If I named ten extensions I am the biggest fan of, WOT Web of Trust would be on that exclusive list.

Why?  They provide a great service to the public, helping organize the public to alert itself about risky web site.  The real power in WOT isn’t the tools, it is the users.  It is the perfect mash up of the right tools, at the right time.  Anything that is simple to use, and makes users more aware of the risks around them is a good thing.  With that said, I wanted to talk a little more about the service with one of the people behind the magic, Esa Suurio, the CEO of Web of Trust.

What was the main inspiration behind the WOT Web of Trust add-on for Firefox?

Esa: The company was founded in 2006 by two postgraduate students, Timo Ala-Kleemola and Sami Tolvanen, both M.Sc. in Electrical Engineering. Timo and Sami graduated from Tampere University of Technology (Finland) where they had met and studied together.  Sami got the idea while researching reputation systems for his doctoral thesis. He originally planned on using it as a part of an Internet messaging system, but decided to try if it would work for websites too, and it did.

The guys put WOT on the Internet and it started to grow without any marketing, which clearly tells that there is a need for this kind of service.

Where did the name, Web of Trust, come from?

Esa: The name highlights that we are a people-driven service. The nature of Internet is open. No single authority can decide what is good and what is bad – neither has the resources to do so. We wanted to create a common platform for people to share their experience on websites and the services they offer. If unreliable sites were known to people, their lives would be short-lived.

There is no doubt that community is the most important part of your service.  What advice would you have to other add-ons or business looking to build a community around their own product?

Esa: We truly are a community-driven service. For example, when we develop our software, we ask our users what new functions they would like to have added. We read very carefully all the feedback we get from our users and use it as our guideline when we develop Web of Trust further. In our case it’s “product around the community” and not vice versa. The community members need to see that the systems gives them real value – I think that’s what make some communities grow.

We value our members and their contribution – for example, we just gave out Web of Trust Publicity Awards 2008 for users who have helped us to spread the word about WOT.

I’ll say in my personal opinion, I was happy to see you guys come along after an add-on that might be in the same category, SiteAdvisor, kind of got a lot worse after being picked up by McAfee. What is Web of Trust doing to make sure they don’t get too watered down?

Esa: SiteAdvisor is a great service and they are fighting on the same side with us. What makes Web of Trust different is the fact that our website ratings are based mainly on ratings coming from our users. This enables us to be faster and more accurate than computerized testing services. Internet fraud can often be only detected by a human person. Lets take an example: One of the latest trend of security threats against Internet users employs software products which pretend to be security tools that help you remove spyware or viruses. These fake anti-malware products scare users by giving false alarms and then try to deceive users into paying for removal of non-existing malware.

When these threats started to emerge last year, WOT was the first system to warn users about them, thanks to our active users who rated these sites. The quality of WOT website ratings has improved as our community has grown, so we definitely are on the right track.

Are you guys working on any spin-off or side projects right now or is your main focus still on Web of Trust.

Web of Trust is our main focus. There is so much to do. We are certainly not going to stop here – the journey has just begun.

Out of all the different, “download the video from that video sharing site” services out there – what does it feel like to be the most popular one, right now?

It’s good and that’s even better to be one of the most popular Firefox extensions overall :)

I started computing in the early 80s on a Sinclair ZX81 (2KB of RAM!) and since then, i wrote many lines of code within a lot of various projects but DownloadHelper is by far the application that got the best success. So when you write a piece of software that will be executed one million times everyday, you for sure feel useful but a bit anxious as you have the responsibility to make this code work flawlessly.

What makes Video DownloadHelper different than the other video download tools for Firefox?

There are 3 major things for an application like DownloadHelper to be successful:

First, it must be easy to use: most users must be able to use it right away after the installation without having to read a long manual.

Second, it must be reliable and work without problem is a large majority of situations. However, in this particular video downloading area, you must accept that the application won’t work in 100% of the cases users would expect it to work.

Third, it must be trustworthy and not try to spy the users, send them popups or anything of that kind, where it would be technically easy to do so and financially lucrative. And not only it must respect the users but it must be seen as such. This is were popularity is quite useful: users know that if millions other people use the application, this one must be safe.

For the case of video downloading tools, DownloadHelper is well perceived because it matches well the 3 points above, in particular it uses generic capture methods that work well in practice and do not depend on a video site implementation that could change the next day, that’s for reliability. Also, it does not resolve video media addresses through an external web site where users could suspect someone spies them upon on the videos they are watching.

Did video web sites complain about your tool being able to grab their content?

