The I/O Tower

Trading Liberty For Security

2011-01-17T14:03:00.000-08:00

Ben Franklin notwithstanding^*, you can sometimes find an acceptable trade-off between liberty and security. A friend just had her Twitter account hacked and used for spam, an occurrence I've seen increasingly frequently over the last year. So, just a suggestion, but if you're the sort of person who has chosen an easy-to-remember password and used it on multiple sites... just stop. Now.

Look, I know it's not easy. A year ago, I was as guilty as you, but I have since repented my sins. I made a New Years Resolution last year was to secure my online presence. It took the better part of a year to do it, but by mid-December I was glad I had. Otherwise, whomever hacked Gawker Media would have potentially had access to my accounts on Facebook, Twitter, Tumblr and a host of other social networking and blogging sites. My financial data would have been safe, as I kept a second password for all of that, but just imagine what could happen if that password had been compromised.

The secret to creating a secure password is to find one that satisfies three criteria: it needs to be strong, memorable and unique. Strength in this case is measured in terms of it's resistance to combinatory attacks; the less likely you are to have chosen a particular sequence of characters, the stronger it is. Memorability prevents you from needing to store passwords insecurely or request frequent resets. Uniqueness guarantees that when (not if) one site is compromised, others will remain secure.

The easiest way to choose a strong password is to choose a combination of upper- and lower-case letters that do not make up recognizable words, then throw in a bit of random punctuation and a few numbers. Of course, choosing a password by banging on keys would sacrifice memorability, and while you might be able to remember one arbitrary string of characters it would be impossible to keep your passwords unique for multiple sites.

The trick I used to balance the three competing goals was to use a pattern to generate passwords that were strong, memorable and unique. The method I use is based on a suggestion I read in this Lifehacker article, but if you really want to geek out you should read this post by Hans Anderson. I may eventually upgrade to a more complicated pattern, but for the moment anything is better than my previous two-password system.

As long as you're updating all your passwords anyway, might I suggest upgrading your password vault as well? Almost everyone saves passwords in their browsers these days, which is fine insofar as it goes. The assumption is that if your computer is lost or stolen, you'll need to change all your passwords anyway (and most likely all your financial data, maybe even your SSN just to be safe). However, once you find yourself storing them in your work computer, your girlfriend's computer, your laptop... well, obviously the risks multiply. While I was updating my passwords, I began storing them at a site called LastPass^**. Having a secure online password vault would be useful enough, but its the browser plug-ins that really sold me. It's the closest thing I've found to single sign-on for the internet. If you're the sort of person that worries about rogue corporations selling your passwords to the highest bidder or whatever, I'm told that Keepass offers an open-source alternative, but I'm too cynical to follow politics these days so I'm more familiar with the one with the prettiest user interface.

So that's it, my whole secret to a more secure life. Use it when you sign up for new sites, spend an hour a night for a few weeks updating your existing passwords, go forth and sin no more. I know the whole thing seems like a pain in the ass now, but I bet you'll feel pretty stupid when all your Facebook friends start getting porn spam from you.^***

^* Actually, Franklin opposed trading liberty for "temporary safety", but then what other kind is there?
^** Thanks for the recommendation if you're reading this, Adrienne ;)
^*** Note that these suggestions do not necessarily apply to those who already use their Facebook account to send porn spam.

Google Case File IOT03 :: New Reminders

2007-05-08T20:04:00.000-07:00

This totally rocks. I live my life by reminders from Google Calendar and Remember The Milk. RTM had all the advantages in this regard, giving me options for email, mobile and a half-dozen chat options for reminders. But GCal is catching up... check it out:

Options for reminders are only email and pop-up right now, but as soon as GTalk is on that drop-down I'm a happy camper. And if they would ever give me options for reminders beyond one week I would be eternally grateful. Can you hear me Google?

[This Just In: I'm always the last to the party. This is what I get for falling days behind on my feeds.]

The Coolest Thing Ever :: TwitterA Little Bird Told Me...

