• Why Does Mozilla Maintain Our Own Root Certificate Store?

  Mozilla maintains a database containing a set of “root” certificates that we use as “trust anchors”. This database, commonly referred to as a “root store”, allows us to determine which Certificate Authorities (CAs) can issue SSL/TLS certificates that are trusted by Firefox, and email certificates that are trusted by Thunderbird. Properly maintaining a root store is a significant undertaking – it requires constant effort to evaluate new trust anchors, monitor existing ones, and react to incidents that threaten our users. Despite the effort involved, Mozilla is committed to maintaining our own root store because doing so is vital to the security of our products and the web in general. It gives us the ability to set policies, determine which CAs meet them, and to take action when a CA fails to do so.

  A major advantage to controlling our own root store is that we can do so in a way that reflects our values. We manage our CA Certificate Program in the open, and by encouraging public participation we give individuals a voice in these trust decisions. Our root inclusion process is one example. We process lots of data and perform significant due diligence, then publish our findings and hold a public discussion before accepting each new root. Managing our own root store also allows us to have a public incident reporting process that emphasizes disclosure and learning from experts in the field. Our mailing list includes participants from many CAs, CA auditors, and other root store operators and is the most widely recognized forum for open, public discussion of policy issues.

• Extract Method Refactoring in Rust

• Why should you use Rust in WebAssembly?

  WebAssembly (Wasm) is a technology that has the chance to reshape how we build apps for the browser. Not only will it allow us to build whole new classes of web applications, but it will also allow us to make existing apps written in JavaScript even more performant.

  In this article about the state of the Rust and Wasm ecosystem, I'll try to explain why Rust is the language that can unlock the true potential of WebAssembly.

• Tails 3.12.1 is out

  This release is an emergency release to fix a critical security vulnerability in Firefox.

  It also fixes other security vulnerabilities. You should upgrade as soon as possible.

• Mozilla to use machine learning to find code bugs before they ship

  In a bid to cut the number of coding errors made in its Firefox browser, Mozilla is deploying Clever-Commit, a machine-learning-driven coding assistant developed in conjunction with game developer Ubisoft.

  Clever-Commit analyzes code changes as developers commit them to the Firefox codebase. It compares them to all the code it has seen before to see if they look similar to code that the system knows to be buggy. If the assistant thinks that a commit looks suspicious, it warns the developer. Presuming its analysis is correct, it means that the bug can be fixed before it gets committed into the source repository. Clever-Commit can even suggest fixes for the bugs that it finds. Initially, Mozilla plans to use Clever-Commit during code reviews, and in time this will expand to other phases of development, too. It works with all three of the languages that Mozilla uses for Firefox: C++, JavaScript, and Rust.

  The tool builds on work by Ubisoft La Forge, Ubisoft's research lab. Last year, Ubisoft presented the Commit-Assistant, based on research called CLEVER, a system for finding bugs and suggesting fixes. That system found some 60-70 percent of buggy commits, though it also had a false positive rate of 30 percent. Even though this false positive rate is quite high, users of this system nonetheless felt that it was worthwhile, thanks to the time saved when it did correctly identify a bug.

• Facebook Answers Mozilla’s Call to Deliver Open Ad API Ahead of EU Election

  After calls for increased transparency and accountability from Mozilla and partners in civil society, Facebook announced it would open its Ad Archive API next month. While the details are still limited, this is an important first step to increase transparency of political advertising and help prevent abuse during upcoming elections.

  Facebook’s commitment to make the API publicly available could provide researchers, journalists and other organizations the data necessary to build tools that give people a behind the scenes look at how and why political advertisers target them. It is now important that Facebook follows through on these statements and delivers an open API that gives the public the access it deserves.

  The decision by Facebook comes after months of engagement by the Mozilla Corporation through industry working groups and government initiatives and most recently, an advocacy campaign led by the Mozilla Foundation.

  This week, the Mozilla Foundation was joined by a coalition of technologists, human rights defenders, academics, journalists demanding Facebook take action and deliver on the commitments made to put users first and deliver increased transparency.

  “In the short term, Facebook needs to be vigilant about promoting transparency ahead of and during the EU Parliamentary elections,” said Ashley Boyd, Mozilla’s VP of Advocacy. “Their action — or inaction — can affect elections across more than two dozen countries. In the long term, Facebook needs to sincerely assess the role its technology and policies can play in spreading disinformation and eroding privacy.”

• Change look & feel of Firefox pinned tabs

  Here's a curious corner case for you. About a year ago, Firefox Quantum introduced a whole bunch of radical changes in how it works and behaves, the biggest among them the switch to WebExtensions. This move made a lot of friendly, powerful extensions not work anymore, including a range of tab management addons. On the upside, Firefox also brought about the integrated tab pinning feature. It works nicely. But.

  Pinned tabs will detach from the tab bar and position themselves to the left, somewhat like a typical desktop quicklaunch icon area. So far so good, but the corner case be here! As it happens, the pinned tabs are relatively narrow, which means quick stab 'n' open action isn't quite possible. You need to be accurate positioning your mouse cursor, and that could slow you down. There does not seem to be a trivial option to change the width of the pinned tabs. Hence this guide.

• Mozilla Open Letter: Facebook, Do Your Part Against Disinformation

  Is Facebook making a sincere effort to be transparent about the content on its platform? Or, is the social media platform neglecting its promises?

  Facebook promised European lawmakers and users it would increase the transparency of political advertising on the platform to prevent abuse during the elections. But in the very same breath, they took measures to block access to transparency tools that let users see how they are being targeted.

  With the 2019 EU Parliamentary Elections on the horizon, it is vital that Facebook take action to address this problem. So today, Mozilla and 32 other organizations — including Access Now and Reporters Without Borders — are publishing an open letter to Facebook.

• Review of Igalia’s Multimedia Activities (2018/H2)

  EME is a specification for enabling playback of encrypted content in Web bowsers that support HTML 5 video.

  In a downstream project for WPE WebKit we managed to have almost full test coverage in the YoutubeTV 2018 test suite.

  We merged our contributions in upstream, WebKit and GStreamer, most of what is legal to publish, for example, making demuxers aware of encrypted content and make them to send protection events with the initialization data and the encrypted caps, in order to select later the decryption key.

  We started to coordinate the upstreaming process of a new implementation of CDM (Content Decryption Module) abstraction and there will be even changes in that abstraction.

• MiUnlockTool unlocks Xiaomi phones' bootloader on macOS and Linux

  MiUnlockTool is a third party bootloader unlock utility which runs on Linux and macOS. The official Xiaomi tool for unlocking bootloader is Windows only.

Back in the good ole days, Firefox had a wealth of excellent, powerful extensions. Among them, Tab Mix Plus with a superb built-in session manager. Come Firefox Quantum (57 onwards) and WebExtensions, a lot of goodies have gone away, forever. We are left with diminished functionality.

One of the things that I've been hunting after the most is a flexible session manager akin to the old stuff, with the ability to manage multiple sessions in a smart, simple, elegant way. I think I've finally found an addon that does the trick. It's called Session Sync, and I'm happy enough to actually write a whole article about this.