Moz/FF
Mozilla: Rust, Socorro, and 'Healthier' Internet (Openwashing)
Submitted by Roy Schestowitz on Friday 15th of January 2021 01:03:17 PM Filed under


-
Another Rust-y OS: Theseus joins Redox in pursuit of safer, more resilient systems
Rust, a modern system programming language focused on performance, safety and concurrency, seems an ideal choice for creating a new operating system, and several such projects already exist. Now there is a new one, Theseus, described by creator Kevin Boos as "an Experiment in Operating System Structure and State Management."
The key thinking behind Theseus is to avoid what Boos and three other contributors from Rice and Yale universities call "state spill".
-
This Week In Rust: This Week in Rust 373
-
Socorro Engineering: Half in Review 2020 h2 and 2020 retrospective
2020h1 was rough. 2020h2 was also rough: more layoffs, 2 re-orgs, Covid-19.
I (and Socorro and Tecken) got re-orged into the Data Org. Data Org manages the Telemetry ingestion pipeline as well as all the things related to it. There's a lot of overlap between Socorro and Telemetry and being in the Data Org might help reduce that overlap and ease maintenance.
[...]
2020 sucked. At the end, I was feeling completely demoralized and deflated.
-
Reimagine Open: Building a Healthier Internet
Does the “openness” that made the [Internet] so successful also inevitably lead to harms online? Is an open [Internet] inherently a haven for illegal speech, for eroding privacy and security, or for inequitable access? Is “open” still a useful concept as we chart a future path for the [Internet]?
A new paper from Mozilla seeks to answer these questions. Reimagine Open: Building Better Internet Experiences explores the evolution of the open [Internet] and the challenges it faces today. The report catalogs findings from a year-long project of outreach led by Mozilla’s Chairwoman and CEO, Mitchell Baker. Its conclusion: We need not break faith with the values embedded in the open [Internet]. But we do need to return to the original conceptions of openness, now eroded online. And we do need to reimagine the open [Internet], to address today’s need for accountability and online health.
Mozilla: Firefox Nightly, Thunderbird, and VPN
Submitted by Roy Schestowitz on Wednesday 13th of January 2021 07:56:24 AM Filed under
-
Improving Cross-Browser Testing, Part 2: New Automation Features in Firefox Nightly - Mozilla Hacks - the Web developer blog
In our previous blog post about the web testing ecosystem, we described the tradeoffs involved in automating the browser via the HTTP-based WebDriver standard versus DevTools protocols such as Chrome DevTools Protocol (CDP). Although there are benefits to WebDriver’s HTTP-based approach, we know there are many developers who find the additional functionality and ergonomics of CDP-based test tools compelling.
It’s clear that WebDriver needs to grow to meet the capabilities of DevTools-based automation. However, that process will take time, and we want more developers to be able to run their automated tests in Firefox today.
To that end, we have shipped an experimental implementation of parts of CDP in Firefox Nightly, specifically targeting the use cases of end-to-end testing using Google’s Puppeteer, and the CDP-based features of Selenium 4.
For users looking to use CDP tooling with stable releases of Firefox, we are currently going through the process to enable the feature on release channels and we hope to make this available as soon as possible.
The remainder of this post will look at the details of how to use Firefox with CDP-based tools.
-
New in Thunderbird 78.0
I use Evolution for work mail, for psychological separation, but also for Exchange support, and I have to say: Thunderbird is just much easier to use, in that you can customize it into whatever you want from a client. I’m genuinely shocked people prefer web mail interfaces to something more robust, like Thunderbird.
-
Think you don’t need a VPN? Here are five times you just might.
Have you ever connected to a hotspot called something like C0MCAST-WiFi-77th-St or Verizon3-Hotspot-Baltimore? Looks legit, right? Not so fast. In reality, anyone can set up a phony public WiFi with a legitimate sounding name to lure people to use it. Connecting to any unknown WiFi makes you an easy target for creeps and criminals who want to access your device to steal private information, install malware or worse. Mozilla VPN can boost your security any time you’re connected to a public WiFi by blocking unknown entities from seeing private data that travels from your phone or laptop. This goes for connecting to WiFi networks at coffee shops, stores, doctor’s offices and so on.
-
Mozilla VPN is Now Available to Mac & Linux Users - OMG! Ubuntu!
Mozilla VPN now supports Mac and Linux. The subscription-based privacy service launched in 2020 but only for Windows, Android and iOS.
-
Mozilla brings its VPN to Mac and Linux
- 6 comments
Printer-friendly version
- Read more
- 1759 reads
PDF version
Firefox – we’re finally getting HW acceleration on Linux
Submitted by Roy Schestowitz on Monday 11th of January 2021 03:11:27 AM Filed under


