4 ms·

Introducing Mozilla Winter of Security 2014

37 points by jvehent 12y ago

higherpurpose 12y ago
Winter is coming at Mozilla, but only because they've chosen to betray their community and adopt DRM, too.
- Ygg2 12y ago
  Riiight. Unlike other browser vendors with more than >5% marketshare, which all voted NO on DRM. Anyway the message is frivolous and OFF TOPIC.
  - pjc50 12y ago
    Not entirely: the DRM code modules are necessarily closed-source and cannot easily be audited for security vulnerabilities. Given that Adobe is apparently supplying one, and given the number of remote exploits provided by the PDF reader plugin, I think it's reasonable to assume that the DRM modules can present a security risk.
    - pcwalton 12y ago
      The CDM is strictly sandboxed.
      - sp332 12y ago
        That's a good start, but it's not reason to implicitly trust that it can't break anything.
      - pjc50 12y ago
        So it's not native code? Interesting.
        pcwalton 12y ago
        It's native code, but it's strictly contained within an open source sandbox that implements all the interfaces it can use to communicate with the outside world.
        justinschuh 12y ago
        Could you provide a link to the source for the sandbox implementation?
        pcwalton 12y ago
        I'm not on that team so I'll have to get back to you—it's quite possible that the code hasn't been written yet. Currently, we use the Chromium sandbox [1] for sandboxing where it's supported. [1]: http://mxr.mozilla.org/mozilla-central/source/security/sandbox/ http://mxr.mozilla.org/mozilla-central/source/security/sandb...
  - nitrogen 12y ago
    This post could be an attempt to shift the narrative away from Mozilla's decision to include DRM, so the DRM issue at least deserves a mention, even if it sits at -4 at the bottom of the page. Somewhat relevant: http://www.paulgraham.com/submarine.html http://www.paulgraham.com/submarine.html
- dang 12y ago
  Please don't post off-topic diversions into political battles. The Mozilla/DRM issue has had extensive discussion in posts devoted to it.
yalogin 12y ago
This sounds like a great way for students to do some real work. Are there any legal issues to this? Are students allowed to work on Mozilla projects while at school when they are not paid (not an internship)? Or is it alright since the whole thing is open source? The question becomes more relevant because a good percentage of the students (especially masters students) are on student visas and are not allowed to work outside the campus. Am I over thinking this?
- Morgawr 12y ago
  Not sure how it works in the US, especially because every country has its own rules, but I don't think there will be any problem. There seems to be no mention of any pay so it can be treated as any other University project (I guess). In my Master's programme (Studying in Amsterdam, so not an american) we can choose to work on University-approved projects(it's up to the professor) and can receive credits for them. A few friends of mine have worked at GSoC projects and got credits from those, I'm currently doing some independent research with a mentor/tutor and will get credits once I finish (and hopefully publish). This doesn't sound any different.
  - jvehent 12y ago
    This is exactly what MWoS is about.

37 points by jvehent 12y ago

higherpurpose 12y ago

Winter is coming at Mozilla, but only because they've chosen to betray their community and adopt DRM, too.

Ygg2 12y ago
Riiight. Unlike other browser vendors with more than >5% marketshare, which all voted NO on DRM. Anyway the message is frivolous and OFF TOPIC.
- pjc50 12y ago
  Not entirely: the DRM code modules are necessarily closed-source and cannot easily be audited for security vulnerabilities. Given that Adobe is apparently supplying one, and given the number of remote exploits provided by the PDF reader plugin, I think it's reasonable to assume that the DRM modules can present a security risk.
  - pcwalton 12y ago
    The CDM is strictly sandboxed.
    - sp332 12y ago
      That's a good start, but it's not reason to implicitly trust that it can't break anything.
    - pjc50 12y ago
      So it's not native code? Interesting.
      - pcwalton 12y ago
        It's native code, but it's strictly contained within an open source sandbox that implements all the interfaces it can use to communicate with the outside world.
        justinschuh 12y ago
        Could you provide a link to the source for the sandbox implementation?
        pcwalton 12y ago
        I'm not on that team so I'll have to get back to you—it's quite possible that the code hasn't been written yet. Currently, we use the Chromium sandbox [1] for sandboxing where it's supported. [1]: http://mxr.mozilla.org/mozilla-central/source/security/sandbox/ http://mxr.mozilla.org/mozilla-central/source/security/sandb...
- nitrogen 12y ago
  This post could be an attempt to shift the narrative away from Mozilla's decision to include DRM, so the DRM issue at least deserves a mention, even if it sits at -4 at the bottom of the page. Somewhat relevant: http://www.paulgraham.com/submarine.html http://www.paulgraham.com/submarine.html
dang 12y ago
Please don't post off-topic diversions into political battles. The Mozilla/DRM issue has had extensive discussion in posts devoted to it.

yalogin 12y ago

This sounds like a great way for students to do some real work. Are there any legal issues to this? Are students allowed to work on Mozilla projects while at school when they are not paid (not an internship)? Or is it alright since the whole thing is open source? The question becomes more relevant because a good percentage of the students (especially masters students) are on student visas and are not allowed to work outside the campus. Am I over thinking this?

Morgawr 12y ago
Not sure how it works in the US, especially because every country has its own rules, but I don't think there will be any problem. There seems to be no mention of any pay so it can be treated as any other University project (I guess). In my Master's programme (Studying in Amsterdam, so not an american) we can choose to work on University-approved projects(it's up to the professor) and can receive credits for them. A few friends of mine have worked at GSoC projects and got credits from those, I'm currently doing some independent research with a mentor/tutor and will get credits once I finish (and hopefully publish). This doesn't sound any different.
- jvehent 12y ago
  This is exactly what MWoS is about.