On 16/10/13 14:47, Anne van Kesteren wrote:
> The API is synchronous so that seems like a bad idea.
As in, it'll cause the tab to freeze (one time only, when a new language
is called for) while the file is downloading? OK, that's bad, but so is
having Firefox be a lot bigger...
Perhaps, as Brian
On 15/10/13 17:06, Benjamin Smedberg wrote:
> With the landing of bug 853301, we are now shipping ICU in desktop
> Firefox builds. This costs us about 10% in both download and on-disk
> footprint: see https://bugzilla.mozilla.org/show_bug.cgi?id=853301#c2.
> After a discussion with Waldo, I'm going
On 10/10/13 00:28, Philipp Kewisch wrote:
> So you are saying, we should start removing features that could decrease
> the attack surface?
...and that we don't need.
What I'm saying is: perhaps feature-ectomies (and driving the web or our
code to a position where we can make them) may be higher p
Attack surface reduction works:
http://blog.gerv.net/2013/10/attack-surface-reduction-works/
Removing E4X broke the NSA's "EGOTISTICALGOAT" attack - a type confusion
vulnerability in E4X.
In the spirit of learning from this, what's next on the chopping block?
A quick survey of the security-group
On 06/09/13 16:17, Adam Roach wrote:
> To the first point: the increase in complexity is fairly minimal for a
> substantial gain in usability. Absent hard statistics, I suspect we will
> disagree about how "fringe" this particular exception is. Suffice it to
> say that I have personally encountered
On 29/08/13 19:41, Zack Weinberg wrote:
> All the discussion of fallback character encodings has reminded me of an
> issue I've been meaning to bring up for some time: As a user of the
> en-US localization, nowadays the overwhelmingly most common situation
> where I see mojibake is when a site puts
On 08/08/13 23:52, Ehsan Akhgari wrote:
> I think you forgot the bug number. :-)
Ehsan: any chance you could trim your responses? I had to page-down 9
times in my mail client just to read this one line...
Thanks :-)
Gerv
___
dev-platform mailing list
On 05/08/13 14:53, Bas Schouten wrote:
> Although I agree fully that by far the best way of offering feedback
> is by talking to that person directly. I do think we have to face the
> fact that at this point in time a significant amount of people find
> it very hard to speak to people directly abou
On 15/07/13 17:56, emada.ad...@gmail.com wrote:
> How can i add a new root cert to xulrunner from the command line in linux?
Ask in mozilla.dev.tech.crypto.
Gerv
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/lis
On 15/07/13 14:57, Benjamin Smedberg wrote:
> Or it means that we need to be willing to issue dot-releases to update
> these items. We're pretty nimble with the desktop release cycle already.
> We should definitely measure this tradeoff before doing a bunch of
> engineering on this. As I understand
On 12/07/13 21:12, Nicholas Nethercote wrote:
> Would such an update increment the version number? I suspect you'd
> want to be able to easily determine if an update has been applied, and
> having to distinguish e.g. "Firefox 30 without update 1" vs. "Firefox
> 30 with update 1" could be annoying
On 13/07/13 00:36, Clint Talbert wrote:
> This is all good stuff, and I want to support us being nimble. We also
> need to balance that against security and quality in our builds. We go
> through the release process for a reason, and we exert the energy to QA
> these builds and ensure we can update
On 11/07/13 14:24, Boris Zbarsky wrote:
> On 7/11/13 7:59 AM, Gervase Markham wrote:
>> Hey, if we had a PTO app that tracked all absences, we could integrate
>> with it...
>>
>
> Just in case you were talking about the moco PTO app, it doesn't track
> absenc
On 12/07/13 18:20, Benjamin Smedberg wrote:
> I think the general concept of making more of our "lists" be dynamic is
> sound, but I'm very skeptical of the technical solution that you appear
> to be outlining.
The technical solution was 3 minutes on the back of an envelope. Feel
free to tear it a
We keep hitting cases where we would like Firefoxes in the field to have
some data updated using a process which is much lighter in expended
effort than shipping a security release. Here are some examples of the
data Firefox stores that I know of which might benefit from this:
- The Public Suffix
On 10/07/13 15:09, Boris Zbarsky wrote:
> And communicated via bzapi so bzexport can also warn.
BzAPI could add a flag based on a parsing of the name - but then, if
there was an accurate algorithm for parsing a name to extract absence
information, bzexport could use it directly.
Perhaps we could
On 10/07/13 23:14, Taras Glek wrote:
> I tried to capture feedback from this thread in
> https://wiki.mozilla.org/Code_Review
I just did a pass over that page to highlight the key points.
