bugmen0t

Any kind of sanitizer that returns a string, yeah.

> Now, we will start the VSCode server in the background at port 9000 without any authentication using the following command.

Great.

Don't let the domain name misdirect you. It works really fine in Firefox ;)

If Range doesn't require PardialOrd, I'm not sure I know what Range is at all...

FWIW, if you're using libreoffice write you can save your file as a flat odt file (.fodt), which gives you a version-controllable format

How: File an issue at https://github.com/publicsuffix/ Why: It's fun. Also, web Security testing gets easier when you have can make pages for all likely and unlikely scenarios (cross-site/domain/origin).

An invaluable resource IMHO: https://w3c.github.io/webappsec-cors-for-developers/

If you go search regularly, there are some cheap two-dot-two you’ll find that are ascii. Bit longer in string length but shorter on the wire.

I own 0e.vc, which is on GitHub as a general purpose xss domain if you need it. Iirc it does eval(window.name), or location.hash. Whatever works for you. It’s also on the public suffix list which makes it almost like a top level domain for security purposes. So I can have subdomains that can’t ever share cookies :-))

Yes. localhost is considered a Secure Context via https://w3c.github.io/webappsec-secure-contexts/#potentially... - This is intentional to testing APIs which require a Secure Context easier to use during development. E.g., ServiceWorkers.

Names of people, events, trends…

> ASCII only because it works everywhere

cries in his native language

> Some browsers, including Chrome but not Firefox, have the ability to check the amount of Javascript memory used. So the solution to test if an object is there, is to make it sufficiently large so that it has a noticeable impact on memory.

It's not observable from content, but the Firefox profiler is awesome. Check out https://profiler.firefox.com/docs/#/./memory-allocations

Feature set is obviously very different.

Pickle is a stack machine (https://en.wikipedia.org/wiki/Stack_machine). It is Turing complete. See source code and documentation at https://github.com/python/cpython/blob/master/Lib/pickle.py#... https://github.com/python/cpython/blob/master/Lib/pickletool...

N.B: "Turing complete" really means a lot less than you seem to believe.

If you want to find out yourself, I can highly suggest using the Firefox Profiler on https://profiler.firefox.com/ - amazing tool!

Given they are based on a fork of Mozilla's Gecko engine I think the real reason behind this post is that their inability to cherry-pick Web Components from Gecko.

It's likely the compatibility cost is making the browser unusable on many websites which is rendering their browser useless over time.

jitsi

Any kind of delay will turn into an annoyance.

If it doesn't, then the randomness will make it a dopamine hit / that somehow makes your brain feel rewarded. Which will lead to more terminal clearing. Not sure if that's the thing you want :-)

I'd stick with CTRL+L instead.

To think about recursion, you first have to think about recursion.

This is in Nightly. I know people often times do _not_ expect breakage, because Nightly has been pretty stable for a long time. But that's not a guarantee.

Most people will be concerned about lacking Web Extensions support. It's indeed not there yet and this is why this blog post is your heads-up to move to a more stable channel.

Web Extensions are being worked on as you can see dependent bugs linked from this meta issue in bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1582185

And FYI, for me personally the built-in tracking protection has been a decent replacement for my favorite add-ons, so I'm personally quite fine with this change :-)

Yes. This is fixed in all branches. Developer Edition is Firefox beta with a different skin. The commits at https://hg.mozilla.org/releases/mozilla-beta/ will show you that 73.0b2 has the same commit as mention elsewhere in the thread.

So this is a closed-source webkit fork? Nothing to see here, moving on then :)

Webkit a comparably easy target to strip down and embed elsewhere. See Apple watch.

That was just the first step. Firefox first had to disallow XUL/legacy extensions before they could remove APIs that others used to depend on.

I'm skeptical about trusted types. It seems very heavy and needs 100% buy-in to work.

Reminds me how CSP was seen as the glorious savior. But so far it only helps the big sites (Google, Facebook Twitter etc)

oops yes.

They just did a security update last week.

It's in page 18. If you have end-to-end encryption you can't sanitize in the client.

I mean, you're really just summarizing the presentation. It should be an API that's in the browser. It isn't. So people need to use a library. That's OK. But not great.

The text on https://use-application-dns.net/ says that it will be attempted to become a standard through the IETF. But only time will tell.

This might be encrypted too in the future. https://tools.ietf.org/html/draft-ietf-tls-esni-04

That's an issue with the f-droid build config. Maybe worth filing a bug with them and asking to change it?