Fuzzyfox[0] is an implementation of a research idea that severely
limits the data that can be extracted by timing side channels
exploited by untrusted JavaScript. It effectively provides a knob that
allows one to control the amount of data that can be extracted by
controlling the coarseness and fuz
I imagine there's a good reason; but I'm curious: why do we want to
keep this legacy, prefixed pseudo-class and not just use is()?
-tom
On Sat, Sep 19, 2020 at 3:36 PM Emilio Cobos Álvarez wrote:
>
> Summary: Implement the legacy :-moz-any selector as an alias of :is().
>
> This means that it'll
Hey Geoff - what sorts of things would be appropriate to file there?
Or perhaps as a more basic question - what *is* comm-central? Is it
'mozilla-central with constantly-rebased Thunderbird patches on top?'
Is it an old fork of mozilla-central where a lot (or very few) patches
are copied across? So
Thank you for continuing to keep try syntax working. I know I'm
holding back progress by not spending the time to figure out how to
convert `./mach try -b do -p win32-mingwclang,win64-mingwclang -u all
-t none` to fuzzy (maybe it's something like `./mach try fuzzy
"'mingwclang -talos"` ?).
-tom
On Fri, Jun 26, 2020 at 7:34 PM Andrew Halberstadt wrote:
>
> On Fri, Jun 26, 2020 at 3:14 PM Jeff Muizelaar wrote:
>>
>> What percentage of the space used for artifacts is actually builds
>> that are used for mozregression vs other stuff (like debug builds)? Is
>> there a way that we could someh
On Mon, May 4, 2020 at 10:45 AM Frederik Braun wrote:
> To help leak data and metadata about security vulnerabilities, Tom has
> implemented a hook for hg.mozilla.org that disallows pushing patches for
> security bugs to Continuous Integration.
Just to correct this credit; I had restarted some
I'm pretty sure that if you're not in the System Principal; your
timestamps from the performance object are going to be clamped to 1ms
resolution (and potentially jittered forward)
I'm not sure in what context this will be used; or if there's
something that would prevent this timing behavior f
On Monday, March 9, 2020 at 6:40:16 PM UTC-5, Cameron McCormack wrote:
> Can we have the bots that operate on Bugzilla needinfo bug assignees when a
> bug is opened up and has an "in-testsuite?" flag?
I had been planning on making an autonag rule that reads a whiteboard tag like
[land-tests: 202
Hi all,
In Berlin we realized that our Bug Severity page is confusing and that
sec-critical and sec-high don't have a good distinction. We
endeavoured to fix this, and think we have. We have:
1) Split the Web and Client Severity page into separate pages. (And
updated them.)
2) Clarified the defi
I'd also like to call attention to one of the fixes.
Previously, linked (depends/blocks/regressions) security bugs would be
visible in the sense that you could tell a security bug was linked to
something but not see the bug.
And in many cases this caused people to avoid linking bugs to avoid
disc
We sandboxed av1 into its own process for security concerns.
Presumably this is using the same or a similar library; so do we have
plans for mitigating the same concern before rolling out to users?
-tom
On Wed, Jan 15, 2020 at 6:28 PM Jon Bauman wrote:
>
> AVIF is an image format based on the AV
at 2:44 PM Tom Ritter wrote:
>
>> In https://bugzilla.mozilla.org/show_bug.cgi?id=1592297 I plan/hope to
>> remove MOZ_QUIET and turn off the DOCSHELL/DOMWINDOW logging by default.
>> It will automatically be enabled in browser-chrome tests where it is
>> needed. (It a
Will non-mozilla websites be eligible to be added into our preload list, or
is it restricted to our own properties?
On Sun, Nov 17, 2019, 8:17 PM Dana Keeler wrote:
> The breadth of the web public key infrastructure (PKI) is both an asset
> and a risk. Websites have a wide range of certificate a
In https://bugzilla.mozilla.org/show_bug.cgi?id=1592297 I plan/hope to
remove MOZ_QUIET and turn off the DOCSHELL/DOMWINDOW logging by default.
It will automatically be enabled in browser-chrome tests where it is
needed. (It actually will no longer be possible to disable it when running
those tests
I will claim that the most common behavior of developers is to leave
XPCOM_DEBUG_BREAK alone and not set it to any particular value. I bet most
people haven't even heard of this or know what it does.