Gerv
___
dev-platform mailing list
dev-platform@lists.mozilla.or
On 09/07/13 21:29, Chris Peterson wrote:
> I've seen people change their Bugzilla name to include a comment about
> being on PTO. We should promote this practice. We could also add a
> Bugzilla feature (just a simple check box or a PTO date range) that
> appends some vacation message to your Bugzil
On 26/06/13 08:45, Mark Hammond wrote:
> There is evidence users find this troubling - eg, bug 762610 reports
> that a couple of users wrote to the mozilla webmaster about this. While
> it may just be a perception, it seems a perception worth managing. And
> even if someone can't read the exact b
On 17/06/13 21:48, Drew Willcoxon wrote:
> Toolkit already has a thumbnail module, [PageThumbs], but it can only
> capture thumbnails of open content windows, same as they appear to
> the user. Windows may contain sensitive data that should not be
> recorded in an image, however, like bank account
On 04/06/13 23:30, Jonas Sicking wrote:
> It would be cool to find a solution that makes the simple things
> simpler than MathML, while keeping the complicated things possible.
Isn't the answer to that sort of question normally something like: a
mini-language for simple math, plus a JS library you
On 04/07/13 17:22, Anne van Kesteren wrote:
> On Thu, Jul 4, 2013 at 5:17 PM, Kyle Huey wrote:
>> Presumably we could have a blacklist of the handful of protocols that are
>> internal to browsers and have compat issues. "It violates the standard"
>> isn't a very compelling argument when the stand
On 06/05/13 20:12, David Dahl wrote:
> That is unfortunate. The Kyoto-* tools are FAST and easy to use. I
> wonder if the author would be willing to issue Mozilla a license that
> is compatible with MPL?
That would be the functional equivalent of relicensing under the MPL,
which is a weaker copyle
On 23/04/13 10:17, Ed Morley wrote:
> Given that local machine time scales linearly with the rate at which we
> hire devs (unlike our automation capacity), I think we need to work out
> why (some) people aren't doing things like compiling locally and running
> their team's directory of tests before
On 16/04/13 12:27, Mike Hommey wrote:
> I doubt we can get a satisfactory response from MS before things blow
> out (if at all)
But if we'd asked them last time, we might have one by now. And if we
don't ask them this time, then we'll get to next time and still not have
one. :-)
Gerv
__
On 03/04/13 15:32, Ed Morley wrote:
> Agreed - TBPL's successor is going to be called something other than
> TBPL2 (name chosen so far is treeherder).
Surely then it should be called "Ent"? :-)
Gerv
___
dev-platform mailing list
dev-platform@lists.mozi
On 05/03/13 23:54, cpmf2...@gmail.com wrote:
> I read the articles for certutil and I have to ask, "what idiot came
> up with that as the only method???" Seriously, not being able to do
> it easily through Group Policy or some other centralized method is a
> GIGANTIC FAIL. If you want enterprises t
On 21/02/13 13:41, Justin Lebar wrote:
> that.) I think pip is the preferred method these days.
The magic incantation for me was:
sudo pip install mercurial --upgrade
This gave me version 2.5.1.
Gerv
___
dev-platform mailing list
dev-platform@lists.m
On 20/02/13 16:06, Justin Lebar wrote:
> The client bug that's fixed with the new version of hg is slowly and
> irreversibly ruining our blame, so I don't think we should wait before
> upgrading clients.
The Mercurial download page:
http://mercurial.selenic.com/downloads/
offers 2.5.1 for Mac and
On 13/02/13 12:55, Henri Sivonen wrote:
> I don't think we have this option. Microsoft and Google have editors
> on the EME spec. So this option looks more like: Have Hollywood movies
> available with good performance and without additional installs in IE
> and Chrome and *for the time being* avail
On 12/02/13 21:20, Benoit Jacob wrote:
> I agree wholeheartedly with Benjamin and care about this, but I don't have
> a lot of time to get into this presumably time-consuming discussion on a
> W3C mailing list --- so I'd just like to express support to any Mozilla
> representative fighting this fig
On 12/02/13 21:20, Benoit Jacob wrote:
> I agree wholeheartedly with Benjamin and care about this, but I don't have
> a lot of time to get into this presumably time-consuming discussion on a
> W3C mailing list --- so I'd just like to express support to any Mozilla
> representative fighting this fig
On 23/01/13 10:33, Henri Sivonen wrote:
> Anyway, it seems
> https://developer.mozilla.org/en-US/docs/Gecko_user_agent_string_reference
> isn't getting updated together with the code changes, which probably
> makes evangelism even harder than it would otherwise be. :-(
Fixed - sorry about that.
