Re: Cross post from fx-dev: Internet Connectivity and Work Offline Mode

On Thu, 20 Feb 2014, Valentin Tsatskin wrote: Please note: This is a cross post from fx-dev. If you can, please reply in the thread there. Can I instead suggest taking this to dev-tech-network ? This topic actually concerns everything that uses necko more or less. (I'm not on fx-dev, which

Re: http-schemed URLs and HTTP/2 over unauthenticated TLS (was: Re: WebCrypto for http:// origins)

On Mon, 15 Sep 2014, Henri Sivonen wrote: What the Chrome folks suggest for HTTP/2 would give rise to a situation where your alternatives are still one one hand unencrypted and unauthenticated and on the other hand encrypted and authenticated *but* the latter is *faster*. You mess up that

Re: Git - Hg workflows?

On Thu, 30 Oct 2014, Gregory Szorc wrote: Hey ho, Let me give you my views on this as a relative newcomer in the source tree. I started at Mozilla early 2014 and as an old open source contributor to and maintainer of dozens of projects for many years I am deeply accustomed to using git and

Re: HTTP/2 and User-Agent strings?

On Tue, 27 Jan 2015, Chris Peterson wrote: Firefox, Chrome, and IE only support HTTP/2 over TLS, even though the spec does not require it. THe IE people have stated repeatedly that they will support it over plain TCP eventually though, it was just not done in the preview. What if browser

Re: FYI: Serious windows bug affecting WebRTC when mem use is over 2GB

On Thu, 26 Mar 2015, Benjamin Smedberg wrote: What is the largest buffer that we can expect to need? Since VM allocation happens in 64k boundaries, is it sufficient to just use a 64k buffer for this? As per a recent comment in the bug however, it doesn't work to just reserve some memory in

Re: HTTP/1.1 Multiplexing

On Wed, 8 Apr 2015, max.bruc...@gmail.com wrote: A request begins by adding a header: X-Req-ID, set to a connection-unique value. The server responded with an exact copy of this ID, and a X-Req-Target header which specifies the location of the response(for server pushing mostly). The server

Re: Decreasing quality?

On Mon, 17 Aug 2015, Dirkjan Ochtman wrote: I have an anecdote, and was wondering if others can corroborate: it seems to me that Nightly's quality has been getting worse recently (this is on latest OS X, rMBP). 2. 1193796 -- Unable to access Google properties with Firefox Nightly This

Re: Stop using PL_strchr/strstr et al for parsing - use mozilla::Tokenizer

On Wed, 29 Jul 2015, Honza Bambas wrote: I've recently introduced a class making parsing string inputs much safer and simpler. http://www.janbambas.cz/string-parsing-made-simple-with-mozillatokenizer/ Nice! How does it act when hitting 64bit integer overflows? -- / daniel.haxx.se

Re: Intent to (sort of) unship SSLKEYLOGFILE logging

On Tue, 26 Apr 2016, Martin Thomson wrote: Maybe I'm unusual, but I just run debug builds when I want to investigate this sort of thing. That's easy for you and for all of us suitably involved and technically aware. When ordinary users run into trouble and we ask them to wireshark their

Re: Intent to (sort of) unship SSLKEYLOGFILE logging

On Tue, 26 Apr 2016, Mike Hommey wrote: Very few developers will need to analyze traffic at a level requiring SSLKEYLOGFILE. Yes, but a larger share of users will do a network capture and submit to Firefox developers on request when we debug network oriented problems. It is almost standard

Re: Intent to ship: NetworkInformation

On Thu, 15 Dec 2016, Boris Zbarsky wrote: Looking at the use cases document at , it seems like people generally care more about things like "bandwidth costs money" and "how much bandwidth do we expect?" than about the actual physical transport,

Re: Intent to ship: NetworkInformation

On Mon, 19 Dec 2016, Gervase Markham wrote: We already do network change detection now, ISTR; could we pop a doorhanger when we get a network change event, of the form of something like "maintain 'expensive data' status Y/N?"...? Nice idea! However the network changes we detect currently

Re: DNS Rebinding protection

On Thu, 28 Jun 2018, Martin Thomson wrote: If we ever have code to support .local in the browser, then those will need to avoid using the DoH stack for resolving those names. That is *exactly* what we already have and do! =) Since they're explicitly local, they're considered "blacklisted" by

Re: DNS Rebinding protection

On Mon, 25 Jun 2018, Brannon Dorsey wrote: Users can protect themselves from this type of attack by using a DNS resolver that filters out private IP addresses from public DNS responses. OpenDNS and dd-wrt can both provide this functionality if configured properly, but my question is, *why not

Re: FYI: Short Nightly Shield Study involving DNS over HTTPs (DoH)

On Mon, 19 Mar 2018, Martin Thomson wrote: I don't know if it is possible to know if you have a manually-configured DNS server, but disabling this experiment there if we can determine that would be good - that might not be something to worry about with Nightly, but it seems like it might be

Re: FYI: Short Nightly Shield Study involving DNS over HTTPs (DoH)

On Sun, 18 Mar 2018, Eric Shepherd (Sheppy) wrote: I don't have such a far-reaching agreement with my ISP and its DNS. I don't have such an agreement at all with 8.8.8.8 or other publicly provided DNS operators. What other precautions or actions can we do to reduce the risk of this being