bzbarsky

57 ms·

511.
by bzbarsky 7y ago
For what it's worth, Mozilla routinely discloses internal findings, subject to the same policy as external findings: the bug report is opened up once the fix has shipped to a sufficient fraction of users. So it's not "literal
512.
by bzbarsky 7y ago
Because you can create that array anyway, like so: var arr = []; arr[0] = 1; arr[1] = 2; arr[3] = 3; so there's not really much downside to also allowing a literal syntax for the same thing.
513.
by bzbarsky 7y ago
There are two possible options there. 1) The loan is still on your books. In that case, you are in the same situation as an individual who has invested money in a 4% bond and can't withdraw it from there while at the same time paying
514.
Dataspii tl; dr: Firefox extensions are more secure than Chrome(diasp.eu)
2 points by bzbarsky 7y ago|0 comments
515.
by bzbarsky 7y ago
> After all, they've presumably backed your loan with some kind of equally long-term security. See, this is what banks are explicitly NOT in the business of doing. They are in the business of borrowing short and lending long, with
516.
by bzbarsky 7y ago
We could also take the mortgage approach, where the actual contract is in fact very long, but there is a required simple-to-understand cover sheet that summarizes all the pertinent details in a clear way.
517.
by bzbarsky 7y ago
Yes, but the point is that if you load it over HTTPS they will redirect to HTTP. So if you type https://www.bbc.com/future/story/20180905-the-cargo-ships-th... in your web browser url bar, you will end up at htt
518.
by bzbarsky 7y ago
What I found really eye-opening was looking at the about:memory output for gmail in Firefox. There's more memory used for the various chat-related iframes than for the actual gmail bits themselves. And I suspect the chat widget is no
519.
by bzbarsky 7y ago
Newer cars tend to be larger and heavier than older cars, which does not help fuel efficiency. For the US specifically, https://www.nytimes.com/interactive/2018/04/03/climate/us-fu... says that in 2
520.
by bzbarsky 7y ago
Is VLC also in the universe repository? Because it sounds like the VLC binary Ubuntu provides is linked against this unsupported and out-of-date library, whereas the VLC binaries the VLC folks themselves provide are linked against a fixed v
521.
by bzbarsky 7y ago
Firefox does not have plans to implement lazy loading at this time, fwiw. If we do, yes, I expect we will have a way to disable it.
522.
by bzbarsky 7y ago
The NoScript point is a good one. I don't necessarily expect browsers that implement it to have a user-visible way to disable lazy loading, though, so you may be out of luck there. You _might_ be able to create userscripts that force
523.
by bzbarsky 7y ago
Note that some browsers are planning to start doing lazy image loading themselves. See https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...
524.
Facebook’s Crypto Annoys Everyone(bloomberg.com)
5 points by bzbarsky 7y ago|0 comments
525.
MITM on HTTPS traffic in Kazakhstan(bugzilla.mozilla.org)
1336 points by bzbarsky 7y ago|453 comments
526.
by bzbarsky 7y ago
Well, yes, there are various levels of "thinking outside the box" here that could be applied.
527.
The Web Can't Survive a Monoculture(mikepennisi.com)
3 points by bzbarsky 7y ago|0 comments
528.
by bzbarsky 7y ago
CORS won't do it, because it protects the response target, not the response source. CSP would do the trick, though. The other fix is properly escaping things before sticking them in your markup.
529.
by bzbarsky 7y ago
> and iirc, permit cross-origin resource access Firefox does not do that. Safari has some behaviors along those lines last I checked. I can't recall for Chrome whether it does or not.
530.
How Google is building a browser monopoly(youtube.com)
2 points by bzbarsky 7y ago|0 comments
531.
by bzbarsky 7y ago
Attaching as a debugger may require elevated privileges too (e.g. on Mac).
532.
by bzbarsky 7y ago
That depends. If the malware (and to be clear, "malware" here includes various anti-virus vendors and other gray-hat software that is nominally providing the user a service but _also_ attempting to insert itself into Firefox) is
533.
Add-Ons Outage Post-Mortem Result(hacks.mozilla.org)
126 points by bzbarsky 7y ago|80 comments
534.
by bzbarsky 7y ago
There turn out to be a bunch of complications when one tries to do that, if the goal is to not break existing legitimate uses. I haven't been following this closely, but for Firefox https://bugzilla.mozilla.org/show_bug
535.
by bzbarsky 7y ago
If cookies were scoped to the (source, target) pair, then that would remove one of the main motivations for CORS, yes: evil.com would not be able to get any information from bank.com by making your browser make the request that they could n
536.
by bzbarsky 7y ago
CORS doesn't apply to navigations by default, so anaphor is correct: evil.com can just submit a form to banking.com and it will send the banking.com cookies. This is the whole field of CSRF (cross-site request forgery) mitigation. COR
537.
by bzbarsky 7y ago
It's a toggleable flag, yes. The "privacy.file_unique_origin" preference controls the behavior.
538.
by bzbarsky 7y ago
That is the idea, yes.
539.
by bzbarsky 7y ago
> If they wanted to show me which websites are impacting my battery life that'd be fantastic! about:performance aims to do that.
540.
by bzbarsky 7y ago
The changenote is talking about access from script. Script running in a page loaded from file:// will not be able to access the DOM or text of any other file:// URLs, other than the one it's running in.

More ›