The other day I stumbled across the following headline on The Verge: "Stratos is not just another all-in-one smart card".

The product described in the article is a "smart" credit card which allows you to combine any three cards (e.g. your personal and business credit card plus your Starbucks loyalty card) in one Stratos card which is hooked up to your phone and allows you to select, with the push of a button, the card you want to use.

Now don't get me wrong - this is a wonderfully designed product and I can geek out on the engineering marvel it is - putting effectively a mini computer, bluetooth connectivity and a battery into something as small and flat as a credit card.

But... WTF?!

Why on earth do we need a smart credit card which replaces all of three normal cards? Is it really such a bother to carry three cards with you? Does it really make such a difference to you that you would spend what-ever-this-thing will cost (and I am sure it won't be cheap)?

In it's own way the Stratos card is symptomatic with what's wrong with some tech startups: It's tech for the sake of tech. It doesn't solve a real problem but is merely a masturbation in design and features. Why not start with a real need or problem (how about access to clean drinking water for example?) and solve that first before we try to figure out how to cut down the size of our wallet by 2 millimeter?

http://blog.finette.com/heres-whats-wrong-with-tech/

This week, we merged 50 pull requests

Notable additions

• Josh added support for async document loading
• Patrick implemented overflow-x/overflow-y
• Patrick and Simon implemented image-rendering
• Glenn fixed iframe visibility
• James added support for beforescriptexecute and afterscriptexecute
• Ms2ger added profiling to image decoding
• Glenn added the ability to reap layout data when a node is removed

New contributors

• Arbitrary Cat
• Avi Weinstock
• Deepak
• dhneio
• Isaac Ge
• James Gilbertson

Meeting

Minutes

• We discussed possibilities for good introductory layout issues
• We’re working on tracking down memory leaks
• If you want to work with Servo, there’s a Staff Research Engineer position open!
• Sadly, Mozilla was not accepted into GSoC this year. We discussed alternatives

http://blog.servo.org/2016/03/04/twis-26/

This is the meeting where all the Mozilla quality teams meet, swap ideas, exchange notes on what is upcoming, and strategize around community building and...

https://air.mozilla.org/quality-team-qa-public-meeting-20150304/

It’s been a minute! We’ve just started a new heartbeat, and now we have a giant team working on the Teach site. Our stand-up today looked like The Brady Bunch.

We’re now entering a stage where we have three strands of work running in parallel:

1. Engineers are setting up the technical framework for the new site, and are beginning to build out the pages that have been designed
2. Designers are polishing up the work they’ve done so far (accommodating some last minute requests from me!), and starting on a few new pages and workflows
3. Members of the Learning Networks team are finalizing copy and content for the various pages

If every strand can keep moving, we’ll be in good shape for the release at the end of the next heartbeat. Ideally, we’ll get into a rhythm where copy is finalized in the heartbeat *before* the design work, which is done in the heartbeat *before* development, but right now things are overlapping a bit.

Iterative Dev {It’s been so long since I’ve done an anagram! Here we go: Tea Revived It}

I’ve been thinking about how to build out this site in a way that reflects the evolving nature of the Learning Networks team work, and specifically the Clubs program. The answer is (always) to be agile.

It’s often difficult to agree on what should be included in a v1. I think the term “MVP” is one of the most abused terms in software. It is sometimes used to mean “do as little work as possible,” but the definition I like best is, “do as much as is needed to prove or disprove a hypothesis.”

This definition provides a great framework for determining what to include in a v1. If you can agree on a hypothesis, then every decision can be made by answering the question, “Do we need this to prove the hypothesis?”

For the Teach site, the hypothesis we’re testing is: “People will use the site to find teaching activities and add their Clubs to the map.”

So the v1 will seek to prove that. The priority items are a couple static pages that point to our high-quality curriculum modules, a Clubs page with an “Add Your Club” workflow, and some additional static content to flesh out the site.

Beyond Version One {Anagram: Sobered Onion Envy}

While  v1 is being created, we also need to start gearing up for the next iteration, which will be focused on building out more advanced tooling for the curriculum (so that we can add to those pages without developer involvement, and incorporate feedback and remix ideas from the community). This is essentially adding a fourth strand to the list above—a kind of “requirements gathering and brainstorming” strand.

(Side note: I like that the “build, measure, learn” cycle we’ll use to iterate on the site echoes the process we’re using to develop the curriculum with our community. Agile methods all around!)

Of course, even while using iterative development practices, we still need to keep the big picture in mind. To see the current thinking about future iterations, you can always check out the roadmap. I’m updating it regularly as our needs change, or as they become clearer to me.

http://hannahgrams.com/2015/03/04/its-been-a-minute-an-update-on-the-teach-site-some-thoughts-on-iterative-development/

Since my last blog post on “remoties”, I’ve worked with ProCore, and Haas, UCBerkeley (again!) as well as smaller private discussions with some other companies. Every single time, I continue to find people eager for passionate conversations, and clear “ah-ha!” moments, which I find very encouraging. There’s also plenty of volunteering stories/ideas of what did/didnt work for them in their past. All this helps me continue to hone and refine these slides, which I hope makes them even more helpful to others.