2007-01-09T21:18:00.000-08:00

One of the best things about living in the mid-west is that it is so incredibly simple to stay on the bleeding edge of technology. The hard part is often dragging a bunch of friends with me so that I'm not lonely out there. Of course, then I suddenly have more friends on My Friend Degrees than in real life, and its no longer the edge, let alone bleeding.

But I digress.

My point is that St. Louis is a great place to be a lazy trend-setter. All you have to do is read some press from the Coasts, check in with Chicago people every once in a while, and keep a vague eye on what's cool in London and Berlin. Then hit the bong a couple dozen times and forget all that. Follow this by siting on your ass for six months until you feel like just can't avoid work any longer, and then hope the URL suddenly springs unbidden into your consciousness.

follow owenj23 at http://twitter.com

This is approximately the story of how I started using Twitter last weekend. All the tech-toy cool kids out on the Left Coast have been using it for months, talking about how it makes them feel connected even when they can't see friends for months at a time. My initial reaction was envy; I often wish I could not see my friends for months at a time. I even spared a moment of jealousy for the bong hits those hippies must have been doing.

The Master Plan behind Twitter is to give your friends, associates, digital stalkers and illicit love interests an easy way to keep up with what you're doing. At first glance it seemed like it would have to be a huge pain in the ass in both directions. First, who the hell would bother to keep it updated. Second, who's going to remember to check some website to find out what I'm doing.

Of course, since then I've started spending more time on the whole "Blogging in my Blog cuz I'm a Blogger" thing. I've also managed to reduce most of my inter-personal communications to one or two line text messages, often accompanied by an emoticon*. And I've been told that my best artistic endeavors are often found in my status message on Google Talk.

Anyway, it turns out that the whole thing is much more zero-interface than I would have thought. Of course, there's the web view, which is very much boring-in-a-good-way but has been primary useful as only when telling someone about the site, or blogging about it. The ideal way to use Twitter is via text. You can send in updates, check on your friends, and even nudge others to update either by SMS (text message) or IM (chat). You can also have Twitter send you notifications of your friends' updates by either of those methods, although I don't recommend the SMS notifications if you're paying for text messages.

When I created my account last weekend, I registered both my phone and my Google Talk account and the whole process took about five minutes. The longest part was waiting for Google Talk to catch up after I added twitter@twitter.com. Since then, whenever I'm bored, I've been updating it with whatever I'm doing, thinking about, or banging my head against. I've set my notifications to come in via IM as well, so I see my friends' updates in the same window. If I get busy and don't want to be bothered, sending the text off turns off notifications. After that, I can either get recent updates from friends with get or get username or just turn notifications back on. Oh, and if I'm wondering what someone is doing, nudge username will prod them into action (sometimes, depending on the person).

Of course, the same should work with any chat client, but if you're not into IM the any phone with SMS capability will do. I'd probably leave notifications off quite a bit more often if I was doing it that way, and (particularly if I had to pay for text messages - poor L-a) I might update once or twice a day at most. Still, if that were my case I think I might value it more in some ways, since I'd have less chance to just talk for entertainment purposes.

My advise? Go sign up, check it out for a few days. The process is brief and, although you are giving up email, IM and cell phone. I'm not worried, as I expect the privacy policy to hold given the pedigree of the founders, Obvious Corp, who also created Odeo and (most recently) Hellodeo.

Oh, and when you do, hit my page and click the Add Oliver Wendell Jones button on the left. You may even be able to just Add Me To Twitter with this link, once you're signed up. Then let me know at owenj23-at-gmail-dot-com, in case I don't notice right away. I haven't found enough people on there yet to really be sure how the friend notifications work; that's why I need my loyal readers to help me learn. Let me know if anyone is trying and has trouble; I started to take some screenshots to write a step-by-step, but it seemed intuitive enough to me that I didn't complete the effort.

*While this isn't quite true, I do sometimes go in another room so I can argue with The Brat via GTalk. Trust me, it's easier that way.

