Best match

Most recent

Thirty-six cybersecurity-related merger and acquisition (M&A) deals were announced in May 2023. CACI has announced buying Bitweave. Both companies are based in the UK and they both offer technology services,

https://www.bing.com/th?id=OVFT.ZwVET3LOgk5xI5GCLDds-y&pid=News

Cybersecurity M&A Roundup: 36 Deals Announced in May 2023

https://www.bing.com/th?id=ODF.IoHVgrsZHSAlqnkD4m21Gw&pid=news

SecurityWeek

I’m not a fan of Google’s approach,” extension developer and researcher Wladimir Palant wrote in an email. In the days before Chrome, when Firefox had a bigger piece of the browser share, real people reviewed extensions before making them available in the Mozilla marketplace.

Google’s Android and Chrome extensions are a very sad place. Here’s why

https://www.bing.com/th?id=ODF.ujb7xrXKIzzWUeiq3sEXxg&pid=news

Ars Technica

Watermark

AI Challenge

Mozilla

What just happened? Mozilla has organized a "Responsible AI Competition" to promote a more ethical and socially acceptable use of generative AI technology and

https://www.bing.com/th?id=OVFT.0YJdpxOfjicY5_OROklXPi&pid=News

Mozilla’s Highest Award Responsible AI Challenge Is Awarded to AI Watermark Protection Technology

Somag News

Windows 7

Firefox

Users of older versions of Windows and MacOS will soon no longer receive support for Firefox.

https://www.bing.com/th?id=OVFT.3RxiqEdvcYgGJ26ecqUIAC&pid=News

Mozilla ends Firefox support for Windows 7, 8, and older Macs

https://www.bing.com/th?id=ODF.OnJZaVfSVEEHyuMeLgxeZw&pid=news

PC World

Achievement

Mozilla's Responsible AI Challenge was a new incubator program conceived to promote AI solutions that would serve the whole society instead of greedy

Mozilla's responsible AI challenge top award goes to an anti-AI watermark technology

https://www.bing.com/th?id=ODF.lK_Pb1dzSoft564j8nm9vw&pid=news

TechSpot

The winners of Mozilla’s Responsible AI Challenge contain a bunch of fantastic ideas that could put AI to good use in making the world a much better place.

https://www.bing.com/th?id=OVFT.XJwlwGuyidlLdqXmfgYWfy&pid=News

Digital Trends

These ingenious ideas could help make AI a little less evil

https://www.bing.com/th?id=ODF.x644vROjZrRe0pKC7YX3XQ&pid=news

The Responsible AI Challenge, Mozilla's latest initiative to invest in responsible AI tech, has announced three winners.

https://www.bing.com/th?id=OVFT.l7yNVyem51wy5XptnXz0MC&pid=News

Mozilla's Responsible AI Challenge won by tech that protects images from AI

https://www.bing.com/th?id=ODF.nYADEgS75l8rdCg9D-p_OQ&pid=news

YAHOO!News

Europe

The popular browser Firefox promises to offer support for Windows 7, 8 and 8.1 until September 2024. Owner Mozilla thus already offers a more long-term

https://www.bing.com/th?id=OVFT.qoCkIJeWc5Dh2L9I7ubd9y&pid=News

Firefox to end Windows 7, 8 and 8.1 support by September 2024

techzine

Digital mental health company BetterHelp is facing multiple potential class action lawsuits over claims from patients that it shared their personal information to advertisers — including Facebook. The lawsuits came soon after BetterHelp agreed in March to pay $7.

https://www.bing.com/th?id=OVFT.S_F6zwccKAi1367NaMI7jS&pid=News

Mental health apps might put your privacy at risk. Here's how to stay protected

https://www.bing.com/th?id=ODF.UM0amhg3WAObCEGqc4w_Cw&pid=news

Yahoo

Get the most recent info and news about Mozilla on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

Mozilla Foundation operates as a non-profit organization The Organization develops browsers, apps, codes, and tools, as well as provides desktop browsers, mobile, and pocket browsers. Mozilla Foundation serves communities in the State of California.

How the autocomplete search in the Mozilla Documentation Works

I joined a panel with awesome fellow founders and builders of Mozilla to discuss the future of "citizen publishing" as a way to democratize the internet. Massive shoutout to "How to do nothing" by Jenny Odell which informs a lot of my thinking on what is wrong with the internet and how we can began to fix it. You can watch me from 30:28 and at 1:23:39. David Transcript of my part: Question: Also we have with us Linh of Hacker Noon whose team has worked tirelessly to decentralize citizen journalism. Linh - we hear a lot about misinformation.. and big media channels can be worrisome sometimes. How does citizen journalism promise to keep society differently? Answer: Here at Hacker Noon, I think a lot about the flow of information. If you think about how we traditionally receive information, it's typically via things like the New York Times, Wall Street Journal, a group of very prestigious journalists that create the kind of information that people historically trust. Now with the rise of social media, you see an entirely different way "citizens" can receive information (whether or not it's journalism is questionable). But, social media is very accessible, easy to use, and information, trust-worthy or not, spread like wild fires. So here at Hacker Noon, we try to combine the good aspects of traditional journalism as well as the good of social media, making it accessible for everyone, anyone with a keyboard can publish on Hacker Noon as long as they have some kind of expertise on technology. But unlike social media where there's a big question mark about how verified information is  (for example, not until the 2016 election that Twitter started to realize the lack of fact-checking necessary for information circulating online), we go above and beyond. We don't think just put a tag on the fact is enough, there always needs to be another set of eyeballs to factcheck the information (what we call the at Hacker Noon). That human touch guarantees that an editor can always vet whether or not a submission is worth publishing. So to answer your initial question, to combat misinformation, we need accessibility as well as a good verification process. We try to do that at Hacker Noon instead of throwing a towel in traditional journalism or social media. Second Human Rule #fixtheinternet with Mozilla.

Linh Dao Smooke & David Smooke repping Hacker Noon at the Mozilla Fix the Internet Showcase

Hacker Noon Joins Mozilla’s Fix The Internet Initiative

Hacker Noon Joins Mozilla’s Fix The Internet Incubator

Build a scalable and privacy-first Internet on . Get the on Rust, WebAssembly, serverless, blockchain, and AI. Second State’s serverless infrastructure email newsletter Internet privacy is broken The Public Key Infrastructure (PKI), invented over 40 years ago, has been the bedrock for security and privacy on the Internet. While PKI algorithms are behind the most internet security protocols, such as HTTPS and TLS, the idea for individuals to use public keys to exchange data, (eg, PGP), was not adopted on a large scale. Traditional PKI is not scalable. It is an complexity problem for an individual to encrypt and send each of her files ( ) using the public key from each of the recipients ( ). O(n*m) n m Centralized file-sharing services, such as Dropbox, reduced the problem complexity to O(n+m) as the individual only needs to upload each file once and to manage her contacts list one person at a time. The complexity could be further reduced to O(m) as the centralized service automates file uploading. The centralized model has proven scalable but also brings significant privacy implications. The service at the center “sees” all data and can be hacked even if they do not do evil themselves. Privacy over profit. — Mozilla Foundation The centralization of Internet and the evasion of privacy is one of the reasons Mozilla called for . Second State is one of the teams that responded to the call and joined the Open Labs to develop a prototype product for a privacy-first Internet. Apply for the for $10k to $75k in funding! “fix-the-Internet” Mozilla Builders Incubator program A new hope In recent years, the proxy re-encryption scheme has emerged as a way to reduce the complexity of privacy-first file sharing to N+M. The idea, known as , is for the individual to encrypt each file once and store the encrypted data on a server. Then, only approved recipients have the ability to download and decrypt the data. A recipient can be added to or removed from the access list at any time. Orthogonal Access Control There can be one or more server-side repositories facilitating the sharing, but none of the servers can decrypt the data. In fact, the file repositories can be open and anonymous and yet still private to people who holds the appropriate private keys. has developed a suite of open source tools and runtimes for the cloud native Internet. Second State tools enable developers to write that can be deployed as web services. In Mozilla Open Labs, the team sets out to build web services that streamline and simplify developer adoption of proxy re-encryption in building privacy-first applications. Second State fast, safe, portable, and serverless functions A solution As part of its Mozilla Open Labs deliverable, Second State has released a developer preview of its open source software. The software enables developers to create public key management services on the Internet. Here is a typical user story for using this service to share private data. recrypt-as-a-service Each individual (Alice, Bob, and Charlie etc) creates an identity on the service via a create_identity request. Alice can grant Bob access to all her data via a grant_access request. When Alice creates a confidential document, she creates a new AES encryption key to encrypt it. She generates the AES key via a create_sym_key request. Alice encrypts and publishes the encrypted document on any public web server. When Bob wants to decrypt the document, he asks for Alice's AES key via a get_sym_keyrequest. The Second State is based on ’ open source proxy re-encryption implementation library. This library is written in the high performance Rust programming language. Second State provides a to provide this library as a safe and scalable Internet service. about Second State’s software platform. IronCore Labs WebAssembly-based runtime Learn more What’s next In the era of COVID-19, online privacy is more important than ever. Telemedicine solutions are increasingly used to avoid infections from hospitals visits. More than ever, we need to share personal medical records with multiple members of the care team in a secure and private manner. As societies re-open, data surveillance efforts such as immunization passports and contact tracing are increasingly used to ensure public safety. It is paramount that we do not give central data repositories, such as governments or big corporations under government contracts, the ability to infringe on our privacy. Hence, the next phase of Second State’s work in Mozilla Open Labs is to build prototype user interfaces for privacy-first exchange of personal medical information. Software developers can now create their own . Start building your privacy-first apps today! recrypt-as-a-service PS. Stay in touch! Get the on Rust, WebAssembly, serverless, blockchain, and AI. email newsletter

