mccr8

14 ms·

91.
by mccr8 10y ago
One bit of E4X trivia: a bug in the Firefox E4X implementation was taken advantage of by an exploit called "EgotisticalGiraffe", according to the Snowden documents. The implementation of E4X in Firefox was large and complex. http
92.
by mccr8 10y ago
There's also Knightscope, which appears to be based in MV. http://knightscope.com/
93.
by mccr8 10y ago
As Deregibus explains elsewhere, this is almost certainly using the same hash collision. https://news.ycombinator.com/item?id=13728116
94.
by mccr8 10y ago
For what it is worth, Firefox also has a security bounty program, one that is older than Chrome itself. :) Of course, the payouts are smaller than those from Pwn2Own, but on the other hand, reporters don't have to demonstrate a full ex
95.
by mccr8 10y ago
We have extensive leak checking in our testing for Firefox, so hopefully the JS engine is not "very leaky". One part of Quantum, which does not have anything to do with Rust, is to figure out how we can spend less time running uni
96.
by mccr8 10y ago
JS engines spend a lot of their time in JITted code, which isn't helped by PGO compilation of C++. (I mean, the JIT itself is of course a kind of PGO compilation...) I believe in Firefox PGO is, or at least used to, be disabled because
97.
by mccr8 10y ago
Writing a parallel GC surely is not "low-hanging fruit" by any reasonable measure. Java already has to deal with concurrency in their objects, and throughput is more of a concern for server-like workloads, so they are dealing with
98.
by mccr8 10y ago
If you go to about:telemetry in Firefox, you can see exactly what data is being collected.
99.
by mccr8 10y ago
Flash is not entirely dead yet, so support can't be completely dropped. However, both Chrome [1] and Firefox [2] have announced long-term schedules for removing support for Flash, bit by bit. As for PDF, the PDF viewers shipped in brow
100.
by mccr8 10y ago
Background tabs already have their timers run less frequently. In Firefox, that was added in 2011 [1]. Certainly further improvements to reduce background tab activity would be nice. One way you can sort of get that effect is to use Reader
101.
by mccr8 10y ago
The main reason tabs aren't saved to disk isn't a concern about responsiveness, it is a concern about data loss. You have to be very sure that you restore the state exactly. What if you spent a few hours filling out some governmen
102.
by mccr8 10y ago
"Performance" in the context of e10s means improving user responsiveness rather than throughput. For instance, you can usually smoothly scroll a page or interact with the browser UI even if the page is some kind of heavyweight mes
103.
by mccr8 10y ago
Currently e10s is only using two processes, so there should not be a massive increase in memory. Particularly, if you have many tabs open, the pages are still all just stored in a single process, so there should not be much overhead. Part o
104.
by mccr8 10y ago
Chrome sends things you type in the URL bar to Google to do prediction: https://support.google.com/chrome/answer/95656?hl=en From that page it sounds like it is on by default.
105.
by mccr8 10y ago
e10s will bring some security and stability benefits. If one webpage crashes, all webpages crash, but you can click to reload. Additionally, this enables sandboxing, so that code from webpages can be run with lower levels of access. Sure, i
106.
by mccr8 10y ago
An experimental investigation into a multithreaded model (for UI and webpages) was investigated a few years ago (see https://bugzilla.mozilla.org/show_bug.cgi?id=718121 ), and I don't think it looked to be "much s
107.
by mccr8 10y ago
Of course, now a site could potentially fingerprint you by the set of APIs you have disabled!
108.
by mccr8 10y ago
From that article: "We expect to significantly reduce the number of prefixed properties supported over time but Web compatibility will require us to keep around prefixed versions of some features." The features WebKit needs to kee
109.
by mccr8 10y ago
"Quietly" should really get added to a list of semi-clickbaity words that get excised from Hacker News titles. https://www.google.com/?gws_rd=ssl#q=site:news.ycombinator.c...
110.
by mccr8 11y ago
A Quora answer to this question linked to this Google Chrome commit: https://bugs.chromium.org/p/chromium/issues/detail?id=71832 In short, it says that the prefix set uses less memory than a bloom filter.
111.
by mccr8 11y ago
This is a pretty common use case for Flash. There's a clipboard API of some sort now: http://caniuse.com/#feat=clipboard
112.
by mccr8 11y ago
That quote is talking about (untrusted) compilers that translate from C/C++ with undefined behavior to WebAssembly programs. The latter would still have a defined behavior. People already "hammer on the entire JavaScript API with
113.
by mccr8 11y ago
Developer Edition is different than Nightly. They both do update about once a day, but far fewer changes land on Developer Edition so it should be more stable.
114.
by mccr8 11y ago
Firefox is changing this because malware injects itself into Firefox using this mechanism. Power users who really want to install unsigned addons can switch to the Developer Edition.
115.
by mccr8 11y ago
If it is just the Pocket toolbar button you are concerned about (I realize other people don't want the code in their browser at all), then you can easily remove it by using the Customize settings option.
116.
by mccr8 11y ago
All browsers have vulnerabilities.
117.
by mccr8 11y ago
Browsers are likely the only place people are using v8 to run arbitrary hostile code.
118.
by mccr8 11y ago
We spend plenty of effort is spent on both stability and performance. "Improved performance by x% in this particular situation that you may or may experience!" just isn't something you can wrap up neatly into a high-level blo
119.
by mccr8 11y ago
This probably doesn't affect the author and commit stats for mozilla-central all that much. The various upstream libraries we use are updated infrequently, in single commits.
120.
by mccr8 11y ago
You used to be able to do that, but it was fixed in 2010: https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...

More ›