Firefox 84.0 is a big milestone for Firefox Linux development as it comes with HW acceleration by default for some Linux users. Stock Mozilla Firefox 84.0 enables WebRender (HW accelerated backend) for Gnome/X.org and Gnome/Wayland will be supported in Firefox 85.0. Fedora is bit ahead and enables WebRender for Gnome/Wayland in Firefox 84.0 too.
WebRender by default is restricted to AMD/Linux graphics cards as NVIDIA is known for various issues – both proprietary and Noveau drivers.
And why it’s enabled in Gnome only for now? For instance KDE is also a popular desktop environment. I think it’s because Gnome utilizes HW acceleration so when Gnome works on your box there’s assumption that Firefox will work too. KDE provides choices how to disable/restrict HW acceleration setup (for instance it supports disabled screen compositing) and it’s more difficult to cover various scenarios.
- Login or register to post comments
Printer-friendly version
- Read more
- 2629 reads
PDF version
Firefox 86 Will Support Next-Gen Image Format by Default
Submitted by Rianne Schestowitz on Sunday 10th of January 2021 06:48:57 PM Filed under
A bug report shows Mozilla devs plan to ship Firefox 86, due in February 2020, with AVIF image support by default. AVIF images used on websites and web services will load in-page just like other supported image formats.
But what is AVIF?
AVIF is a free, lightweight, and highly optimised image compression format based on the AV1 video codec. AVIF images are up to 50% smaller in size (so they load faster) but are visually comparable to JPEG and other image compression formats in most instances.
- Login or register to post comments
Printer-friendly version
- Read more
- 2692 reads
PDF version
Mozilla Firefox Flips On AVIF Image Decoding By Default
Submitted by Roy Schestowitz on Saturday 9th of January 2021 05:20:17 AM Filed under

As noted before the holidays that Mozilla Firefox was ready to enable AVIF image decoding by default, now that the holidays have passed and developers back to their keyboards, Firefox today has re-enabled AVIF by default.
Since Google's Chrome 85 there has been AVIF support enabled by default while the Firefox support has been disabled by default for now. But as of today in their nightly code the functionality is there out-of-the-box.
- Login or register to post comments
Printer-friendly version
- Read more
- 3031 reads
PDF version
The first fully tested Fedora Firefox package
Submitted by Rianne Schestowitz on Friday 8th of January 2021 01:33:36 PM Filed under

We hit a big milestone in Firefox deployment on Fedora with firefox-84.0.2 package. It’s the first fully tested Firefox package released to Fedora users. Let’s see what’s so exciting on it.
Mozilla has a large testsuite as a part of development and release process. When any new patch hits Firefox repository, it’s built and tested for functional and speed regressions. The testsuite is also a developers nightmare as it contains some old and outdated test environments and it may be difficult to pass patches through it.
- Login or register to post comments
Printer-friendly version
- Read more
- 1780 reads
PDF version
Security Leftovers
Submitted by Roy Schestowitz on Friday 8th of January 2021 12:28:49 AM Filed under

