Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread Anne van Kesteren
On Sat, Jan 31, 2015 at 12:15 AM, L. David Baron wrote: > My understanding is that the objections to powerfulfeatures are over > the possibility of powerfulfeatures defining what is and isn't a > powerful feature, because that should be decided primarily by the > group developing the feature. It'

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread Brian Smith
L. David Baron wrote: > Is the argument you're making that if the site can serve the ads > from the same hostname rather than having to use a different > hostname to get same-origin protection, then ad-blocking (or > tracking-blocking) tools will no longer be able to block the ads? Yes. Anyway,

Partial restoration: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread Hal Wine
[typo on address first time] Forwarded Message Subject: Partial restoration: gecko-dev and Git replication will be broken for a little while

Re: Evaluating the performance of new features

2015-01-30 Thread Chris Peterson
A 2013 dev-platform thread ("Storage in Gecko") spawned bug 866238: Implement simple key-value store module on top of indexedDB for storing small amounts of data. https://groups.google.com/forum/#!topic/mozilla.dev.platform/vYbQqkqGzlo chris On 1/30/15 10:03 PM, Vladan Djeric wrote: We do

Re: Evaluating the performance of new features

2015-01-30 Thread Vladan Djeric
We do need a performant key-value store implementation. This has been discussed before and various people have come up with proposals (myself included), but no one has had the time & focus to see it through to the end :/ I suspect part of the problem is that different use cases (IndexedDB re-implem

Re: Intent to implement and ship FormData on workers

2015-01-30 Thread Tantek Çelik
On Fri, Jan 30, 2015 at 7:13 AM, Boris Zbarsky wrote: > On 1/30/15 1:30 AM, nsm.nik...@gmail.com wrote: >> >> Well my work on getting FormData on workers was because Fetch uses it, and >> there doesn't seem to have been demand for it on workers before. > > > That's fair, but it seems like exposing

Re: HEADS-UP: Disabling Gecko Media Plugins on older Linux kernels (bug 1120045)

2015-01-30 Thread Bobby Holley
I think the point here is that we want to free ourselves from needing the chemspill over OpenH264 memory hazards if we find them (since the code is relatively new). With gstreamer, I think we just blacklist vulnerable versions. On Fri, Jan 30, 2015 at 3:15 PM, Mike Hommey wrote: > On Fri, Jan 3

Re: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread Gregory Szorc
I figured people would like an update. There were multiple, independent failures in the replication systems (there are 2 systems that replicate Mercurial to Git). At least one system wasn't DAG aware. It was effectively using the "tip" commit of the Mercurial repositories (the most recently commi

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread Martin Thomson
Please note the need to liaise with the groups that are affected by the permissions work. Otherwise, this is good. On Fri, Jan 30, 2015 at 3:20 PM, L. David Baron wrote: > Here's a revised set of comments, mainly changing: > > - describes the objection to powerfulfeatures (part of objection (3

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread Eric Rescorla
This seems good to me. On Fri, Jan 30, 2015 at 3:20 PM, L. David Baron wrote: > Here's a revised set of comments, mainly changing: > > - describes the objection to powerfulfeatures (part of objection (3)) >more clearly, but also, I think, scopes the objection a bit more >narrowly > > -

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread L. David Baron
Here's a revised set of comments, mainly changing: - describes the objection to powerfulfeatures (part of objection (3)) more clearly, but also, I think, scopes the objection a bit more narrowly - makes objection (2) more explicit about being satisfied by an option not to complete the

Re: HEADS-UP: Disabling Gecko Media Plugins on older Linux kernels (bug 1120045)

2015-01-30 Thread Mike Hommey
On Fri, Jan 30, 2015 at 12:33:55PM -0500, Randell Jesup wrote: > >On Thu, Jan 29, 2015 at 06:57:30AM +0900, Mike Hommey wrote: > >> So, in practice, because the h264 code is not sandboxed on some setups, > >> we're disabling it so that vp8, which is not sandboxed either, is used > >> instead. We ha

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread L. David Baron
On Friday 2015-01-30 11:14 +0100, Anne van Kesteren wrote: > On Fri, Jan 30, 2015 at 7:32 AM, L. David Baron wrote: > > I'm particularly interested in review of point (3) in what I've written; > > I feel that the argument I've written so far is weak, I think because I > > don't particularly unders

