Re: Intent to ship WebRTC RTCRtpReceiver contributing and synchronization sources

2017-12-11 Thread Tanvi Vyas
dia, and as > the bug indicates, there are other ways to obtain it. > > -Ekr > > > On Thu, Dec 7, 2017 at 3:41 PM, Tanvi Vyas wrote: > >> Is there a pref to turn this added functionality off? That way users who >> are worried about their fingerprint can change the

Re: Intent to ship WebRTC RTCRtpReceiver contributing and synchronization sources

2017-12-07 Thread Tanvi Vyas
Is there a pref to turn this added functionality off? That way users who are worried about their fingerprint can change the about:config pref? Or perhaps it can be disabled when privacy.resistFingerprinting is set to true? Thanks! ~Tanvi On Tue, Dec 5, 2017 at 9:19 PM, Nico Grunbaum wrote: >

Re: Still-supported cases of out-of-tree XPCOM code?

2017-11-15 Thread Tanvi Vyas
We can easily make the containers addon a Web Extension and take out the bootstrap.js code. But until today (with 57 out the door), we couldn't do that. We could only host one version of the addon on AMO, so we had to host one that was compatible with release. Now that 57 is out the door, we can

Re: MXR permanently offline, please transition to DXR

2016-07-08 Thread Tanvi Vyas
On 7/8/16 12:49 PM, Gijs Kruitbosch wrote: In case this is useful for folks: I wrote a webextension that rewrites these links and that obeys the "rev" and "mark" query params from MXR links and rewrites them to the equivalent DXR URL syntax: https://addons.mozilla.org/en-US/firefox/addon/mxr-

Re: MXR permanently offline, please transition to DXR

2016-06-27 Thread Tanvi Vyas
Is it possible to safely redirect mxr to dxr? When I use my awesomebar and type "docshell", it pulls up https://mxr.mozilla.org/mozilla-central/source/docshell/base/nsDocShell.cpp. I click enter and end up at the mxr error page. So instead I do a dxr search for docshell and scroll through a l

Re: Nightly Only Containers Feature

2016-06-16 Thread Tanvi Vyas
Looks like there are some formatting issues with the blogpost link, so sending it again: https://blog.mozilla.org/tanvi/2016/06/16/contextual-identities-on-the-web/ On 6/16/16 11:42 AM, Tanvi Vyas wrote: This week we enabled the Containers feature for testing in Nightly. Containers is a way

Nightly Only Containers Feature

2016-06-16 Thread Tanvi Vyas
This week we enabled the Containers feature for testing in Nightly. Containers is a way for users to have multiple browsing contexts within the sameprofile. With these different contexts, Containersallows users to login to multiple accounts on the same domain simultaneouslyin the same browser w

Re: Intent to implement and ship: rel="noopener" on links

2016-04-25 Thread Tanvi Vyas
Very cool! Thanks for implementing. On 4/25/16 11:09 AM, Boris Zbarsky wrote: Summary: The idea is to be able to write Go there and not have "someone-I-don't-trust" be able to get hold of your window via window.opener. This is already possible with rel="noreferrer", but that also preve

Re: One Firefox repository to rule them all

2016-04-18 Thread Tanvi Vyas
+1. Figuring out why a line of code was added years ago and what bug caused the change takes way too long. On 4/16/16 2:05 AM, Henri Sivonen wrote: On Sat, Apr 16, 2016 at 8:02 AM, Nicholas Nethercote wrote: For me, having the CVS history in the mozilla-central repo would be much more helpfu

Re: Intent to ship: Treat cookies set over non-secure HTTP as session cookies

2016-04-14 Thread Tanvi Vyas
On the surface, this seems like a great idea and privacy win - it gets rid of all those pesky tracking cookies! But under the covers there are a lot of issues, as mentioned by previous replies and summarized below: * Puts the user's password at greater risk, since the user has to enter it and

Re: Heads-up: SHA1 deprecation (for newly issued certs) causes trouble with local ssl-proxy mitm spyware

2016-01-04 Thread Tanvi Vyas
On 1/4/16 11:20 AM, Richard Barnes wrote: First a bit of good news: The overall trend line for SHA-1 errors is not spiking (yet). Bin 6 of SSL_CERT_VERIFICATION_ERRORS corresponds to ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED, which is what you get when you reject a bad SHA-1 cert. https://ipv.sx/

Re: about:profiles and the new profile manager

2015-12-18 Thread Tanvi Vyas
Very cool baku! Thank you! I just tried it out, and although I'm sure there are many things we could do to enhance the UI/UX, this is much better than what we had before. On 12/18/15 9:17 AM, Andrea Marchesini wrote: Hi all, This week I landed a set of patches to introduce 'about:profiles'.

Re: Intent to ship: RC4 disabled by default in Firefox 44

2015-09-03 Thread Tanvi Vyas
Do we know if Chrome or IE will have a fallback UI? On 9/1/15 10:30 AM, Richard Barnes wrote: And from Microsoft: http://blogs.windows.com/msedgedev/2015/09/01/ending-support-for-the-rc4-cipher-in-microsoft-edge-and-internet-explorer-11/ On Tue, Sep 1, 2015 at 1:03 PM, Richard Barnes wrote:

Re: Intent to Ship: Updated third-party iframe storage behavior

2015-08-18 Thread Tanvi Vyas
It is nice to see that we are moving towards an "Accept third party cookies and data" setting instead of just "Allow third party cookies". Will localstorage and sessionstorage also start honoring the users blocking preferences soon? On 8/18/15 8:20 AM, Michael Layzell wrote: Summary: Currentl

Re: PSA: Upcoming changes to the creation of Necko channels

2015-04-06 Thread Tanvi Vyas
Hi Ehsan, Before we created the loadInfo object, the use of TYPE_OTHER in Gecko was close to zero. Now the use of nsIContentPolicy::TYPE_OTHER is mostly used for internal loads, but it would be good to change that to TYPE_INTERNAL and use TYPE_OTHER sparsely or change it to something more sp

Re: Sane/possible to implement/standardize opt-in (user and page) mobile "show password" behavior for HTML input type=password?

2014-12-12 Thread Tanvi Vyas
A touch event or mouseclick-and-hold on the eye icon could show the password, and as soon as the user releases the password can go back to being obfuscated. That would prevent accidental leakage through screen sharing. The tricky part is adding such an icon next to the password field (same is

Re: Standardizing request contexts

2014-07-01 Thread Tanvi Vyas
On 7/1/14 7:28 AM, Doug Turner wrote: adding tanvi. On Jul 1, 2014, at 7:20, Boris Zbarsky wrote: On 7/1/14, 6:06 AM, Anne van Kesteren wrote: Hi Doug, Patrick, Boris, ccing Jonas, since he's been thinking about this a lot recently. https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XP

Re: Request principal in nsIContentPolicy implementation

2014-05-13 Thread Tanvi Vyas
Hi Matthew, Are you using any other addons that could be calling into nsIContentPolicy? aRequestPrincipal is optional for non-gecko code, so perhaps another caller isn't setting it[1]? You can also get the principal off the Context[2][3]. Depending on what information you are trying to gat