With that env var unset, in Debug mode, NS_ASSERTION will print to stderr
and otherwise do nothing
I wrote a similar thing, not nearly as friendly, that takes a taskgroupid:
https://gist.github.com/tomrittervg/9e99de9b3c517b8ba4e87d2a86985616
It seems like there should be some better platform for communicating these
types of tools.
-tom
PS: Other gists I have:
https://gist.github.com/tomritte
On Thu, Oct 17, 2019 at 1:35 PM Matthew N. wrote:
> On 2019-10-16 7:15 a.m., Paul Zühlcke wrote:
> > I plan to land a patch next week which will disable OriginAttribute
> > stripping in the permission manager. This will result in private browsing
> > windows and containers having isolated permiss
It's a bit hard for me to tell from the description - are these values
dependent on a user's hardware, performance of the user's computer, or
a user-chosen setting? If so we would want to support
resistFingerprinting.
-tom
On Thu, Oct 3, 2019 at 9:54 PM Andreas Pehrson wrote:
>
> As of Oct 4th
Summary:
window.outerHeight/outerWidth are legacy properties that report the
size of the outer window of the browser. By subtracting against
innerHeight/innerWidth it exposes the size of the user's browser
chrome which can be unique depending on customization, but at the
least reveals non-standardi
This is really exciting; thanks for this I had no idea it was in the works!
-tom
On Fri, Jul 19, 2019 at 3:32 AM Nicholas Nethercote
wrote:
>
> Greetings,
>
> PHC is a probabilistic heap checker I have been working on. It has landed
> and I am planning to enable it on Monday morning AEST (which
Just a note: we have a new template for Intent to X here:
https://wiki.mozilla.org/ExposureGuidelines
In particular, this one looks like it has all the same
concerns/problems with filters being applied to sensitive third party
content, and attacks that use timing to read that content. Are these
go
On Tue, May 14, 2019 at 9:23 PM Mike Taylor wrote:
>
> On 5/14/19 12:53 PM, Tom Ritter wrote:
> > On Tue, May 14, 2019 at 4:26 PM L. David Baron wrote:
> >> So I think there's may be value in removing these distinctions from
> >> the User-Agent header we s
On Tue, May 14, 2019 at 4:26 PM L. David Baron wrote:
> So I think there's may be value in removing these distinctions from
> the User-Agent header we send over HTTP even if they're still
> accessible from Javascript (and useful there for sites offering
> downloads).
While I would prefer to remov
If you have FPI enabled; it will override the StoragePrincipal switch
and always return the partitioned jar; correct?
Also, I don't think this is a big problem; but users who have enabled
FPI in the past and then disabled it will have pre-populated
sub-cookie jars for the trackers. This will link
On Mon, Mar 25, 2019 at 10:05 PM wrote:
> > As far as separating the value; it kind of depends on how you
> > implement it; but let's say you were going to use a static uint64_t or
> > something like that. Instead of heaving a static uint64_t, create a
> > Dictionary and look up the uint64_t usin
> > > Example 1: Let’s say touchId is currently set to 0 and no fingers are
> > > touching the touchpad. When a finger touches the touchpad, touchId of
> > > this event would be 1. As that finger moves around the touchpad, new
> > > touch events are added with updated coordinates, however, the
On Fri, Mar 15, 2019 at 4:47 PM J.C. Jones wrote:
> That's a good argument for us never "optimizing" it to avoid re-downloading
> already-known certs. Just download the whole set once, everywhere - the
> bandwidth savings are limited.
Yes and No. As ekr pointed out to me offline, there are so m
On Thu, Mar 14, 2019 at 3:26 PM Nicholas Alexander
wrote:
> J.C. -- I don't think this answers Tom's question, but perhaps it does. In
> that case I'll ask what I think is the same question:
Actually, what I was worried about was Mozilla being able to track
users based on what the client sends.
Thanks for more details on the use case.
On Wed, Mar 6, 2019 at 1:35 AM wrote:
>
> On Monday, February 25, 2019 at 4:17:29 PM UTC-8, Martin Thomson wrote:
> > To add to Dan's comments here...