Google Case File IOT02: Case of the Unread Items

2007-01-08T22:19:00.000-08:00

As I've mentioned before, one of the reasons I drank the Google Kool-Aid a long time ago is that they have some of the only software so complex that it regularly exhibits behavior that I simply can't explain. I have this pet theory (or maybe I read it somewhere) that Google has developed into the first networked intelligence. I know more, but fear Blogger would only delete my post if I were to publish it.

But I digress.

For today, let's just take the case of my Topher's linkblog. Topher has been following my linkblog for a while now; frequently I convince him to try a service shortly after I declare it The Coolest Thing Ever, and Google Reader was not a hard sell after it's incredible upgrades last year. Of course, as soon as I set him up I subscribed to his Shared Items feed, but for a while he didn't use them much. Recently however, he decided to emulate my for- tags and share a for-me feed (no, I'm not linking to that... god only knows what that boy might send me). That's when things got weird.

It seems that two items in his shared feed and one in his for-me feed just refused to become unread in my Google Reader. Eventually we traced the for-me item down to an old post regarding a Mythbusters bloopers reel on Youtube [Ed Note: can't find the link right now, ironically -- Topher?], and once he removed it my Reader returned to normal for that feed. The Shared Items problem was more recalcitrant, however, and even GReader admitted there was a problem:

Now obviously this is not particularly a usability issue, at least not for me. It does however trigger my OCDUI tendencies, which made me investigate further. It seem that if I go to the home screen, It will actually show me the two "unread" items:

Funny thing is, these are both links I'd seen before, on feeds that I read, and I'm pretty sure that I shared one or both of them. Not that I can find them now, of course; as has been lamented in nearly every forum on Earth, the lack of search in GReader is deplorable. And while the Google Co-op Hack and ensuing Greasemonkey script are cool, they don't really excuse it. I really have to think that some company out there must have the necessary technology to index large amounts of text for quick searching by many users at a time. If only Google could partner with them...

Anyway, it seems likely that once I tell Topher what items are bugging the system, [Ed Note: it's the XKCD Katamari comic and the Lifehacker DIY Warhol, if you're curious.] he'll be able to remove them fairly easily. Which still raises the question, where and how did the wires get crossed?

I suppose I'm pretty unlikely to find out, and knowing Google the entire issue will completely disappear with absolutely no warning nor fanfare by about half past whenever. Still, it's curious. Is anyone else using Google Reader to subscribe to Topher's Shared Items? Do you see the same behavior. Let me know...

[Another Ed. Note: Special thanks to CyberWare, which pointed me to FastStone Capture for the screenshots above. Beautiful piece of software. Installed in about 60 seconds, worked immediately, almost zero-interface and it sits in the system tray when I don't want it. Oh yeah, and it's free.]

Project Description: Blogroll Widget

2007-01-02T21:08:00.000-08:00

I've been wanting to build one of them thar Web 2.0 Widget Thingamabobs for a while now. The problem, of course, is that almost everything has been done. Not always to my specifications, of course, but often close enough to let the laziness factor kick in. However, I have yet to find a Blogroll Widget of any sort that will satisfy my theoretical use case, and it seems like it should be easy enough to design.

Here's my plan: I'd like to auto-generate the blogroll by querying my del.icio.us account, perhaps for the tags iot+blogroll for this blog or cas+blogroll for Cheating At Solitaire, my poker blog. From what I understand, having not yet looked at the API, this should be a trivial implementation. However, I'd like to go a step further, adding the ability to add meta-data such as feed or author links. I think this could be accomplished by embedding formatted text in the description field, although that may violate a TOS or something. A preferable method would involve tagging additional links with the same title and iot+blogroll+feed, for example. I'm not sure if their querying structure will support that, however.

It seems to me to using del.icio.us as a back end for this sort of thing would allow the ability to insert one of those little buttons on your page that would allow others to automatically add you to their blogrolls. You could even add such a thing directly to your feeds, if you use a service such as Feedburner. Obviously, the real Web 2.0 way to do this would be to announce a startup called iBlogRoll.com or MyBlogBuddies or something and then try to get VC funding prior to actually writing a line of code. And of course, I may still do that... hmm, wonder if someone has already snapped up those domains?