No, on the contrary, many of them ask for their site to be included in our lists.

It’s important to understand that DownloadHelper is not only a tool to grab videos to your local hard disk, but the overall project also includes a registry of more than 600 video sites which is managed mainly on the web site (http://www.downloadhelper.net/sites.php) and a bit in the extension (supported sites list). Thanks to the magic of statistics, from the data collected in the site over a large population of visitors, the lists are sorted accurately based on their quality. If a new good video web site opens, it will quickly show up in the top of the list.

This discovery feature generates everyday about 150,000 hits to those web sites. So to answer your question, a few sites requested to be removed and only 1 of them maintained this request once they understood the traffic was directed to their html pages and not directly to the media content.

Is there still room for improvement with Video DownloadHelper, or are you more focused now keeping it up and running with the most recent Firefox versions?

There is still a large functional margin with DownloadHelper and you can expect to see new great features in the near future. Amongst them, you should see:

• much smarter naming of the videos: most users would prefer downloading a file named funny_basketball_shots.flv rather than 3246874321854.flv
• video conversion parameters sharing: fine tuning the embedded converter can be tricky. As DownloadHelper users is a large population, sharing the
• configurations that work best becomes statistically meaningful
  direct access to YouTube high-quality videos
• several other features that are still secret :)

Do you have other secret Firefox-related projects?

Unfortunately, my brain is not powerful enough to handle other projects in parallel, and it’s certainly wiser to use the energy capitalizing on the popularity of DownloadHelper.

But still in the overall DownloadHelper context, the next big step is to take benefit of the exposure of the extension to help populations in Africa. It’s something to help people in developed countries getting videos, but if you can also provide a more significant support to people in need, then why not doing so ? I am currently discussing with associations to have that in place in late September or October.

How many people are contributing to the DownloadHelper project ?

About 2 millions daily users making suggestions and reporting issues (not all of them fortunately !), 800 beta-testers, 20 translators, ~10 advisers and 1 making the decisions and the coding.

What made you want to create the add-on for Firefox?

Basically the need for it.

In summer 2006, I wanted to download a video file out of YouTube. The only Firefox extension that was available at that time was really not good. As I developed several Mozilla extensions in a professional context, I had the technical expertise to do better, which I did in a week-end. The first day it was published on addons.mozilla.org it downloaded 2000 times which I found very high. I now have other figures in mind to talk about success :)

What other Firefox add-ons out there really impress you?

I like small extensions doing a simple job well, like Download Statusbar, Mouse Gesture Redox, Table2Clipboard.   And also as a web developer, I could not live without Javascript Debugger (Venkman), Firebug and Web Developer.

Why would the random Firefox user off the street be using NoScript?

Firefox is an extremely safe browser, because it can take advantage of an open and agile development process, a very security-minded core development team and a multi-vendor security coordination group, including people from major Linux distributions and IT integrators, which I’m also a member of. This ensures that many experts with different backgrounds and points of view are steadily discussing about making Firefox safer and stronger, and that discussion quickly translates in bug fixing and enhancement code.

That said, no modern browser can be said 100% safe:

• The code base is very complex and articulate, including a network stack, multiple parsers, renderers, codecs for images/video/audio, a scripting engine and many other components. This code will never be 100% bug free, because of its continuous evolution, even if the mandatory regression tests which are dictated by the current Mozilla development policy do help a lot. Incidentally, the piece which over the time proved to be the most vulnerable to security-sensitive bugs is JavaScript, and the bad guys start or prepare their attacks using this scripting language because it’s extremely powerful, ubiquitous, easy to obfuscate and often a soft-spot itself. That’s the main rationale behind NoScript blocking JavaScript on every unknown site, until the user explicitly decides to trust it.
• Even if the Mozilla code was absolutely clean, nowadays web content rendering requires a number of 3rd party plugins (Java, Flash, Silverlight, Quicktime, just to name the most popular) which have proven to be all but invulnerable. Most recent remote execution exploits, indeed, leverage intrinsic features of these plugins (e.g. the fact they implement virtual machines and JIT compilation, and therefore they need write access on executable memory) to bypass the additional protections put up by latest OSes and browsers. That’s why NoScript blocks Java, Flash and all the other plugins on sites you don’t trust.
• Even if both the browser and its plugins did not expose any attack surface, today the web itself is fundamentally broken from a security perspective. The HTTP protocol and the HTML markup, the building blocks of the WWW, had been originally developed with the intent of representing and making navigable a network of interrelated (hyperlinked) documents. They were not designed to support applications, i.e. full fledged programs, often in charge of sensitive databases. Years later, many of our daily web destinations (Google Search, GMail, our online banking site, our customized feed-laden home page) are read/write applications, and securing them requires a great development effort because their foundation is so fragile. In facts, most of them are vulnerable, especially to attacks caused by the lack of isolation: a malicious site can read sensible data or push transactions on a different web application on behalf of the current user. This kind of attacks, the most relevant and widespread of which are Cross Site Scripting (XSS) and Cross Site Request Forgery (CSRF), are made possible by very common programming errors or deficiencies on the web application side; therefore, for a long time, browser vendors did not feel the responsibility of mitigating their nefarious effects. Fortunately something is changing, and I like to believe a relevant cause has been the pioneering role of NoScript, which dispelled the myth that nothing could be done about XSS and CSRF on the client side: IE8, for instance, will contain an Anti-XSS filter which is pretty much a copy of the one introduced by NoScript, albeit less effective than the original ;)