Second State Releases Scalable Privacy Service at Mozilla Open Labs

I've seen software developers in dozens of Slack channels, Telegram groups, and Discord servers pass this image around about Mozilla's Fix-The-Internet Incubator. I didn't really understand why people were so excited about an incubator for a web browser, but I ended up clicking the link anyway. My naivety was obliterated right away upon visiting . mozilla.org/builders Mozilla Builders is dedicated to delivering on the promise of the internet, where the people are in control of how the internet is used to shape society and where business models should be sustainable and valuable, but do not need to squeeze every last dollar (or ounce of attention) from the user. For instance, we love initiatives that shift the balance of power from centralized forces back towards individuals, citizens and communities. As one of the co-founders of , my mission the last 2-3 years has been to play a critical role in decentralization. Specifically, that is to pull the power of Artificial Intelligence and Machine Learning out of the hands of megacorps (centralized forces) and put it into the hands of the developer community. Only then can we see new creations unimaginable. There currently is very little incentive for large corporations to share the power they hold with the rest of the world. It is to their advantage to continue to hold that monopoly. Raven Protocol So why exactly am I excited about what Mozilla is doing? They are seeking a wide range of proposals around big categories including, but not limited to: , particularly in view of the current global crisis: (i) Foster better collaboration online, (ii) Grassroots collaboration around issues & emergencies, (iii) Local & neighborhood support networks, (iv) Supporting small businesses, (v) Social money-pooling for issues, people & businesses. Collaboration & Society build a new, decentralized architecture for the internet from infrastructure, communications, media & money, to using the blockchain and peer-to-peer technologies. This summer we are particularly interested in seeing proposals around how to make decentralized storage services a viable + reliable system for building applications upon. Decentralized Web: can we build a new way to communicate online that favors privacy, people, and users' interests? What needs to evolve? Messaging & Social Networking: whether it’s big tech or governments, everyone’s collecting your data. How do we put the user back in control of their data? Can we build new business models for messaging, social networking, news & information that don’t rely on excessive data minute and hijacking our attention? Surveillance Capitalism: ideas for services that help us get beyond polarization, filter bubbles and fake news. Misinformation & Content: that works to benefit communities and citizens. Artificial Intelligence 25 years of evolution and improvement, and the web’s "execution environment" - the Javascript engine in every browser - has now broken free as a remarkably fast, safe way to run ANY code. We’re interested in tools and platforms that leverage and build on Wasm as THE way to run applications connected to the internet. What’s the ecosystem missing today? What new things can be built with it that couldn’t be built before? Where can Wasm have the biggest impact? Web Assembly: For most people in the world, search is the gateway to news, shopping, information, and answers that shape the way they live their lives. These searches happen for billions of people from the search boxes in their browsers but also in new and exciting ways like getting a quick answer with your voice from a little screen in your kitchen. For the last 10 years the thought of building a new search experience was left to only the largest companies in the world but with the rise of privacy focused search engines such as DuckDuckGo, the panoply of vertical search engines, cloud platforms, and developer tools, there’s clear evidence that better search is possible. What will be the next major step in making the world’s information open, accessible, and credible for the next generation of users and devices? Search: Mozilla will literally fund you to fix the internet. They're currently accepting applications. Thousands and thousands of developers will be applying. These will be the next generation of ecosystem builders. Startup founders + product builders...We're taking apps for summer at Mozilla Builders with a $75K Startup Studio + $16K MVP Lab...Great mission, mentorship, structure, community to build your next thing. —Bijan Marashi, Studio Lead at Mozilla What these proposals mean for Mozilla and the future of the internet Do you see where Mozilla is going with this? If you understand, then you know where the world is going. Mozilla played a critical role in the growth and adoption of the internet starting in 1998. 22 years later, in 2020, the state of the internet is in despair. Our privacy has been stripped. Our data is sold. Large corporations are stealing our attention in the name of ad revenue. And what do users get? Supposedly a free service, but we are paying a heavy price with our freedom. This is why Mozilla, with some of the smartest people across different industries, is making a huge bet to develop an entirely new internet and surrounding ecosystems. The power will certainly be pulled from centralized forces and put into the hands of the community. We will see a renaissance of the internet and I am deeply excited for the next 22 years to come. What a time to be alive!

Why Developers Are Buzzing About Mozilla’s Fix-The-Internet Incubator

TLDR: See mozilla.org/builders for more details regarding our summer programs! Back in March, we put out our call for ideas to "fix-the-internet". 1500 of you showed up and well over a hundred projects are now underway. Now we're launching our v2: the Mozilla Builders Incubator. We're looking to invest in people, projects, and technologies that shape the internet and have a positive impact without having to only worry about the bottom line. People like you built Firefox. People like you will write the next amazing chapter of the internet. Mozilla Builders is dedicated to delivering on the promise of the internet, where the people are in control of how the internet is used to shape society and where business models should be sustainable and valuable, but do not need to squeeze every last dollar (or ounce of attention) from the user. For instance, we love initiatives that shift the balance of power from centralized forces back towards individuals, citizens and communities. Over the years and from our work building platforms like Firefox, Javascript, Rust, WebRTC, Web Assembly, and others, we have been developing a vision for a next internet that is imbued with these values and deployed across tomorrow's devices, networks, algorithms, and cloud platforms. We’re inviting you to join us with your ideas for how to bring this vision into the world. We are offering three programs: 1. Startup Studio: $75,000 investment, mentorship, workshops, and more! The Startup Studio is the place to cement the foundation of your startup and initial product traction. 2. MVP Lab: $16,000 award, mentorship, workshops, and more! The MVP Lab is to explore product concepts and, over the 8 weeks of the program, ship a minimum viable product that people want to use (we will measure usage during the program as a sign of viability) 3. Open Lab: Ten $10,000 prizes, office hours, workshops, and more! The Open Lab is for early exploratory work. Participate in the Open Lab to hack on an awesome project in a structured way, create community around your project and, if you want, get it ready for launch or even a company. See mozilla.org/builders for more details and links to applications!

Mozilla Summer Startup Studio and MVP Lab

: Apply to be a part of the Mozilla Spring MVP Lab at mozilla.org/builders TLDR These are stressful, frustrating times - you likely find yourself at home under quarantine and may be looking for something you can invest your time and energy into. Mozilla values creating technology that puts people over profit and respects privacy. Now, Mozilla wants to give you the chance to put your skills in Software Engineering, Product, and Design to the test and create something in that spirit. Why should you apply? Being a part of the Mozilla Spring MVP lab means you will have the chance to create a meaningful product from scratch, work with some of the best mentors in engineering and product, earn a $2500 stipend, AND have a chance at some cash prizes. Visit mozilla.org/builders to learn more and join our Slack channel to connect with other like-minded people (link on website). Hope to see you apply! Join the Slack or email fixspringlab@mozilla.com with any questions you may have.

