Who wants to plant their flag on a lifeless husk?
2,413 karma · joined July 3, 2015
Where did that come from?!
I never said anything about monetization. I said "content," and there's plenty of non-commercial and indie content that is only tested in Chrome. You can probably root-cause analyze it to monetization (indie website creators only test in Chrome because they only use Chrome, and they only use Chrome because they also happen to frequent YouTube which works best in Chrome, or maybe because their PC came with Chrome by default), but blaming Mozilla for the fact that most people don't exclusively use non-commercial websites seems a bit silly.
> We're here for the browser, not the content that makes us the product.
I really don't understand what you mean here. What do you even do with Firefox, if not open web pages in it?
It's great if you know about it. But it still shake's people's confidence about the future of any new product announcements from Mozilla.
The essential problem here is that a web browser is nothing without content, and much of the most popular content on the web is found through Google, a company who grows closer every day to locking down a vertical monopoly. Firefox would have to be ten times as good as Chrome to even be on equal footing, and while it does have some marginal advantages, nothing is enough of a deal breaker that I would stop visiting YouTube just to avoid using Chrome [1]. Firefox really was that much better than IE6, but Firefox isn't competing with abandonware this time around.
Mozilla needs to stimulate the creation and viewing of content outside of Google-owned walled gardens. Pocket Recommendations were an obvious attempt at this; just make sure all the recommended articles actually open correctly in Firefox. This was probably also the biggest reason why they bent over so far backwards to accommodate NetFlix, who would have been happy to make sure Firefox worked correctly just to avoid being vertically integrated to death by Chrome and Google Play Movies/TV.
The relationship between Steam and Linux comes to mind. Funny how Linux became a viable gaming platform right after Microsoft announced the Windows Store.
[1]: This will, of course, change once uBlock Origin stops working.
2. If not, do your parents know how to print to PDF?
The one I've favored while reading these arguments has been the "suspended process" model. The primitives are CREATE(), which takes an executable as a parameter and returns the PID of a paused process, and START(), which allows the process to actually run.
Unix already has the concept of a paused executable, after all.
This model also requires all the process-mutation syscalls, like setrlimit(), to accept a PID as a parameter, but prlimit() wound up being created anyway, because the ability to mutate an already-running process is useful.
http://daniellakens.blogspot.com/2017/07/impossibly-hungry-j...
I honestly don’t know where you got that idea from. I always thought the whole point of computer programming was to solve problems. If it makes things more complex as a result, then so be it. Just as long as it creates fewer, less severe problems than it solves.
There are two places this can end:
* Redesign the runtime environment so it doesn’t matter if you download trackers. The execution environment doesn’t offer the I/O facilities that it requires to actually produce harm. This is what Apple Private Relay and Tor Browser try to give you. By analogy, this is why Web Apps became so popular in the first place — web publishers who do not intentionally collude are protected from each other by the SOP, so opening a web page should be less risky than running an EXE. It’s “just”[1] extending the existing sandbox to prevent differing origins from being able to collude.
* Instead of blocking bad scripts, allow only known-good ones. To match the convenience of current-day ad blocking, it needs to be a collaboratively-produced list. In other words, a gatekeeper. By analogy, this is why installing “unrecognized” applications on Windows and macOS is behind a scare screen, and why doing it on iOS is prevented entirely.
The former seems less dystopian, but much more difficult.
[1]: this is actually very difficult
* This came after the "points" game. Deciding to be collectivist makes sense, after a game that's designed to result in obviously unfair distribution of ownership. These kids are probably used to these kinds of object lessons: it sounds like this is the program's preferred method of teaching.
* They still wanted to make one huge LEGO Town. Thus, they need to come up with a plan for resolving conflicts, and it can't just be "I own it."
It's been true since forever.
> FWIW your anecdotes don't match mine. My public school stories are all about learning critical thinking, being allowed to think way outside the box, and being rewarded for questioning authority.
Those are the values that schoolteachers publicly espouse, but even if they want to live up to it, they can't. It's impossible in an environment where they have to train kids to perform standardized tests, and have to keep an overcrowded classroom from turning into a madhouse.
> [the rest of the anecdotes]
Yeah, I had cool teachers, too. It really doesn't take away from the extremely rigid structure of the environment. It helps make things bearable, but the best-learned lessons are the ones you experience, not the ones you read, and what you learn in school is sitting in a desk, doing what you're told, giving your input only when prompted, and that the authority figure standing in front of you has to do things they don't want to do just like you do.
That's not a healthy environment. That's literally the big man screwing over the little man.
The problem with DNS is that DNS names are global, and human readable, and therefore rely on a central authority to handle disputes. They aren't even particularly good at human-readability, because they have a vestigial hierarchy that doesn't even mean anything half the time, and they aren't given enough scrutiny to make sure that nobody uses confuseable, typo squatted, or bit squatted names.
The problem with CAs is that they're centralized, and they need to be able to see your domain name in order to validate it. This makes air gapped systems a pain in the neck, along with anything else that calls into question the global reach-ability assumption that they're making (like plain ol' networking glitches).
* The Tor network also has exit nodes that can access the regular web. For this to be secure, you need all of the normal security practices for websites, including TLS. Hidden Services don't need exit nodes, and they don't need TLS.
Plenty of cold case shows that start the episode 5 years after the original investigation, when new evidence comes in to clear the convict.
It's not that I think TCP/IP is inherently secure. It's that, because TCP/IP is not inherently secure, I don't think raw TCP/IP addresses should be exposed to end-users. In other words, the right way to phrase it would have been.
> If you get the TOR address from a trusted source, like the Azure dashboard, then you’re connecting to the correct machine. No need to rely on people being meticulous enough to compare hex addresses.
Tor Hidden Services are closer to a well-designed petname system. The important insight is that, since domain names are too technical for ordinary people anyway, they might as well just be random numbers. If you trust someone to give you the real domain name for the server, you can also trust them to give you a signature for their real public key, and you don't even need a CA any more. The advantage of using a cryptographic signature for your address is that it implicitly forms a web of trust, using the links that people were already sharing.
The biggest problem with this — and SSH doesn't seem to do a better job of it than Tor does — is key rotation. Deprecating an old cryptographic algorithm is a total disaster in any system that doesn't support key rotation — it's fine on the server side (just host with both keys, and serve a 301 redirect from the old one to the new one), but the client side eventually needs to stop supporting the old algo, because those would be vulnerable to downgrade attacks, and at that point you cut off anyone who hasn't switched to the new one yet. CA's take care of this, because it's literally their job, but distributing the responsibility to everyone can easily mean it doesn't get taken care of properly.
People don’t care, because people don’t know. RowHammer-vulnerable RAM is like canned food with botulinum and gasoline with lead. In 100 years, we’ll all be flabbergasted that everyone in the industry wasn’t arrested for letting it happen.