I believe the reasons above are more than enough for “the random Firefox user” to embrace NoScript, because a web browser alone, even if its the safest like Firefox, could never be as safe as Firefox with NoScript.

For those people out there who don’t read descriptions or reviews before trying out an add-on, has anybody ever complained about scripts being blocked after installing?

Yes, I admit it used to happen all the time, even if there are a lot of sites out there (most blogs and news sites, including Slashdot) which work perfectly fine with scripts blocked.

But now NoScript, after first install or upgrades, redirects its users to a “Release Notes” page which incorporates also a quick tour through its features, hoping to convey the message that allowing scripting on a trusted site is just one click away from the NoScript icon, that your trust judgment will be remembered and therefore the training burden will get always lighter and lighter.

The training phase can enjoy a further speed up if you enable the “Allow sites opened through bookmark” preference.

Finally, if you don’t feel ready yet for a whitelist approach, you may want switch to the less safe “Scripts Globally Allowed” mode: Anti-XSS protection is still fully enforced, and you will be able to selectively blacklist the sites you don’t want to run scripts and plugins.

What was the main inspiration for developing NoScript?

More than 3 years ago (early May 2005), some months after releasing my first Firefox add-on called FlashGot, a crisis situation hit Mozilla because a serious, unpatched vulnerability was publicly disclosed, which allowed attackers to perform remote code execution against any Firefox user visiting a malicious site enabled to run JavaScript.

I felt concerned for my own security in the first place, and began to investigate previous known browser vulnerabilities, discovering that, across all major browsers, the culprit or the main vessel of exploitation was almost always JavaScript. Actually, in the overwhelming majority of the browser-related security advisories, the suggested work-around is still “Disable JavaScript”.

So I asked myself, what about disabling JavaScript as they suggest, but keeping it enabled on sites I trust and I need it to work on, like my webmail or my bank? Or should I give up online banking “until the bug is patched”? And what about the bugs which have not been disclosed yet? Am I sure bad guys don’t already know how to exploit them?

3 days after, NoScript 1.0 was ready and published on the Mozilla add-ons web site.

Short of your own add-on, what other security measures or tips to you suggest people take advantage of?

From a strict browser security stand-point, NoScript is almost all you need, because it covers active content permissions, XSS and, to a certain extent, CSRF too. The Anti-CSRF capabilities of NoScript are being dramatically augmented in the current development cycle eventually leading to NoScript 2.0, which introduces an innovative feature called “Application Boundaries Enforcement” (ABE), a sort of in-browser firewall greatly mitigating this class of vulnerabilities. In the meanwhile, some additional security on this front might be provided by RequestRodeo or LocalRodeo, but I’m not sure if they’ve been updated to work with Firefox 3. The same goes for SafeHistory and SafeCache, two privacy-related add-ons, whose Firefox 3 compatibility status is not very clear at this moment and whose functionality will be likely absorbed by a future NoScript release. On the privacy side, other 2 add-ons I personally use with satisfaction are RefControl, which hides or forges your referrer header depending on the site you visit, and CS Lite, to manage your cookie permissions with an user interface apparently inspired by NoScript, but if you’re after real anonymity you definitely need Tor. Another nice complement to NoScript is WOT, which provides real-time security and privacy community-driven advices about each site you visit: this can help a lot to judge the accountability of a site you’re landing on for the first time, so you can better decide if it’s safe to allow in NoScript.

Out of the browser, I encourage using a limited user account for everyday activity (that should sound obvious if you’re on Linux or Mac OS X, but some Microsoft customers still need to be educated in that direction). If you’re not behind a corporate or home firewall, keeping a personal firewall enabled and correctly configured is mandatory too.