> >
> > Assuming that I'm reading this correctly [1], the fingerprinting risks are
> > pretty extreme her
How does kinto know which certificates you yet need to download?
On Fri, Mar 8, 2019, 3:29 PM J.C. Jones wrote:
> # tl;dr #
>
> At the end of February I enabled Intermediate CA Preloading for all
> desktop Nightly users to begin gathering telemetry. This means all
> intermediate CAs disclosed to
On Tue, Mar 12, 2019, 1:18 PM Dave Townsend wrote:
> Thank you thank you thank you thank you thank you thank you thank you thank
> you thank you thank you.
>
+11
>
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/
On Wed, Feb 13, 2019 at 9:48 PM Matthew N. wrote:
> What about doing better sandboxing of the content
> process (e.g. ensuring a compromised process can't request information
> from the parent that isn't relevant to it)?
This is https://bugzilla.mozilla.org/show_bug.cgi?id=1505832
Its major sub-b
Can we set it up so we can manually runs tests on opt builds; but they
aren't by default?
I've had many instances where opt (and pgo) fail; but I can't
reproduce a test failure locally and can only do it on try. Letting me
run that test on the opt build will save the additional pgo build time
(bot
It's tracked in https://bugzilla.mozilla.org/show_bug.cgi?id=1515702 - we
should be backing it out soon.
To solve it immediately, you can add --disable-hardening
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listi
This would also be relevant for Tor; as they would like to disable
direct UDP and TCP IPC mechanisms:
https://trac.torproject.org/projects/tor/ticket/28148
-tom
On Thu, Dec 13, 2018 at 4:45 PM wrote:
>
>TL;DR: Is there a way to make a "manages" declaration conditional, for
> protocols that
On Wed, Nov 14, 2018 at 3:17 PM Ehsan Akhgari wrote:
> What are your plans with regards to implementing the second part? Can
> these reports be sent cross-origin? (From the spec, it seems like the
> answer is yes.) If so, how are you planning to handle issues such as
> sending these reports to
The Security and privacy considerations section reads like this:
[intro]
[paragraph saying the web page gets new information users would
normally consider confidential]
[details about the type of new information that is now exposed]
[discussion about how this can be used to
profile/bucket/fingerpr
On Fri, Oct 19, 2018 at 3:43 PM Dave Townsend wrote:
> On Fri, Oct 19, 2018 at 6:31 AM Tom Ritter wrote:
>> > On Thu, Oct 18, 2018 at 3:32 PM Dave Townsend
>> > wrote:
>> > > For cases where users manually downgrade an install of Firefox or attempt
>> &g
Awesome!
> On Thu, Oct 18, 2018 at 3:32 PM Dave Townsend wrote:
> > For cases where users manually downgrade an install of Firefox or attempt
> > to forcefully use an older version of Firefox with a newer profile the
> > profile downgrade protection feature will now tell the user that the
> > pro
I believe that we fiddle these for Resist Fingerprinting; can you ensure
the new values are similarly fiddled?
-tom
On Tue, Oct 16, 2018 at 10:02 PM Emilio Cobos Álvarez
wrote:
> (Trying to be more disciplined about pinging dev-platform@ about
> web-exposed changes, a few other emails will come
Are we bringing in a new third party library for this? (Seems like yes?)
Who else uses it/audits it? Does anyone else fuzz it? Is it in OSS-fuzz?
Are we fuzzing it?
How does upstream behave? Do they cut releases or do they just have
continual development and downstreams grab random versions of it
On Wed, Sep 12, 2018 at 12:09 AM, Tom Ritter wrote:
> However, thanks (again) to the efforts of all the reviewers, build peers,
> and especially Jacek Caban - we've been able to re-enable a MinGW build.
> We are now building with clang using the MinGW headers. (Previously it
Previous Thread:
https://groups.google.com/forum/#!topic/mozilla.dev.platform/r3mYWbb42pM
As of a few hours ago, there is a new Tier 2 MinGW build on TaskCluster.
It's in the 'Windows MinGW all' line, with the group WMC64 for 'Windows
MinGW Clang x64'.
