HNHacker News
TopNewBestAskShowJobs

mimasama

142 karma · joined March 24, 2024

submissionscomments
mimasama··on The case against JPEG XL
AV1 wasn't also exclusively designed and developed by Google.

Chrome's team should be blamed for favoring AVIF over JPEG-XL, not Google entirely.

mimasama··on GIMP Development Update
Zipped XML? Isn't that just OpenRaster? (which is already supported by GIMP anyway, but also supported by Krita and other image editors)
mimasama··on Cloudflare breaks promise to not gatekeep small browsers
Since HN apparently strips out URI fragments I meant to link to this post in the thread (latest post as of writing): https://forum.palemoon.org/viewtopic.php?t=33442#p273914

> And worse yet, I was just now told that CF "provide the troubleshooter as a quality-of-life tool and maintain it with best effort." So they aren't even committed to making it work while that was one of the very things that kept coming up in our meeting as it was the only tool remotely available to be able to test Pale Moon (other than testing internally which they seem unwilling to consider, as well) prior to them pushing things to production, so they are already going back on their promises.

> I'm really running out of what little patience I have left with CF. They have effectively not addressed our problems, not provided answers, not told me what behaviour is wrong or broken in Pale Moon (according to them), not provided any tools, and are now playing down the one thing we could use in some fashion as "best effort without commitments", while continuing to be gatekeepers for the Internet and access to large swathes of it. EU's Digital Markets Act is pretty clear about how that is not acceptable behaviour -- even if it was written initially to deal with "preferred bundled software" for operating systems, it does lay the groundwork for addressing unfair practices by other types of gatekeepers like CF.

mimasama··on Cloudflare gatekeeps small browsers by requiring WebGL draft for their CAPTCHA
And the funny thing is that the WebGL context attribute they're asking for is not even the root cause, so implementing it didn't do squat. But it shows the attitude of Cloudflare to the open web: we don't care about mature and stable web standards, or the fact that you don't allow automating your browser by intentionally not implementing WebDriver or Selenium, implement these draft features unrelated to actual bot detection or we will consider your browser a robot and block it.
mimasama··on I tried Firefox's new AI 'Smart Window' in a beta build
> My memory list isn’t populated with things Smart Window learned since I enabled it. Oh no.

> It has activity going back months. We’re talking searches and website interactions from long before I enabled this. features.

> Firefox just handed that history to the AI models to plough from, without telling me upfront.

Pretty concerning that Mozilla at this point has made sharing all of your browsing history the default, without even asking you about it. This is a beta version, which is pretty much like a release candidate in Firefox, being the next version to be published after all. This shouldn't have reached beta at all.

mimasama··on Firefox Nova – our first look at the browser's big redesign
Are they really going to double down on the tabs looking like buttons.

Anyway not looking forward to my userChrome CSS for tabs on bottom ending up broken again in the redesign

mimasama··on Keep Android Open
I email my dad documents and photos I need printed (and he uses his work office's laser printer). I forward the billing statement I receive monthly from my family's ISP to my mom via email. And I'm "Gen Z"
mimasama··on France's homegrown open source online office suite
Sure, "all" operating systems. "All" that is OSes that have a web browser built for it that at least supports [TransformStream](https://developer.mozilla.org/en-US/docs/Web/API/TransformSt...)... And the browser and spec written and maintained mostly by people outside of France. Kinda compromises the point of being "sovereign" doesn't it?
mimasama··on Termux
I use Termux for my OTP implemented in a bash script, I trust oathtool more than an app.
mimasama··on Notepad++ hijacked by state-sponsored actors
> Even after losing server access, attackers maintained credentials to internal services until December 2, 2025, which allowed them to continue redirecting Notepad++ update traffic to malicious servers. The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++.
mimasama··on XHTML Club
> Better question, why don't we upgrade XML to do that?