Mozilla Spring MVP Lab

Mozilla Firefox is one of the most popular web browsers around, and for good reason. It's fast, secure, open-source, and it's backed by an organization that actually respects your privacy. That's why at PrivacyTools as a general-purpose browser for most users. we recommend Firefox We think Firefox is fantastic out of the box, but where it really shines is customizability. By adjusting Firefox privacy settings and using helpful add-ons, you can increase your privacy and security even further. 1. Change Your Search Engine This is an easy one if you're looking for some protection from big advertising networks. In the tab of your Firefox Preferences, change your to something other than Google. Search Default Search Engine Out of the built-in options, DuckDuckGo is the most privacy respecting service, but there's a number of that can be easily installed as well. search engines we would recommend 2. Enhanced Tracking Protection Now we'll delve into the biggest set of options for people like us, Firefox's options section. First up is their . This set of filters is set to Standard by default, but we'll want to change it to Strict for more comprehensive coverage. Privacy & Security Enhanced Tracking Protection Strict protection takes a stronger stance against third-party trackers and cookies, but in rare situations it can break some websites. However, there's no need to worry about enabling it here. If you suspect the Strict browsing protection is breaking a website you visit frequently, you can disable it on a site by site basis with the shield icon in the address bar. Disabling Enhanced Tracking Protection will of course decrease your privacy on that site, so you will have consider whether that's something you are willing to compromise on, on a site-by-site basis. Another benefit of Firefox's Enhanced Tracking Protection is that it can actually speed up your browsing! Advertising networks and social media embeds can sometimes make your browser download huge files just to show an ad or a like button, and blocking those out trims the fat, in a sense. 3. Disabling Telemetrics When you use Firefox, Mozilla collects information about what you do, what kind of extensions you have installed, and various other aspects of your browser. While they claim to do this in a privacy-respecting way, sending as little data as possible is always preferred from a privacy standpoint, so we would go ahead and uncheck all the boxes under just to be safe. Firefox Data Collection and Use 4. Clearing Cookies Regularly For more advanced users, Firefox provides the option to delete all your cookies and site data every time Firefox is closed. Cookies and site data are little pieces of information sites store in your browser, and they have a myriad of uses. They are used for things like keeping you logged in and saving your website preferences, but they also can be used to track you across different websites. By deleting your cookies regularly, your browser will appear clean to websites, making you harder to track. This will likely log you out of websites quite often, so make sure that's an inconvenience you're willing to put up with for enhanced tracking protection. 5. Enable DNS over HTTPS DNS (or the Domain Name System) is what your browser uses to turn domain names like privacytools.io into IP addresses like 145.239.169.56. Because computers can only make connections to IP addresses, it's necessary to use DNS every time you visit a new domain. But DNS is unencrypted by default, that means everyone on your network (including your ISP) can view what domains you're looking up, and in some situations even change the IP answers to redirect you to their own websites! Encrypting your DNS traffic can shield your queries and add some additional protection to your browsing. Encrypted DNS takes many forms: DNS over HTTPS (DoH), DNS over TLS, DNSCrypt, etc., but they all accomplish the same thing. They keep your DNS queries private from your ISP, and they make sure they aren't tampered with in transit between your DNS provider. Fortunately, Firefox recently added native DoH support to the browser. On the page of your preferences, scroll down to and open . At the bottom of the window you will be able to select "Enable DNS over HTTPS" and choose a provider: General Network Settings Keep in mind that by using DoH you're sending all your queries to a single provider, probably Cloudflare unless you choose that supports DNS over HTTPS. While it may add some privacy protection from your ISP, you're only shifting that trust to the DoH provider. Make sure that's something you want to do. another provider It should also be noted that even with DoH, your ISP will still be able to see what domain you're connecting to because of a technology called Server Name Indication (SNI). Until SNI is encrypted as well, there's no getting around it. Encrypted SNI (eSNI) is in the works — and can actually be today — but it only works with a small number of servers, mainly ones operated by Cloudflare, so its use is limited currently. enabled on Firefox Therefore, while DoH provides some additional privacy and integrity protections, its use as a privacy tool is limited until other supplemental tools like eSNI and are finalized and implemented. DNSSEC 6. Use an Adblocker By far, the biggest privacy concern when browsing the web today is third-party tracking networks, like large advertisers and social media companies. Additionally, the use of online advertisements to spread malware and cryptominers ( ) has seen a recent upswing in popularity. This is why we recommend all users use a good adblocker on their browser. malvertising We recommend , an efficient ad- and tracker-blocker that is easy on memory, and yet can load and enforce thousands more filters than competing blockers. We trust it because it is completely open-source, and unlike its competitors, it has no monetization strategy: There's no "Acceptable" ads program or a similar whitelist like many other adblockers feature. uBlock Origin 7. Install "HTTPS Everywhere" HTTPS is the secure, encrypted version of HTTP. When you see an address starting with https:// along with the padlock in your browser's address bar, you know that your connection to the website is completely secure. This is of course important when you're logging into websites and sending your passwords and emails in a form. But it also prevents people on your network and your ISP from snooping in on what you're reading, or changing the contents of an unencrypted webpage to whatever they want. Therefore, is a must-have extension, all it does is upgrade your HTTP connections to HTTPS wherever possible. And because it works silently in the background, you probably will never notice it! We trust HTTPS Everywhere because it is completely open-source, and is developed by the , a non-profit dedicated to promoting private and secure technologies. HTTPS Everywhere Electronic Frontier Foundation Of course, it only works with sites that support HTTPS on the server's side, so you'll still need to keep an eye on your address bar to make sure you're securely connected. But fortunately more and more websites have implemented HTTPS thanks to the advent of free certificates from organizations like Let's Encrypt. 8. Install "Decentraleyes" When you connect to many websites, your browser is most likely making connections to a myriad of "Content Delivery Networks" like Google Fonts, Akamai, and Cloudflare, to download fonts and Javascript that make the website run. This generally makes websites look and feel better, but it means you're constantly making connections to these servers, allowing them to build a fairly accurate tracking profile of you. works by impersonating those CDNs locally in your browser. When a website wants to download a program like jQuery, instead of connecting to a remote CDN Decentraleyes will serve the file from its own cache of files. This means that you'll won't have to make remote CDN connections for the files that Decentraleyes supports, and therefore the remote CDNs can't track your browser. Decentraleyes Because everything is stored locally instead of on a far away server, Decentraleyes has the added benefit of speeding up your browsing as well. Everything happens instantly, and you won't see a difference in the websites you visit. 9. Consider Multi-Account Containers Mozilla has an in-house add-on called that allows you to isolate websites from each other. For example, you could have Facebook in a container separate from your other browsing. In this situation, Facebook would only be able to set cookies with your profile on sites within the container, keeping your other browsing protected. Multi-Account Containers A containers setup may be a good alternative to techniques like regularly deleting cookies, but requires a lot of manual intervention to setup and maintain. If you want complete control of what websites can do in your browser, it's definitely worth looking into, but we wouldn't call it a necessary addition by any means. Additional Resources — Our comprehensive set of recommendations for browsers and tweaks you can make to enhance your privacy is a great next step for more advanced users looking to protect their privacy online. Web Browsers at PrivacyTools — For more advanced users, the ghacks user.js is a "configuration file that can control hundreds of Firefox settings [...] which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage". ghacks user.js — Of course, we always recommend reading through the privacy statement of any organization you deal with, and Mozilla is no exception. Mozilla's Privacy Policy Firefox Privacy Summary In conclusion, we believe that Firefox is the most promising browser for privacy-conscious individuals. The non-profit behind it seems truly dedicated to promoting user control and privacy, and the good defaults coupled with the sheer customizability of the browser allow you to truly protect your information when you browse the web.