The MinGW builds are part of the Tor Uplift
On Fri, Sep 7, 2018 at 12:54 PM, Ehsan Akhgari
wrote:
>In our implementation, once the Storage Access API grants storage
>access, all newly created third-party iframes of the same origin will
> have
>storage access for a period of time (currently defined at 30 days)
> without
>cal
CFI vcall requires one to specify a -fvisibility flag on the command line,
with hidden being the preffered. We set visibility explicitly in some
difficult-to-quickly-identify ways, and adding -fvisibility=hidden
triggered issues with NSS (as well as apparently being redundant to what we
currently d
Is this something worth making a lint over? It's pretty easy to make
regex-based lints, e.g.
yml-only based lint:
https://searchfox.org/mozilla-central/source/tools/lint/cpp-virtual-final.yml
yml+python for slightly more complicated regexing:
https://searchfox.org/mozilla-central/source/tools/li
On Wed, Jul 25, 2018 at 5:42 AM, Panos Astithas wrote:
> On Wed, Jul 11, 2018 at 4:52 PM Tom Ritter wrote:
>
>> Device Memory clearly has made an effort to make it 'less fingerprintable'
>> by only reporting possible values of 0.25, 0.5, 1, 2, 4, 8 - but there is
As far as I can tell the specification does not indicate any privacy
concerns; even though this exposes a system preference.
I'd request that if Resist Fingerprinting is enabled; the browser behaves
as if the user has not set any preference.
-tom
On Tue, Jul 24, 2018 at 2:34 AM, Hiroyuki Ikezoe
On Wed, Jul 18, 2018 at 9:21 PM, Bobby Holley wrote:
> In practice, I kind of doubt that standard libraries would actually include
> multiple implementations of the web platform.
>
It also seems like the implementation(s) that get included will essentially
be those those authors devote the resou
I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1475605 to capture
this issue and (most of) this discussion.
On Tue, Jun 26, 2018 at 5:17 PM, Brannon Dorsey
wrote:
> >
> > First, I think downright denying "private IP addresses" from DNS
> responses
> > is very hard and is doomed to break th
On Wed, Jul 11, 2018 at 6:25 PM, Karl Tomlinson wrote:
> Is there a guideline that should be used to evaluate what can
> acceptably run in the same process for different sites?
>
This is on me to write. I have been slow at doing so mainly because there's
a lot of "What does X look like and wher
I have a few concerns.
The Long Task Specification is essentially a way for a website to know if
you have other tabs open and if they are CPU intensive tasks. That seems in
pretty fundamental opposition to the Same Origin Policy.
Device Memory clearly has made an effort to make it 'less fingerpri
On Thu, Jun 28, 2018 at 11:42 PM, Nathan Froyd wrote:
> We have generally trusted people to use good judgement in what they
> use and how much review is required. Accordingly, I think you should
> request review from the people who would normally review your code,
> and if you have concerns abou
I'd just like to note that we still have
https://bugzilla.mozilla.org/show_bug.cgi?id=1383656 open to figure out
what is the best thing we can do with regards to making
size-correlation-based attacks difficult. When navigator.storage was
initially developed a low-effort-best-guess algorithm was put
On Wed, May 30, 2018 at 2:16 PM, Mike Hommey wrote:
> I'm sure the day we'll have to choose between not
> doing cross-language inlining or upgrading clang for e.g. security
> features is relatively close.
Oh. Are we doing this rustc inlining development on a particular old
version of clang? I'm
On Tue, May 29, 2018 at 8:48 PM, Jeff Gilbert wrote:
> It would be sad to see us standardize on a clang monoculture.
I wouldn't want us to abandon msvc and gcc as well-supported
compilers; but from just one perspective (security) it would be very
advantageous to have a single open source toolchai
I agree with ekr in general, but I would also be curious to discover
what failures we would experience in practice and how we could
overcome them.
I think many of the issues experienced with local builds are
preventable by doing a TC-like build; just build in a docker container
(for Linux/Mac) and
On Mon, May 14, 2018 at 1:57 PM, Jean-Yves Avenard
wrote:
> Hi
>
>> On 14 May 2018, at 6:47 pm, Tom Ritter wrote:
>>
>> It seems like this will reveal a lot of information about the user's
>> hardware. Does the Resist Fingerprinting preference disable the AP
It seems like this will reveal a lot of information about the user's
hardware. Does the Resist Fingerprinting preference disable the API or
report standardized results? If not, can we get that bug on file (and
if it's easy, point out exactly where we would want to add the 'if()
return false'?)
