ericlaw

Note that I said: "One of my", and Cloudflare has hired a HUGE percentage of the best networking talent I've encountered.

Fun fact: still can in Chromium-based browsers. https://textslashplain.com/2023/03/22/attack-techniques-spoo...

The October 2025 Patch Tuesday patches locked down previews of files in the Windows Explorer shell. This post explains why.

Mistakes and Successes in building the Fiddler web debugger

Almost everybody knows this, yet most of us don't think through the implications, leading to some surprising results.

There is no visible "OK" button on a SmartScreen reputation warning.

.com files still work fine on Windows; Visual Studio installs devenv.com, for example (IIRC, it's there for a somewhat wacky reason. See %PATHEXT%)

Happy to add those, if you can point to some information about actual implementations?

Is your contention here that there's somehow a human male with two Ethernet ports that is manipulating HTTPS traffic and I'm just too "lazy" to admit that?

https://blog.cloudflare.com/monsters-in-the-middleboxes/

The many many upstart browsers (including mine) that are eager for Chrome to do something so foolish so we can collect all of their irate users?

To answer a few questions here:

1. I landed this fix because there was a policy that did not work properly. We could instead document that the URLBlocklist policy works for every scheme but one, or we could fix it. Fixing it makes more sense.

2. This policy only can be set on managed machines.

3. This policy, in isolation, is trivially circumvented. Managed environments block many things, including many of the proposed circumventions here.

4. I've built one of the world's most popular tools for viewing and modifying web traffic. The narrative that this feature has broad implications for anything is absurd.

The abstraction leaks because the performance characteristics are inherently impossible to mask from the higher layers.

There are other places where the abstraction leaks as well (try to add a file with a Unicode name to a Compressed Folder).

It's true that you could add more and more code to try to make the abstraction leak less.

As noted in the blog post, he's the author of the Shell Namespace code, but not the ZIP code beneath.

Tracked by https://crbug.com/959839

It certainly appears to be monitoring the entry of passwords into Facebook, but given the stated purpose of the extension ("Record activities undertaken in the content area for later playback") it's not clear to me that this is the same as "stealing". We'd need to see code that shows the recorded content being exfiltrated to somewhere else, which should be pretty obvious by watching network traffic and or doing a full review of the code.

Many "irrational" decisions are related to interactions with anti-bot/anti-fraud logic.

I worked on IE in the days when there were many crazy conspiracy theories about silverlight and IE collaborating to ruin the open web. This sounds similar.

Thanks! Followup post has a little bit more: https://textslashplain.com/2018/05/07/google-chrome-twoish-y...

A full build of Chrome on local hardware takes a very long time, variable based on the number of CPU cores and their clock speed.

Much faster builds are achieved using Goma. https://news.ycombinator.com/item?id=16135596

Not anymore, after https://bugs.chromium.org/p/chromium/issues/detail?id=646465. Hence https://bugs.chromium.org/p/chromium/issues/detail?id=663971

> " it was not really compelling versus LZHAM "

For those of us building things on the web, things supported by browsers are far more compelling than those that are not.

They probably would've if they were doing it now.

It doesn't bother to compare LZMA because no major browser is planning to add LZMA.

As it turns out, they made a great offer for me to return in 2014, but they don't allow remote work and we're staying in Austin. I have many friends in IE/Edge and wish them all the best.

Pass the -dpiAware command line argument into Fiddler to have it report that it is DPI aware.