mccr8

Off-hand, I'd guess you can use these hints earlier in the loading process than you could start executing JS.

I don't know what Linux does, but Mozilla puts out security advisories for every release.

https://www.mozilla.org/en-US/security/advisories/

Is the conversion tool actually open source? The Swiffy Wikipedia page says "There is a server-side component (source currently not public) that converts SWF to an intermediate representation serialized as JSON.".

Visiting only trusted sites is a niche use case for web browsers.

Generally, beta is supposed to be almost completely identical to the release version, to ensure that what gets shipped to release users is tested. This particular pref seems harmless, but you never know.

Developer edition is what used to be known as "Aurora", which is in between Beta and Nightly.

Being well-tested from the perspective of regular use is not quite the same as being well-tested from the perspective of defending against a hostile actor.

Chrome autoupdates Flash and Firefox blocks old versions of Flash. (I'm not sure what IE does.) That should help limit the number of people who are exposed.

The cynical interpretation is that discouraging people from opening many tabs means having less tabs open which means the browser performs better. This is particularly true in Chrome, which tries to use a process-per-tab, something you can't really do with 200 tabs.

Click on the hamburger. Click on "Customize". Drag the "Hello" icon off of the tool bar. It is now removed from the UI.

Yes, the CC list will subscribe you to email notifications about the bug, and does not really indicate support, only interest in receiving email notifications about the bug.

The size of each individual object is determined by calling malloc_usable_size on the block itself, so this includes any internal alignment, as well as any padding from the allocator after the object proper.

So, you get the size of the object, using the callback. Then, if the object has fields that point to other objects, you call the reporter on those fields. Then those two quantities are totaled.

For what it is worth, this is just a draft.

I realize that you are just making a snarky dig, but probably never. It would be a huge amount of work just to backport basic security fixes, and almost impossible to backport large architectural changes that are made in the service of security. Are you going to backport multiprocess Firefox once that is working?

It is much easier to flip a preference. If you wanted to get sophisticated, you could create an addon that disables all of the preferences you dislike.

Apparently it is a thing in DC, known as "slug lines": http://en.wikipedia.org/wiki/Slugging

The idea is that by picking up people, you can drive in the HOV lanes.

You can look at the local telemetry for your current Firefox session, including this variable, by going to about:telemetry, which sort of gets you what pbhjpbhj was looking for, albeit in an inconvenient and limited fashion.

Google used to run a separate contest (at the same conference as Pwn2Own) called Pwnium for Chrome OS, but starting this year they are moving to a model where they pay similarly large bounties year-round rather than at contests.

http://googleonlinesecurity.blogspot.com/2015/02/pwnium-v-ne...

All were running on Windows, except Safari which was running on OSX. You can see the details at this overly long URL from the contest organizers:

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2O...

To mitigate this problem, Google has recently announced that they are running a similar program year-round:

http://blog.chromium.org/2015/02/pwnium-v-never-ending-pwniu...

People certainly do find security vulnerabilities by reading source code.

And more money.

Why wouldn't they? As somebody pointed out elsewhere, ads on various scummy sites show up if you search for "Firefox" and other things on regular Google search. I'd guess people who are searching for something specific are more likely to actually make a purchase or whatever, so they'd be more valuable to Google.

None of it. The work on multiprocess Firefox is primarily an issue in the front end UI code (written in JS), and does not have much to do with networking or crypto.

Another thing to keep in mind is that patch notes are a list of user-facing changes, not a breakdown of where the engineering effort went in a particular 5 week release cycle. Removing the command line flag probably took an engineer an hour or two to do. In the same time frame, I spent weeks analyzing and fixing a variety of leaks that only show up in multiprocess Firefox, but none of that shows up in the patch notes.

This doesn't help with your main issues, but I think the Vimperator extension is a little better maintained than the Pentadactyl one.

I'm sorry that your experience with Firefox has been so poor. Web browsers are a complex application platform, and individual experiences can vary wildly. You may use some web page that does well on Chrome but poorly on Firefox, while others may experience the opposite. Individual browsing habits, in terms of the number of tabs that are open at once, or how long the browser is left open, also vary greatly, and can affect performance on one browser compared to another.

You can add a custom search in Firefox by right clicking on a search box, then clicking on "Add a keyword for this search". Then save a bookmark with a keyword, like "so" for stack overflow.

Then you can enter this in the URL bar: so python reverse list

...and you'll get a search for "python reverse list".

This is much less magical than how it works in Chrome, and harder to discover, but once you get it set up it is reasonably convenient.

I'd guess that the larger barrier to the lack of saving is the desires of the copyright holders who decide what the EME module can do, rather than the permissiveness of the sandbox.

I don't know about Telefonica's role, but in general WebRTC needs external servers to deal with things like NATs and firewalls: http://www.html5rocks.com/en/tutorials/webrtc/infrastructure...

The underlying technology used to implement this is WebRTC, which is available to web pages. Implementing peer-to-peer real time video communication entirely in Javascript would be difficult, so it has to be provided to some extent by the browser itself.

What do you mean by "as yet non-existent"? I believe Chrome, IE and Safari are all shipping it. It sounds like you can even use Netflix with it, as of last year: https://news.ycombinator.com/item?id=8159110

I believe that the YouTube HTML5 video rollout depends on parts of the Media Source Extensions, which are only available in Firefox starting in beta.