-to
On Thu, May 3, 2018 at 2:00 AM, Anne van Kesteren wrote:
> On Thu, May 3, 2018 at 12:51 AM, L. David Baron wrote:
>> Please reply to this thread if you think there's something we should
>> say as part of this charter review, or if you think we should
>> support or oppose it.
>
> Perhaps I've miss
On Wed, May 2, 2018 at 5:11 AM, Robert O'Callahan wrote:
> On Wed, May 2, 2018 at 9:21 PM, Karl Tomlinson wrote:
>
>> It seems that Chrome works around this by choosing to garbage
>> collect input nodes even when their presence is specified to
>> require (observable) AudioWorkletProcessor.process
Does it support the feedback flag?
On Fri, Apr 20, 2018, 5:03 PM Gregory Szorc wrote:
> On Fri, Apr 20, 2018 at 2:51 PM, L. David Baron wrote:
>
> > On Friday 2018-04-20 14:23 -0700, Kris Maglione wrote:
> > > For a lot of these patches, my opinion is only really critical for
> > certain
> > >
I've spoken to glob about this offline; but just wanted to note: Our
fledgling 'Third Party Library Audit' project is planning on using
this metadata (even if the library itself isn't completely vendored)
for checking for security issues in upstream and auto-filing bugs.
-tom
On Mon, Apr 9, 2018
privacy.firstparty.isolate.restrict_opener_access is a pref for First
Party Isolation that relaxes the protections of FPI by allowing access
to window.opener across first party domains.
It was created because in Tor Browser's initial FPI patch, they
allowed this by mistake, and we wanted to keep b
Is running the service ourselves out of the question? If so, how come?
I mean I know we're not really in the business of running massive
scale DNS; but running it for a month, and ramping up the people
included in the study so we can monitor load seems feasible.
The goal of the study is described
On Tue, Feb 6, 2018 at 5:36 PM, Aaron Klotz wrote:
> I'd like to follow up on this old thread to discuss what we can do about
> improving the mingw developer experience for people doing Windows-centric
> stuff.
To follow up on this, in
https://bugzilla.mozilla.org/show_bug.cgi?id=1444167 I lande
eeherder), yet sheriffs are backing out patches when
> mingw bustage occurs. Tor is important, so of course we want to make our
> best effort to ensure that mingw isn't broken, but this "tier 2 but really
> tier 1" state is not helpful.
>
> I apologize for being curt, b
On Sun, Jan 21, 2018 at 6:29 PM, Jonathan Kingston wrote:
>> But this vector is not realistic. The website _included_ the thirdparty.
>> They want this tracking to occur. If we blocked invisible login forms from
>> autofill - the website will make the forms unobtrusively visible so they get
>> aut
It seems we are in a bad position here. There's two vectors:
The browser and the website are collaborating to mitigate tracking by
a third party.
The third party makes an invisible login form - well we can restrict
autofill to only visible elements. Or make a write-only form field
that prevents re
Telemetry was removed in 55:
https://bugzilla.mozilla.org/show_bug.cgi?id=1358004
You can still query it on tmo for 54... except it seems to give me a JS error.
-tom
On Fri, Jan 12, 2018 at 3:55 PM, Kris Maglione wrote:
> Do we have telemetry on the usage of the preference or of remote JAR
> ch
On Thu, Jan 11, 2018 at 10:26 AM, Gervase Markham wrote:
> On 10/01/18 18:40, Tom Ritter wrote:
>> This proposal is that. Add a permission 'canvas-imagedata' that will
>> return 'granted' when Resist Fingerprinting mode is disabled, and
>> 'prompt&#x
> In Resist Fingerprinting mode, could it sometimes return all 3
> states (granted, prompt, denied) depending on whether the user had
> chosen to remember the decision from a prior prompt? Or is there no
> such memory?
Yes, it can return all three, it will behave like a normal permission
(and alr
Summary:
When Resist Fingerprinting is enabled, we display a permission prompt
when a website tries to access the rendered canvas data. This is
because canvas rendering is a popular fingerprinting and tracking
vector on the web.