Anyway, I'm not sure if or when I'll get time to work on this, but I thought it might be a good idea to get the project notes down while I'm still high and think that I can accomplish something. Later, once I realize that I'm nearly completely useless, I'll feel properly embarrassed about posting this I'm sure.

Fast Firefox Fix Found

2006-12-27T08:44:00.000-08:00

It's no secret that Firefox is a memory-leak hydra: every time the development team fixes one, two more spring up to take it's place. Build a large enough application and you're guaranteed to drop a few pointers here and there, and once you add in a Javascript engine, Chrome interfaces and a half-dozen or more extensions you might as well throw in the towel on your leak analyzer. This is the one area that Internet Explorer will always surpass Firefox. When you package most of your functionality as an integral part of the OS, your memory leaks are either found quickly or so deeply buried that you'd have to move Jimmy Hoffa to find them.

On the other hand, Microsoft Visual Studio 2005 leaks like a sieve, but it's the most helpful development environment I've ever seen. Perhaps memory leaks are found due to usefulness the way security flaws stem from popularity. That theory would conveniently explain the balance of bugs in Microsoft's OS code. But I digress.

There are some people (whose initials may be BMW) that will tell you that the best solution for this problem is to never install Firefox on a Microsoft OS. These are usually the same sort of people who still prefer vi to a text editor. Personally I'm not one to give up functionality for the sake of form, but what can a resource-constrained power-surfer do?

Well, the traditional method of freeing up resources lost to a leak is to restart the application. Back in the old days (like, three months ago) this was a major pain, involving bookmarking or finishing any open tabs, logging in to sites again and losing any form data that you might have entered on any open pages. Of course, there were extensions to fix any of those problems, but often they were a cause of the very problems you were trying to fix.

Thankfully, Firefox 2 fixed all that. I don't even want to know that you haven't updated yet, just go do it now. I'll wait. Anyway, Firefox 2 includes a crash recovery mode that can restore your entire session, usually without reloading the pages. Of course, this doesn't happen when you voluntarily close the browser, but you can see it in action when you install an extension. In fact, I suggest you check it out right now. Go install the Restarter extension from from the add-ons site. Once you've clicked the Install button (after the standard five-second penance), the Extension Manager will open to show the progress. Installing this tiny extension will probably take less time than the install delay. Once it's done, notice the Restart button? Click it. Go ahead, I'm patient.

That served two purposes. First, you have now seen the session restore function at work. Until now, the only way to trigger that as a user was after installing an extension. However, the tiny little extension that you just installed added an item to your File menu. At the bottom, just above Exit, there is now a Restart Firefox option. This will do exactly what the Restart button just did for you, so you can try this whenever the browser seems to have gotten bloated and slow.

This is far more convenient than a restart used to be, and it is guaranteed to free up any leaked memory, but it's still not always convenient. It's like rebooting the computer, almost guaranteed to fix the problem but sometimes like chasing a fly with a baseball bat. However, I found a potentially more useful tweak today in a post on Cybernet, which I found via Lifehacker's Best of April 2006. Here's what to do:

Highlight the words config.trim_on_minimize and copy them to the clipboard.
Open a new tab and type about:config in the address bar. This will display a page of Firefox's internal configuration values.
Right-click anywhere on the page and select New -> Boolean from the context menu.
Paste the copied text from above into the input box that appears and hit enter. Yes, you can type it if you'd prefer, I just found cut-and-paste more convenient.
Select true as the value and click the OK button, then go to the File menu and click that new Restart Firefox option we just added.