Then, especially if you’re a Windows user, you already know an anti-virus product can save your back sometimes, even if using a secure browser (Firefox+NoScript) and a secure mail client (Thunderbird) is much more important as a first line prevention strategy: after all, an anti-virus can block only the threats it already knows, so unless you practice safe browsing and mailing you’re still very exposed to 0 day attacks.

Where should people go to learn more about NoScript and your development of the add-on?

The NoScript web site contains a “features” page, which turned into a quick user manual over the time, and a quite extensive FAQ section.  I’d also love people to come and share their views about security, Mozilla and other “hackerish” topics on my blog, Hackademix.

The team over at Wired have posted a very interesting article with Mozilla’s CEO, John Lilly about a number of topics.  One of the topics that came up was iPhone and the easy somebody like Mozilla would have developing for it:

Wired: Are you going to develop a version of Firefox for the iPhone?

Lilly: No. Apple makes it too hard. They say it’s because of technical issues — they don’t want outsiders to disrupt the user experience. That’s a business argument masquerading as a technological argument. We’re focusing on more important stuff. The iPhone has been influential, but there’s not that many of them. We’re part of the LiMo Foundation — Linux on Mobile. The Razr V2 is a LiMo phone, and you’ll see more in the next year or so.

I do understand Apple’s need to “control the experience” with the iPhone, and hey… who knows, this could really open some doors for other phones and mobile devices.  Also Apple isn’t going to want to take away from Safari which for me as a Windows user has not been much than bundle-ware with iTunes. 

Check out the full interview with Lilly:  The Mozilla CEO on His Firefox Strategy, His Google Gambit, and Working With Apple

Does it make you feel nervous at all that your success is so tied into the success of addons for the browser? You have clients for both Firefox and Internet Explorer, but what if addons sometime become “not so cool”.

Sure, industry change always makes us nervous. The key is to continually provide enough value for the user that cool transforms into indispensable. We are trying to provide a tremendous amount of information in a very small space, so there is always the possibility of looking at other ways to display the value, but at this point, the experience of surfing with your friends is so tied to where you are on the Internet, that a marriage between the browser and Me.dium makes sense.

How quickly has your user base grown and how many average users would you say you have at the present date and time?

We’ve been very pleased with our user growth and Firefox has played a big part in that. We’re looking forward to the 3.0 upgrade to fuel even more users. While specific numbers aren’t something that we publicize, the key with Me.dium has always been more about whether there are people that matter to me (my friends or people doing similar things) online right now. We have gotten to the point now where there are enough people using Me.dium at the same time that you are no longer alone online. You can bump into your friends and gain value by watching the activity of other users.

From my standpoint, you have done a lot when it comes to bringing a social interaction to any site or page. What is next with the Me.dium project?

Thanks for the vote of confidence! That’s definitely been our goal. I think as far as the next evolution goes, we need to really refine a bunch of things on the User Interface side to make it much more understandable and usable. Surfing with your friends in Me.dium still takes a bit too much of a learning curve from our perspective and adding a bunch of new features before the current version of Me.dium is a bit clearer and easier to use is probably just going to muddy the waters a bit.

When and where does Me.dium become a profitable business?

Working on setting that meeting right now. I’ll shoot over the coordinates and meet you there! :)

In all seriousness, were working hard to package the data that our users share in a valuable way right now. Based on all market data we have, it’s not too far out at the moment. The key for us will be making sure that our users know how we are creating value with their shared data so the process is clear and users know exactly what we are getting in return for whatever they choose to share with us.

As far as Firefox extensions go, what separates Me.dium from the rest of the pack as a must have addon to any browser?

That’s an easy one. Today’s browsing experience is simply way too solitary. Me.dium makes the entire web social. By connecting you in real time to all your friends online, Me.dium is the only way to get all the benefits of your social interactions from the real world in your online world.

Unlike social networks, Me.dium isn’t just a collection of pages where you post information about yourself and send your friends messages. Me.dium is a social browsing add-on that transforms the entire web into a social experience. Navigate around the entire web with people you care about. Bump into your friends and interact with the crowds, wherever they are.

Me.dium allows you to truly surf with friends for the first time:

• Watch YouTube vids together and share them with your friends in real time.
• Cruise Flickr or Facebook pics with your friends.
• Cruise the best shopping sites and shop together like your in the store with your friends.