However, some uses of this technique are not actually malicious -
th
I am curious what Enterprise users are asking for. I'd like to
think/hope that a primary concern of enterprise is "Security" (or the
separate topic of Privacy); but I'm not certain it is.
In particular, I am curious if enterprise users would be interested in
flipping preferences that would provid
There have been a series of attacks[0] that allow SOP bypasses by
applying non-constant-time transforms to cross-domain resources and
using timing attacks to infer the contents.
I'm not sure to what extent we have been tracking our exposure to
these attacks over the years, but it's something I'm h
On Wed, Nov 22, 2017 at 10:36 AM, Sylvestre Ledru wrote:
>
>
> On 22/11/2017 17:25, Tom Prince wrote:
>> On Wed, Nov 22, 2017 at 8:51 AM Jet Villegas wrote:
>>
>>> Do you have a use case for shipping the ESR with --disable-stylo?
>>>
>> Thunderbird in a similar position to Tor. Our current build
On Wed, Nov 22, 2017 at 9:51 AM, Jet Villegas wrote:
> Do you have a use case for shipping the ESR with --disable-stylo? We want to
> be very quick about removing the legacy C++ style system as it adds
> significant impedance to new feature development. I have not heard of any
> site breakage that
On Wed, Nov 22, 2017 at 8:08 AM, Makoto Kato wrote:
> When enabling stylo, explicit memory will be 2-3% grow on Linux from
> AWSY, so android will be same rate
>
> Also, APK size grows 1.5MB now. But stylo team is working to remove
> old style system.
Is there a timeframe for when --disable-styl
Warning: they auto-shut down after 30 minutes (maybe? I never timed
it). I haven't put any effort into figuring out if that's
configurable, but I don't think it is.
-tom
On Tue, Nov 7, 2017 at 3:13 PM, Mats Palmgren wrote:
> FYI, Microsoft distributes free VMs for browser testing purposes:
> htt
+1. I would love pulsebot to get it's own channel I can get mention alerts
on, and have developers just be development chat.
On Nov 4, 2017 8:13 AM, "Kartikaya Gupta" wrote:
> +1. I also find myself less likely to read the backscroll because of the
> high volume of pulsebot messages.
>
> Thanks
On Mon, Oct 9, 2017 at 10:31 AM, Philipp Wagner
wrote:
> Am 09.10.2017 um 07:31 schrieb Tom Ritter:
> > As part of our work with Tor, we’ve been working on getting a MinGW-based
> > build of Windows into TaskCluster.
>
> A maybe too obvious question from the side lines: W
As part of our work with Tor, we’ve been working on getting a MinGW-based
build of Windows into TaskCluster. Tor is currently using ESR releases, and
every ESR they have to go through a large amount of work to get the build
working under MinGW again; by continually building (and testing) that build
On Tue, Oct 3, 2017 at 3:12 PM, Thomas Wisniewski wrote:
> Security & Privacy Concerns: this exposes whether the user has pointer that
> is finely controlled like a mouse, or more coarse-grained like a
> touchscreen (or no pointer at all). It also exposes whether they have a
> pointer capable of "
On Fri, Sep 22, 2017 at 8:39 AM, Ehsan Akhgari wrote:
> * Ensure that we don't leak this information when fingerprinting
> resisting is turned on for the Tor Browser if we don't already.
Tor sets device.sensors.enabled to false, which should disable these
events. (If that's not the case, we'd l
On Thu, Sep 7, 2017 at 1:09 PM, Shubhie Panicker via dev-platform
wrote:
> Curious - are there concerns with implementing Client Hints in general?
Yes. But the fingerprinting team (specifically, I'm not sure what
other teams have done) haven't investigated Client Hints yet to see
what we may wish
On Wed, Sep 6, 2017 at 7:18 PM, Mike Hommey wrote:
> On a personal note, I find > 2000 as in the first sample more readable
> than the latter. So much so that I'd actually prefer the logical
> operators to be on the next line than boolean operator being on the
> previous.
A small +1. =)
-tom
___
This is pretty concerning to me from a fingerprinting POV. The spec
currently rounds up to one of the following values:
0.25, 0.5, 0.75, 1, 1.5, 2, 3, 4, 6, 8, 12, 16, 24, 32, 48, 64, 96, 128
Steam's hardware survey shows the following distribution percentages.