XSLT which is an application of XML allows you to do a for-each: https://developer.mozilla.org/en-US/docs/Web/XML/XSLT/Refere...

mimasama··on FOSS "just fork it" delusion
> when that problem is big enough that enough people are thinking about forking it

Isn't that a situation where forking happens as "a last resort when projects become irredeemably captured or hostile" as the article writes?

I think you're the one who missed the point and haven't digested this blog post properly.

mimasama··on Constructing the Word's First JPEG XL MD5 Hash Quine
Actually JPEG XL is based in part on Google's PIK format. The Zurich team from Google Research (which developed PIK and Brotli) is even actively working on JPEG XL to this day.

The reason why Chrome (also a Google product) removed it at first is more likely to be internal politics. Google is a very large corporation after all, with each faction within it having its own priorities and alignments. In the case of Chrome the team there are probably more aligned with the AVIF/AOM team than with Zurich/PIK when it came to the next-gen image format to be pushed (which would explain why Chrome did not have problems with Brotli, because there wasn't a competing Google faction that is developing a replacement for gzip).

mimasama··on XSLT RIP
WebExtensions still have them? I thought the move to HTML (for better or worse) would've killed that. Even install.rdf got replaced IIRC so there shouldn't be much traces of XML in the new extensions system...
mimasama··on XSLT RIP
Pale Moon still has XSLT support and has no plans to remove it: https://outerheaven.club/notice/AxFlFCfzzgRRpvubVw
mimasama··on Chromium Browser DoS Attack via Document.title Exploitation
This is a very old problem, known since Chrome 49: https://issues.chromium.org/issues/41245417, https://issues.chromium.org/issues/41246063

Simply a consequence of multi-process' inter-process communication (IPC) swamping the task scheduler. Changing the title requires a message to be sent from a content process to the UI through IPC. If you sufficiently flood the IPC protocol with messages, it will bring your browser to a halt in its entirety because you're basically DoSing the browser's internal communications.

Single-process browsers (e.g. Pale Moon) and browsers that have previously been designed primarily with a single-process model in mind and only adopted multi-process later (Firefox, Safari) would've handled this better by at the very least not locking up the browser and eventually the OS with a runaway meltdown in memory allocation.

To test this theory I've forced the Brash code to run with `Brash.run({burstSize: 8000,interval: 1});` in the devtools console. Why the PoC author decided to arbitrarily restrict the running the PoC only to Chrome-based browsers, I don't know. If non-Chrome truly is not vulnerable we should be able to verify that for ourselves.

In a fresh profile of Pale Moon without add-ons (and immediately closing the devtools afterwards) the UI does slow down but it's still usable (and therefore the offending tab can be closed even after a while). If you never reopen devtools in the offending tab the memory never even reaches 1 GB. In the worst-case scenario where the browser would hang (which could happen if you try to open up devtools in the offending tab for example), the memory allocation doesn't get instantly out of control, and the OS will recognize that it's hanging and let you close it.

In Firefox the UI is still working somewhat but memory allocation is faster than Pale Moon (but a bit slower than Chrome). Memory becomes manageable though when you switch focus to another tab; it no longer allocates more memory and the garbage collector was able to free up memory in the offending tab's content process with the JavaScript engine no longer blocking it thanks to the said content process being suspended in the background. However the main UI process will still hold a lot of memory unless you switch back to the offending tab for the garbage collector to recognize it needs to free up memory there. And if you close the offending tab before that you get yourself a memory leak, i.e. the memory allocated by the UI process will never go away, at least until you rerun the Brash code again (where the garbage collector will then recognize there is memory to be freed in the UI process).