So what did this accomplish? Well, now Firefox will unload most of itself from memory each time you minimize it. In my experiments, it went down to between 7M and 8M, from it's average of 40M to 50M (too many extensions loaded). Your results may (and probably will) vary, but from what I've been able to determine, at least some leaked memory is regained after you maximize the application. At the very least, you can free up a big chunk of system resources while you're doing something else without having to close the browser. This is a must for any serial tab abuser like myself, as well as anyone running on an ancient and/or overloaded system. I'm looking at you, Kare-Bear... just follow the instructions, you'll thank me later.

Google Feeds My Neuroses

2006-12-07T16:52:00.000-08:00

[Ed Note: Just another post that felt isolated and alone back in the old one-blog days.]

Just a random bit of Google weirdness that left me wondering who exactly was getting high last night.

Results of Google search for flickr+feed+viewer (Wednesday 2006-12-06 c.11:00pm CST)
How did this patent application become the top result?

This is the patent application in question. It does not contains 'flickr', 'feed' or 'viewer'.
The URL is a doozy, you'll have to scroll to see it all.

Results of Google search for flickr+feed+viewer (Wednesday 2006-12-07 c.11:00pm CST).
The next day it's gone. But...

While this is on 'flickr' and it does have a 'feed', still no 'viewer'. And not exactly relevant either.

I'm not sure why this sort of thing fascinates/annoys me so greatly. Some part of my brain wants more weird data points like this, thinking that if it had enough outliers I would understand Google's algorithm or something. Of course, if I could correlate that many data points I probably wouldn't need a search engine as much.

Then again, this could be an artifact of someone gaming the algorithm. Maybe some private Google-bomb or black-hat SEO is trying to screw with the search term Flickr? Or maybe Google is messing with the term internally now that Yahoo owns them.

I need to find the Google-equivalent of Fox Mulder to investigate this for me. Anyone have any wild theories?

HOW-TO: Make BlackBerry Internet Service Work With GMail (again)

2006-11-02T08:18:00.000-08:00

[Ed. Note: Another old post moved from my personal blog because I'm OCD.]

[Ed. Note - A few people have pointed out that Google just released a Gmail client for mobiles, and BlackBerry is one of the supported devices. I just installed this morning, and yeah, it totally rocks. While it may actually be faster and easier to view and reply to messages via the app, it can't replace the satisfying chirp my BB gives when a message comes in. For that, the instructions below are still useful.]

While I'm not sure what the official stance of RIM is, let alone other carriers, it became apparent through multiple rounds of calls with T-Mobile "Customer Care" that they are no longer required to Care when their Customer's Gmail stops being picked up by BlackBerry Internet Service. Phrases like "it might help if" and "it's about 50/50" and "we do not guarantee service" were mixed liberally with "it works on mine" and "I use it all the time." Armed with this knowledge, as well as a fierce determination honed by hours of hold music, hang-ups, and one threatened arrest, I found my own solution.

The following procedure has been tested on my device, and on the device of one guy I found on BlackBerry Forums who was having the same problem. I'm planning on posting a link to this in a few places, so if you try it for yourself let me know the results.

Step 1 Log in to My T-Mobile (or, well, your T-Mobile to be precise). Click the "Set Up BlackBerry Internet Email" and click it. From there you will be presented with a list of all your email addresses. You'll need to click that little trash-can icon next to each of them, or at least each that is not working. NOTE: You'll lose any filters you have set up, so you may want to make a note of them for later.

Step 2 On your BlackBerry, go to Options->Advanced Options->Service Book. (I think the menu location is different for this on older models. Anyone know?) Delete the service books for all email accounts (you'll recognize them by your email address followed by [CMIME]). Yes, even the entries for the ones that are still working. On the Pearl, this is accomplished by highlighting the entry, pushing the menu button, and selecting delete. YMMV.

Step 3 Meanwhile, Back On The Web: Log in to your Gmail account and click "Settings" in the upper right corner. Select the "Forwarding And POP" tab. In the "POP Download" section, select the radio button labeled "Disable POP" and then click Save Changes.