Surfing the web has been a private and solitary activity for too long. Just like in the real world, you have more fun when you can share your experiences with friends. Me.dium has redefined what it means to surf the web by bringing you and your friends together in a true social experience. That’s what separates Me.dium from the rest of the pack.

What is the difference between Adblock and Adblock Plus?

Well, usually that’s the point where I send people to the FAQ: http://adblockplus.org/en/faq_project#adblock

Adblock is very outdated, it hasn’t been updated for a while. There is a bunch of ways that web sites can detect Adblock, there is also a bunch of ways that web sites can prevent their ads from being blocked – no such security holes exist in Adblock Plus to my knowledge.

Adblock is full of UI inconsistencies, I tried to eliminate those as much as possible. One extremely important Adblock Plus feature is filter subscriptions – you can subscribe to a filter list maintained by somebody else and just forget about the ads. In Adblock you have to use Filterset.G Updater if you don’t want to write the filters yourself – not the perfect choice if compared to some subscriptions available for Adblock Plus. Finally, I put lots of effort into making Adblock Plus efficient and into avoiding website breakage – both points that were never considered in Adblock development.

That’s only the big differences I can give you off the top of my head.

Have you ever been approached by any of the advertising businesses offering to pay you briefcases full of money to stop what your doing?

LOL – No, I am not that important yet, the advertising industry cares very little about Adblock Plus. It is mostly owners of small websites who care – and suspect that they would earn millions if it weren’t for Adblock Plus. But those would never pay.

How much of your daily life has Adblock Plus taken over? Do you have time for other projects and work or is it Adblock on your mind 24/7?

I have my day job as well, you know? :)

I don’t have any constant amount of time per day that I spend on Adblock Plus. Sometimes I actually used to spend a few days on Adblock Plus only though mostly it wasn’t more than 2-3 hours per day. Recently however other things have taken over so that now I only spend maybe 4 hours on Adblock Plus per week – barely enough to maintain the project yet not enough to develop it further. I hope that I will have more time for it again soon.

As far as development goes, have you done all that can be done or are you still looking at improvements that can be made to the product for future releases?

I haven’t even started. There is very much that can be done. Something that I hope to see happen in the nearest future is a community-driven filter database that will allow classification of filters, and that in turn should allow users to choose which types of filters they want to subscribe to (e.g. graphical ads but not text ads). Something else that is in discussion is a set of rules for “acceptable advertising” and the ways how a “certification” of ad servers according to these rules can work – users would be able to configure Adblock Plus to not block these ads then.

What is the best way for normal everyday users to help with the development of Adblock Plus?

Testing Adblock Plus (also development builds) and reporting bugs is something where I can never get enough help. In particular testing in less popular applications (Songbird, K-Meleon etc) is where we have issues right now. Helping other users (forums) is another area where everybody can contribute.

I have to point to the FAQ here again:

http://adblockplus.org/en/faq_project#contribute

I want to thank Wladimir Palant for taking time out to talk with me here, and please be sure to check out Adblock Plus if you haven’t done so already. I think if there was an extention hall of fame for Firefox – Wladimir’s contribution would definitely belong.

The Mozilla Digital Memory Bank has announced the launch of a new weekly podcast featuring snippets from the memory bank’s audio content.

Organized a few years ago by the Center for History and New Media, the MDMB “is a permanent, open, peer-produced digital archive of Mozilla history” that “collects and permanently preserves digital texts, images, audio, video, personal narratives, and oral histories related to Mozilla, its products, and its community of developers, testers, and users”.

The first one launched, an interview with Ben Goodger, I have not had the pleasure of listening to yet, but I have a feeling it should be interesting.

Later today Firefox will begin broadcasting, for the first time, four “fan-produced” commercials on prime time television. Initially the ads will only run in the San Francisco and Boston regions, but this will be expanded over time.

The 4 video ads are a sampling of approximately 300 clips which were submitted to Mozilla’s Firefox Flicks program. The theme of the ads is that Firefox is “the safest, fastest and most enjoyable way to experience the Web.” The ads are also partly sponsored by Firefox fans – and Mozilla will insert the names of those sponsors at the end of each commercial.

+ Read More of the Interview With Asa Dotzler!

How was the cake from MS?

Chris: It was a nice surprise actually, and we think it’s great that Microsoft is taking an interest in browser development again. Of course there wasn’t nearly enough of it to go around since there are thousands of people worldwide working together to make Firefox possible, but those of us at the Mountain View office made sure to enjoy it for everybody :) .

+ Read the Entire Interview With Chris Beard of Firefox!