Nine Essential Privacy Settings and Add-ons for Mozilla Firefox

Soon after COVID hit and made our team go fully remote, we quickly got tired of seeing each other's faces on video and decided to give Mozilla Hubs a try – so we could meet up in the same room, virtually. More than 30,000 people decided to make an avatar within the first month Hubs is pretty awesome, but there was one thing about the platform that just didn't do for a team creating personal avatars: the generic robot-style avatars you have zero similarities or connection with. Having the right tools at hand, we decided to fix the problem and integrate Ready Player Me avatars with the platform, so we could use our own avatars created on in Hubs. readyplayer.me We tweeted some people in the Mozilla Hubs community about it and ran a successful . Product Hunt campaign What happened next was unexpected. More than 30,000 avatars were created for Mozilla Hubs within a month of the launch, peaking at 2,500 avatars in one day. We saw a lot of excitement on social media as people were eager to show off their freshly created avatars or cheer to the progress of the 3D avatar industry. Personal avatars are an essential part of the future of virtual communication. In contexts imitating reality, such as work meetings or conferences, people can connect with each other better when using avatars that look like themselves. We're glad the Hubs community agrees. Mozilla Hubs has already hosted many previously-offline meetups and conferences that moved online due to the pandemic. Ready Player Me avatars have made virtual conferences like WeAreSummit and SIGGRAPH feel more like face-to-face. Personal avatars also make a perfect profile picture if you want your identity to be recognizable yet anonymous. Just check out founder @mr.doob's Twitter pic (definitely one of our proudest moments). 💁‍♀️ Three.js What's next for Ready Player Me? We're currently in the process of integrating Ready Player Me with many other VR apps, virtual events platforms and games. Our eventual goal is to create a universal identity platform that allows you to create your avatar once and use it across the virtual world. Previously published at https://readyplayer.me/blog/we-added-personal-avatars-to-mozilla-hubs-and-this-is-what-happened

This is What Happens When You Add Personal Avatars To Mozilla Hubs

TL;DR In Q2 2020, Hacker Noon had its highest revenue quarter in company history ( ), we built a lot of quality software (including ), published a lot of great technology stories ( ), made it onto , increased the share price by 38% in our second round of financing (2020 Strategic Coil investment vs. 2019 StartEngine Equity crowdfunding round); but have seen a decline in Google traffic, and are actively working with Google and experts to rectify. We’ll dig into how our business is making adaptations for internet reading trends, but our overall strategy remains unchanged. Hacker Noon publishes insightful tech stories, makes useful software, and just is We’ve passed the total revenue of last year ( redacted ) within the first half of this year! redacted Noonies 2.0 some top ones Wikipedia how hackers start their afternoons. Product Development The Hacker Noon product team had a strong quarter. With our cleaner infrastructure detailed in our previous shareholder letter, we were able to accelerate our rate of deployment significantly, largely via automatically (as opposed to manually) deploying features, as well as adding one more part-time back-end developer to the team. We are so happy with the work of , who’s a referral from our Full-Stack Developer , that we made him a full-time offer in Q3, which he accepted :-) Richard Kubina Austin Pocus In 2020 Q2, here is a list of what we released, and one sentence about each: : our custom voting product at (voting opens on August 13th). The Noonies v2 Noonies.Tech : all stories published on a date accessible by clicking any date under each story title ( ) Story Archives example : Chrome is Hacker Noon readers’ most popular browser and by installing ( ), users can get the latest stories from Hacker Noon when opening a new tab. Tech Stories Tab Chrome Extension this extension open sourced here : removing barrier to reading even further, this feature emphasizes the story title, author accreditation, and a less annoying, more reader friendly sticky ad ( , scroll down to see how design functions). Sticky Story Headline example : easily accessible under each story title for writers & editors, this new stat page also includes a pixelated graph that showcases how well the story does over time compared to average peak performance ( ). Single Story Stats Page example : It is a lot easier to move fast and break things if you can go back in time to restore how things work - now we can! Backup System : this feature emphasizes the value created by each writer via hackernoon.com (time reading, one of our 3 core metrics) front & center on their profile ( ) Time Reading Created on Profile Page example : any writer can now add meta tag to their profile to be streamed micropayments from Coil subscribers ( ) Coil Web Monetization Integration 2.6k users have done so About Page: all you need to know about Hacker Noon in one page . : Hacker Noon’s pixelated designs are now open sourced on Github ( & ). Open Sourced Emojis here here we continue to improve our , which manages hundreds of submissions per day (reject, improve, schedule or publish), on top of 22k+ , 12k+ writer profiles, sponsor payments for , and content curation & distribution. Admin/Editor Improvement: app tags BAA : ; however, as we are transitioning off Disqus commenting system, this is currently turned off. Commenting Leaderboard ranking all comments on Hacker Noon : Reliability, reliability, reliability - we’ve built more testing systems with Sentry, Hotjar, and more importantly, we’ve been writing end-to-end tests that simulate user behavior with Cypress. Increased Testing Overall, each of these product developments help move at least one of our main core metrics: time reading, words published, or money made. Profit and Loss For better or for worse, we are getting closer to profitability despite a growing pandemic. Last quarter, while the US GDP , Hacker Noon revenue grew by 121.96% QoQ. shrank by 32.9% Redacted Editorial & Traffic This quarter, we published from Hacker Noon stories; which marks a + 7.3% YoY and + 5.6% QoQ increase. We averaged published per day; representing a + 19.6 % YoY and +5.5% QoQ increase. . 3,593,068 words 30.9 stories Redacted Our long term strategy, however, is to diversify our traffic to come from different sources other than search, such as emails and social media, and overall, to significantly strengthen our relationship with our readers (think subscription emails, bookmarks, emoji reactions, smoother login, etc.). Redacted Redacted Coil Strategic Investment, & Ensuing Investor Interest Redacted Team , we offered Richard a full time position which he accepted. He’s the best developer Austin had worked with besides Dane, and has proven to be extremely agile, adaptable, and thoughtful. His skillset compliments our current dev team perfectly. Redacted Redacted Outlook & Q3 Sneak Peek Q3 started off with a grant from Mozilla. Our mentor for the program is Rotten Tomatoes founding CEO . For the 8 week sprint we are working on inline emoji reactions. The data schema is set up to be able to iterate at the character level, word level, and paragraph level. We will be working hard to facilitate the exchange of value between reader and writer. redacted Fix the Internet Patrick Lee Redacted

State Of The Noonion Q2 2020: Building The Noonies 2.0, Mozilla Grant, And More

Transcriber with PyAudio and DeepSpeech in 70 lines of Python code. Voice Assistants are one of the hottest tech right now. Siri, Alexa, Google Assistant, all aim to help you talk to computers and not just touch and type. Automated Speech Recognition (ASR) and Natural Language Understanding (NLU/NLP) are the key technologies enabling it. If you are just-a-programmer like me, you might be itching to get a piece of action and hack something. You are at the right place; read on... Continue reading »

How to build Python transcriber using Mozilla DeepSpeech

If left unfixed this flaw could have wreaked havoc but Mozilla’s prompt fixes saved the day. In this article, I’ll discuss details of a bug I discovered with Firefox private mode that made it possible for private browsing sessions to be tracked. Mozilla browsing is one of the most widely known and used features in modern browsers today. Browsers continually add enhancements to private browsing to enhance the users’ privacy. Private Browsing many The features offered might differ from one browser to another, but at the very least a user using private browsing has the two most basic requirements: 1. Websites visited in private cannot save any data 2. Visited pages are not saved Well, I discovered that the Firefox browser Private browsing mode didn’t meet any of the above requirements. For a website to track a user across private browsing sessions, it needs to use some persistent storage at the browser level. There are multiple ways of storing data in a browser — , and . LocalStorage WebSQL IndexedDB I recently came across IndexedDB storage. IndexedDB is a low-level API for client-side storage of significant amounts of structured data, including files/blobs — Mozilla Developer Network Although, as per the documentation, IndexedDB should not be available in private browsing mode. If you use IndexedDB directly on the webpage, it will throw an error: But what happens if you combine IndexedDB with ? Web Workers Web Workers makes it possible to run a script operation in background thread separate from the main execution thread of a web application — Mozilla Developer Network IndexedDB can be accessed in private browsing mode via Web Workers. Not only that, but when the browser is closed, the IndexedDB data is not cleared. This stored because it is not cleared when exiting. 😮 data will persist across multiple private browsing sessions So let’s look at a few ways this issue could be abused. A malicious website can leverage IndexedDB and track users across private browsing sessions. For example, say you visited which uses Web Workers and IndexedDB in private browsing mode. Close the private browsing window, close Firefox, start Firefox again, start private browsing mode, and again visit badsite.com. The website will be able to access the data from your previous private browsing session, as the data is still stored in IndexedDB. badsite.com, Let’s assume loads an analytics script from Then another website, , also loads an analytics script from the same website . Since the malicious website uses Web Workers and IndexedDB, the website can now track users of websites and across all their private browsing sessions. siteA.com BadAnalyticsSite.com. siteB.com BadAnalyticsSite.com BadAnalyticsSite.com BadAnalyticsSite.com siteA.com siteB.com , which means that every database has a name that identifies it within an origin. Because domain name is used as part of the file name, this can result in serious issues when used in private mode. IndexedDB adheres to a same-origin policy For example, if a user visits a (demo) which uses Web Workers + IndexedDB hosted on , and loads a resource from , the following two entries are created on disk. test webpage cdn.cliqz.com konarkmodi.github.io Location of IndexedDB: ` Poc web pages. profile/storage` lists Because of the above flaw, a website/tracker could effectively generate a fingerprint and save it. Even if a user were to clear the website history or select the option “forget about this site,” the IndexDB storage is not removed. This can create a permanent storage for a website or a tracker that can be leveraged forever. Mozilla encourages security research for their products. In their own words: The Mozilla Client Security Bug Bounty Program is designed to encourage security research in Mozilla software and to reward those who help us create the safest Internet software in existence. I reported this issue in October 2017 via their , and the issue was fixed in November 2017. They were prompt to identify and fix the issues. Bug Bounty Program For more details, you can read the complete bug report at . Mozilla’s Bugzilla I really appreciate Mozilla’s efforts and actions in fixing issues with the highest priority when it comes to the privacy of its users. Happy Hacking! You can follow me on Twitter at Konark Modi Thanks for reading and sharing ! :) If you liked this story, feel free to 👏👏👏 a few times (Up to 50 times. Seriously). Credits: Special thanks to Remi and Pallavi for reviewing this post :) Originally published at medium.freecodecamp.org on April 22, 2018.