There, you're done. You've now guaranteed that you will never receive Gmail on your BlackBerry. Oh wait... that's not where we were going, was it. *sigh*

Step 4 Now we're on the comeback trail. Go back to your T-Mobile account (I hope you're using Firefox, or at least IE7's tabs) and click the "Service Books" link on the left. Click the little pink button to "Send Service Books" to your phone. This will ensure that any accounts you have no deleted get set up on the BlackBerry correctly, and seems to be an important step in this process. Roger Ebert of The Chicago Sun-Times says, "If you follow only one step this tutorial, Step 4 is the one to follow."

Step 5 Back to Gmail again. I hope you're still in Settings->Forwarding and POP, as it is time to turn POP back on. Select the radio button that says "Enable POP only for mail that arrives from now on" and click Save Changes. It seems to be important that you select this option, rather than "all mail", even if you really really want your old mail on your device. Trust me, it's gone. It's just gone. Answer it from the Gmail app and move on with your life.

Step 6 And hopefully the last one. On the T-Mobile site, go back to Email Accounts. Click "Setup Account" and enter your Gmail address (including the '@gmail.com') and password (twice). A quick click on the Next button and you should be done. For all their talk of not supporting Gmail, they obviously know the IP for the POP server (which they claim does not exist). You should get an activation message on your BlackBerry within a few minutes. If you do not, delete and resend your service books once again - for instructions see Step 2 and Step 3 above. That bit seemed necessary for me, but not for the other user who tried it, so again let me know if you follow these steps what happens for you.

So there it is. As I said, let me know if you try this, what the results are, and if I missed or mis-stated. If you're having similar problems but do not use T-Mobile, I suspect that similar steps may work for you, but you'll obviously have to figure out your provider's interface yourself.

I have no idea yet how often this process might have to be repeated. I've tried everything I could think of to re-break my Gmail POP access and have not yet had any luck, so I still can't guess what caused the problem initially or when it might recur. Any further data on this would be appreciated.

Midnight In The Garden Of Pumpkin And Squash

2006-10-31T21:03:00.000-08:00

[Ed. Note: Moved from personal blog due to content.]

It's still nearly three hours until The Great Pumpkin should be arriving, but as always it's getting cold, and boring, and a little bit lonely here in the pumpkin patch. I've been having blog troubles recently, not so much with writing as with not writing. Well, and finishing... that's kind of a bitch too. I wish there was some way I could publish a post in beta. Of course, with no readers it doesn't much matter what I post, let alone whether I post. On the other hand, I kind of expect that sooner or later, I'll pick up a few regulars. I can't possibly be the only person who uses Google Reader to stalk my friends and idols... and if I am the only one, I'm about half-way through writing a primer on setting it up for yourself.

I can't be expected to finish any of these things until at least this weekend, however, as I have to stop writing every 10 to 15 minutes so I can play with my new toy. The Pearl is pretty -- too damned pretty, according to this article by Jack Kapica in The Globe And Mail, which suggests that if I was a Real Man I'd buy a RAZR. And perhaps he's right, because I haven't shaved in days. Not to mention the fact that some very sexy, very rich little girls have been shot while holding lately.

However, I think this picture of my k-rad case mod should prove that I'm at least a Real Nerd. It seems that my new toy is so much smaller than the old one that it slides right past the sensor. However, through painstaking moments of looking around on my desk, I discovered that the cap from a Sanford Uni-Gel Medium (seen here in stylish ~~red~~ Crimson Dash) is the perfect size to trigger the sensor. And they thought they could make me buy a new case? I feel all MacGyver, like I should send this in to the MAKE blog or something. Probably soon, before the Pearl slides out of this oversized case and I never see it again.

I had written a review of Performancing v1.3, which is a Firefox extension designed to make blogging easier. Unfortunately, I made the mistake of using the software to review itself and once it became aware that my opinion was somewhat luke-warm it promptly deleted the post. Prior to hating it with a passion, however, I truly didn't think it was all bad. My problems are almost certainly because I'm using Blogger beta, and a dev build of Performancing that was designed to work with the beta but has not been fully tested. I'll probably check it out again once the Blogger changes stabilize.