Less than 512 MB 0.00%
512 Mb to 9
IIRC, the rework won't be able to be switched 'back-to-existing' with
a pref, but we'll continue to respect existing disable-webrtc prefs
and the --disable-webrtc compiler switch, right?
-tom
On Wed, Sep 6, 2017 at 11:41 AM, Byron Campen wrote:
> What: RTCRtpTransceiver is a central part of
On Tue, Jul 18, 2017 at 10:37 PM, Boris Zbarsky wrote:
> On 7/18/17 11:21 PM, Tom Ritter wrote:
>>
>> This will respect the 'svg.in-content.enabled' pref, correct?
>
>
> Respect in what sense?
>
> What this will do is that _if_ you have an and you dr
This will respect the 'svg.in-content.enabled' pref, correct? Can I
request that be added as a test? =)
-tom
On Tue, Jul 18, 2017 at 6:00 PM, Boris Zbarsky wrote:
> Summary: allow passing to canvas createPattern and drawImage.
>
> Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1382027
>
> Sp
On Tue, May 16, 2017 at 1:48 AM, Mike Hommey wrote:
> On Tue, May 16, 2017 at 01:33:13AM -0500, Tom Ritter wrote:
>> My interest in jemalloc3/4 has always been with taking advantage of
>> it's partitioning capabilities to segment things like javascript
>> arrays for
My interest in jemalloc3/4 has always been with taking advantage of
it's partitioning capabilities to segment things like javascript
arrays for increased security against heap grooming and UAF
exploitation.
Is there a path forward with this in mozjemalloc? Plans, or would-take
changes, or just tho
On Fri, May 12, 2017 at 1:27 AM, Ehsan Akhgari wrote:
> I realized we haven't had a performance mini-story for a while -- I sort of
> dropped the ball on that. Running over this bug made me want to talk about
> a pretty well known sort of slowness in C++ code, virtual functions. The
> cost of vi
So I haven't thought through this proposal in detail, but I worry it
has concerns for SOP. One of the big pushes in the Web Crypto group
was to enable the web to talk to SIM cards and PIV cards and related
secure elements. But these SEs had no notion of an origin and thus
could let the user be easi
On Wed, Apr 5, 2017 at 12:29 PM, Aryeh Gregor wrote:
> On Wed, Apr 5, 2017 at 7:34 PM, Tom Ritter wrote:
>> It looks like this exposes pointerType, which reveals whether the user
>> is using a mouse, pen, or touch input.
>>
>> It also exposes detailed information abou
On Tue, Apr 4, 2017 at 10:29 PM, wrote:
> Security & Privacy Concerns: none
It looks like this exposes pointerType, which reveals whether the user
is using a mouse, pen, or touch input.
It also exposes detailed information about the geometry of the input
(size of the thing pointing, pressure, t
It seems like SubResource Integrity could be extended to do this...
It's specifically for the use case: where you kinda trust your CDN,
but you want to be completely sure.
-tom
On Fri, Mar 24, 2017 at 12:24 PM, Mike Hoye wrote:
> My 2006 proposal didn't get any traction either.
>
> https://lists
On Fri, Mar 17, 2017 at 3:26 PM, Sylvestre Ledru wrote:
>
>
> Le 17/03/2017 à 19:40, trit...@mozilla.com a écrit :
>> On Friday, March 17, 2017 at 1:35:15 PM UTC-5, Sylvestre Ledru wrote:
>>> Looks like we are duplicating some contents and efforts with:
>>> https://dxr.mozilla.org/mozilla-central/
As part of a broader initiative to perform a security review of the
third party libraries we use, there is now a semi-automated service
that can file bugs when upstream libraries are newer than the one we
embed.
Closely tracking upstream can ensure we don't inherit publicly known
vulnerabilities.
On Sun, Feb 26, 2017 at 5:12 PM, Brian Birtles wrote:
> On Sat, Feb 25, 2017 at 1:09 AM, wrote:
>> On Thursday, February 23, 2017 at 9:09:58 AM UTC-6, Boris Chiou wrote:
>>> *Preference behind which this will be implemented*: I'm not sure. I think
>>> we don't need it because it is just a varian
100 matches
Mail list logo
