Re: Future of out-of-tree spell checkers?

(Sorry for the continued laggy responses here...) On 04/27/2017 03:38 AM, Henri Sivonen wrote: For a while we've been trying to make it difficult for semi-legit-but-not-quite-malware parties to load crappy code into Firefox (I'm thinking of crappy antivirus software, adware, etc.). Removing

Re: Future of out-of-tree spell checkers?

On Wed, Apr 26, 2017 at 9:49 PM, Ehsan Akhgari wrote: > On 04/26/2017 07:02 AM, Henri Sivonen wrote: >> >> On Tue, Apr 25, 2017 at 9:02 PM, Bill McCloskey >> wrote: >>> >>> On Tue, Apr 25, 2017 at 5:41 AM, Henri Sivonen >>>

Re: Future of out-of-tree spell checkers?

On 04/26/2017 07:02 AM, Henri Sivonen wrote: On Tue, Apr 25, 2017 at 9:02 PM, Bill McCloskey wrote: On Tue, Apr 25, 2017 at 5:41 AM, Henri Sivonen wrote: What problem did you mean to address by code signing? The reason I suggested code signing

Re: Future of out-of-tree spell checkers?

On Tue, Apr 25, 2017 at 9:02 PM, Bill McCloskey wrote: > On Tue, Apr 25, 2017 at 5:41 AM, Henri Sivonen wrote: >> >> What problem did you mean to address by code signing? > > The reason I suggested code signing is because loading libvoikko would >

Re: Future of out-of-tree spell checkers?

On Tue, Apr 25, 2017 at 5:41 AM, Henri Sivonen wrote: > What problem did you mean to address by code signing? The reason I suggested code signing is because loading libvoikko would provide an easy way for people to inject code into Firefox. For a while we've been trying

Re: Future of out-of-tree spell checkers?

On Wed, Apr 19, 2017 at 4:43 AM, Ehsan Akhgari wrote: > On 2017-04-18 2:38 AM, Henri Sivonen wrote: >> On Sat, Apr 15, 2017 at 8:06 PM, Ehsan Akhgari >> wrote: >>> On 2017-03-27 3:30 AM, Henri Sivonen wrote: 2) We couldn't trigger a

Re: Future of out-of-tree spell checkers?

On 2017-04-18 2:38 AM, Henri Sivonen wrote: > On Sat, Apr 15, 2017 at 8:06 PM, Ehsan Akhgari > wrote: >> On 2017-03-27 3:30 AM, Henri Sivonen wrote: >>> 2) We couldn't trigger a libvoikko autoupdate on Windows/Mac if there >>> was a crasher bug in the library. (I'd

Re: Future of out-of-tree spell checkers?

On Sat, Apr 15, 2017 at 8:06 PM, Ehsan Akhgari wrote: > On 2017-03-27 3:30 AM, Henri Sivonen wrote: >> 2) We couldn't trigger a libvoikko autoupdate on Windows/Mac if there >> was a crasher bug in the library. (I'd expect the distros to take care >> of pushing an update

Re: Future of out-of-tree spell checkers?

On 2017-03-27 3:30 AM, Henri Sivonen wrote: >>> But when (according to doing a Google Web search excluding mozilla.org >>> and wading through all the results and by searching the JS for all >>> AMO-hosted extensions) the only out-of-tree spell checkers use >>> libvoikko, why involve Web Extensions

Re: Future of out-of-tree spell checkers?

On Sat, Mar 25, 2017 at 8:48 PM, Ehsan Akhgari wrote: > Another option would be talking to the maintainers of libvoikko and > seeing if they would be open to maintaining the Mozilla bindings, I started a fact-finding thread on the libvoikko list:

Re: Future of out-of-tree spell checkers?

On Fri, Mar 24, 2017 at 3:20 PM, Ehsan Akhgari wrote: > On 2017-03-24 4:20 AM, Henri Sivonen wrote: >> On Fri, Mar 24, 2017 at 2:38 AM, Ehsan Akhgari >> wrote: >>> On Wed, Mar 22, 2017 at 11:50 AM, Jeff Muizelaar >>>

Re: Future of out-of-tree spell checkers?

On 2017-03-24 2:45 PM, Bill McCloskey wrote: > If we do end up going with the dlopen plan, let's make sure that we > enforce some kind of code signing. We're finally almost rid of all the > untrusted binary code that we used to load (NPAPI, binary XPCOM, > ctypes). It would be a shame to open up a

Re: Future of out-of-tree spell checkers?

