111–120 of 137 posts
Earlier quoted context omitted.
One can see a rationale in not having a security group - every team should have security focus (eg by having expertise & champions within each group). You can't tack on security, you have to build it in.
I think you need both. Same as I think you need i10n and a8y at both layers.
Earlier quoted context omitted.
What about differentiating applications and web sites? The line between the two is blurry, I know, but I would be happy if the document metaphor were divorced from the application one.
Absolutely, there should be a different port for web pages than applications. Even if we started by disabling js on port 80
Earlier quoted context omitted.
The entire point is managing privileges. Just because I type in yourdomain.com does not mean I want you to be able to start playing death metal from my speakers. What about typing yourdomain.com means I want you to break my back button? Show a popup rather than close the browser? Churn CPU cycles crypto mining or do just about anything beyond hand me a document? Display a flashing GIF? The current model is basically…
> The single greatest web innovation in the last 30 years was readability mode. For you. From what I see, everyone else seems to be enjoying the dancing and singing monkeys online.
Earlier quoted context omitted.
Yeah that Chrome experience doesn't sound great. Fwiw I tend to put my test cases on jsbin or Glitch, but yeah, a Chrome engineer should know to put the page on a basic web server. If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.
> If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me. Hi, and thanks for being part of creating Chrome && reaching out here. Now that I have a Chrome guy here maybe you can help with another annoying issues: -QC internally at Google seems to be blissfully unaware of the fact that other browsers exists. Examples: - one glaring issue I'm running into in core Angular on…
Earlier quoted context omitted.
Sorry, but we need a Turing-complete language for ads and tracking. Preferably with JITting, and unfettered access to the GPU and other misc. peripherals like GPS, webcam, etc. In return you get free cat videos. You’re welcome.
No. The server just needs to send over an image and log the IP of the requestor for reconciliation at the end of the month.
The Microsoft experience reminded me of the time when security@apple.com went to the building security office, who just quietly deleted bug reports. Poor processes amd communication is one of the worst classes of security problem.
Last time I reported a security issue to Microsoft I got reply same day and a confirmation that it was in fact an issue some day later. And then a few days later they notified me that my report was eligible for a bounty (I didn't have to ask). This was the opposite experience of my previous report where the bug was acknowledged 9 months later and then fixed another 3 later. I wonder if it just depends on whether your…
Earlier quoted context omitted.
> Plus web worker bugs always get pushed to the bottom of the queue for every browser. Why is that?
It's pretty rare to use in user-code. It might be well used in libraries, but I guess the standard developer experience is using libraries not writing them.
So... somewhat self-fulfilling
I can echo his experience reporting browser bugs and provide my own reviews: Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick. Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems. Chrome - Somewhat of a mixed ba…
Personally over many bug reports and many years: A+ experience with the Chrome team E with Edge F with Safari The Chrome devs have been astonishingly good. My experience has repeatably been that if they are given a good bug report, they get it fixed and often fix it really fast. Or they reply with excellent technical reasons why not. Also multiple times I have seen extreme corner-case regressions get magically fixed…
I can echo his experience reporting browser bugs and provide my own reviews: Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick. Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems. Chrome - Somewhat of a mixed ba…