kumar303

Is this dark magic? :) How does it do oauth without a domain? If you build an apk for Android how does the authentication step grant your app an oauth token?

Does it use a shared firebase server to grant access? If so, how is that secure between unrelated firebase apps?

I tried the demo but it didn't work when running file://.../index.html. The login buttons did nothing.

Actually, to many people harassment isn't a serious thing. It's just a "casual" snide comment about being cute or looking hot. Many men don't realize they're making women feel uncomfortable in geek circles.

It makes me sad that HN reinforces the fact that women have a hard time participating in s/tech conferences/tech forums/g

PyCon was 20% female this year which was a remarkable milestone. Along with this milestone came an amplification of why it was so hard for PyCon to reach that milestone.

This was not an isolated issue; Titus' post provides a good summary of the general harassment women faced at PyCon http://ivory.idyll.org/blog/pycon-2013-and-codes-of-conduct....

And, yeah, blame your employer for making a poor judgement call on this. If I were you I wouldn't want to work for a place that fires people over Internet drama anyway.

Prior to this, Mozilla has been using AWSBox as a similar deploy environment for node.js https://github.com/mozilla/awsbox

I think it's a fair argument to say that one is locked into Mozilla today with our receipt protocol. However, we've designed it from the ground up to work in a decentralized manner so that other marketplaces can participate. This is the exact opposite of iOS (and to an extend, Android) where the business model relies on some premise that the customer will be locked into the platform at the minute she makes a purchase.

The point of this article was to start getting others to help us make it work for them. There is a chicken/egg problem so someone has to start somewhere.

Compare this to Chrome OS; they have not made an effort at creating a decentralized receipt format. To validate a paid app your only option is to talk to Google's web service. https://developers.google.com/chrome/web-store/docs/check_fo...

Correct. Now you have a PhoneGab app not a WebOS app :)

You can use CORS in a packaged app to talk to your own web service http://en.wikipedia.org/wiki/Cross-origin_resource_sharing or you need XHR permissions such as

"permissions": { "systemXHR": {} }

https://developer.mozilla.org/en-US/docs/Apps/App_permission... Some info

Well, WebOS did it in secret and built their own walled garden of "web" APIs, sadly. That may or may not be why it never got traction. Either way, if you built a WebOS app then it won't run anywhere else today. With Firefox OS, Mozilla at least has used standard HTML5 everywhere that it made sense to. Granted, WebOS began its design a long time ago in web years.

You also need an "always on" network to verify paid iOS or Android apps. They use web services for verification.

It's just as easy on Firefox OS. Writing a web service is not required! Mozilla provides one for you :)

BTW, both iOS and Android require servers to be available for purchase checks unless, as the app developer, you don't care about piracy (which might be legitimate for the "most people will buy it" argument).

As for JavaScript being easy to patch. Is it really easier though? You can literally copy around apk files or search for them on pirate sites to get paid Android apps for free. There are videos on youtube for how to Patch paid iOS apps with fake certs and DNS hacks.

You're talking about a phishing attack and it's actually worse for OpenID http://identity.mozilla.com/post/7669886219/how-browserid-di... Once Persona is integrated into browsers it will offer better security. BTW, the iframe is always in a pop-up for this exact reason. It's never an iframe within the context of the website that initiated the login.

It's fully distributed because the identity provider is your email domain. When joe@gmail.com logs in, gmail.com could be the only server that the system interacts with! This is described here: https://developer.mozilla.org/en-US/docs/Persona/.well-known... Gmail may or may not choose to become an identity provider. That's ok too. In that case, a secure Mozilla server (with a sane privacy policy) will broker the email verification instead and thus can vouch for the user's identity.

in 5 years many people using the web will have no idea what you're talking about when you say "browser" :)

Awesome work, Greg! You may be interested in following some of the WebRTC work around peer to peer connections http://www.w3.org/2011/04/webrtc-charter.html It's in the distant future but they need real world cases to get the APIs right.

Boot to Gecko / Firefox OS is a Gecko based mobile OS. However, the open apps platform we're building lets you run an HTML5 app on, well, any HTML5 device including Chrome, IE9, etc.

This mostly applies to the Marketplace in how it offers paid apps; we have a decentralized receipt format to let the paid app run on any platform. Unlike any other mobile player, Mozilla is truly making the web the platform. Our platform is not Firefox OS. That's just one device to support open web apps.

I totally agree: the web does not have a decent abstract UI layer for devs to use. Help us build out Web Components! https://github.com/mozilla/x-tag

Good point, html5 has some catching up to do here but I think it's possible, at least on JIT'd js environments, to achieve the same performance. Can.js has one of the best performing UI code right now and can do the lazy loading, live binding patterns you're talking about http://canjs.us/

This is the biggest challenge of building an html5 ecosystem: it is competing with high level, well designed UI abstractions. Help us solve this problem! Mozilla is focusing on the Web Components spec to try and offer a solution https://github.com/mozilla/x-tag

If you want to start testing the Apis you can flash B2G on to a nexus S very easily today. There will be nightly builds available for download soon too if you don't have a build environment set up

Edit: originally I listed the wrong nexus model

The Marketplace is just the "app store" -- it's where you buy apps. You can run the apps on any supported HTML5 device after buying them. So the supported device would not provide anything more than a browser rendering engine (and some navigator.* JS methods). It won't include x-tags.

No. The congressional hearing only just started, no voting yet. Now is a good time to call your US rep (if you live in the US) http://www.contactingthecongress.org/ . I was surprised that several of my IL reps did not have a stance on the issue! Calling is better than emailing. I know, it's a backwards system.

Those countries are in Oceania