robolange

"Explained" is perhaps too generous a word. I'm a software engineer and I found that page to be confusing. It seems to be written for internal Mozilla employees, not for the general public.

I too use Debian's Firefox ESR. I noticed the "Allow Firefox to install and run studies" option in Privacy & Security Preferences a long time ago. It was unchecked and greyed out (i.e., unclickable), and a label below it says "Data reporting is disabled for this build configuration", so I gave it no further thought. This morning I woke up and launched Firefox, noticed this headline, and then noticed my extensions were still running. I looked in about:config and lo and behold, app.normandy.enabled=default [true]. I'll be filing a bug with debian to disable this in the build configuration.

Edit: There are some questions about whether Normandy is really enabled in Debian Firefox ESR even if the about:config setting defaults to true. I've filed a bug report, and I'm sure once a Debian maintainer has a chance to look at it we'll find out the answer.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928433

Edit2: It should go without saying, but please do not spam this bug report with "me too" and its ilk.

Fair enough. I had a few minutes of spare cycles and I tried it out. It failed on the first thing I tried (installing Typescript), so I dropped it and didn't look back.

Last time I used UserLand I couldn't install something major (maybe typescript from npm, it's been a while) because there was some file path limit (maybe 143 bytes, again, it's been a while) that a bunch of the package's files violated. Has this been addressed with new versions?

I see people mention Waze frequently as a competitor or alternative to Google Maps. It's useful to remind people that Google also owns Waze, so it's really just another Google product.

If I recall correctly, immigration in the US is considered a civil, not criminal matter, so there is no right to an attorney if you cannot afford one.

I would live it if someone did a really good anthology series based on the Silmarillion. Those were some epic stories that, if told fully, could easily rival the Lord of the Rings.

Yup. My 1987 Toyota pickup contains no digital computer whatsoever. It's so mechanically simple. I'm pretty sure I could do or have done any major repair (e.g., full transmission replacement, major engine overhaul) for less money than the cost to replace a just-out-of-warranty computer module in a newer vehicle. I realize that computers enable better fuel efficiency, but I just don't see how all that added complexity is worth it in a gasoline-powered vehicle. I'll willingly part with it only when all-electric becomes economically viable.

That is true for distribution-hosted repositories. But how many web sites are there that are like, "Add this line to sources.list, then run this apt-key command, and then run apt-get install our-app." So few people bother to check for a web of trust for the proffered key (or even know how to, or even grok the concept) that there is little functional difference.

Doesn't Mirai use UPnP IGD to work around NATs/firewalls? I imagine a lot of people have that activated on their router to play video games and whatnot.

https://krebsonsecurity.com/2016/10/who-makes-the-iot-things...

Edit: I guess it's more accurate to say that a lot of poorly designed devices use UPnP IGD to work around NATs/firewalls and Mirai takes advantage of this to infect them.

The main take-aways are: 1) Use a firewall between your Internet connection and your IoT devices, and 2) disable UPnP support on your firewall.

It's disturbing how many devices enable telnet and/or ssh by default, make it difficult or impossible for a user to actually change the default password, and subvert firewalls using P2P protocols. At the end of the day, to secure your network you really do need to run nmap regularly against your subnet checking for devices with open ports, and tcpdump between your gateway and your devices, monitoring what connections they are actually making.

For ordinary users, the situation is truly hopeless. They are pwned by default if they buy into IoT.