You can get the latest version of these slides, in handout PDF format, by clicking on the thumbnail image.

Remoties are clearly something that people care deeply about. Geo-distributed teams are becoming more common in the workplace, and yet the challenges continue to be very real and potentially disruptive. Given how this topic impacts people’s jobs, and their lives, I’m not surprised by the passionate responses, and each time, the lively discussions encourage me to keep working on this even more.

As always, if you have any questions, suggestions or good/bad stories about working in a remote or geo-distributed teams, please let me know – I’d love to hear them.

Thanks
John.

http://oduinn.com/blog/2015/03/04/we-are-all-remoties-feb2015-edition/

This week, we merged 50 pull requests

Notable additions

• Josh added support for async document loading
• Patrick implemented overflow-x/overflow-y
• Patrick and Simon implemented image-rendering and background-size
• Glenn fixed iframe visibility
• James added support for beforescriptexecute and afterscriptexecute
• Ms2ger added profiling to image decoding
• Glenn added the ability to reap layout data when a node is removed

New contributors

• Arbitrary Cat
• Avi Weinstock
• Deepak
• dhneio
• Isaac Ge
• James Gilbertson

Meeting

Minutes

• We discussed possibilities for good introductory layout issues
• We’re working on tracking down memory leaks
• If you want to work with Servo, there’s a Staff Research Engineer position open!
• Sadly, Mozilla was not accepted into GSoC this year. We discussed alternatives

http://blog.servo.org/2015/03/04/twis-26/

Weekly coordination meeting for Firefox Desktop & Android product planning between Marketing/PR, Engineering, Release Scheduling, and Support.

https://air.mozilla.org/product-coordination-meeting-20150304/

Watch mconley livehack on Firefox Desktop bugs!

https://air.mozilla.org/the-joy-of-coding-mconley-livehacks-on-firefox-episode-4/

Firefox 38 has now merged to Aurora (Firefox Developer Edition) and we are a couple weeks into development of Firefox 39 on mozilla-central. At this point, bugs that are fixed on mozilla-central will need to be uplifted to mozilla-aurora to continue to ride the 38 train.

These are some of the 21 bugs that were fixed since the last update (1/31/2015):

• Bug 1008171 No focus for elements except textboxes (and buttons, on Windows and Linux) inside in-content preferences
• Bug 1025719 – openPreferences(panelName) doesn’t open the requested pane if about:preferences is in a yet-to-be-loaded tab
• Bug 1034296 – Action dropdown in Application pane does not open when session restored
• Bug 1037225 – Consider keeping browser.preferences.instantApply = false on Windows
• Bug 1044597 – in-content preferences: resized dialogs should not push buttons into overflow
• Bug 1047586 – Unable to interact with in-content preferences after changing minimum font size to a very large value
• Bug 1108302 – Menulists in the in-content preferences have too much padding at the start of their contents
• Bug 1111353 – No longer displayed check mark in in-content preferences if Text : white, Background : Black and Select “Never” in “Content” > “Colors…” > “Allow pages to choose their own colors, instead of my selections above”

Since the last update all of the P1-tracked bugs have been fixed. We are tracking the following P2 bugs:
Bug 1043612 – Persist the size of resizable in-content subdialogs
Bug 1136645 – InContent prefs – Make focusrings match the spec on Windows and Linux
Bug 1044600 – in-content preferences: empty dialogs after pressing backspace or the Back button

Bug 1044600 in the above list should be very close to getting fixed. It has landed and been backed out a couple times due to intermittent failures and leaks, but is making steady progress towards being fixed.

Gijs and I will be meeting up in less than two weeks in San Francisco to have a “hack week” focusing on the in-content preferences. We’ve gone through the list of bugs in the in-content preferences and put together a subset of 10 bugs that we’ll tackle during the week if they’re not fixed beforehand.

Big thanks go out to Ian Moody [:Kwan], Gijs, Yash Mehrotra, Richard Marti [:Paenglab], and Tim Nguyen [:ntim] for their help in fixing the 21 bugs.

Tagged: firefox, in-content-preferences, mozilla, planet-mozilla

https://msujaws.wordpress.com/2015/03/04/status-update-in-content-preferences-part-5/

This week, using my new AMQP and HTTP taskcluster go client api library (see recent posts), I’ve written a service, running in heroku, to capture metrics for task cluster.

