriate Wikipedia page is near the top of the search results, so Wikipedia search is redundant.

(3) Doing a quick lookup for this posting led me to http://www.mozilla.com/en-US/firefox/search.html, which points out that one can select text and drag it to the search bar, which seems to work well. So my search bar is, at least temporarily, back in my Firefox window on most of my machines--just not the one in my office.

Blackboard 9 Usability and Security

It turns out that Firefox users can improve their browsing experiences within Blackboard and keep their local data a bit safer through the use of the AdBlock Plus extension.

A problem I've had for awhile--predating Blackboard 9--is that when editing content within a Blackboard text area, Blackboard pops up a requester asking me to give some piece of Java code complete access to my PC. Of course I always say no. However, Firefox and Chrome seem unable to remember this, though Opera can be instructed to always block such a request from a particular site. Firefox is happy to allow one to always trust signed content from a provider, but not to always distrust. Strange.

Anyhow, these two AdBlock Plus rules block the annoying content from UMBC's Blackboard installation:

|http://blackboard.umbc.edu/webapps/blackboard/content/webeq3.editor.InputControl
|http://blackboard.umbc.edu/webapps/blackboard/execute/webeq3.editor.InputControl

It appears that Blackboard wants access to all the data and applications on my PC on the off chance that I might want to run an equation editor. I'll go out on a limb, having never tried webeq3, and say I have better equation editing tools on my machine.

Security on the Client Side

Common--and good--advice is to not trust the client. If an organization has no control over the client, as is the case in web-based client-server applications, the client is not trustworthy. The Milwaukee Journal-Sentinel's Packer Insider is a very good low-stakes example of a site that has gotten this wrong. The Packer Insider is intended to be a subscription-only service, but I was reading it for a while, perhaps a long while, before I realized I was reading for-pay content.

If I visit http://www.jsonline.com/sports/packers/ in Firefox I get full access. If I visit it with Opera or Chrome, and click one of the Insider links, I get a login screen. What's the difference?

The difference is NoScript, an indispensable Firefox tool. NoScript is not intended to circumvent security, but rather to enhance client-side security. The idea is that if I let any given web site execute any script it wants on my machine, my personal data and the integrity of my machine are at risk. NoScript also helps me limit more obnoxious advertising by selectively shutting off Flash, JavaScript, Java, etc. NoScript uses a default-deny model, meaning that sites are not allowed to run client-side scripts unless I assent. NoScript is not for everyone because it does cause problems with some sites and it does require some effort on the part of the user, but it does provide a much safer browsing environment.

So, if I disable scripting, I get a much cleaner, more pleasurable view of the Journal Sentinel's Packer pages. As a side effect, I also get access to the Packer Insider materials. This is due entirely to poor security architecture at the Journal Sentinel's site, and, IMHO, strong evidence that the design was not done by an experienced professional. OTOH, there may have been other constraints making this desirable, and they may not actually care. If I were to lose access to these pages, I wouldn't really care because the Green Bay Press Gazette has comparable content that's openly-available.

As an aside, there are those that think it is bad to disable advertisements that support web sites. I have sympathy for this view, but I don't want their scripts running on my machine, eating cycles, providing animations which make it difficult to concentrate on the actual content, and, in extreme cases, making noise or damaging my system. I will aggressively block Flash, animated GIFs, etc., that damage the user experience.

This shows a general advantage of server-side over client-side scripting. Providers have a better idea of what their pages look like on the client side if they use server-side scripting--which is controlled by the provider--rather than client-side scripting, which is controlled by the end user, the browser, malware, etc.

Summary: security must be on the server side.

Different Browsers for Different Purposes, II

I previously commented on how I've started using different browsers for different purposes. I just visited the Weather Underground (wunderground.com) using Chrome, and it wasn't pretty. Right next to the weather map was this obnoxious flash animation. I quickly closed the frame and reopened it in Firefox, where NoScript screens out much of the obnoxious, much of the dangerous, and much of the insipid.

I had a similar experience last week while out of town. I don't have cable TV, and so am usually not subjected to cable news. Cable TV news is terrible, all commercials all the time and almost no news. Give me NPR and BBC any day. I've mostly stopped watching NFL games for the same reason.

Browsers

More and more I'm starting to use different browsers for different purposes. Opera is nice because it allows fine control over scripting on a per site basis. For example, at NFL.com, I can shut off most of the advertising but still use most of the site's features. I especially like this for Blackboard, however.

Blackboard is a commercial course management system. Essentially, it's bloatware loaded with features that I can't imagine many people use, but they persist because, apparently, someone uses each. One of the unfortunate features of Blackboard is that when entering data in a text area, it starts a Java application. Yes, an application, not an applet. For some inexplicable reason, Blackboard wants to run an application with full user privileges on my PC. This is even harder to understand, since disallowing execution seems to have no effect on Blackboard functionality. It's probably innocuous, but as a matter of policy, why subject all the data on my PC to Blackboard's whims and bugs? Plus, what, if anything, are the software folks at Blackboard thinking?

Firefox generates a warning, but doesn't remember negative decisions. It allows one to always trust a site, but not to always distrust a site. Strange.

Opera, though, now knows to never run Java at blackboard.umbc.edu. So far, this is causing no problems, and so Opera is now my browser of choice for Blackboard.

Blocking the HTTP Referer, Take 2

I was about to post that RefControl now seems to work on all my systems, but double checked and, alas, no. RefControl is broken on Firefox 3.5 running on Ubuntu 9.04. Time to systematically uninstall RefControl on all my Linux boxes and install Web Developer on each. I can't have a privacy tool that sometimes works on some systems.

Web Developer Add On: https://addons.mozilla.org/en-US/firefox/addon/60
Testing for broken referer blocking: grc.com or http://userpages.umbc.edu/~jmartens/courses/is430/infoleak.shtml

Blocking Referer Page

By default, browsers tell servers what page they're coming from, i.e., the page on which the link to the page was clicked. The justification for this is hazy--I can't imagine why I would want to give this information to any server.

I used to use RefControl to block referring information (note the HTTP spelling is referer[sic]). Unfortunately, the current version of RefControl doesn't work with Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.14) Gecko/2009090216 Ubuntu/8.04 (hardy) Firefox/3.0.14, so I went in search of something that would work. I tried No-Referer and Refspoof, neither of which appear to work at all.

A little Googling led to the Web Developer Toolbar, which does successfully block the referring page. It's a bit heavier weight than I wanted, but it works, and it does have other features I may use over time.

Check to see if your referer information is shared.