moosingin3space

Yes, it is, and over 50% of Linux CVEs are memory-safety related.

A ton of stuff related to eBPF, last I saw.

It makes it so that your mirror would have to be exploiting apt, instead of effectively anyone. As a result, using TLS for downloads would mitigate this (but not fix it).

I've read the arguments against HTTPS for apt many times. They're wrong.

I find the touchscreen support to be pretty good with Fedora's patches running on Wayland. I think these patches are slated for upstreaming, so get excited!

Disclaimer: I contribute to Firefox and enjoy it quite a bit.

Also, since Fedora is primarily an integration project, many users report bugs upstream.

If you're confused as to why, this article was illuminating: https://scotthelme.co.uk/using-security-features-to-do-bad-t...

> visually are a single char

IIRC that's what grapheme clusters are for.

It really isn't that ridiculous that someone who has worked as a network engineer for a decade would use Erlang, C++, and Go. Even Haskell isn't too much of a stretch, considering the user's company has functional programming expertise in Erlang. Rust is a neat language that, depending on their workload, could replace all of those languages. Why the presumption of bad faith?

In your particular example, the ownership system would help here, since `foo` is consumed by `doBazWithFoo`. (Only exception is when `foo` is `Copy`.)

In Rust, you're supposed to use `unicode-segmentation`[1] if you need to split on logical character (grapheme cluster in the Unicode standard). Otherwise, the iterators `.bytes` emits raw bytes, and `.chars` emits UTF-8 codepoints.

Basically, string indexing is a lot harder than it seems at first glance, depending on what you want.

In retrospect, you're correct. I should have said "WR reduces the cost of the paint/composite cycle".

I'm going to offer a different explanation, but first, the standard one: Mozilla doesn't want to miss a paradigm shift, especially one where the only players currently in it are very proprietary. They learned their lesson with mobile.

One thing that many of us, myself included, are very excited about regarding the Servo/WebRender/Quantum projects is the ability for a fast, parallel web rendering engine to open new possibilities, such as how V8's JIT significantly pushed the envelope of what was possible. Now that JavaScript is acceptably fast, and we have WebAssembly for cases where control over memory layout is necessary, network speeds are the bottleneck of most applications. WebRender's big concept of rendering the entire web at "maximum FPS" is pretty awesome, but it's not pushing the envelope by itself, since framework and application developers have been treating "minimize DOM manipulation" as an important optimization. There's clearly potential with WebRender, but if a majority of used webpages are already rendering at an adequate framerate due to framework-level optimizations (and prior browser optimizations like Electrolysis and Stylo), it may be viewed as superfluous, despite potentially huge advantages.

I think the research in this direction is beneficial, and as a result, I'd like the Servo project to be allowed to continue developing cool stuff. As Servo won't replace Gecko in Firefox, it needs to try more challenging tasks to continue to push its envelope. WebRender has a ton of potential in the WebVR space, since a Web Components-based VR system would rely heavily on a performant DOM. Such a project would push Servo to continue development in preparation for a more functional future web.

That's also a problem, though, because an attacker just needs a large number of nodes to effectively control the currency, which is not challenging or necessarily costly (see: Mirai). Doesn't stop the hardware race that leads to centralization.

If the incentives promoted by cryptocurrencies inevitably lead to centralization, what's their benefit over the existing financial system?

On Fedora, there's a system Python interpreter installed at `/usr/libexec/system-python` that is used to run Python tools installed in the base system like `dnf`. On my F29 system, it's version 3.7. You can't install pip packages into the system Python environment, which helps you not break your system, like what can happen if you've ever run `sudo pip install --upgrade pip` on Ubuntu or Debian!

Red Hat does not own anything that's valuable aside from their developers, who chose to work at Red Hat due to their pro-FOSS positioning. If IBM chose to start shutting projects like Fedora down or move in the direction of closed-source, these developers would have no desire to remain, and would leave, making that $40B acquisition worthless.

For these "pet containers", Fedora has been building this: https://github.com/debarshiray/fedora-toolbox. The Toolbox is built on top of runc, but uses it to run a mutable container.

I'm excited about Silverblue, just need to get a few more apps into sandbox-ready Flatpaks...(Firefox, I'm looking at you)

Right now, this is automatically enabled based on whether the application runs in a Flatpak sandbox. I spoke with GTK developers on IRC, and while they want to enable it by default, there are some unresolved issues, summarized in this Reddit comment: https://www.reddit.com/r/firefox/comments/9my9fe/qt_file_pic....

In case this is serious, 64-bit builds of Firefox have been produced officially for a while.

I actually wrote my own extension to do quick tab movement across multiple windows (often on different monitors/workspaces) all from the keyboard: https://addons.mozilla.org/en-US/firefox/addon/workspaces-fo...

The environment variable only works with apps using GtkFileChooserNative, a GTK3-only API that landed in GTK 3.20. (In Firefox, my patch will fall back if you have an older version of GTK3.) GtkFileChooserNative was designed for use by sandboxed Flatpaks, but the environment variable can force it on outside of a sandbox.

DevTools UI is actually currently being re-written with React, so it can be more easily hacked on and benefit from all the performance work Quantum brings. Check out https://github.com/devtools-html to see the progress of this work.

It should be possible to build this with an extension, but I haven't tried.

That being said, there are a few alternatives. Firefox Top Sites supports search engines, as described in https://blog.mozilla.org/firefox/save-a-search-step/. Additionally, if you use DuckDuckGo as your default, you can use bang patterns, which I prefer as they are curated.

This depends on what `xdg-desktop-portal` DBus service is running on your setup. In most non-DE environments, there is no `xdg-desktop-portal`, and as a result, GTK will automatically fall back to GTK file selectors.

If you'd like to use KDE file selectors in a non-DE setup, you'll need to get `xdg-desktop-portal-kde` working.

I don't know about that. This particular environment variable is handled by GTK, not Firefox.

Kind of a niche thing to comment on, but this release lands a commit I made that enables XDG desktop portals support in Firefox. If you're on KDE Plasma, you can run Firefox with the environment variable `GTK_USE_PORTAL=1` set and it will use KDE file selection dialogs.

> should be designed and implemented holistically for best results

This is why I, a privacy-conscious individual, don't follow any of these guides in my Firefox. If you follow the discussion on Bugzilla, the weekly team meeting notes, and occasionally ask respectful questions on Mozilla IRC, you come to a similar conclusion to me in that the Firefox development community is doing the right thing in not enabling this by default.

This is what first-party isolation is supposed to help with.

There is (was?) a prototype built on top of Servo and browser.html for this: https://medium.freecodecamp.org/lossless-web-navigation-with...

Not sure if it has any traction anymore.

I am incredibly excited for this!

NLL is stable in 1.31?