>
On 23/01/13 02:45, Lawrence Mandel wrote:
> As a mitigation strategy for sites serving non mobile content to B2G,
> we added a UA override (domain whitelist) mechanism that allows B2G
> to send a custom UA to a specific domain
...and then we file a bug on evangelising the site to fix itself.
> 1.
On 07/01/13 18:48, JP Rosevear wrote:
> If I understand what you are proposing I think its reasonable given we
> are switching to the "desktop" UA. But I come from the camp that UA
> changes should be for a deeply clear benefit, simply "it won't harm
> much" is not an argument for change in a prop
On 19/12/12 10:21, Gervase Markham wrote:
On 18/12/12 18:51, Alex Keybl wrote:
Agreed that major fallout is unlikely - do we have a list of the most
heavily used mobile tablet sites to verify that this change will not
cause severe web regressions though?
I will consult the wonderful Mr
On 03/12/12 19:32, Norbert Lindenberg wrote:
As part of implementing the ECMAScript Internationalization API [1,
2] in SpiderMonkey, and as an aid in internationalizing other
functionality in Mozilla products [3], I need to integrate the ICU
library (International Components for Unicode [4]) into
On 18/12/12 18:51, Alex Keybl wrote:
Agreed that major fallout is unlikely - do we have a list of the most
heavily used mobile tablet sites to verify that this change will not
cause severe web regressions though?
I will consult the wonderful Mr. Mandel.
- This decision is going to be widely p
Hi everyone,
After taking all input into account, I have decided that we should drop
the "Tablet" token from Fennec's UA on tablets. This is what Android
browser and Chrome do, and corresponds to option D) of my original
options. So for non-"Mobile" devices, it would be:
Mozilla/5.0 (Android
On 07/12/12 02:21, Norbert Lindenberg wrote:
The benefit is that the ECMAScript Internationalization API lets
developers create a more consistent localized experience for their
users, with the correct
* date time, and number formats,
* the culturally appropriate calendar,
* correct currency sym
On 07/12/12 12:33, Jonathan Kew wrote:
This is somewhat analogous to the solution (proposed and prototyped in
bug 619521 and bug 648548) to provide downloaded-on-demand fonts to
extend the character coverage when the device lacks any preinstalled
fonts for a given script/writing system.
And we
This thread has got off-topic (reasonably; the new issues are important)
but back on the original point, if we do add ICU then:
On 03/12/12 11:32, Norbert Lindenberg wrote:
- Add the required set of ICU source files as separate files to the
Mozilla repository. The current version of ICU (50.1,
On 20/11/12 00:41, Jonas Sicking wrote:
If this is indeed the case, maybe we should add something to the UA
string which indicates the screen size.
As well as being something no other browser does, that would increase
our fingerprintability.
Gerv
___
On 20/11/12 00:14, Jonas Sicking wrote:
If indeed we can't send the token on mobile devices (because it would
cause them to send us the somewhat-larger-screen-size tablet UI?) then
I agree with you. My proposal only makes sense if we can send the
"touch" token for mobile as well.
Or developers
On 12/11/12 17:25, Kevin Brosnan wrote:
On mobile Chrome leaks the device name in the UA this is the current
method of hardware feature detection on the Android stock browser as
well.
OK. So given that we don't want to do that (we've rejected it twice
now), if this is the even-worse alternativ
On 12/11/12 16:36, jim.math...@gmail.com wrote:
I don’t see how this information will be of any use in deciding how
to present content, and will likely be used in the wrong way which
will break user experiences.
We have a related situation with W3C touch event interfaces. Web
authors are using t
On 13/11/12 16:37, wjohnston2...@gmail.com wrote:
Just to be clear, this is NOT generally true in what I've seen.
Websites send dramatically different content to small screen devices,
but not to touch based ones or tablets.
I think this is an important question. Is there anywhere we can get som
On 12/11/12 23:29, Justin Dolske wrote:
The UA is such a disaster. I wish we'd just freeze the damn thing
already (or as close to as possible).
Hey, I'm not saying that I like having to revisit this as often as we
are! :-|
Surely there are other ways to
help sites do whatever it is they wan
On 12/11/12 16:49, Marcio Galli wrote:
Touch++, again. Same points I said in September.
Can you give us a reference?
Gerv, do you have an online place that captures the discussion?
You mean the Touch/Tablet discussion?
