Slashdot Mirror

Actually Web browsers need to implement a standardized speech recognition API (WebSpeech --- https://developer.mozilla.org/...), so this work could and probably will become part of Firefox. We wouldn't want speech-dependent Web applications to suck in Firefox on Linux because Firefox doesn't have access to a quality recognizer on free operating systems, would we?

This sort of thing is why building and maintaining Firefox is tremendously expensive. http://robert.ocallahan.org/20...

For a lot of what C is used for, security and reliability are important, and C's (and C++'s) deficiencies are critical by any definition. See http://robert.ocallahan.org/20... for more of my thoughts on that.

When security and reliability truly don't matter, C's deficiencies are only critical if you care about wasting time and money developing in a language without any modern productivity features.

(Note that developers tend to underestimate the importance of security and reliability of their code. If you create a library and release it, you never know when someone's going to use it on untrusted input or as a component of an important system.)

I wrote about this:
http://robert.ocallahan.org/20...
Summary: In practice, attackers can leverage arbitrary-write bugs to produce the same-origin violations Microsoft warns about without requiring RCE, completely bypassing the CFI mitigations Microsoft is touting here.

WebAssembly: Mozilla Won (Not a put-down to the excellent Chrome developers, but acknowledging the massive and important contribution Mozilla made here.)

After reading, what I get is the devs saying procceses/threads as dictated wont solve the problems being described. And that they will work to solve them a different way.

The "different way" is sitting around hoping that some experimental non-useful "transactional programming language" called X10 never released outside IBM will have its ideas absorbed into C and Javascript so they can be used to fix the web without using threads. I hope I don't have to tell you how that panned out in the decade that they sat on the bug.

The "different way" did not include clear statement that "bad javascript on the web should not cause unrelated tabs to hang."

I agree with GP it is dysfunctional.

Wonder if antivirus has anything to do with it...

http://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html

For example, back when we first made sure ASLR was working for Firefox on Windows, many AV vendors broke it by injecting their own ASLR-disabled DLLs into our processes. Several times AV software blocked Firefox updates, making it impossible for users to receive important security fixes.

I wrote about the weaknesses of the AV-Comparatives tests here: http://robert.ocallahan.org/20...
Testing against only already-identified malware is bogus. But FWIW, Defender has a 97% catch rate in AV-Comparatives' latest report.

I wrote about this in a followup: http://robert.ocallahan.org/20...

The problem is that, by design, AV software is ineffective at catching "new stuff", partly because malware authors can tweak new malware until it passes the classifiers of the major AV products.

So the reality is that every day new malware appears that will not be caught by even the best AV packages unless you're lucky. Real life detection rates will be significantly lower than seen in these tests. Even if the difference between Windows Defender and the others grows a bit, it may actually be less significant.

"A chance at catching them" isn't good enough. What you need are the systematic security measures deployed by modern OSes and browsers, more and better. And AV software gets in the way of that.

And their js is slow as fuck compared to Firefox's engine, which also just surpassed V8's speed

The comments here are explain this pretty well:
http://samuelsidler.com/2013/03/firefox-os-and-browser-choice/#comment-183

Summary:
FirefoxOS is roughly an Android kernel, Gecko-based userspace, and the Gaia HTML+JS homescreen apps. Anyone is free to replace the Gecko-based userspace with something else, e.g. a Webkit-based userspace. We (Mozilla) are assisting with this by standardizing the phone-specific HTML+JS APIs so they can be reimplemented by others, by trying to ensure Gaia doesn't have unnecessary dependencies on non-standard stuff, and of course by making everything under our control open source. Your OS should be able to run FirefoxOS apps and we have open-sourced our app store so you might even be able to run our app store (I'm not sure). Apple obviously provides nothing comparable for iOS!

However, if you replace Gecko then the result isn't really FirefoxOS any more and you wouldn't be allowed to use the Firefox trademark (nor would it be appropriate for you to do so).

If you're asking for the ability to install an alternative native-code Web engine alongside Gecko on FFOS, the answer is no; giving Gecko sole control of FFOS userspace simplifies a lot of problems and increases performance and security. See http://robert.ocallahan.org/2013/03/canonicals-new-mir-display-server-and.html for more.

I thought FireFox was such a positive force for open standards, in the days when IE was a monopoly.

But something happened. FireFox got to 20% market share, and they got a bunch of money (from Google) and fame. Then, Mozilla ceased to become an organization that was dedicated to an open web. It became, instead, an organization that knew better than the open web. It wasn't about implementing standards any more. It was about God's chosen web engineers determining what was best for the web.

The problem with Mozilla refusing to implement open standards that other browsers implement, is the same problem we had back when IE had disproportionate market share.

Chrome and Opera and Webkit don't suffer from this narcissism. They just get on with it and implement open standards.

Hooray for open standards!

Why Mozilla Doesn't Use Native Widgets

XUL is a smart move IMHO.