I don't know about Safari, I have no Apple device to test it with unfortunately.

mimasama··on Secret diplomatic message deciphered after 350 years
This deserves an Ig Nobel Prize lol.
mimasama··on Cloudflare is sponsoring Ladybird and Omarchy
And it's not just the WebKit monopoly in iOS, but also being slow on adopting new features pushed by Google. Often even being slower than Mozilla funnily enough. I don't care about what Apple's intentions could be for being a slowpoke on adopting the new features, as long as it allows independent browsers like Pale Moon to catch up with the mainstream.
mimasama··on Firefox starts testing "Link Previews"
I tried the link preview feature on a link to the English Wikipedia article about Touhou Project, and the LLM's key points are just hilariously bad. For some reason it's focusing too much on the PS4 and Nintendo Switch (which the LLM "thinks" were both released on August 15, 1997). I have a screenshot 6 days ago when it wasn't a Firefox Labs feature yet in my Misskey: https://makai.chaotic.ninja/notes/a6d86p8n26

Tried it today in an updated Nightly and the key points are still the same lol.

mimasama··on Cloudflare: Trapping misbehaving bots in an AI Labyrinth
"Bot attack protection" mode is also opt-in and many sysadmins just enable it immediately after setting up their website with CF and forget about it (because Cloudflare's marketing suggests it), leading to legitimate browsers being blocked: https://news.ycombinator.com/item?id=43329320

With so much hate towards LLMs right now (which isn't unjustified) being vented on the internet there's no doubt sysadmins will do the same here and niche user agents will again suffer.

mimasama··on Implications of Global Privacy Control
"Tracking" is pretty vague and trying to stop it is just unenforceable, unlike "selling personal information" which is very clear and what GPC and the CCPA and GDPR cover. I often criticize Mozilla but they're correct in replacing unenforceable DNT (which is also worse fingerprinting-wise since it has three possible values instead of being a binary on-off signal) with GPC. It's long overdue.
mimasama··on Cloudflare asks browser devs to sign insane NDAs before fixing browser blocking
By default the browser checks for available updates, whether for the browser or the add-ons (in the latter case, it's most probable that at least one installed add-on is hosted in the Pale Moon add-ons site). There's also the sync service, and default start page at start.palemoon.org. You can probably gather some stats from those sources.
mimasama··on Cloudflare-Pale Moon dialogue stalled by overly broad NDA & secrecy of broken JS
Despite a long working relationship between Pale Moon and Cloudflare in the past, the latter refuses to disclose to the browser developers the 2 particular JavaScript functions and some CSP assumptions required by CF's browser check.
mimasama··on A look at Firefox forks
> Yes browsers share your data, it's a browser...

That's not the problem people have with Firefox. One of the issues right now is that there are people who have intentionally opted-in to sharing "technical data" to Mozilla for the sole purpose of improving the browser, when in fact, it's not just for that but also for improving ad-tech which was never an intent those power users had in mind: https://www.quippd.com/writing/2025/03/12/mozilla-has-been-s...

mimasama··on A look at Firefox forks
It's not the exact same revenue model. Floorp doesn't use tracking whatsoever for sponsored ads in the home page. And donations to Floorp directly goes to development, unlike in Mozilla.
mimasama··on A look at Firefox forks
I think the issue is that the donations Mozilla receive don't go to Firefox's development. This is not the case with Floorp, Ladybird and Pale Moon where donations and sponsorship money (PM used to accept sponsors but they don't now) do go to development.
mimasama··on A look at Firefox forks
Besides, it will just end up being an xkcd 927, lol.
mimasama··on A look at Firefox forks
Yeah "donations" is not the right word, it's more like "sponsorship"... It does work though, I haven't heard of CubeSoft before I used Floorp and I have one of its PDF tools installed now. This is how advertising should work, not the tracking ads Mozilla (and idc if they're trying to make it "privacy-preserving" or the data aggregated, it's still tracking), Google, and co. want
mimasama··on Tranvia: The Mass Transit System in Metro Manila: From Tranvia to MRT, 1879-2014
A Filipino documentary about the history of rail in the Philippines' capital region.
mimasama··on Verifying Firefox Sync privacy claims
What if the Firefox account's password got compromised and the attacker doesn't have access to any of the user's devices?

The previous sync (Sync 1.1 aka Weave) used to protect against this scenario by not allowing any synced data to be decrypted at all (since the sync server does not have your secret key at all).

Page 1 of 2Next →