Five task cluster pulse queues are monitored to watch for completed tasks and completed task graphs. Then the taskcluster queue API is queried to get task data, such as worker payloads, in order to build up a view of durations taken for the tasks to progress through states until completion. This data is then collected, for pushing to influxdb for real-time query analysis. InfluxDB is similar to graphite.

In parallel, the hg pushlogs are monitored to get push times for hg changesets, so that we have a view in the end of how long it took from a change being received on the hg server, until a task graph is build, then until it is executed, and then until it completes.

The publish to InfluxDB is not quite done yet, hope to finish that off shortly.

The data is persisted using BoltDB during data collection and denormalisation.

I plan to wrap that up shortly, and then start work on …. the generic worker!

See bug 1136537 for more details.

Code lives here: https://github.com/petemoore/tc-gecko-metrics-go

It is auto-deployed to heroku using the https://github.com/kr/heroku-buildpack-go buildpack after a push to github.

http://petemoore.tumblr.com/post/112697565668

Over the last month or so I've added reverse-execution support to rr's gdb interface. This enables gdb commands such as reverse-continue, reverse-next, reverse-finish and reverse-step. These work with breakpoints and watchpoints, so you can do things like

Breakpoint 1, nsCanvasFrame::BuildDisplayList (this=0x2aaadd7dbeb0, aBuilder=0x7fffffffaaa0, aDirtyRect=..., aLists=...)
    at /home/roc/mozilla-inbound/layout/generic/nsCanvasFrame.cpp:460
460   if (GetPrevInFlow()) {
(gdb) watch -l mRect.width
Hardware watchpoint 2: -location mRect.width
(gdb) reverse-cont
Continuing.
Hardware watchpoint 2: -location mRect.width

Old value = 12000
New value = 11220
0x00002aaab100c0fd in nsIFrame::SetRect (this=0x2aaadd7dbeb0, aRect=...)
    at /home/roc/mozilla-inbound/layout/base/../generic/nsIFrame.h:718
718       mRect = aRect;

(Here the "New value" is actually the value before this statement was executed, since we just executed backwards past it.)

Since debugging is about tracing effects to causes, and effects happen after their causes, reverse execution is a big deal. I've just started using it to debug Gecko, and I'm enjoying it immensely! I find myself having to unlearn a lot of my usual debugging tactics; much of what I've learned about debugging up until now is really just workarounds for not having had reverse execution.

An example from today: working on bug 1082249, I was in a function nsDisplayTableItem::ComputeInvalidationRegion with a geometry variable pointing to an nsDisplayBackgroundGeometry when it should have been a nsDisplayTableItemGeometry. At first I considered various indirect ways to figure out where the nsDisplayBackgroundGeometry came from, but now there's an easy direct way: set a breakpoint on the nsDisplayBackgroundGeometry, make it conditional on this == the current value of geometry, and reverse-continue to see exactly where that specific object was created (in a subclass of nsDisplayTableItem that I hadn't thought of).

This work is checked into rr master. It's not well tested yet, so a new official rr release is not imminent, but I'd appreciate people trying it out and reporting issues. At least I have been able to use it to get work done today :-).

http://robert.ocallahan.org/2015/03/debugging-gecko-with-reverse-execution.html

Instead of the classical 6 weeks, the 37 cycle is going to be only 5 weeks.

In this beta 2, we continued the work started during the 36 cycle. We landed fixes for MSE or image processing. We also took most of the stability fixes which will ship with 36.0.1.

• 82 changesets
• 130 files changed
• 2459 insertions
• 1610 deletions

Extension	Occurrences
cpp	48
h	25
js	17
java	7
jsm	6
xml	4
html	4
ini	3
json	2
css	2
build	2
xhtml	1
webidl	1
jsx	1
in	1
idl	1
hgtags	1

Module	Occurrences
layout	25
dom	25
browser	24
netwerk	10
mobile	10
toolkit	9
image	9
js	6
testing	5
xulrunner	1
widget	1
security	1
accessible	1

List of changesets:

