martius

There is a comprehensive "motivation" section on the linked page of the project.

Firefox is a brand present in a highly competitive market. It's a brand known by consumers who are used to associate a name and a logo to an experience and can easily get confused (such as people seeing the "blue E icon" as the way to "start google" for instance).

Mozilla protected more agressively its Firefox brand to cope with malware-stuffed clones which were hijacking the name.

Projects such as VLC or Android protect their brand too, Chrome is only available through official closed-source builds, many linux distributions only package chromium.

On Linux, I use the unshare command to hide my /home, you can do the same thing with /etc:

  sudo unshare -m bash -c "mount --make-rslave / && mount -n -o bind /tmp/empty /home && sudo -u $(whoami) firefox -ProfileManager -no-remote"

it :

- forks the mountpoints table for the process to be executed (bash) - it requires capabilities (hence sudo),

- make / as as slave mount in this context (because of systemd which shares the / mountpoint (see: https://www.kernel.org/doc/Documentation/filesystems/shareds...),

- bind an empty directory to /home (that I previously created), it will only be visible for this process and its children, since it's in an unshared mountpoints table,

- I run firefox in user mode.

sudo unshare -m bash -c "mount --make-rslave /home ; mount -n --make-rprivate -o bind /tmp/empty /home ; sudo -u $(whoami) firefox -ProfileManager -no-remote"

- creates an empty directory,

- fork the mount table for the new bash process and its children (requires privileges),

- unshare /home (required if / is mounted in shared mode [1]),

- hide /home by mount-binding the empty directory,

- start firefox in unprivilegied mode, without being able to access to user's files.

[1] https://www.kernel.org/doc/Documentation/filesystems/shareds...

You don't have to surrender the key, but you are required to at least decrypt things for the authorities.

However, I the twist seems to be in the word "susceptible": any encryption key is susceptible to be somehow used to commit a crime, while on the other hand a jury would probably "deny a request" of the authorities if they can't show enough evidences.

Assuming you have time and knowledge to do it. Assuming you own the domain or at least are able to access to its DNS records. Assuming you can use SNI (and all your visitors too) or have your own IPv4 address. Assuming $40 is free...

No, even a free certificate doesn't mean that deploying ssl is free.

It's a spec bug: they wrote a draft spec, implemented it and pushed it to a stable release too soon.

1) Well, web servers are always evolving, think of HTTP/2 :)

2) During the beta, they didn't receive enough feedback to evaluate the criticality of the problem, they assumed that the fix could wait 6 weeks.

It does break frontends too: assets and links URL are generated with an https:// scheme, which results in assets not loaded and broken links.

Yes, it's a bad idea, but an awful lot of bad ideas were the common practice a long time ago, when vendors had to deal with limitations of the HTTP/1.0 and 1.1 RFCs.

In fact, we aren't talking about application headers. The HTTP RFC makes a distinction between application headers and hop-by-hop headers. There are mechanisms that proxies are required to implement, but they still don't.

For instance, a proxy must declare itself by appending its signature to a "Via" header - however most of them don't.

The RFC about forwarded HTTP extension is unclear about how a hop should deal with those headers, there is no one-size-fit-all situations: http://tools.ietf.org/html/rfc7239#section-8.1

It's Chrome fault to use push for a new standardized header without properly checking its impact: the issue has been raised during the beta phase, but they underestimated it and did not rollback.

I believe it is known that some old reverse-proxies used this header before a standard solution emerged (X-forwarded-proto), Wordpress probably had to deal with this surprising behavior at some point.

Also, by naming a header "HTTPS", one could expect collision with a non-standard behavior: this is very common with HTTP/1.1.

He's talking about a client not supporting HTTPS.

A client may have reasons to prefer HTTP over HTTPS: perfs, plaintext for debug, etc. It's hard to assume that "HTTPS should be the default" in any circumstance.

I'm not sure the wordpress sites are to blame here (for once): SSL isn't free to deploy (yet).

The issue here is that the frontend may be behind a reverse proxy, talking to the client in HTTPS but to the frontend in HTTP. In that case, the frontend should probably let the HTTPS header.

In practice, with X-Forwarded-Proto, they don't, unless they can authenticate the downstream hop.

Basically, now Chrome sends the header HTTPS: 1 when issuing a request over HTTP to notify it "prefers" HTTPS.

However, this header is (or was) used by several HTTP servers/proxies (including Apache, I believe) to notify the application that the client connection is established in HTTPS. Wordpress reacts to this header by generating https:// URLs, which may not work if the server doesn't serve HTTPS with a properly configured certificate.

It does not really answer to the questions "Are you open-source ?" or "Where can I find acuman source code ?" :(

Kimsufi offers servers with SSDs in France: KS-2 SSD: Atom™ N2800, 4GB of Ram, 40GB SSD, 100 Mbps for 9,99€/month.

http://www.kimsufi.com/fr/

Humble Bundle proposes the Humble Indie Ballyhoo:

https://www.humblebundle.com/ballyhoo

http://blog.humblebundle.com/post/115193038361/step-on-up-fo...

For a long time: getaddrinfo() and others are specified in susv3[1] (since 2003 I think). However, gethostbyname() and gethostbyaddr() are still very commonly used, and won't be gone soon.

1/ http://refspecs.linuxbase.org/LSB_3.1.1/LSB-Core-generic/LSB...

Yes, the mail you link says:

"I will keep you posted in next hours. I send the notice to early. Big fail of my own. Stay tuned."

From https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-0235

"A heap-based buffer overflow was found in __nss_hostname_digits_dots(), which is used by the gethostbyname() and gethostbyname2() glibc function call. A remote attacker could use this flaw to execute arbitary code with the permissions of the user running the application."

I'd like to know the risks, if you can find the article.

I'm not sure but I think someone is working on that at mozilla. It is almost dedicated to things specific to mobile, though.

How about a screenshot of the alerts configuration page, and the screenshot of an alert, in your mail client?

It looks like a meta Google alerts, but it's open source and hackable, which can be really handy. A documentation of how to write custom alerts would be useful, I guess.

Also, you should host a demo somewhere.

It's hard to have a clear perspective on this.

Obviously it's again net neutrality, and there are probably a lot of better ways to give access to Internet to people who don't have it. On the other end, I'd like to think it can be really useful to some people.

I regret however that the conditions and the process to be integrated to the app are not clearly stated.

For instance, it should be required that a service is accessible without restriction of any kind, and be interoperable... and Facebook Messenger doesn't meet these requirements.

Thanks for that, I'll have a look and mention it if I make a follow-up post.

I think that good small projects can be plug-ins to bigger projects, or a library that someone use in a project.

I wrote a patch for Firefox too. While the experience was different, I applied the same method and it worked quite well. As a comment says it: the mentoring part is important, probably even more than the project itself. I saw that when trying to contribute to other large projects.

Contributing to Servo has its downsides too: things move quickly and can break, and many things are really unstable and unfinished.

Everything is discussed via meetings and mailing lists. I guess you can not make significant changes to the UI, but you can contribute by writing an extension.

> The problem is when people rent these places and then throw loud parties.

I don't know who cares of a party in a flat. Noisy parties existed before airbnb.

To me, the problem is that since there is no regulation, renting a flat for short periods allows to make much more money than renting it for a long time to a reasonable price. It contributes to the shortage of flats to rent supply, the rise of the rent prices and gentrification.

It makes sense, thank you!