bugmen0t

Always wondering if there's a standard format for the thing in emails that uses underscore, slashes, asterisks for underline, italics, bold and less/greater than for URLs. Never found it. Always thought it would be a great addition to pandoc output formats :)

I'm surprised that none of the business who are in direct competition with Google (or in fear thereof) start to contribute & make use of Gecko. It's really mind-boggling how many companies and how much money depends on the implementation of the web platform. Why would you use the one that is always acting in Google's interest? For mobile apps, GeckoView should be an interesting replacement of other webviews.

> We did a hacky image analysis with ImageMagick to survey favicon colors. Here is the dominant color breakdown across our favicons. This isn’t very accurate, unfortunately. I suspect that many multicolored favicons are getting lumped in with purple.

Writing or reviewing a sentence like this should make you reconsider. Either do the right analysis or remove this from your article. But when you say your analysis is probably wrong and the results look weird, then why publish as is?

The intent is to shift the responsibility to the browser. Decades worth of userspace solution have failed us. The browser is pretty good at HTML parsing.

If you sanitize on the server, you are sanitizing for a theoretical browser and how _you_ might think it parse HTML. Any kind of parsing ambiguity will lead to XSS.

That's why you should be using an API that relies on the browser's parser.

The pur is to further the mission of the nonprofit, i.e., an open interoperable web. All money earned stays within Mozilla.

In contrast to all other browser products, whose main purpose is increasing share holder value.

HEEx looks awesome. How does compilation work? Does it properly & contextually encode/escape to avoid XSS? I'd love to learn more about the inner workings.

It's very easy to "make it work" while fencing with compiler warnings by just copying things around instead of developing a clear sense of memory ownership. I've seen myself fall into this trap. The upside, coming from C, is that you don't have terrible memory safety issues. The downside is that you have the same data copied all over the place and (accidentally) allocate like a mad man. Managed memory is not inherently bad or good.

There is no options for non-standard ports, but you may perform a local scan using https://github.com/mozilla/observatory-cli

Regardless of the motivation behind this change, bear in mind in whose interest the company and browser is working: The shareholders.

I can only think of one high-quality browser that belongs to a non profit. Mozilla Firefox. All money earned with it goes back to the browser. Sure, I’ve heard that executive may have been paid a subjectively “too high” salary and however true that may be: So far, no Executive who would actively question the mission and the core privacy principles has been able to stay for long.

The web is the most open, most unowned application platform out there. It’s too important for single-vendor control.

Have you heard of https://deprecate.it/? :)

Note that a hash collision is not the same as a pre-image attack. Though it seems to me that finding the latter is also feasible.

Did they remove it due to low usage numbers? Turns out those "few users" are big aggregator scripts and proxies for hundreds, thousands users each :)

Example: https://twitter.com/intenttoship/

And Firefox

My home town is too small to have a zoo. I bought a domain that makes it look like there is, which makes me proud owner of the veterinarian@ email address. I also had a lot of fun taking a free design template and combine it with Creative Commons zoo animal photos.

True, that was somehow expected as obvious characteristics when writing this down. There is now an issue on the spec at https://github.com/w3c/webappsec-subresource-integrity/issue...

The reasonable approach is to listen for error events of such scripts and switch the `src` to a self-hosted fallback URL.

Hi. Firefox developer speaking here. Feel free to take a look at https://wiki.mozilla.org/Release_Management/Release_Process and https://aosabook.org/en/ffreleng.html. The latter is quite outdated but some core assumptions are still valid. Our CI is hosted at https://treeherder.mozilla.org/jobs?repo=autoland . Every patch that is uploaded will be tested before and after it goes into a branch. Firefox Nightly ships directly from that branch. The changes will be "promoted" to Beta (and subsequently Release) every four weeks. Our community hangs out on Matrix and is very Open to newcomer questions and other contributors. In fact, we Vene have an introduction channel and list good first bugs on bugzilla (searchable through something called "Codetribute")

Not to be confused with https://en.wikipedia.org/wiki/OpenSearch.

Your post seems more nationalist than anything else.

I’ve worked at a geo-distributed company for a long while and let me tell you: The diversity of viewpoints and experiences will make your teams stronger, happier and more resilient. That culture needs to be consciously built though. That won’t happen in and of itself. But it’s so, so worth it.

To anyone else reading this: Don’t buy into the "us versus them" rhetoric. It will lead you down a dark path.

Reminder that Firefox is most easily customized through Firefox Color at https://color.firefox.com/

slack

Why? It has auto updates for a long while now. Honestly, I've received auto update notification by emails more often before I see any blog posts or news article about the vulnerability itself. I agree it used to be worse, but this? This is awesome.

The definition of site in this case is <https://html.spec.whatwg.org/multipage/origin.html#sites>, for both Firefox and Chrome. If you don't like reading specs, this blog post might be interesting to you <https://web.dev/same-site-same-origin/>.

The concept of a Site is defined here https://html.spec.whatwg.org/multipage/origin.html#sites

It's basically an origin, but disregarding subdomains.

It would be if an (advertisement) iframe did, no?

Is there a guide for switching from gpg on the cli to sq? Specifically, I'm not sure how to move keys from my gpg keyring to sq.

Nice work! A colleague of mine did a similar thing in 2014 but it bitrotted terribly. Code is at https://github.com/tOkeshu/bananaphone. Great to see some alternatives popping up!

He presented it at a mini conference in Berlin: https://www.youtube.com/watch?v=pyIIkUV3moM&list=PL37ZVnwpes...

Most notable change: new privacy protections! https://blog.mozilla.org/security/2021/01/26/supercookie-pro...

You need defaults, and that default is an allow-list of sane HTML. If you want, you can initialize DOMPurify with your own allow-list, that might just be the bold, italics, underline, strikethrough.

The fact that their list is not namespace-specific is a bigger issue imo.