moosingin3space

I had read somewhere that AMD PSP does not have Internet access.

Does this attack affect the security of RSA-based SSH keys, or is it TLS-only?

If I remember correctly, it's in Nightly behind a feature flag, not Beta.

I'm not sure that there will be many XUL extensions left maintained after a while -- since no major browser supports them and the fact that WebExtensions is a much easier framework for development. As a result, I don't see much of a future in Firefox pre-Quantum forks.

I really like this idea. Would improve the user-visible quality of wireless mesh networks where latency can be high.

It is my hope that one day, we'll use IPFS and other similar tools to enable our apps to work effectively in mixed-connectivity environments.

> Who actually cares about browser speed?

This, from Hacker News, who not one week ago was complaining about "everything being perceptibly slower" and who constantly complains about latency in applications. Pretty sure everyone cares about browser speed.

On Gnome with Wayland, it works, but only with integer multiples. Gnome 3.28 (which will ship in F28) will have full fractional scaling support if you need that.

> WASM sold a lie

What? The original WebAssembly announcement[1], which can be viewed as the manifesto for how WASM was envisioned, it clearly says "once browsers support the WebAssembly syntax natively, JS and wasm can diverge". Eich's goal with WebAssembly is not replacing JS, it's providing a better compilation target for other languages. WebAssembly is a replacement for asm.js, not JavaScript. No one is selling a lie here.

[1]: https://brendaneich.com/2015/06/from-asm-js-to-webassembly/

It uses `electron-builder`, which has rpm support. I don't think it would be that difficult to add in a pull request, might do it myself later. (I use Fedora, with SELinux and Wayland and all that good stuff)

This tool is lighter-weight than firejail. nsjail seems to be a thin abstraction over Linux namespaces, while firejail contains profiles for common desktop applications and some X hackery to enable jailing of GUI programs.

This link should clarify what is preserved by the refresh.

https://support.mozilla.org/en-US/kb/refresh-firefox-reset-a...

A forum thread[1] suggests it may be possible to use the profile refresh functionality to recover most of the profile. Only problem is that it does not preserve extensions or settings.

[1]: http://forums.mozillazine.org/viewtopic.php?f=38&t=3032457

NoScript's author works on the Mozilla Security Group. As a result, this particular extension was one that was strongly pushed. The author will be releasing a WebExtensions version in time for 57. He maintains the legacy version for the benefit of Tor Browser (based on 52ESR) so there is no chance for breakage before Tor Browser moves to 59ESR.

NoScript isn't about bluntly disabling JavaScript. It's a set of tools for managing what scripts can do and what scripts run.

If this is a problem for you, please switch to 52 ESR and use it until June 2018, and file bug reports against those legacy extensions. Disabling updates for a piece of software that is used to run untrusted code is a terrible piece of advice.

"Trusted data" can exist in theory -- on a closed network where you control all endpoints -- but does not exist in practice (as many devices eventually connect to the Internet or exchange data with Internet-connected computers).

Therefore, it follows that re-writing parsers in memory-safe languages would provide a nice bang-for-buck.

> I'm quite bored by the obsession of some for replacing C.

Well, I'm quite bored of the endless stream of memory safety vulnerabilities that can be systematically eliminated with memory-safe languages like Rust. Note that every single one of the CVEs disclosed yesterday in dnsmasq are memory safety violations, and the fact that buffer overflows, data races, and other related errors are not only pervasive, but also tend to sit around for years in codebases[1].

> Nobody would criticize assembly for letting you shoot yourself in the foot, C is much the same.

It's completely acceptable to criticize the choice of any tool. I can and do criticize the use of C for any code that touches a network and in some cases consider it willful negligence, as using a non-memory-safe language to parse untrusted data is asking for trouble.

[1]: https://twitter.com/johnregehr/status/914663997647069184

The target audience is people who casually use the terminal (probably over ssh) and need something simple to edit a config file with. This comes with all the basics that people expect from a graphical editor like Notepad++ and comes with familiar keybindings from CUA applications. I could see something like this being very useful for that use case.

That other entry is probably the most creative exploit of a language package management ecosystem I've ever seen.

IIRC, Python's `os.path.join` behaves the same way if you join with an absolute path.

This release only includes the CSS components (Stylo) from Servo. The new rendering architecture, WebRender, is expected to land later.

I wouldn't consider seL4 to be a "C project". Yes, their github repository is mostly C, but the process of writing seL4 was extremely involved: write the kernel in Haskell, then write it again in C, then prove that the C is equivalent to the Haskell. seL4 is ~9000 lines of C, ~600 lines of asm, and ~200,000 lines of Isabelle (theorem prover).

I don't disagree with your use of OpenSSH as an example.

The goal of this series is to explain the techniques behind the performance improvements coming in WebRender.

Additionally Mozilla is not re-writing anything from scratch, instead working toward integrating components from Servo into Firefox.

With the major exception that all evergreen browsers (most browsers in wide use today) quickly officially support new web standards, but Windows, OS X, and Linux are unlikely to ever officially support each others' native toolkits.

They discovered Discourse, which uses Ember.js.

I've used both on Fedora, and found tuned to be easier-to-use and more effective. tlp also does not work well with SELinux, and as such causes a flurry of errors every time you change the power state (sleep, resume, plug, unplug), which may be part of why I found it ineffective.

The way I set up my tuned profile is pretty simple:

    sudo dnf install tuned-utils
    sudo powertop2tuned -n laptop

Then, I edited the profile in `/etc/tuned/laptop/tuned.conf` and enabled things. On my Thinkpad X220, simply enabling everything worked great, but my Asus ROG laptop and my friend's Razer Blade had issues with that, so YMMV wrt what to enable. Then, I added USB autosuspend support by adding the following to the profile:

    [usb]
    autosuspend = 1

After that, I ran `sudo tuned-adm profile laptop`, which sets it and tells tuned to start on boot, and have had vastly improved battery life, good performance, and no hassles since.

On my laptops, tlp on Ubuntu/Debian/Arch (when I used those) and tuned on Fedora (which I've used since F25) have been awesome, so power management is unlikely to be the biggest issue with this phone.

That was a long time ago, and I think it's discontinued. Gnome Mobile and Embedded Initiative hasn't had an update presented at GUADEC or any other major FOSS conferences in 8 years.

With X11, an exploit in any GUI application can be turned into a privilege escalation vulnerability. On Wayland, to achieve the same, an exploit in a GUI application would need to exploit another application running with higher privileges to escalate.

Not running apps you don't trust is an overly simplistic security model, and completely ignores exploits.