-
Mozilla Security Blog: Encrypted Client Hello: the future of ESNI in Firefox
Two years ago, we announced experimental support for the privacy-protecting Encrypted Server Name Indication (ESNI) extension in Firefox Nightly. The Server Name Indication (SNI) TLS extension enables server and certificate selection by transmitting a cleartext copy of the server hostname in the TLS Client Hello message. This represents a privacy leak similar to that of DNS, and just as DNS-over-HTTPS prevents DNS queries from exposing the hostname to on-path observers, ESNI attempts to prevent hostname leaks from the TLS handshake itself.
Since publication of the ESNI draft specification at the IETF, analysis has shown that encrypting only the SNI extension provides incomplete protection. As just one example: during session resumption, the Pre-Shared Key extension could, legally, contain a cleartext copy of exactly the same server name that is encrypted by ESNI. The ESNI approach would require an encrypted variant of every extension with potential privacy implications, and even that exposes the set of extensions advertised. Lastly, real-world use of ESNI has exposed interoperability and deployment challenges that prevented it from being enabled at a wider scale.
-
33 hardware and firmware vulnerabilities: A guide to the threats | CSO Online
Meltdown and Spectre raised the alarm over vulnerabilities that attackers can exploit in popular hardware and its firmware. Here's a roundup of the ones that present the most significant threats.
-
6 Open Source Tools for Your Security Team
Open source tools are a fact of life in application development. A growing number of open source security tools makes the noncommercial license a realistic option for more security teams.
Traditionally, open source tools have been viewed as options for academic institutions and smaller companies. But current-generation open source tools, developed with an emphasis on scale and deployment flexibility, have been developed with larger enterprises in mind.
Dark Reading looked at a range of tools and system across the open source landscape to find a half-dozen that enterprise security teams will want to know about. Several are at the beginning of their product lives; one is at the end, though it is still useful. In most cases, these tools compete against commercial offerings, though in every case the open source option provides qualities (aside from purchase price) that make them worthy of consideration for specific situations.
- Login or register to post comments
Printer-friendly version
- Read more
- 1738 reads
PDF version
Mozilla: Security, HTML, Standardizing Principles and More
Submitted by Roy Schestowitz on Tuesday 5th of January 2021 08:49:47 PM Filed under
-
Why getting voting right is hard, Part III: Optical Scan
This is the third post in my series on voting systems. For background see part I. As described in part II, hand-counted paper ballots have a number of attractive security and privacy properties but scale badly to large elections. Fortunately, we can count paper ballots efficiently using optical scanners (opscan). This will be familiar to anyone who has taken paper-based standardized tests: instead of just checking a box, next to each choice there is a region (typically an oval) to fill in, as shown in the examples below These ballots can then be machine read using an optical scanner which reports the result totals.
[...]
So far in this series I’ve talked about paper ballots as if they are cast at the polling place, but that doesn’t have to be the case. They can just as easily be sent to voters who return them by mail. Depending on the situation this is referred to as “vote by mail” (VBM) or “absentee ballots”. VBM brings some special challenges which I’ll be covering in my next post.
-
Martin Thompson: RFCs in HTML
I spend a shocking amount of my time staring at IETF documents, both Internet-Drafts and RFCs. I have spend quite a bit of time looking at GitHub README files and W3C specifications.
For reading prose, the format I routinely find to be the most accessible is the text versions. This is definitely not based on the quality of the writing, all of these formats produce unreadable documents. What I refer to here is not the substance, but the form. That is, how the text is laid out on my screen[1].
There is clearly a degree of familiarization and bias involved in this. A little while ago, I worked out that there is just one thing that elevates that clunky text format above the others: line length.
-
Standardizing Principles
There is a perennial question in standards development about the value of the different artefacts that the process kicks out.
One subject that remains current is the relative value of specifications against things like compliance testing frameworks. Reasonable people tend to place different weight on tests, with a wide range of attitudes. In the past, more people were willing to reject attempts to invest in any shared test or compliance infrastructure.
In recent years however, it has become very clear that a common test infrastructure is critical to developing a high quality standard. Developing tests in conjunction with the standardization effort has improved the quality of specifications and implementations a great deal.
Recently, I encountered an example where a standards group deliberately chose not to document behaviour, relying exclusively on the common test framework. Understanding what is lost when this
-
Aaron Klotz at Mozilla: 2018 Roundup: Q2, Part 2
One of the things I added to Firefox for Windows was a new process called the “launcher process.” “Bootstrap process” would be a better name, but we already used the term “bootstrap” for our XPCOM initialization code. Instead of overloading that term and adding potential confusion, I opted for using “launcher process” instead.
The launcher process is intended to be the first process that runs when the user starts Firefox. Its sole purpose is to create the “real” browser process in a suspended state, set various attributes on the browser process, resume the browser process, and then self-terminate.
In bug 1454745 I implemented an initial skeletal (and opt-in) implementation of the launcher process for starting.
This seems like pretty straightforward code, right? Naïvely, one could just rip a CreateProcess sample off of MSDN and call it day. The code is a bit more complicated than that, for various reasons, which I will outline in the following sections.
- Login or register to post comments
Printer-friendly version
- Read more
- 1477 reads
PDF version
Rust 1.49.0 Released and Related News
Submitted by Roy Schestowitz on Thursday 31st of December 2020 08:16:42 PM Filed under

