On Sun, Sep 6, 2015 at 3:51 PM, Georgi Guninski wrote:

On Sat, Sep 05, 2015 at 03:48:48PM +0000, Alfonso De Gregorio wrote:

...

.... I ask vulnerability sellers: How effective your favorite exploit acquisition platform / program is at preventing this from happening again?

You mean something like the the dear nsa: http://www.theregister.co.uk/2015/09/04/nsa_explains_handling_zerodays/

Mind-blowing secrets of NSA's security exploit stockpile revealed at last Incredible document has to be seen to be believed

It made me reconsider the true meaning of [XXXXXXXXXXX] to read about [XXXXXXXXXXX] and, especially, [XXXXXXXXXXX]. More seriously: After years of fierce debate, vulnerability disclosure is still looking for a convincing answer. The NSA may contribute its substantial share to discussion --- albeit less to the practice --- of vulnerability disclosure. Needless to say, it would have been more helpful to read a less heavily redacted 'Vulnerabilities Equities Policy and Process' to this end. On September 29, NTIA will convene a meeting on this topic. For those considering to attend it http://www.ntia.doc.gov/september-29-multistakeholder-meeting-vulnerability-... Will we never stop from drinking from the (endless?) stream of exploitable vulnerabilities? -- Alfonso

Every upgrade of Mozilla (and all browsers) has diminished security and increased ads and user profiling. Sites which nag visitors to upgrade to latest versions are complicit. So too are ad blockers and security promoters part of the racket. Unceasing program upgrades, nagging and underwriting hacking security panic are Silicon Valley-Alley fracking. No surprise that FVEY capitalizes on the eagerness to cooperate against Net users. Man in the Machine about Jobs hardly scratches the surface, complicit too in the hawking of cyber derring do in the Era of Snowden Without Harming the US: "Be sure to use encryption," Jobs would applaud that planned parenthood documentrary. At 06:10 PM 9/5/2015, you wrote:

On Sat, 5 Sep 2015 18:35:37 +0300 Georgi Guninski wrote:

...

Likely the mozilla u$a comrades caught the less skilled attackers, not those with r00t access (having in mind what a mess their code is).

Ah, but firefox keeps getting an even cooler GUI every day. How can you not like them?

Dnia niedziela, 6 września 2015 08:58:41 Georgi Guninski pisze:

On Sat, Sep 05, 2015 at 07:10:10PM -0300, Juan wrote:

...

Ah, but firefox keeps getting an even cooler GUI every day. How can you not like them? Don't forget the new privacy enhancing features.

Like EME? ;) http://rys.io/en/141

AFAIK Debian and the FSF have forks of firefox.

Did they manage to get rid of sufficiently enough spyware?

No. Even the simple things are apparently ignored: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654336 http://rys.io/en/53

(This doesn't appear easy IMHO).

Some things would appear easy. Like *not* removing the "delete history after X days" setting. Now in Firefox you can only either have history, or not have it at all. -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

On Mon, Sep 07, 2015 at 12:55:11PM -0400, Ulex Europae wrote:

I wonder, is there an A-list of must-have extensions for Firefox? Because "the internet is for porn," and porn doesn't work on text-only browsers...

NoScript, RequestPolicy, RefControl, CookieMonster, policeman, https-everywhere, monkeysphere, RedirectCleaner, CertPatrol|Convergence, BetterPrivacy, random-agent-spoofer, ssleuth -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

There's two categories or buckets here if you're playing to win; One is a list of extensions you can install on *anyone's* computer without them even noticing the privacy/security boost they're receiving (because if they notice, you lose because they blame the new *ware for all their trivial problems). The other list is the power-user stuff that really works, but which n00bs will reject out of ignorance, blaming the protective software instead of the buggy websites it exposes. My short-list for install-on-everyone's-computer is: * Disconnect * HTTPS-Everywhere * uBlock Origin (don't change default settings) * Disable 3rd Party Cookies NoScript, Cookie-killers, RequestPolicy etcetera are too prone to creating problems for browser users; to an enlightened user, blame the website, work around, or make an exception and move on. But to a n00b, exposing errors in tracker-rich sites is unacceptable, sadly. On 08/09/15 00:57, rysiek wrote:

Dnia poniedziałek, 7 września 2015 20:49:10 stef pisze:

...