Windows performance tutorial videos

2015-01-30 Thread ben turner (bent)
Hi folks, If you're a Windows developer I highly recommend watching these free videos that explain how to use the windows performance toolkit: https://randomascii.wordpress.com/2014/08/19/etw-training-videos-available-now/ It requires a free signup and then the videos are time-limited, but t

Re: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread Wander Lairson Costa
On Fri, Jan 30, 2015 at 2:24 PM, Gregory Szorc wrote: > On Fri, Jan 30, 2015 at 3:38 AM, Wander Lairson Costa > wrote: >> >> On Thu, Jan 29, 2015 at 8:48 PM, Mike Hommey wrote: >> > On Thu, Jan 29, 2015 at 12:31:35PM -0800, Gregory Szorc wrote: >> >> The steps within my control to potentially fi

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread L. David Baron
On Friday 2015-01-30 10:18 -0800, Eric Rescorla wrote: > I think there's some competence there, certainly, but I'm not convinced > it represents a balanced set of the views on this topic. If there is to > be oversight, it should probably be at that TAG level, IMHO. For many topics, oversight from

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread Eric Rescorla
On Fri, Jan 30, 2015 at 2:14 AM, Anne van Kesteren wrote: > Thanks David! > > On Fri, Jan 30, 2015 at 7:32 AM, L. David Baron wrote: > > I'm particularly interested in review of point (3) in what I've written; > > I feel that the argument I've written so far is weak, I think because I > > don't

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread Eric Rescorla
This seems satisfactory to me. On Thu, Jan 29, 2015 at 10:32 PM, L. David Baron wrote: > Here are the comments I have so far on this charter, based on the > thread. I'd note that this is a relatively large set of demands to make > in the charter review stage at the AC, especially for a recharte

Re: HEADS-UP: Disabling Gecko Media Plugins on older Linux kernels (bug 1120045)

2015-01-30 Thread Randell Jesup
>On Thu, Jan 29, 2015 at 06:57:30AM +0900, Mike Hommey wrote: >> So, in practice, because the h264 code is not sandboxed on some setups, >> we're disabling it so that vp8, which is not sandboxed either, is used >> instead. We have about the same amount of control over openh264 and >> vp8 code bases

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread L. David Baron
On Friday 2015-01-30 08:54 -0800, Daniel Veditz wrote: > On Thu, Jan 29, 2015 at 10:32 PM, L. David Baron wrote: > > > There are a number of problematic aspects to this charter to which > > we object: > > > > (1) The "Confinement with Origin Web Labels" deliverable is described > > in a way t

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread Daniel Veditz
On Thu, Jan 29, 2015 at 10:32 PM, L. David Baron wrote: > There are a number of problematic aspects to this charter to which > we object: > > (1) The "Confinement with Origin Web Labels" deliverable is described > in a way that makes it unclear what the deliverable would do. It > should

Web Workers full reference + tutorials

2015-01-30 Thread Chris Mills
Hi all, We’ve had some web workers stuff on MDN for a while now, but it has been rather bitty and incomplete. I’ve added in the missing bits, updated stuff, and pulled it together underneath the following landing page: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API Let me kno

Re: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread Andrew McCreight
On Fri, Jan 30, 2015 at 2:08 AM, Tim Guan-tin Chien wrote: > Any support for Level 1 people for creating a patch-to-commit for > attaching on Bugzilla? > I tried :jlebar's moz-git-tools once but the exported patch was broken for > hg. > The easiest way to attach a git patch to bugzilla is with

Re: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread Gregory Szorc
On Fri, Jan 30, 2015 at 3:38 AM, Wander Lairson Costa wrote: > On Thu, Jan 29, 2015 at 8:48 PM, Mike Hommey wrote: > > On Thu, Jan 29, 2015 at 12:31:35PM -0800, Gregory Szorc wrote: > >> The steps within my control to potentially fix this issue have been > >> postponed until at least tomorrow du