-
Announcing Rust 1.49.0
The Rust team is happy to announce a new version of Rust, 1.49.0. Rust is a programming language that is empowering everyone to build reliable and efficient software.
-
This Week In Rust: This Week in Rust 371
-
Niko Matsakis: The more things change… [Ed: Rust language is becoming GAFAM surveillance monopolies, hosted on Microsoft servers]
That said, I’ve talked to a number of people in the Rust community who feel nervous about this change. After all, we’ve worked hard to build an open source organization that values curiosity, broad collaboration, and uplifting others. As more companies form Rust teams, there’s a chance that some of that could be lost, even if everyone has the best of intentions. While we all want to see more people paid to work on Rust, that can also result in “part time” contributors feeling edged out.
[...]
I want to zoom out a bit to the broader picture. As I said in the intro, we are entering a new phase for Rust, one where there are multiple active Rust teams at different companies, all working as part of the greater Rust community to build and support Rust. This is something to celebrate. I think it will go a long way towards making Rust development more sustainable for everyone.
Even as we celebrate, it’s worth recognizing that in many ways this exciting future is already here. Supporting Rust doesn’t require forming a full-time Rust team. The Google Fuchsia team, for example, has always made a point of not only using Rust but actively contributing to the community. Ferrous Microsystems has a number of folks who work within the Rust compiler and embedded teams. In truth, there are a lot of employers who give their employees time to work on Rust – way too many to list, even if I knew all their names. Then we have companies like Embark and others that actively fund work on their dependencies (shout-out to cargo-fund, an awesome tool developed by the equally awesome azfoltzer, who – as it happens – works at Fastly, another company that has been an active supporter of Rust).
- 4 comments
Printer-friendly version
- Read more
- 3512 reads
PDF version
Mozilla Leftovers
Submitted by Roy Schestowitz on Tuesday 22nd of December 2020 02:20:07 PM Filed under

-
Scammers use Chrome, Firefox extensions in widespread ad fraud campaign
The scammers are using malicious browser extensions— a tried and tested fraud tactic — to inject bogus advertisements into the results displayed on a search engine page. The more users who visit the fraudulent ad pages, the more money the perpetrators earn via a traffic-driven advertising program. Microsoft did not identify who was responsible for the attacks, or how much money they had netted.
-
Firefox Browser updated to 84.0.1 [in] PCLinuxOS
The Mozilla Firefox browser has been updated to 84.0.1 and is a minor bug fix update. This update will appear in your Synaptic Package Manager if you are using Firefox.
-
David Humphrey: SnowyOwls.ca
But as the snow begins to fall each December, my attention turns to another owl: the Snowy Owl. Normally at this time of year I'm seeing Snowy Owls on my long commutes to and from work. With COVID, I'm not out driving anymore, and as such, I'm not having as easy a time finding them.
I decided that this year's marking-side-project would be a tool to help people find Snowy Owls near where they live. I've long wanted to play with eBird and the eBird API, and hoped that I could get recent sighting data this way. To use the eBird API, you have to create an account and then request an API key. After that you can do all sorts of interesting queries to get current or historical data about sightings by species, region, or location.
[...]
As we enter our tenth month of the pandemic, I wanted to make something for the current moment. Christmas won't be the same this year: we won't be able to celebrate or visit our parents, siblings, or their families; I can't get together with any friends for a meal; and many of the usual traditions our family has are off the table. I'm sad at all of it.
I can't fix any of this, but I wanted to do something to give some small bit of joy over the holidays. While the pandemic forces us to avoid each other, we're still allowed to go outside, to drive in the country, to walk in the park or along the shoreline, and to look for Snowy Owls.
As I was finishing up the app's code, I noticed that a new owl had been spotted 15 minutes from our house. My wife and I drove off into the falling snow in search of it, creeping along an old fence line stretched across a farmer's field. It was really beautiful to be out, to be hopeful, and to be focused on what is yet to come.
- Login or register to post comments
Printer-friendly version
- Read more
- 1156 reads
PDF version

More in Tux Machines
- Highlights
- Front Page
- Latest Headlines
- Archive
- Recent comments
- All-Time Popular Stories
- Hot Topics
- New Members
today's leftovers
| Programming Leftovers
|
Devices: Xtra-PC, Arduino and Inventor Coding Kit
| Security Leftovers
|
Recent comments
14 hours 28 min ago
14 hours 34 min ago
15 hours 45 min ago
16 hours 30 min ago
17 hours 5 min ago
20 hours 6 min ago
22 hours 18 min ago
22 hours 37 min ago
1 day 5 hours ago
1 day 5 hours ago