On Mon, Sep 07, 2015 at 12:55:11PM -0400, Ulex Europae wrote:

...

I wonder, is there an A-list of must-have extensions for Firefox? Because "the internet is for porn," and porn doesn't work on text-only browsers...

NoScript, RequestPolicy, RefControl, CookieMonster, policeman, https-everywhere, monkeysphere, RedirectCleaner, CertPatrol|Convergence, BetterPrivacy, random-agent-spoofer, ssleuth

And PrivacyBadger, I might add.

Also, Self-Destructing Cookies is an interesting one, as while CookieMonster allows you to keep track of which sites can or cannot set cookies, that's for-session granularity. Self-Destructing Cookies destroys cookies after a set time after closing a given tab. I use both.

And if you're into this kind of stuff, Lightbeam. Just for shits and giggles.

-- Scientific Director, IndieBio EU Programme Now running in Cork, Ireland May->July Learn more at indie.bio and follow along! Twitter: @onetruecathal Phone: +353876363185 miniLock: JjmYYngs7akLZUjkvFkuYdsZ3PyPHSZRBKNm6qTYKZfAM peerio.com: cathalgarvey

On Tue, Sep 08, 2015 at 07:20:41AM +0000, Peter Gutmann wrote:

stef writes:

...

On Mon, Sep 07, 2015 at 12:55:11PM -0400, Ulex Europae wrote:

...

I wonder, is there an A-list of must-have extensions for Firefox? Because "the internet is for porn," and porn doesn't work on text-only browsers...

NoScript, RequestPolicy, RefControl, CookieMonster, policeman, https- everywhere, monkeysphere, RedirectCleaner, CertPatrol|Convergence, BetterPrivacy, random-agent-spoofer, ssleuth

You forgot the most critical ones, the extensions you need to undo all the

well, i prefer vimperator, this list is intentionally neglecting UI plugins. also you should look into random-agent-spoofer it does disable a lot of the mozilla sabotage crap.

crap that Mozilla have piled onto Firefox since they started on their copy- everything-Chrome-does spree. Classic Theme Restorer is the first extension I load on any new install (even before NoScript), it's now comprehensive enough that it's probably the only one you need, although Hide Tab Bar With One Tab is also useful.

-- otr fp: https://www.ctrlc.hu/~stef/otr.txt

On Sun, Sep 06, 2015 at 11:01:39AM +0000, Peter Gutmann wrote:

Not to mention their plan to deprecate their extension API, which is the only thing still separating them from actually being Chrome. It looks like there could be a race between them naturally driving their market share to zero before the API-deprecation, or the API-deprecation forcing the issue.

IMHO they will kick the bucket as soon as google stop pouring money in them.

What we'd really need is a reboot of the project to take it back to its roots, removing layers and layers of accumulated bloat and "features" no-one wants, run by dedicated developers who actually listen to their users rather than doing whatever they think is trendy (mostly just cloning Chrome) and forcing it on their users. It'd be like Firefox rising anew from the ashes. They could call it, oh, I dunno, something like "Phoenix".

Back to the roots? According to quote: "Roots are the branches down in the earth. Branches are roots in the air -- Stray Birds". If you want the roots, consider spamming Brendan Eich, he has ideas about "expanding JS", which I won't comment. If you ask me, starting from zero is better. Likely, this will require nontrivial amounts of money.

From experience, older mozilla code contained dereferencing NULL on purpose, which can only compete with certain openssl's construct I don't quite remember well ATM (it was even funnier).

On Sun, Sep 06, 2015 at 01:28:49PM +0100, Cathal (Phone) wrote:

TBF, Servo is kind of a total rewrite of exactly the sort the world needs: memory and type safe from the ground up.

Is this one, from mozilla r3s34rch? https://github.com/servo/servo/blob/master/README.md A lot of dependencies I see: On Debian-based Linuxes: sudo apt-get install curl freeglut3-dev \ libfreetype6-dev libgl1-mesa-dri libglib2.0-dev xorg-dev \ gperf g++ cmake python-virtualenv \ libssl-dev libbz2-dev libosmesa6-dev libxmu6 libxmu-dev libglu1-mesa-dev Could point which parts of Servo display jpg/png and render fonts? The above dependencies are provably not memory safe, sorry.