rfk

6 ms·

1.
by rfk 7y ago
Any sort of verification presumes that you have an initial trusted checksum against which to verify, so I don't believe this solves the separate problem of obtaining such a checksum. IIUC your question here boils down to "what is
2.
by rfk 7y ago
There are plenty of mischievous things an attacker could do if you just verify each chunk separately, including reordering or omitting chunks, and truncating the file.
3.
by rfk 8y ago
For no reason other than "legacy reasons" - much of the client-side crypto code in the current Firefox Sync is inherited from an earlier system that predates widespread acceptance of GCM as a best practice. If we designed it from
4.
by rfk 8y ago
Hi, Firefox Accounts developer here. You're correct in your understanding that that login flow is ultimately driven by a webpage, and this is a deliberate trade-off that we made in the interests of reach and usability of the system. I
5.
by rfk 8y ago
FWIW, as a developer on the Firefox Accounts team, I strongly endorse the sentiment of this article. We've occasionally found ourselves merging microservices back together because the abstraction boundaries we designed up-front weren&#
6.
by rfk 8y ago
Because I typo'd the date; thanks, fixing now...
7.
by rfk 10y ago
> Unmaintained critical infrastructure is bad news. (article author here) To add to @callahad's excellent points: unmaintained critical infrastructure on your security perimeter is even worse, and a service like Persona is about as
8.
by rfk 11y ago
Yes indeed; I have bugs open to get those added to all our public-facing Persona docs.
9.
by rfk 11y ago
Not that it really matters after this announcement, but it has always been possible to disable the suggested tiles, from the little settings gear icon on the newtab page.
10.
by rfk 11y ago
This thread suggests that Hello is indeed being considered for similar treatment: https://mail.mozilla.org/pipermail/gofaster/2015-November/00...
11.
by rfk 11y ago
> Firefox Accounts has an active userbase orders of magnitude larger than Persona's. > We may be able to reintroduce a notion of federated identity into FxA at some point in the future As a member of the team working on Firef
12.
by rfk 11y ago
Not sure I understand your question, but the thing I'm talking about is a new "Firefox for iOS" product being worked on right now, due for release pretty soon IIUC, that will include syncing among its core capabilities: h
13.
by rfk 11y ago
Yes, proper syncing with Desktop Firefox is a core part of the new Firefox for iOS initiative.
14.
by rfk 11y ago
Mozilla could be just as easily compelled to turn over user data as Pocket, they're both US companies bound by US law.
15.
by rfk 11y ago
It's not hard to imagine how this concept could expand to the web at large. Rather than deciding what ad to display by consulting a user profile built on cross-site history tracking, a site could simply ask the browser for advice on w
16.
by rfk 11y ago
Indeed, the whole point of this (and all the verbiage about "respecting user privacy") is that the browser will do the analysis locally without sending history data back to Mozilla.
17.
by rfk 12y ago
it's a slidedeck from a presentation, you can use the arrow keys to advance slides.
18.
by rfk 12y ago
I had not considered this, it's currently just using whatever default colours matplotlib selected. Thanks for the heads-up!
19.
by rfk 12y ago
> The old one let you run your own server. This is still possible with the new system, although I'll admit the ease and usability of such a setup needs work (and IIRC there are some changes required before android devices can proper
20.
by rfk 12y ago
Unfortunately this server is not compatible with the new sync protocol. It will continue to work while there is still old-sync support in the browser (a few versions after FF29 at least) but will eventually need to be upgraded to the new s
21.
by rfk 12y ago
> It also let you sync through your own server rather than Mozilla's which I don't think the new version does yet This is possible with the new version, but it's not (yet) as simple as it was with the previous one: ht
22.
PyPy.js Update: A Proof-of-Concept JIT(rfk.id.au)
3 points by rfk 13y ago|0 comments
23.
by rfk 13y ago
Heh, actually it might be possible to cheat a little with this backend as well, using http://www.jsil.org/ to translate the output of the cli backend into javascript. Trying C+Emscripten versus CIL+JSIL would be a very int
24.
by rfk 13y ago
I got my acronyms wrong, it's called the "CLI" backend, but it's definitely in there: http://doc.pypy.org/en/latest/cli-backend.html
25.
by rfk 13y ago
The RPython toolchain has another mode of operation, which outputs higher-level class-based code rather than low-level C-style code. They use this for a CLR backend, but it would be interesting to try implementing a JavaScript backend at t
26.
by rfk 13y ago
A big part of the current size problem is the way that the stdlib files are bundled - the contents of each file are encoded, byte-for-byte, as a list of base-10 integers. So "hello" gets bundled as "[104, 101, 108, 108, 111]
27.
PyPy.js: First Steps(rfk.id.au)
129 points by rfk 13y ago|49 comments
28.
by rfk 13y ago
I recently set up my personal domain as an identity provider, using static HTML/javascript files and a bit of crypto: https://www.rfk.id.au/blog/entry/persona-identity-provider/ There are some things to be mindful of w.r.t. security
29.
by rfk 14y ago
Mozilla Services is the team within Mozilla that builds/runs much of the backend infrastructure, e.g. the firefox sync servers, marketplace servers etc. The existence of separate "mozilla" and "mozilla-services" github projects is largely
30.
by rfk 14y ago
In the case of gmail, they're note even waiting. There is active development on a gmail-to-persona proxy so that you can authenticate with just your gmail password: https://github.com/mozilla/browserid-bigtent

More ›