marumari

Safari is a lot more strict about cookies than Chromium or Firefox, it will straight up drop or ignore (or, occasionally, truncate) cookies that the other two will happily accept.

I had hoped when writing this article that Google would look at Safari and see that it was always strict about feel comfortable about changing to be the same. But doing so now would unfortunately break too many things for too many users.

Thanks for pointing that out -- I've updated the article and given you credit down at the bottom. Let me know if you'd prefer something other than "kibwen."

An unspecified "implementation detail" is essentially another way of saying that it doesn't work.

I've ported my account on ActivityPub a couple time, and it's a horrendous experience -- not only do I lose all my posts and have to manually move a ton of bits, but the server you port from continues to believe you have an account and doesn't like to show you direct links on there anymore.

The latter could probably be easily solved, the former needs to be built into the spec or it will continue to be broken.

Platform keys are only required to be v2, as far as my understanding goes.

this is a terrible time of year for interviewing, most places won’t be adding headcount until january.

I guess we just have different definitions of what "broken" means, since disconnecting Gecko sounds fairly broken to me. :)

Because huge chunks of are broken in the new browser engine, and could leave your browser in an unrecoverable state.

X25519 is the mechanism for using Curve25519. Software that uses OpenSSL all uses “X25519” and so it would be needlessly confusing to use other verbiage despite being more technically correct.

Both uBlock Origin and Tree Style Tabs (as well as Tab Center Redux, which I prefer) are already compatible with Firefox 57.

You can do the same in Firefox. It's under Tools -> Web Developer -> Browser Toolbox.

Connections to the Mozilla Telemetry server are done over HTTPS, so all an interceptor would know is that you are sending Telemetry and not what that Telemetry is.

> If AV was so vulnerable, we'd see nothing but exploits in the wild going after AV. Yet we aren't seeing that anywhere.

That's because the Linux kernel, Chrome, Firefox, etc. are installed on hundred of millions or billions of devices. Any given piece of anti-virus is orders of magnitude less popular. Further, the route to exploitation is often more circuitous with AV

Overall, that adds up to significantly less exploitation seen in the wild.

On the plus side, there are sites doing really well, like GitHub (A+), HackerOne (A+), and Twitter (A). Even Facebook is doing pretty well, with a B. Hopefully sites like the Observatory help sites do better.

We're working really hard on getting mozilla.org to the point where it also gets an A+.

The nice thing is that most of the security measures -- aside from Subresource Integrity -- can be done without changing any of the actual content.

It also has an invalid website certificate. Kind of a shame that it's so neglected, but it's a pretty good example of what happens to sites when they're allowed to sit for too long.

I'm the primary developer of the scanner and website, and would be happy to answer anybody's questions, should they have any. :)