I found a major flaw in Mozilla’s private browsing mode.

Web developers are the builders of web pages like this one. Consider how we are collaborating here: You, on the reading side, and me, becoming a better writer with the support of an editor from HackerNoon. Do you see the developers? Probably not, as they did a good job. We are likely to find them reading about the . future of web development What I offer with this article, on the other hand, is an opportunity to pause and reflect on the emergence of web developers, how that ties to the history of browsers, and how their collaboration has reignited the timeline of browser development. A new kind of engineer, for the web + In the early days of the web, many software engineers did not pay much attention to web development in terms of web pages. Why would they, right? If you were an engineer, would you be impressed by the first passenger coming from the locomotive or the locomotive itself? , from the , wrote it well: Jason Kottke Home of Fine HyperText Products Using to surf the World Wide Web for the very first time in the basement physics lab at college was as close to a religious experience as I’ve ever had. It was a thunderbolt that completely changed my life. NCSA Mosaic But that first impression also allowed hackers (and painters) to approach the subject from the user interface aspect of it. Therefore, the invention and innovation of the Mosaic browser mark the beginning of the opportunities with web development: Early in 1993, the National Center for Supercomputing Applications (NCSA) at the University of Illinois released a first version of its Mosaic browser. This software ran in the X Window System environment, popular in the research community, and offered friendly window-based interaction. Shortly afterwards the NCSA released versions also for the PC and Macintosh environments. The existence of reliable user-friendly browsers on these popular computers had an immediate impact on the spread of the WWW. Notice how the browser, as a tool, started to make a lot of sense as the infrastructure behind showed the potential: On 30 April 1993, CERN made the source code of WorldWideWeb available on a royalty-free basis, making it free software. By late 1993 there were over 500 known web servers, and the WWW accounted for 1% of internet traffic, which seemed a lot in those days (the rest was remote access, e-mail and file transfer). It was a surreal experience because of that friendly interface that showed the potential to access knowledge from everywhere. Perhaps not different from how I felt when using ChatGPT as a friendly interface that showed the potential to access knowledge from everywhere. Consider reading about the history of Mosaic, and the invention of the Web, in the following article: https://hackernoon.com/how-the-browser-wars-changed-the-landscape-of-the-internet?embedable=true View-source: Learn via examples copying But web pages were quite simple. At the time, we - computer science students - would find smart people by how their pages were simple, like this one from . Dennis Ritchie at Bell Labs As I was there as a curious user - not attending the computer science lectures and playing with the web - I also stumbled into a menu option, , that enabled us to view the source of web pages. And by the way, almost overnight that Mosaic browser was called Netscape. incorporated into the browser Jim Nielsen has reflected in and identified how the Netscape browser had enabled a learning opportunity - instantaneously - for every page on the web. The Spirit of View-Source In his article, he quoted an observation from Clive Thompson in the book Coders Every single web page you visited contained the code showing you how it was created. The entire internet became a library of how-to guides on programming. Now, try to picture “the web” as the hottest thing around and imagine how many of us were checking the source of pages to copy ideas from others and try to learn eventually. These were the “view-source days” where we could see the magic. Although we still have the “view page source” in the menu of modern browsers, if you view the source of a web page, you will likely see something that looks mysterious: JavaScript: Control and interaction Another inflection point, well perceived, came about when Netscape (again) enabled JavaScript - the programming language - that allowed web developers to create scripts to control certain aspects of web pages and to have control over the interaction. h, the inventor of and the now-CEO of , has given us a that summarizes the hero’s journey of JavaScript in the land of the Web. His points helps us see that JavaScript was not always seen as elegant but was being heavily used in the end of the day - and continued to improve. Brendan Eic JavaScript Brave Software The Browser That Cares about your Privacy slide The following screenshot shows an alert box invoked from the Netscape 2 browser interface. Web developers used JavaScript to launch visual alerts (to debug their code) and do impossible things such as control web forms, validate the value of an input form, and other use cases. Needless to say that a curious user could learn about JavaScript on a page through the “view source.” The HTML page was the envelope that conveyed a great deal of presentation and logical structure about sites through its HTML elements, hyperlinks, images, style, and JavaScript code. Dynamic HTML: Layout customizations and animation And another opportunity was enabled through a new tag in HTML named < >. Back in the day, around 1997, Netscape launched Netscape Communicator Preview Release with new APIs for developers. According to a press release, “ ” layer Dynamic HTML is a significant milestone for HTML, providing designers more flexibility and control over Web page layout, while providing users a greater degree of interactivity. Later the <layer /> tag became the <div />. The technical innovation at the time had to do with the ability to position a visual piece of HTML, an element, on top of another, as the following 3D illustration shows . from one of the earliest DHTML technotes For now, you won’t be able to experience the following demonstration from 1997 but try to imagine that train (which was just an image) moving as if it was coming toward you. The trick consisted of using JavaScript to toggle the visibility of images of different sizes creating an illusion of an animation. The page also launched the sound of a locomotive using some other methods. At that point, the browser wars at its peak, developers who had started writing pages for Netscape, like me, started to produce pages for Internet Explorer, unlike me. These differences - and the skills required - contributed as reasons for developers to be hired as web developers. The magnitude and complexity of the DHTML movement correlates with the content written by this . popular book of 1000+ pages Web Standards A major outcome of the browser wars is that Netscape released its source code as open-source. This is where the name Mozilla appears, as documented in Project . That process was strategic, complex, and risky. It was a bold move as acknowledged by the then-CEO Jim Barksdale: Code Rush “Well, it’s certainly my hope that the enormous amount of new people that no one company could afford to have working on any product - now contributing to the Netscape Navigator Communicator - will make a significant difference in the improvement of the product. How that works against any competitor, remains to be seen.” Jim Barksdale @ Code Rush 2013 29min55sec Aside from the open-source foundation, a key strategy from Mozilla sparked attention of web developers - its Web standards support. To help with that, Netscape has assembled a new team of technology evangelists. Among them, the CSS guru that attained celebrity status among developers. Their cause resonated with needs of web developers - to end the proprietary differences and have a common ground to implement pages working with all browsers. Eric has celebrated our fight: Eric Meyer “ “So here’s to Bob Clary, Marcio Galli, Katsuhiko Momoi, Chris Nalls, Tristan Nitot, Arun Ranganathan, Doron Rosenberg, and Susie Wyshak.  We fought the good fight and created a lot of great material, including information about the redesign of DevEdge itself. Keep in mind that the above is a small piece of a larger photo. Another part of it was the documentation efforts by Mozilla, which has grown later as Mozilla Developer Network. Single-Page Applications and the AJAX way As developers were helping themselves to fix web pages in standards-compliant ways, they were also pushing pages to the limits. These were the days when use cases like , and initiatives like , have enabled us to consider the idea of - what if a web page could work like software applications? The following articles show what the evangelists were writing at the time: Gmail came along Web Services single-page applications (06 Jun 2003) Accessing Web Services In Netscape 7.1/Mozilla 1.4 Using WSDL Proxying (20 May 2003) Standards-Based Collapsible Table of Contents Widget (CTOCWidget) (16 May 2003) Inner-Browsing: Extending Web Browsing the Navigation Paradigm Despite these efforts, an inflection point came also from the old west. In 2005, Jesse James Garrett from San Francisco, wrote a seminal article entitled " " Jesse was an user experience designer that impacted web development worldwide. AJAX became a popular term used by developers to convey the intention to add interactivity and create the behavior of web applications. Ajax: A New Approach to Web Applications, If you were to hire someone to create a single-page application, you had to hire a web developer that knew AJAX: The Developer’s Best Friend  - Developer Add-on Tools and Page Inspection The Mozilla project continued the saga, now with Firefox. Firefox carried on the goods of Mozilla and has reached a readiness level in terms of performance, security, and standards support. But the turning point was that it gained the trust of developers not justified by market share but because of built-in tools that helped them to test and troubleshoot pages. extension - written by that had worked at Netscape - came along in 2006 and helped to build the moment when browser add-ons were increasingly being used to help web developers to debug pages. The usage of Firebug also correlates with rise of the famous written by John Resig which was Firebug Joe Hewitt jQuery library hired by Mozilla in 2007. Product managers were not unaware that developers were using Firefox to test their pages and deliver faster, even if the main browser, in terms of markeshare, was Internet Explorer. Firefox as a tool to help build pages - used by web developers - was a worldwide phenomenon, better understood if you look at a 2008 presentation from Mozilla contributors Clauber and Mario entitled Firefox - Developer's Best Friend. On a key slide they stated the importance of using Firefox as a development framework due to its Web standard support and development add-ons for debugging of JavaScript and more. The rest is history - JS libraries, and frameworks Now, am I crazy to talk about what is next? No way. If you are web developer, you might be feeling the heat and the complexity of what you know that has happened. Let’s end this party here with: Browsers have evolved, pages evolved, developers too. And to say that all the players are equally contributing in a fast pace - too fast - to the point that I prefer to look at the past and celebrate. A few notes are important. One is that I didn’t mention the aspects in terms of server side. It would be difficult to incorporate that reflection with structure, although I acknowlede that web developers branched as front-end, back-end, or fullstack. Another is that the moment indicated as “Firefox as the Developer’s Best Friend” came in sync with the rise of libraries shipped alongside web pages. A good example is the library . Therefore, the "jQuery + Firefox as Developer’s Best Friends" days was really a phenomenon where the code of pages started to get complex and demanded more engineering role involved - more bugs in the client side of pages. jQuery That observation would open the door to consider the emergence of libraries like React and, among other subjects, the complex world as indicated by The Great Gaslighting of the JavaScript Era. The lead image for this article was generated by HackerNoon's via the prompt "early internet browser". AI Image Generator