Re: Intent to implement and ship extended FormData methods

2015-01-30 Thread Boris Zbarsky
On 1/30/15 1:25 AM, nsm.nik...@gmail.com wrote: https://bugzilla.mozilla.org/show_bug.cgi?id=1127703 Thanks. The fetch spec states that FormData is immediately serialized when send() is called (send defers to Fetch's "extract body" routine) https://fetch.spec.whatwg.org/#concept-bodyinit-ex

Re: Intent to implement and ship FormData on workers

2015-01-30 Thread Boris Zbarsky
On 1/30/15 1:30 AM, nsm.nik...@gmail.com wrote: Well my work on getting FormData on workers was because Fetch uses it, and there doesn't seem to have been demand for it on workers before. That's fair, but it seems like exposing it separately, if it's going to be ready before the rest of Fetch

Re: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread kgupta
On Friday, January 30, 2015 at 5:30:52 AM UTC-5, 陳侃如 Kan-Ru Chen wrote: > > I use this alias in ~/.gitconfig > > [alias] > hg-format-patch = !sh -c 'git format-patch -kp -U8 "$@"|tee > /dev/stderr|xargs git-patch-to-hg-patch' git > > Get git-patch-to-hg-patch from https://github.com/mozil

Re: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread Trevor Saunders
On Thu, Jan 29, 2015 at 01:28:48PM -0800, Eric Rescorla wrote: > Thanks. Hopefully all will be back to normal soon. Alternatively you can use the git-remote-hg glandium wrote and let Alternatively you can take the excuse and switch to using the git-remote-hg glandium wrote for everything and let m

Re: Evaluating the performance of new features

2015-01-30 Thread Gabriele Svelto
On 30/01/2015 08:45, Jonas Sicking wrote: > However, it would be cool if we fixed our IndexedDB implementation > rather than told our own developers not to use it. Web developers are > not so lucky as to have other options. Yeah and we're making some pretty heavy use of it within Firefox OS. I've

Re: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread Wander Lairson Costa
On Thu, Jan 29, 2015 at 8:48 PM, Mike Hommey wrote: > On Thu, Jan 29, 2015 at 12:31:35PM -0800, Gregory Szorc wrote: >> The steps within my control to potentially fix this issue have been >> postponed until at least tomorrow due to the Firefox Beta build today. >> tl;dr is people don't want to tak

Re: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread 陳侃如
Tim Guan-tin Chien writes: > On Fri, Jan 30, 2015 at 6:48 AM, Mike Hommey wrote: >> >> People using Git for Gecko development can also try a new workflow that >> doesn't involve gecko-dev at all. >> >> http://glandium.org/blog/?page_id=3438 >> >> Mike > > This sure look promising! > > Any suppor

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread Anne van Kesteren
Thanks David! On Fri, Jan 30, 2015 at 7:32 AM, L. David Baron wrote: > I'm particularly interested in review of point (3) in what I've written; > I feel that the argument I've written so far is weak, I think because I > don't particularly understand the concerns about the powerfulfeatures > draft

Re: gecko-dev and Git replication will be broken for a little while

2015-01-30 Thread Tim Guan-tin Chien
On Fri, Jan 30, 2015 at 6:48 AM, Mike Hommey wrote: > > People using Git for Gecko development can also try a new workflow that > doesn't involve gecko-dev at all. > > http://glandium.org/blog/?page_id=3438 > > Mike This sure look promising! Any support for Level 1 people for creating a patch-to

Re: Proposed W3C Charter: Web Application Security (WebAppSec) Working Group

2015-01-30 Thread Anne van Kesteren
On Thu, Jan 29, 2015 at 10:27 PM, Eric Rescorla wrote: > On Thu, Jan 29, 2015 at 12:56 PM, L. David Baron wrote: >> On Friday 2015-01-16 09:58 +0100, Anne van Kesteren wrote: >>> Also, can we request that they adopt a public asynchronous decision >>> policy? I think we should start making that re

Re: Memory management in C programs

2015-01-30 Thread Frederik Braun
On 29.01.2015 21:32, ISHIKAWA, Chiaki wrote: > On 2015/01/12 22:46, Philip Chee wrote: >> "" >> One large difference between C and most other programming languages is >> that in C, you have to handle memory yourself rather than having a >> garbage collector do it for you. Ensuring that memory is al