If we do end up going with the dlopen plan, let's make sure that we enforce some kind of code signing. We're finally almost rid of all the untrusted binary code that we used to load (NPAPI, binary XPCOM, ctypes). It would be a shame to open up a new path. -Bill On Fri, Mar 24, 2017 at 6:20 AM,

Re: Future of out-of-tree spell checkers?

On 2017-03-24 4:20 AM, Henri Sivonen wrote: > On Fri, Mar 24, 2017 at 2:38 AM, Ehsan Akhgari > wrote: >> On Wed, Mar 22, 2017 at 11:50 AM, Jeff Muizelaar >> wrote: >>> >>> On Wed, Mar 22, 2017 at 11:08 AM, Henri Sivonen >>>

Re: Future of out-of-tree spell checkers?

On Fri, Mar 24, 2017 at 2:38 AM, Ehsan Akhgari wrote: > On Wed, Mar 22, 2017 at 11:50 AM, Jeff Muizelaar > wrote: >> >> On Wed, Mar 22, 2017 at 11:08 AM, Henri Sivonen >> wrote: >> > >> > dlopening libvoikko, if installed,

Re: Future of out-of-tree spell checkers?

On Wed, Mar 22, 2017 at 11:50 AM, Jeff Muizelaar wrote: > On Wed, Mar 22, 2017 at 11:08 AM, Henri Sivonen > wrote: > > > > dlopening libvoikko, if installed, and having thin C++ glue code > > in-tree seems much simpler, except maybe for sandboxing.

Re: Future of out-of-tree spell checkers?

On Wed, Mar 22, 2017 at 11:08 AM, Henri Sivonen wrote: > > dlopening libvoikko, if installed, and having thin C++ glue code > in-tree seems much simpler, except maybe for sandboxing. What are the > sandboxing implications of dlopening a shared library that will want > to

Re: Future of out-of-tree spell checkers?

Hey Henri, Freddy pointed me to the sandboxing part of the question, here is my impression. In general, if the Sandbox is running any additional code that is not in the tree could also be accomplished with a compromised child process. However in case of dlopen() it is important to know our

Re: Future of out-of-tree spell checkers?

On Wed, Mar 22, 2017 at 4:45 PM, Axel Hecht wrote: > Am 22.03.17 um 15:39 schrieb Jorge Villalobos: >> >> On 3/22/17 8:10 AM, Henri Sivonen wrote: >>> >>> On Wed, Mar 22, 2017 at 3:52 PM, Nicolas B. Pierron >>> wrote: On 03/22/2017 09:18

Re: Future of out-of-tree spell checkers?

Am 22.03.17 um 15:39 schrieb Jorge Villalobos: On 3/22/17 8:10 AM, Henri Sivonen wrote: On Wed, Mar 22, 2017 at 3:52 PM, Nicolas B. Pierron wrote: On 03/22/2017 09:18 AM, Henri Sivonen wrote: Without XPCOM extensions, what's the story for out-of-tree spell

Re: Future of out-of-tree spell checkers?

On 3/22/17 8:10 AM, Henri Sivonen wrote: > On Wed, Mar 22, 2017 at 3:52 PM, Nicolas B. Pierron > wrote: >> On 03/22/2017 09:18 AM, Henri Sivonen wrote: >>> >>> Without XPCOM extensions, what's the story for out-of-tree spell checkers? >>> >>> […], which implements

Re: Future of out-of-tree spell checkers?

On Wed, Mar 22, 2017 at 3:52 PM, Nicolas B. Pierron wrote: > On 03/22/2017 09:18 AM, Henri Sivonen wrote: >> >> Without XPCOM extensions, what's the story for out-of-tree spell checkers? >> >> […], which implements >> mozISpellCheckingEngine in JS and connects to

Re: Future of out-of-tree spell checkers?

On 03/22/2017 09:18 AM, Henri Sivonen wrote: Without XPCOM extensions, what's the story for out-of-tree spell checkers? […], which implements mozISpellCheckingEngine in JS and connects to the libvoikko[1] back end via jsctypes. […] Would compiling libvoikko to WebAssembly remove the need for

Re: Future of out-of-tree spell checkers?

On Wed, Mar 22, 2017 at 11:18 AM, Henri Sivonen wrote: > Without XPCOM extensions, what's the story for out-of-tree spell checkers? > > Finnish spell checking in Firefox (and Thunderbird) has so far been > accomplished using the mozvoikko extension, which implements >

Future of out-of-tree spell checkers?

Without XPCOM extensions, what's the story for out-of-tree spell checkers? Finnish spell checking in Firefox (and Thunderbird) has so far been accomplished using the mozvoikko extension, which implements mozISpellCheckingEngine in JS and connects to the libvoikko[1] back end via jsctypes. (Even