HOW-TO: Modify an extension to install under Firefox 2.0

2006-10-24T23:01:00.000-07:00

[Ed. Note: Moving posts from my personal blog due to content considerations.]

The following steps have been tested on the del.icio.us Firefox extension. I read in this post by David Findlay that the extension seemed to work fine in Firefox 2.0 despite it's maxversion property. I attempted to follow the steps therein, but was too impatient and failed to wait for the second restart before giving up and uninstalling.

Due to my massive del.icio.us addiction, however, I had to invest a bit more effort. Creating XPI Installer Modules on the Mozilla Developers Center was extremely helpful, and a little guesswork led to the following procedure.

Step 1: Download the XPI file by right-clicking on the link (usually a big button that says something like "Install Now") and selecting "Save Link As..."
Step 2: XPI files are (conveniently) nothing more than specifically ordered ZIP files it turns out, so you can open them with just about any compression utility. I use IZArc out of habit and because it's free, but most any would do. You might even be able to do it from Windows without any special software if you want to badly enough. Whatever your preference is, right click on the XPI in explorer and use "Open With..." to view the contents of the file.
Step 3: In the root directory will be a file named install.rdf. If your compression utility allows you to edit files in-place within the XPI, open it up from there. Otherwise, extract the file and open it with any text editor. I'm a big fan of EditPad Lite because (again) it's free and knows how to deal with *nix carriage returns, but even notepad.exe will do fine for this.
Step 4: Find the line that says something like 1.5.0.* or and change the value to "2.0.*".
Step 5: If you had to extract the file to edit it, go back into the archive and delete install.rdf, then add your modified file. If you made your changes in-place, you can just save the file.
Step 6: If there is a folder labeled META-INF in the XPI, delete it. This contains the signature information for the extension, but it will no longer match since you made changes. However, it doesn't seem like much of a stretch to trust this particular unsigned XPI, since you just unsigned it.
Step 7: Do whatever you need to do to make sure changes to the XPI are saved, then close your compression utility.
Step 8: Right click on the XPI file, select "Open With...", then choose Firefox from the list. Click the Install button, Restart Firefox, and you're good to go.

Hope this works for everyone, it seems like a fairly easy procedure. Of course, you should keep in mind that some extensions are marked incompatible for a reason. Don't do this at all if you're not comfortable crashing Firefox completely, potentially losing all of your settings, probably suffering premature baldness and possibly going to hell.

LiveBlogging The Firefox 2.0 Release

2006-10-24T15:32:00.000-07:00

[Ed. Note: Originally posted on my personal blog during a really slow period at work. Far more at home here.]

Word is that Firefox 2.0 is due to be released sometime this afternoon. Who the hell releases their software in the afternoon anyway? Are you going for that crucial after-school download market there or what? Anyway, I'm planning on playing with it as much as possible today, and I'm going to try posting results as I'm able throughout the day. Why? Hmm... nothing better to do?

9:45am For those of us saddled with day jobs at which we can fake-work by testing new software, it appears that the Firefox team really ought to change how they build URLs if they want to keep their software to themselves through the morning. You can go download it from the ftp site if you're a little clever.

9:51am My two favorite extensions, the plug-in for del.icio.us and the Tabrowser extension, are not compatible with the new version. Le sigh... I know a lot of Tabbed Browsing was included in the new version, I'll have to find my key functions in the options panel.

10:00am God I love the internets. It seems that David Findlay (whoever that is) has been kind enough to solve my problem for me. I haven't tested it yet, but this blog post gives details on how to get the del.icio.us extension working in Firefox 2.

10:27am It looks like you probably want to read David Findlay's post before you upgrade rather than after. I was unable to get it working post-install, and it looks like I may have to do some real work before I can try again. OTOH, if all it takes is a minor text edit to make it work, maybe the del.icio.us folks will get it working pretty quickly. I'd check their site before I went to too much trouble if I were you.

10:47am I miss my Tabbrowser extension. I have yet to find a way to get the search bar to open searches in a new tab.