The History of Web Developers Tied to Browser Development

La historia de los desarrolladores web vinculados al desarrollo de navegadores

L'histoire des développeurs Web liée au développement du navigateur

ब्राउज़र विकास से जुड़े वेब डेवलपर्स का इतिहास

ブラウザ開発に結びついた Web 開発者の歴史

A história dos desenvolvedores da Web vinculados ao desenvolvimento de navegadores

Lịch sử của các nhà phát triển web gắn với phát triển trình duyệt

Web 开发人员与浏览器开发相关的历史

Like any web browser, Firefox loads code from untrusted and potentially hostile websites and runs it on your computer. To protect you against new types of attacks from malicious sites and to meet the security principles of Mozilla, we set out to redesign Firefox on desktop. Site Isolation builds upon a new security architecture that extends current protection mechanisms by separating (web) content and loading each site in its own operating system process. This new security architecture allows Firefox to completely separate code originating from different sites and, in turn, defend against malicious sites trying to access sensitive information from other sites you are visiting. In more detail, whenever you open a website and enter a password, a credit card number, or any other sensitive information, you want to be sure that this information is kept secure and inaccessible to malicious actors. As a first line of defence Firefox enforces a variety of security mechanisms, e.g. the which prevents adversaries from accessing such information when loaded into the same application. same-origin policy Unfortunately, the web evolves and so do the techniques of malicious actors. To fully protect your private information, a modern web browser not only needs to provide protections on the application layer but also needs to entirely separate the memory space of different sites – the new Site Isolation security architecture in Firefox provides those security guarantees. Why separating memory space is crucial In early 2018, security researchers disclosed two major vulnerabilities, known as and . The researchers exploited fundamental assumptions about modern hardware execution, and were able to demonstrate how untrusted code can access and read memory anywhere within a process’ address space, even in a language as high level as JavaScript (which powers almost every single website). Meltdown Spectre While band-aid countermeasures deployed by OS, CPU and major web browser vendors quickly neutralized the attacks, they came with a performance cost and were designed to be temporary. Back when the attacks were announced publicly, Firefox teams promptly to keep our users safe. reduced the precision of high-precision timers and disabled APIs that allowed such timers to be implemented Going forward, it was clear that we needed to fundamentally re-architecture the security design of Firefox to mitigate future variations of such vulnerabilities. Let’s take a closer look at the following example which demonstrates how an attacker can access your private data when executing a Spectre-like attack. Without Site Isolation, Firefox might load a malicious site in the same process as a site that is handling sensitive information. In the worst case scenario, a malicious site might execute a Spectre-like attack to gain access to memory of the other site. Suppose you have two websites open – www.my-bank.com and www.attacker.com. As illustrated in the diagram above, with current web browser architecture it’s possible that web content from both sites ends up being loaded into the same operating system process. To make things worse, using a Spectre-like attack would allow attacker.com to query and access data from the my-bank.com website. Despite existing security mitigations, the only way to provide memory protections necessary to defend against Spectre-like attacks is to rely on the security guarantees that come with isolating content from different sites using the operating system’s process separation. Background on Current Browser Architecture Upon being launched, the Firefox web browser internally spawns one privileged process (also known as the parent process) which then launches and coordinates activities of multiple (web) content processes – the parent process is the most privileged one, as it is allowed to perform any action that the end-user can. This multi-process architecture allows Firefox to separate more complicated or less trustworthy code into processes, most of which have reduced access to operating system resources or user files. As a consequence, less privileged code will need to ask more privileged code to perform operations which it itself cannot. For example, a content process will have to ask the parent process to save a download because it does not have the permissions to write to disk. Put differently, if an attacker manages to compromise the content process it must additionally (ab)use one of the APIs to convince the parent process to act on its behalf. In great detail, (as of April 2021) Firefox’s parent process launches a fixed number of processes: eight web content processes, up to two additional semi-privileged web content processes, and four utility processes for web extensions, GPU operations, networking, and media decoding. While separating content into currently eight web content processes already provides a solid foundation, it does not meet the security standards of Mozilla because it allows two completely different sites to end up in the same operating system process and, therefore, share process memory. To counter this, we are targeting a Site Isolation architecture that loads every single site into its own process. Without Site Isolation, Firefox does not separate web content into different processes and it’s possible for different sites to be loaded in the same process. Imagine you open some websites in different tabs: www.my-bank.com, www.getpocket.com, www.mozilla.org and www.attacker.com. As illustrated in the diagram above, it’s entirely possible that my-bank.com and attacker.com end up being loaded in the same operating system process, which would result in them sharing process memory. As we saw in the previous example, with this separation model, an attacker could perform a Spectre-like attack to access my-bank.com’s data. Without Site Isolation, the browser will load embedded pages, such as a bank page or an ad, in the same process as the top level document. While straightforward to understand sites being loaded into different tabs, it’s also possible that sites are embedded into other sites through so-called subframes – if you ever visited a website that had ads on it, those are probably subframes. If you ever had a personal website and you embedded a YouTube video with your favourite song within it, the YouTube video was embedded in a subframe. In a more dangerous scenario, a malicious site could embed a legitimate site within a subframe and try to trick you into entering sensitive information. With the current architecture, if a page contains any subframes from a different site, they will generally be in the same process as the outer tab. This results in both the page and all of its subframes sharing process memory, even if the subframes originate from different sites. In the case of a successful Spectre-like attack, a top-level site might access sensitive information it should not have access to from a subframe it embeds (and vice-versa) – the new Site Isolation security architecture within Firefox will effectively make it even harder for malicious sites to execute such attacks. How Site Isolation Works in Firefox When enabling Site Isolation in Firefox for desktop, each unique site is loaded in a separate process. In more detail, loading “https://mozilla.org” and also loading “http://getpocket.com” will cause Site Isolation to separate the two sites into their own operating system process because they are not considered “same-site”. Similarly, “https://getpocket.com” (note the difference between http and https) will also be loaded into a separate process – so ultimately all three sites will load in different processes. For the sake of completeness, there are some domains such as “.github.io” or “.blogspot.com” that would be too general to identify a “site”. This is why we use a list of effective top level domains (eTLDs) to aid in differentiating between sites. community-maintained Since “github.io” is listed as an eTLD, “a.github.io”  and “b.github.io” would load in different processes. In our running examples, websites “www.my-bank.com” and “www.attacker.com” are not considered “same-site” with each other and will be isolated in separate processes. With Site Isolation, Firefox loads each site in its own process, thereby isolating their memory from each other, and relies on security guarantees of the operating system. Suppose now, you open the same two websites: www.attacker.com and www.my-bank.com, as seen in the diagram above. Site isolation recognizes that the two sites are not “same-site” and hence the site isolation architecture will completely separate content from attacker.com and my-bank.com into separate operating system processes. This process separation of content from different sites provides the memory protections required to allow for a secure browsing experience, making it even harder for sites to execute Spectre-like attacks, and, ultimately, provide a secure browsing experience for our users. With Site Isolation, Firefox loads subframes from different sites in their own processes. Identical to loading sites into two different tabs is the separation of two different sites when loaded into subframes. Let’s revisit an earlier example where pages contained subframes, with Site Isolation, subframes that are not “same-site” with the top level page will load in a different process. In the diagram above, we see that the page www.attacker.com embeds a page from www.my-bank.com and loads in a different process. Having a top level document and subframes from different sites loaded in their own processes ensures their memory is isolated from each other, yielding profound security guarantees. Additional Benefits of Site Isolation With Site Isolation architecture in place, we are able to bring additional security hardening to Firefox to keep you and your data safe. Besides providing an extra layer of defence against possible security threats, Site Isolation brings other wins: By placing more pages into separate processes, we can ensure that doing heavy computation or garbage collection on one page will not degrade the responsiveness of pages in other processes. Using more processes to load websites allows us to spread work across many CPU cores and use the underlying hardware more efficiently. Due to the finer-grained separation of sites, a subframe or a tab crashing will not affect websites loaded in different processes, resulting in an improved application stability and better user experience. Going Forward We are currently testing Site Isolation on desktop browsers Nightly and Beta with a subset of users and will be rolling out to more desktop users soon. However, if you already want to benefit from the improved security architecture now, you can enable it by downloading the Nightly or Beta browser from and following these steps: here To enable Site Isolation on Firefox Nightly: Navigate to about:preferences#experimental Check the “Fission (Site Isolation)” checkbox to enable. Restart Firefox. To enable Site Isolation on Firefox Beta or Release: Navigate to about:config. Set `fission.autostart` pref to `true`. Restart Firefox. For technical details on how we group sites and subframes together, you can check out our new process manager tool at “about:processes” (type it into the address bar) and follow the project at . https://wiki.mozilla.org/Project_Fission With Site Isolation enabled on Firefox for Desktop, Mozilla takes its security guarantees to the next level and protects you against a new class of malicious attacks by relying on memory protections of OS-level process separation for each site. If you are interested in contributing to Mozilla’s open-source projects, you can help us by filing bugs if you run into any problems with Site Isolation enabled. here Acknowledgements Site Isolation (Project Fission), has been a massive multi-year project. Thank you to all of the talented and awesome colleagues who contributed to this work! It’s a privilege to work with people who are passionate about building the web we want: free, inclusive, independent and secure! In particular, I would like to thank Neha Kochar, Nika Layzell, Mike Conley, Melissa Thermidor, Chris Peterson, Kashav Madan, Andrew McCreight, Peter Van der Beken, Tantek Çelik and Christoph Kerschbaumer for their insightful comments and discussions.  Finally, thank you to Morgan Rae Reschenberg for helping me craft alt-text to meet the high standards of our web accessibility principles and allow everyone on the internet to easily gather the benefits provided by Site Isolation. First published here

