381–390 of 392 posts
Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains: - why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) - what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies…
Earlier quoted context omitted.
Mine says Developer edition beta 16 Version 67.0b16 (64-bit) Last updated = 03May2019. do I need to make this change? is it in the about:config ? 'xpinstall.signatures.required = false
Yeah, so if you set 'xpinstall.signatures.required = false' in the about:config it'll let you use your extensions, but this is just a workaround. When a fix is fully rolled out (which should include Developer edition), then you won't need that (and probably should re-enable signature checking).
Earlier quoted context omitted.
Edge's switch to Chromium was a bit surprising, even if it makes complete sense to do so on both the browser and OS level. At this point, I'm not sure if Mozilla's involvement with the Chromium project would be such a bad thing. In regards to web standards and freedom, having Google, Microsoft and Mozilla having their hand in that pot doesn't seem a lot different from each maintaining their own.
It would be a terrible loss to us all if Mozilla made Firefox chromium based, since it would mean Google basically controls the internet via Chromium EDIT: also Mozilla putting more and more rust code into Firefox is great for memory safety which is something that is a cause of many security issues these days
My second thought is that they already control the internet either way with Chromium. I'm not sure my (beloved) Firefox has any meaningful sway, or often even gets tested. A lot of web developers who probably don't frequent HN, want to have a single IE6-style monoculture to make their job that much more straightforward.
For sure, I can't say I disagree about Firefox adopting Rust. Definitely a nice technical perk to being a Firefox user. I've been here since 2002 and never left. Can't say I've ever had all the issues that everyone else insists existed. I think a FF reset would have resolved most issues, for most people. I certainly never came across any deal breakers. If there have been any, they were all very recent. The removal of Live Bookmarks, adoption of Pocket and the ousting of Brendan Eich was not a good look in my view.
Earlier quoted context omitted.
That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.
What would you propose?
Earlier quoted context omitted.
Many things. 1. It uses Google DNS internally, bypassing system DNS. 2. First-run analytics to Google, new tab page analytics to Google. 3. Various built-in google services that phone home: Google Host Detector, Google URL Tracker, Google Cloud Messaging, Google Hotwording, Google Safe Browsing, WiveDine DRM, Google AutoFill, etc. 4. Update checks for all these components (the browser does not have update, but the re…
Cool, thanks. Do you happen to know if Brave has these issues too?
Earlier quoted context omitted.
But Chromium still has most, if not all, the Google integration. There are forks that try to strip Google from it, but it is a mistake to assume that Chromium is somehow better than Chrome.
Firefox by default sends all your searches to Google, and uses Google search suggestions (so sends all typed in text to Google). What other integrations, specifically please, does Chromium have with Google? Aside: do Google serve the Firefox Newtab adverts, perhaps that "feature" was added for the extra money Firefox are getting from Google?
This is not true. Firefox explicitly asks you the first time you start typing a search in the location bar whether to allow search suggestions. It is opt-in.
Firefox also allows you to keep the location/search bar separate so that you can have search suggestions without sending every URL you type to Google.
Earlier quoted context omitted.
> workaround of ublock This has nothing to do with ublock origin specifically, ublock origin's author just happens to have a band-aid for this exploit. Assuming I don't misunderstand what is happening, any other blocking plugin is vulnerable as well. > people don't want to mess with Google's stuff I don't understand what you're saying. Chromium is vulnerable and by extension, so is Chrome. Edit: > You make it sound l…
>third-party code It's third-party cookies, look like first-party cookies, isn't it? Whilst they are "code", that's misleading because it's not being executed; which is what makes it sound like an RCE. Or did my brief scan pick up the wrong idea?
I believe so. To quote: "The purpose of Instart Logic technology is to disguise 3rd-party requests as 1st-party requests"
The net result of this is also that third-party javascript will get loaded as if it is first-party. Third-party content will look like first-party content in it's entirety. This subverts any potential security features that rely on being able to distinguish a first party from a third party.
Edit: As an example you can read https://www.w3.org/Security/wiki/Same_Origin_Policy
Earlier quoted context omitted.
>third-party code It's third-party cookies, look like first-party cookies, isn't it? Whilst they are "code", that's misleading because it's not being executed; which is what makes it sound like an RCE. Or did my brief scan pick up the wrong idea?
> Or did my brief scan pick up the wrong idea? I believe so. To quote: "The purpose of Instart Logic technology is to disguise 3rd-party requests as 1st-party requests" The net result of this is also that third-party javascript will get loaded as if it is first-party. Third-party content will look like first-party content in it's entirety. This subverts any potential security features that rely on being able to disti…
Earlier quoted context omitted.
"Opt-out telemetry" creates precisely the scenario I describe, where the users who care most are least visible to Mozilla, at which point their needs would go unconsidered; no one knows they exist, how many of them there are, or why they're opting out. This remains true regardless of why , which negates your entire list of issues, replacing them with a simple question that is very difficult to answer: How could Mozil…
> How could Mozilla respect the needs of users who opt-out of Mozilla knowing they, and their needs, exist at all? How about surveys or well, common sense? I'm a tech oriented person who cares about privacy. I want software that is lightweight, configurable, with sensible defaults. For any features besides the basic functionality (in this case: browsing the web), I don't want to opt-out, I want to opt-in. Privacy ori…