10:56am You can configure Firefox 2 to automatically subscribe to feeds using Google Reader. Sweet. Check under Tools->Options->Feeds->Subscribe To Feed Using. Other pre-loaded options include Bloglines and My Yahoo, but I'm sure someone will figure out how to put everyone's personal favorites in there soon. Really, though, I'm pretty sure your personal favorite should be Google.

11:49am History->Recently Closed Tabs. Idiot protection for my occasional bouts of hyper-aggressive resource-releasing.

11:56am Firefox Build Engineer J. Paul Reed on why no one should do what I'm doing. Take it from me, kids, downloading pre-release software is neither safe nor a good idea. But it does beat hell out of real work.

1:13pm Just back from lunch, and David (do I know you, David?) has left a comment saying that the del.icio.us extension mod that I posted before worked for him, both at work and at home. It's possible that I was just impatient, as it apparently does not activate the first time you restart but does by the second restart. Whatever you do, it should be noted that clicking the uninstall button is not a good idea under any circumstances if you want to get it to work later. Trust me.

1:32pm Cool new feature: there's a Restart Firefox button after you install an extension. I used to have an extension installed that did this, but it stopped working due to some versioning problem with the Firefox 1.5.0.x Extension Manager. I may yet add it anyway, if the trickery I'm trying now works out.

1:37pm Been using the new version for hours now, and I just noticed the form spell-checker. Of course, I noticed it because it believes that I misspelled "versioning" above, but I'll give it a pass because it's a neat feature. Apparently I could, if it bugged me enough, right click on this (or any) text box and turn spell-checking off for that control. I wonder if there's a way to add words to the dictionary?

1:40pm Super-cool. The "Restart Firefox" button re-opens any tabs. Didn't check if it will re-open multiple windows as well, but I bet it does. Oh, and my XPI hack seems to have worked to re-install the del.icio.us extension. I'll write it up in a minute, once I've tested a bit more.

2:49pm The Restart Firefox extension I mentioned earlier installs just fine, despite the fact that the minversion and maxversion properties in the install.rdf file are both set to 1.4. It didn't work under 1.5.0.*, and I really don't understand why it would work now. Any help?

2:52 pm It works even better than before, too. Just like the "Restart Firefox" button in the extension manager, it re-opens tabs. Again I'm too lazy to test with multiple windows.

3:32 pm Just posted the instructions for modifying the del.icio.us XPI in a separate entry. Not sure, but it looks like they may have already taken care of this in their posted install. I'm leaving work now, but more later once I start breaking shit at home.

7:24pm Take a few hours off and the whole world changes. The good news is, the release is now official, so you can disregard any earlier ~~whinings~~ warnings you received about pre-release software and download it now. The other good news is that updates came out for del.icio.us, Tabbrowser Preferences and Greasemonkey to keep them compatible with 2.0. I doubt that any of these updates did much more than update the maxversion property as I described, at least they are now official.

7:49pm I guess it kind of looks like I was wasting my time earlier trying to update them myself, but that wasn't really the point. I did learn a lot about how extensions are put together, and I got a comment from someone I don't even know. I did have two extensions installed that have not yet been updated for 2.0. The openselectedlinks extension didn't update, but I just uninstalled since my primary use for it has been supplanted since I found DownThemAll! (which did update). Feedview is a really cool little extension that formats the display of an RSS feed, but I went ahead and uninstalled it so I could see the supposed improvements in FF2's RSS display.

7:59pm Firefox relaunched their Recommended ~~Extensions~~ Add-Ons page along with the new version, and TechCrunch compares the new 20 to the old 11 to find the winners and losers. I've been waiting for 2.0 to come out to publish my own recommended list, so expect to see that as soon as I can remember to start calling them Add-Ons instead of extensions.

9:37pm I just installed a nice little extension called TinyMenu which (with a little bit of work) let me entirely eliminate one of the standard toolbars from my life. I got the details from the LifeHacker Download of the Day article, you probably should too.