An Introduction to Firefox’s new Site Isolation Security Architecture

Welcome to our Hacks: Decoded Interview series! Once a month, ’s speaks with people in the tech industry about where they’re from, the work they do and what drives them to keep going forward. Make sure you follow Mozilla’s blog to find more articles in this series and make sure to visit the Mozilla Foundation site to see more of our org’s work. Mozilla Foundation Xavier Harding Hacks Meet Seyi Akiwowo ( ) pronounced Shay-ee Aki-wo-wo Seyi Akiwowo’s reputation precedes her. Akiwowo is the founder of , an organization that seeks to end online abuse. Akiwowo is a graduate of the London School of Economics. She’s delivered talks at TED, European Parliament, the U.N. and more and was elected a councillor for the Labor Party in East London — the youngest Black woman ever to do so. Glitch We spoke with Seyi over video chat to learn about what drives her, why she does what she does and what she’d be doing if not battling trolls online for a living. All that in this month’s Hacks: Decoded. Where do we even begin? What do you consider to be the starting point of your story? I’d start with my love for the internet. When you’re in this anti-troll, human rights space, you’re pitched as anti-tech and anti-change and it’s simply not true. It’s because I’m such a lover and fan of the internet, I do what I do. I’m part of the ’90s, Microsoft-PC-with-the-big-back-and-a-CD-drive generation. I had dial-up internet and spent huge amounts of time on MSN and MySpace. There were times I was home alone, my mum out trying to make ends meet, my dad not around, and the computer was my outlet. I adored all of it. The worldwide web was my friend. It was my connection to the rest of the world, all while in a small council flat in East London. It was when I appeared in a that went viral that I learned what it meant to be a black woman online. I realized, “Oh, there are people that don’t know me and do not like me and are telling me that they don’t like me in very violent ways.” So I’d say my journey starts with the love of the internet and innovation. When you’re in this kind of anti-troll, human rights space, you’re kind of pitched as anti-tech and anti-change and it’s not [true], it’s because I’m such a lover of the internet is the reason I do what I do. video How does where you’re from influence what you do now? I went to a very good university but the mix of social classes felt almost like a class war! Going to university was the first time I ever felt othered. I didn’t feel it growing up. I grew up in Newham in East London and I didn’t really realize I was from a poor area. There’s such beauty and safety in that, but there’s also a glass ceiling without you really realizing it. I grew up with an entrepreneurial spirit and we just made do with what we had and we just were still excellent with the minimum we had. I see how that translates to nowadays. I can really make £1 of funding go far at Glitch! My working-class bargain hunting roots really helped me be frugal with money. It’s interesting how when you throw a Black woman into the mix, people don’t know how to act. Off the internet but specifically on the internet too. It is, something I’ve been thinking about a lot is that the internet doesn’t need to be this bad if we just listen to Black women many many years ago. If we think about some of the Black activists or campaigners or even the Black women that were just minding their business but got forced into this issue because of their lived experience, like myself. Folks at Facebook, Twitter, Google who weren’t listening — you have and Michelle Ferrier. Michelle is a journalist who, after a hate campaign, started to help other journalists and women. Sydette Troll Busters You’ve got on Twitter who I remember learning a lot about her experience on social media and she just wasn’t listened to. I think white men not only have the privilege to make things and get a lot of venture capital and raise a lot of money to make these huge products and break and fail. That’s one. But they’re also privileged in their echo chamber bubble that they didn’t have to listen to Black women. And it was only until it started affecting white middle-class upper-class Hollywood that we started paying closer attention to this issue. Angry Black Lady You’re saying something a lot of us know. Black women encounter harms on these platforms that a white guy may not necessarily encounter. And yet, most of the leadership at these companies are not black women, they’re mostly white men — a group of folks who may not realize how bad these problems are. Why do you think that is? When will it change? I really don’t know and I think it’s a conundrum that isn’t unique to the tech space. You see it everywhere. You see it in conversations in policy discussions about domestic abuse or refugees and you do not have the community that faces it the most, in those conversations. That’s the whole reason I went into politics because decisions were being made about my community that’s predominantly people of colour, we have such a high transient population, one of the most diverse boroughs in the world, and yet the council did not look like its community. It’s a phenomenon that’s existed in so many places and it’s even worse in tech because you’re seeing such the direct harm it’s having tenfold. But it’s everywhere. The erasure and the lack of dignity and respect Black folks and people of colour are given. Issues have to become mainstream enough for people to act on that. Black Lives Matter had to become mainstream enough for people to finally listen. It’s a lesson for all of us. How do we make sure there is someone in the room who is more, in relative terms, a more minoritized community than you. How do we make sure that we’re allies offline and online? How are we making sure we’re building community and sharing that legacy and our knowledge and our playbooks and our capital? So that more people from minoritized communities come together. What’s been the most challenging thing about founding and running Glitch? When you’re a Black founder CEO in a predominantly white charity sector and tech sector, things are just different. I’ve taken meetings where it’s supposed to be a prospective funding meeting about our work and before we can even give the pitch the first thing the prospective funder says is, “If Black lives really matter—” raises eyebrows, confusedly Exactly. So he says, “If Black lives really matter, why are you all not getting the vaccine?” It feels like someone is putting you in an ice bucket or flushing your head down a toilet, comments like that, microaggressions too, are a jarring reminder that you don’t belong here. It’s like you’re finally at the table, and someone has banged your head against that very table as if to say “you’re stupid for thinking you can be here.” I think those are moments that really bungee-cord pull you back to reality, That’s what’s really tough. Really, really, really, tough. And I think I got lost in negative thoughts this summer where I thought, “I don’t belong, I don’t know what I’m doing. This privilege of being CEO — how do I use it?” and overall just a massive loss of confidence. And everything. And I think that’s been really tough. Wow. I’m still stuck on this “If Black Lives really matter—” guy. Seyi, what did you want to be when you grew up? Trolls attacked you online because you made a viral video online so you rose to the occasion and fought back. There are folks out there who don’t grapple with trolls, out there living their truth without a care in the world. What did that look like for you? What did you want to be when you grew up? I wanted to be a dancer. I wanted to be the next Ciara. I wanted to be in Missy Elliot’s videos. I was like, ‘Move over, sis!’ What’s your favorite Ciara song? Goodies. Classic. Back to trolls, what’s a topic regarding online abuse that you wish you saw people talk about more? The topic of social media whistleblowers and how we should be less worried about making Facebook and Twitter look bad and more about holding them accountable. More specifically, what does this do in the way of changing the system? We shouldn’t have to keep relying on brave individuals who generally tend to be women and women of colour who really put themselves out on the line. I don’t want this to be the trend where we get small bits of reform. We need to have the media holding companies to account, not looking to make Mark Zuckerberg the bad guy because then the narrative becomes ‘when he leaves everything will be sorted out’ and that is not the case. Seyi, you have the longest resume I’ve ever seen in my life. What motivates you to keep going? I’m not, I don’t think I want to “keep going” anymore. I grew my organization by 50% in terms of income and more in terms of staff and diversified our income streams before we hit the two-year mark — during a pandemic! I’m ready to rest, I’m ready to sleep more, I’m ready to do work that is still great with minimum viable effort. That’s the sweet spot I’m looking for. — You can keep up with Seyi and Glitch’s work right and support their special Christmas fundraiser for a safe internet . here here First published here

