News for hackers. Stuff that matters.
Re:Firefox Quantum Lands in Beta, Developer Edition by Brakenshire on Tuesday September 26, 2017 @11:55AM (#15339760)
Pocket is now owned by Mozilla, and is going to be open sourced. What separates that from any other functionality built into the browser, for instance Firefox Sync or Autocomplete?
Re:Firefox Quantum Lands in Beta, Developer Edition by drdaeman on Tuesday September 26, 2017 @01:59PM (#15341074)
1. Firefox Accounts & Sync is a terrible mess. Its security is still broken[1] and it's insanely over-engineered[2].

I really wish it shouldn't have existed, and instead Mozilla would've focused on providing an API to build a synchronization service upon. And then, whatever - their services could've been an pre-bundled extension.

2. I believe all of those SaaSes (i.e. Firefox Screenshots, too) shouldn't belong to the browser's core. Those could be distributed as pre-bundled extensions (which they actually are, but in a special way), but not as a part of the browser itself.

This is highly opinionated, though. I just feel that rather than a browser, Firefox is becoming something like a service platform. I don't like it for the same reasons I tend to value self-hosting over the dependence on others' services, and Free Software over non-free options. I recognize others may feel very differently and possibly even welcome that.

---

[1] Authentication pages are still served from network, so if you use it - you trust Mozilla to not steal (or, better say, not be forced to steal) your password and the encryption keys. The protocol is stable for quite a while so I really don't know why they're still not fixing this.

[2] I wrote an alternative self-hosted Accounts & Sync implementation, so while I'm biased I sort of know what I'm talking about here. Four different authentication protocols (BrowserID, Hawk, OAuth2 and JWT), multiple non-standard HTTP headers, and the whole system just reeks of the NIH syndrome.

Re:Firefox Quantum Lands in Beta, Developer Edition by snaky on Wednesday September 27, 2017 @07:54AM (#15346845)
Add to this things like https://bugzilla.mozilla.org/show_bug.cgi?id=812348 and https://bugzilla.mozilla.org/show_bug.cgi?id=814801 to make the whole picture even worse.

Did you open-sourced your alternative self-hosted Accounts & Sync implementation?

Re:Firefox Quantum Lands in Beta, Developer Edition by drdaeman on Wednesday September 27, 2017 @05:34PM (#15352546)
Yes, of course. Although I can't vouch for its security and stability - while I use it myself and it seems to work OK, I'd rather state that it's risky. In short, the repo is more like a code dump, rather than a properly released project.

Still, here it is: https://gitlab.com/drdaeman/firesync

Development is very sporadic, though - you can see it in commit history. And some parts of code feel dirty (in particular, I've made a bad design decision when trying to avoid implementing full-fledged OAuth2).

The repo lacks few things:

1) Notes about patched PyBrowserID. It's in the repo, and you can check the Dockerfile, but not in README.

2) Instructions on installing Kinto - another piece that is used to sync WebExtension settings[1]. It became mandatory with 57, without it sync fails and doesn't update "last synced" date (used to work in 56 and below). I'll add some instructions later, when I'll find time to do so.

----

[1] BTW, this means that everyone who runs self-hosted Sync but not Accounts (relying on Mozilla tokens instead) are now storing parts of their data on Mozilla servers. I don't think this was ever announced, I've only learned about Kinto when my Firefoxes started to log errors in the browser console. If you self-host Sync-only and think you may be affected - check `webextensions.storage.sync.serverURL` value.

Re:Firefox Quantum Lands in Beta, Developer Edition by nebabyte on Wednesday September 27, 2017 @12:41AM (#15344984)
> I just feel that rather than a browser, Firefox is becoming something like a service platform

Isn't it? Wasn't this the crux of the whole dev team controversy/split years ago?

(This is all sounding like rehashed news to me, but I admit I don't go out of my way to keep up with browser community drama, so someone correct me if I'm wrong.)

Re:Firefox Quantum Lands in Beta, Developer Edition by magnat on Tuesday September 26, 2017 @12:49PM (#15340385)
Sync, Pocket, Dev tools, Screenshots etc are not required to display and interact with HTML pages. They are useful and it's nice they exist, but I don't see a reason to have them installed if I don't need them - just as I don't install every package available in OS just in case I'll need later it.

Even if they don't use resources when not being actively used (no way to test since there is no way to remove them), they increase attack surface and clutter UI.

Re:Firefox Quantum Lands in Beta, Developer Edition by staticassertion on Tuesday September 26, 2017 @01:07PM (#15340552)
> just as I don't install every package available in OS just in case I'll need later it.

But your OS does come with lots of packages and features you may not use.

Re:Firefox Quantum Lands in Beta, Developer Edition by drdaeman on Tuesday September 26, 2017 @02:08PM (#15341145)
There are users who value OSes where things are "just working", out of the box. Even more, there are users who value if OS has lots of stuff pre-installed.

There are users who value OSes for being absolutely minimal, so they can install only the stuff they want.

There are users who build their OSes from scratch, compiling each piece from source, fine-tuning every option they want to touch, manually defining every aspect of their system.

None of those approaches are wrong. And each of users may voice their discontent if things are not the way they prefer them to be (and that's good).

Re:Firefox Quantum Lands in Beta, Developer Edition by magnat on Tuesday September 26, 2017 @01:12PM (#15340600)
> But your OS does come with lots of packages and features you may not use.

Sure does. And I can remove them if I want to. I can apt-get remove libc6 if I really really want to and I accept the consequences. I can't remove non-essential parts of the Firefox, though.

Re:Firefox Quantum Lands in Beta, Developer Edition by drdaeman on Tuesday September 26, 2017 @02:04PM (#15341114)
Technically speaking, you (still) can.

Delete /usr/lib/firefox/browser/features/[email protected] (or - better - rebuild the .deb package to not include this file) and the Pocket will be gone. Same for [email protected].

Sync and DevTools are tightly integrated, though. I'd really really wish it would be realistically possible to remove Sync and replace it with something else.

Re:Firefox Quantum Lands in Beta, Developer Edition by nebabyte on Wednesday September 27, 2017 @12:43AM (#15344988)
Not necessarily, depending on their OS
Re:Firefox Quantum Lands in Beta, Developer Edition by CrystalGamma on Tuesday September 26, 2017 @04:54PM (#15342421)
That is news to me, and https://getpocket.com/about doesn't mention Mozilla at all … do you have a link to some official announcement?
Re:Firefox Quantum Lands in Beta, Developer Edition by glandium on Tuesday September 26, 2017 @07:27PM (#15343553)