Viewing profile — rfk

Any sort of verification presumes that you have an initial trusted checksum against which to verify, so I don't believe this solves the separate problem of obtaining such a checksu…

There are plenty of mischievous things an attacker could do if you just verify each chunk separately, including reordering or omitting chunks, and truncating the file.

For no reason other than "legacy reasons" - much of the client-side crypto code in the current Firefox Sync is inherited from an earlier system that predates widespread acceptance …

Hi, Firefox Accounts developer here. You're correct in your understanding that that login flow is ultimately driven by a webpage, and this is a deliberate trade-off that we made in…

FWIW, as a developer on the Firefox Accounts team, I strongly endorse the sentiment of this article. We've occasionally found ourselves merging microservices back together because …

Because I typo'd the date; thanks, fixing now...

> Unmaintained critical infrastructure is bad news. (article author here) To add to @callahad's excellent points: unmaintained critical infrastructure on your security perimeter is…

Yes indeed; I have bugs open to get those added to all our public-facing Persona docs.

Not that it really matters after this announcement, but it has always been possible to disable the suggested tiles, from the little settings gear icon on the newtab page.

This thread suggests that Hello is indeed being considered for similar treatment: https://mail.mozilla.org/pipermail/gofaster/2015-November/00...

> Firefox Accounts has an active userbase orders of magnitude larger than Persona's. > We may be able to reintroduce a notion of federated identity into FxA at some point in the fu…

Not sure I understand your question, but the thing I'm talking about is a new "Firefox for iOS" product being worked on right now, due for release pretty soon IIUC, that will inclu…

Yes, proper syncing with Desktop Firefox is a core part of the new Firefox for iOS initiative.

Mozilla could be just as easily compelled to turn over user data as Pocket, they're both US companies bound by US law.

It's not hard to imagine how this concept could expand to the web at large. Rather than deciding what ad to display by consulting a user profile built on cross-site history trackin…

Indeed, the whole point of this (and all the verbiage about "respecting user privacy") is that the browser will do the analysis locally without sending history data back to Mozilla…

it's a slidedeck from a presentation, you can use the arrow keys to advance slides.

I had not considered this, it's currently just using whatever default colours matplotlib selected. Thanks for the heads-up!

> The old one let you run your own server. This is still possible with the new system, although I'll admit the ease and usability of such a setup needs work (and IIRC there are som…

Unfortunately this server is not compatible with the new sync protocol. It will continue to work while there is still old-sync support in the browser (a few versions after FF29 at …

> It also let you sync through your own server rather than Mozilla's which I don't think the new version does yet This is possible with the new version, but it's not (yet) as simpl…

Heh, actually it might be possible to cheat a little with this backend as well, using http://www.jsil.org/ to translate the output of the cli backend into javascript. Trying C+Emsc…

I got my acronyms wrong, it's called the "CLI" backend, but it's definitely in there: http://doc.pypy.org/en/latest/cli-backend.html

The RPython toolchain has another mode of operation, which outputs higher-level class-based code rather than low-level C-style code. They use this for a CLR backend, but it would b…