bugmen0t

"Why the strange name? AssemblyScript is to Assembly as JavaScript is to Java. Not quite."

Lovely.

I'd love to know if you can still use a third-party browser (e.g., Firefox) and if it would inherit lockdown settings per web page (given that all iOS browsers have to use webkit webview).

It works smoothly with high quality using CrossOver (wine) on my M1 MacBook pro from 2021.

Donate to a tech history museum.

Pervasive traffic monitoring is an attack and it is an attack being carried out in massive scale. I believe HTTPS is the most meaningful and available method out there to stop this attack.

If your website does not support using HTTPS you are an accomplice in pervasive monitoring.

localhost is in the Secure Context specification. It won’t be taken away.

Mozilla

Are crypto "currencies" a black ball technology as they are incentivizing heavily-destructive practices, i.e., massive energy consumption?

I believe my point was that asking users is… tricky.

I think we all agree that we want faster horses.

Heard of https://1x.engineer/ ?

Nit: `integrity` also works for stylesheets, not just scripts

Practice. Find a course, a group, something where interacting with people is normal and you have a shared conversation topic (homework, practice, worst case the news, the weather, the weekend). Maybe a language class?

It's OK to prepare statements in your head so you don't have to blush or worst-case come up with something inappropriate.

Firefox has easter eggs AND visible credits. The former I won’t tell. The latter is about:credits.

With the commodification of free and automated certificates, I'd argue that authorities become less and less tech savvy: There is little to no money in the business sector, which means there's less possibility to keep technical people around.

Also, I am surprised what exactly is making you think that the baseline requirements do not exist for security reasons (even if it isn't exclusively about cryptographic security).

Write a popular web app. Make it work on Firefox only ;-) worked for Chrome at least…

I strongly believe that you don't have to use your power for evil.

It may be true for the early hackers, but there are many famous hackers that have not been in prison. Just think of the people like Dan Kaminsky.

As pointed out by sibling-comments, this seems to be in the context of making sandbox escapes harder.

There are security checks for detecting userChrome.js. My understanding is that Firefox is going to let people customize as before but just not enable some security enhancements for those users. https://searchfox.org/mozilla-central/rev/02bd3e02b72d431f2c...

This is a "chrome script" extension, which downgrades some of the built-in Firefox security features. Use at your own risk.

This mode exists to enable the Tor browser's idea of fingerprinting resistance. The reasoning for why it works the way it does is documented in their design document at https://2019.www.torproject.org/projects/torbrowser/design/#....

Ah, again? Happens to me all the time.

"Thirty arguments should be enough for everybody"

Can't reproduce. The notification starts scrolling into view the same time the webpage becomes full-screeen. Firefox Nightly on Linux Desktop here.

Please report a but with more details if this is also true for you on Firefox Nightly.

The "portable version" is not maintained pr built by Mozilla and breaks/disables the sandbox. Don’t use it.

Seems to me like a CSP bypass bug that all implementors of svg fonts (cough, cough, webkit) should fix :)

Cool. What’s the interop story between Go‘s existing implementation for parsing objects with duplicate keys? Keep first, overwrite or abort?

Some of the statements in this article are just not true. The post seems to get frequent edits and always looks new/recent when I visit it, though I’ve seen and rebutted it several times over the last years. Yet, apparently nobody made the effort to verify the claims with more recent analyses.

A real shame.

Pretty sure you will be able to opt out via group policy. If you control your network so hard that you can accept CSRF, it even makes sense. But would you swear that none of your smart devices are terribly insecure and incapable of even updating at all? You’ll have my utmost admiration if you can.

s/security/privacy/