The reason
I ask this is my interest to really understand what is the
On 12/11/12 16:07, Dirkjan Ochtman wrote:
A) Use "Touch" to indicate "has a touch-sensitive screen (and is not already
marked 'Mobile')". This would lead to us using it on tablets, Windows 8
machines, and any other desktop PC with a touchscreen. It would not be
removed if a keyboard was _also_ pr
Hi everyone,
Can we quickly revisit the question of whether to have one of "Touch" or
"Tablet" in our UA string under some circumstances? We need to work out
how Windows 8 Metro fits into our plans (bug 787786), plus the new pile
of touch-enabled laptops and desktops that I see in the glossy a
On 25/10/12 14:48, Henrik Skupin wrote:
When I started to work on tests for WebRTC and WebAPI lately I have
noticed that there are no clear specifications where tests have to be
added. Some are located in a tests subdirectory (like
/dom/feature/tests/) while others are under a testing folder (lik
On 11/10/12 08:54, David Anderson wrote:
Keep in mind that debug builds are probably at least an order of
magnitude slower (or a large factor), whereas PGO is a very small
factor. (After all, we do not PGO on Mac and it doesn't seem to be a
problem.)
5-20%, if it were a general slowdown, is _hu
On 27/09/12 14:30, fbender wrote:
As posted in the other thread, I'd rather setup an updateable list
instead of baking this list right into the release thus being able to
react faster on fixes to existing sites and newly found broken sites.
See the IE7/8/9 compat mode list analogy.
That is mech
On 26/09/12 14:05, Dirkjan Ochtman wrote:
This is likely to be a stupid question, but: posted where?
I can now say: in this group. Sorry for the delay :-) Dodgy wifi.
Gerv
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.m
This is a proposed lightweight policy for adding sites to the UA string
override list.
I propose that we implement this policy, then switch the B2G default UA
back to the OS-agnostic one (no "Android"; bug 787054). If we hit
problems with specific sites, we file bugs, run through this process,
On 25/09/12 17:57, Jason Smith wrote:
Don't know. We probably should define a strategy of how we're going to
get web content to move towards supporting the UA without the platform
identifier, so that we don't get endlessly stuck with Android in the UA
for FF OS in the long term.
I've just poste
On 24/09/12 20:06, Jason Smith wrote:
3. For v1, we probably need to still stick to the original plan for
the UA that does include Android in the UA, even though that's
sub-optimal to receive Android specific content. We should move to
the optimal UA in long-term though without the platform ident
On 18/09/12 17:13, Asa Dotzler wrote:
I think we should go with Touch like Microsoft and not Tablet.
The bug on this has been reopened:
https://bugzilla.mozilla.org/show_bug.cgi?id=773355
Gerv
___
dev-platform mailing list
dev-platform@lists.mozill
On 18/09/12 09:48, Jonas Sicking wrote:
I don't think there's a "good detection practice" for detecting what
hardware the user is running.
So either:
1) we need to invent one; or
2) we think that there is no legitimate use for the information (or
perhaps that there are a small number, but th
On 18/09/12 09:37, Jonas Sicking wrote:
So it seems to me that not putting hardware tokens in the UA string
effectively disables this business model.
I'm not sure that's true. Having no way to detect the underlying
hardware platform effectively disables this business model - or perhaps,
"busi
On 13/09/12 07:27, Jonas Sicking wrote:
* Some content providers strike deals with hardware manufacturers
which allow devices made by the manufacturer to access content for
free. One way that this is implemented is by looking for tokens in UA
strings and serve content based on this. This is obvio
On 20/08/12 18:25, Asa Dotzler wrote:
> Can you say more about this? Are you saying it's Mozilla's
> responsibility to put Mozilla resources into solving problems for Opera?
> I'm not sure I understand this assertion.
I think he's arguing that a belief in user choice could well translate
into doin
On 02/08/12 21:02, Benoit Jacob wrote:
> The #1 problem for many people with the current MDN wiki was that it didn't
> offer mediawiki-compatible markup editing. It would be great to be able to
> use right away one's familiarity with mediawiki markup (which is what most
> people know), and of cours
On 02/08/12 07:09, Lawrence Mandel wrote:
> My argument against is that this change continues the churn on our
> UAs, which have already been publicized [1]. Unless there is a clear
> benefit, I think we should avoid shooting ourselves in the foot by
> making changes that may impact compatibility.
On 02/08/12 11:53, Henri Sivonen wrote:
> Opera and, IIRC, the RIM PlayBook browser say "Tablet".
I love the fact that I can always rely on you to bring data about a
problem to the table :-)
> What if MS ships IE10 for phones with "Touch", too?
I'm assuming that they think that "Mobile" implies
http://blogs.msdn.com/b/ie/archive/2012/07/12/ie10-user-agent-string-update.aspx
IE10 has introduced the Touch token to the UA string, which overlaps in
intent with our Tablet token.
Dao suggests it would be nice to get cross-browser consistency here.
https://bugzilla.mozilla.org/show_bug.cgi?id=
101 - 167 of 167 matches
Mail list logo