An Interview with Seyi Akiwowo, Founder of Glitch - an Organization that Seeks to end Online Abuse

Starting with , Firefox blocks by default. This follows a practice adopted by Internet Explorer ( ) and . Firefox 23 active mixed content since version 9 Chrome This page explains what you should be aware of as a web developer. Your Website May Break If your website delivers HTTPS pages, all delivered via HTTP on this pages will be blocked by default. Consequently, your website may appear broken to users (if iframes or plugins don't load, etc.). is displayed by default, but users can set a preference to block this type of content, as well. active mixed content Passive mixed content Note that since mixed content blocking already happens in Chrome and Internet Explorer, it is very likely that if your website works in both of these browsers, it will work equally well in Firefox with mixed content blocking. In any case, the best way to know if something is broken in Firefox is to download the , open different pages on your website with the open (enable the "Security" messages) and see if anything related to mixed content is reported. Or use a free online crawler like or , a desktop crawler like , or a CLI tool like to check your website recursively and find links to insecure content. If nothing is said about mixed content, your website is in good shape: Keep making excellent websites! latest Firefox Edition web console SSL-check Missing Padlock HTTPSChecker mcdetect How to Fix Your Website The best strategy to avoid mixed content blocking is to serve all the content as HTTPS instead of HTTP. serve all content as HTTPS and fix your links.  Often, the HTTPS version of the content already exists and this just requires adding an "s" to links - http:// to https://. For your own domain, However, in some cases, the path may just be incorrect to the media in question. There are online as well as offline tools (depending on your operating system) such as to help resolve this. linkchecker use the site's HTTPS version if available. If HTTPS is not available, you can try contacting the domain and asking them if they can make the content available via HTTPS. For other domains, Credits : Published under license Source https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content Open CC Attribution ShareAlike 3.0

Using HTTPS to Render Blocked Mixed Content on a Website

The Resize Observer API provides a performant mechanism by which code  can monitor an element for changes to its size, with notifications being delivered to the observer each time the size changes. Concepts and Usage There is a whole raft of use cases for responsive design techniques  (and others besides) that respond to changes in an element's size, but  previously their implementations have often been hacky and/or brittle. For example, / are great for updating layouts at specific points when the viewport  changes sizes, but what if you want to change layout in response to a  specific element's size changing, which isn't the outer container? media queries window.matchMedia To achieve this, a limited solution would be to listen to changes to a suitable event that hints at the element you are interested in changing size (e.g. the window ), then figure out what the new dimensions or other features of the element after a resize using or , for example. resize event Element.getBoundingClientRect Window.getComputedStyle resizeObserver = ResizeObserver( { ( entry entries) { (entry.contentBoxSize) {
      entry.target.style.borderRadius = .min( , (entry.contentBoxSize.inlineSize/ ) +
                                                      (entry.contentBoxSize.blockSize/ )) + ;
    } {
      entry.target.style.borderRadius = .min( , (entry.contentRect.width/ ) +
                                                      (entry.contentRect.height/ )) + ;
    }
  }
});

resizeObserver.observe( .querySelector( )); const new => entries for let of if Math 100 10 10 'px' else Math 100 10 10 'px' document 'div' Such a solution tends to only work for limited use cases, be bad for performance (continually calling the above methods would result in a big performance hit), and often won't work when the browser window size is not changed. The Resize Observer API provides a solution to exactly these kinds of problems and more besides allowing you to easily observe and respond to changes in the size of an element’s content or border-box in a performant way. It provides a JavaScript solution to the often-discussed lack of element queries in the web platform. Usage is simple, and pretty much the same as other observers, such as Performance Observer or Intersection Observer — you create a new ResizeObserver object using the ResizeObserver() constructor, then use ResizeObserver.observe() to make it look for changes to a specific element's size. A callback function set up inside the constructor then runs every time the size changes, providing access to the new dimensions and allowing you to do anything you like in response to those changes. Interfaces ResizeObserver Provides the ability to register new observers and to start and stop observing elements. ResizeObserverEntry Describes a single element which has been resized, identifying the element and its new size. Examples You can find a couple of simple examples on our GitHub repo: ( ): A simple example with a green box, sized as a percentage of the viewport size. When the viewport size is changed, the box's rounded corners change in proportion to the size of the box. We could just implement this using with a percentage, but that quickly leads to ugly-looking elliptical corners, whereas the above solution gives you nice square corners that scale with the box size. resize-observer-border-radius.html see source border-radius ( ): Here we use the resize observer to change the of a header and paragraph as a slider’s value is changed causing the containing <div> to change the width. This shows that you can respond to changes in an element’s size, even if they have nothing to do with the viewport. resize-observer-text.html see source font-size The code will usually follow this kind of pattern (taken from resize-observer-border-radius.html): resizeObserver = ResizeObserver( { ( entry entries) { (entry.contentBoxSize) {
      entry.target.style.borderRadius = .min( , (entry.contentBoxSize[ ].inlineSize/ ) +
                                                      (entry.contentBoxSize[ ].blockSize/ )) + ;
    } {
      entry.target.style.borderRadius = .min( , (entry.contentRect.width/ ) +
                                                      (entry.contentRect.height/ )) + ;
    }
  }
});

resizeObserver.observe( .querySelector( )); const new => entries for let of if Math 100 0 10 0 10 'px' else Math 100 10 10 'px' document 'div' Source: Published under Open CC Attribution ShareAlike 3.0 license https://developer.mozilla.org/en-US/docs/Web/API/Resize_Observer_API

Mozilla News on
HackerNoon and Around the Web

mozilla.org

3001 employees

Since 2005

241 at Alexa

Mozilla Story Mentions

Articles Around the Web

Read More Tech Stories Related to #Mozilla

Mozilla News on HackerNoon and Around the Web