Margaret Leibovic	Bug 1073775 - Pass default engine from JS to Java, instead of making assumptions based on engine list order. r=liuche a=sylvestre - 21ec3b2d3da5
Jean-Yves Avenard	Bug 1132796: Revert incorrect change unfixing Bug 1132825. r=jya a=lmandel - 82ef773ccb71
Mark Banner	Bug 1114713 - Fix intermittent test failures by removing a event-cycling setTimeout call. r=mikedeboer, a=test-only - 153da3594a3e
Seth Fowler	Bug 1130707 - Make decode-on-draw-only image notifications more robust. r=tn, a=lmandel - b5f695706683
Michael Comella	Bug 1133770 - Display the selected tab in the tab strip on device rotation. r=mhaigh, a=lizzard - eb261fd50770
Michael Comella	Bug 1133770 - Use Refreshable interface instead of TabStrip in BrowserApp to allow builds on API 9. r=mhaigh, a=lizzard - e7319d343f20
Michael Comella	Bug 1134192 - Add ActivityUtils.isFullScreen. r=mfinkle, a=lizzard - f18e2aecea6d
Michael Comella	Bug 1134192 - Prevent the options menu from opening in fullscreen mode. r=mfinkle, a=lizzard - b23a690fa325
Mike Conley	Bug 1136855 - Send a message from the content script when printing has finished so the parent can save print settings. r=Mossop, a=sledru. - 4a73e4bc3ee5
Mark Banner	Bug 1137469 - If an uncaught exception occurs whilst processing an action, the dispatcher can fail, rendering parts of Loop inactive. r=mikedeboer,a=sledru - c0698821db6c
Joel Maher	Bug 1134824 - Update talos on trunk to gain fixes for e10s, mainthreadio, etc. r=wlach, a=test-only - 193fb1410c0d
Ben Turner	Bug 1121519 - Fix racy test. r=jgraham, a=test-only - 6454e62689f1
Bob Owen	Bug 1129369 - Part 1: Turn on DEP_NO_ATL_THUNK process-level mitigation for the GMP sandbox. r=tabraldes, a=lmandel - 56d34ca3b983
Bob Owen	Bug 1129369 - Part 2: Turn on BOTTOM_UP_ASLR process-level mitigation for the GMP sandbox. r=tabraldes, a=lmandel - fa0645acfc44
Bob Owen	Bug 1129369 - Part 3: Turn on MITIGATION_STRICT_HANDLE_CHECKS process-level mitigation for the GMP sandbox. r=tabraldes, a=lmandel - 8fd533be98aa
Timothy Nikkel	Bug 1132427 - Make sure that the first frame refresh area for an animated image gets updated based on the refresh area of all subsequent frames, not just the second. r=jrmuizel, a=lmandel - 0d4ecc5c742c
Timothy Nikkel	Bug 1132427 - Add test. a=lmandel - 97f402db19a4
Henry Hu	Bug 1132358 - Save and restore mIterGenCnt. Keep it consistent with mIter. r=mcmanus, a=lmandel - 386a573b4fc0
Sotaro Ikeda	Bug 1133426 - Care about new CompositorChild and CompositorParent re-creation. r=jrmuizel, a=lmandel - 4564e0e22a37
Gijs Kruitbosch	Bug 1107695 - Make one-off buttons accessible. r=florian, f=MarcoZ, a=lsblakk - 4fc445cb5642
Jean-Yves Avenard	Bug 1136576 - Properly align source buffer starts with current decoder. r=cajbir, a=lsblakk - 5a0ed5076b4f
Richard Newman	Bug 1137259 - Don't send Campaign:Set for distribution referrer intents. r=mfinkle, a=lsblakk - 432de8008403
Michael Comella	Bug 1135796 - Update ActivityUtils to use proper API levels. r=rnewman, a=lsblakk - 7ede0abc5a1c
Matt Woodrow	Bug 1132757 - Don't crash if we call WMFVideoMFTManager after we've initiated shutdown. r=cpearce, a=lsblakk - 2aa1ca037446
Tim Nguyen	Bug 1105704 - Fix UI issues with SSL error reporting. r=dao, a=lmandel - 4b6bec5f7ff7
Jean-Yves Avenard	Bug 1131433 - Show codec/container type in MSE logs. r=cajbir, a=lmandel - 963bd7dabda0
Jean-Yves Avenard	Bug 1134064 - Part 1: Don't hold on reader when we stop needing it. r=mattwoodrow, a=lsblakk - 2e539009f86e
Jean-Yves Avenard	Bug 1134064 - Part 2: Drop current reader when seeking outside range. r=mattwoodrow, a=lsblakk - 5f400332977d
Jean-Yves Avenard	Bug 1134064 - Part 4: Fix racing condition should data get evicted. r=mattwoodrow, a=lsblakk - c92f6beaa505
Jean-Yves Avenard	Bug 1134064 - Part 5: Evict from TrackBuffer's current decoder. r=cajbir, a=lsblakk - d461222b1a07
Jean-Yves Avenard	Bug 1096089 - Part 3: Add trimming support from beginning of source buffer. r=cajbir, a=lsblakk - 4c92b1dcb67f
Jean-Yves Avenard	Bug 1096089 - Make end argument an unrestricted double as per spec. r=cajbir, r=bholley, a=lsblakk - dd1511c04aad
Patrick McManus	Bug 1133177 - Network logging and cleanups (part 1). r=hurley, a=lmandel - f321e120f8e1
Patrick McManus	Bug 1133177 - https tunnel of h1 without pconn inside h2 session stall. r=hurley, a=lmandel - 1c270f40087a
Michael Comella	Bug 1132720 - Hide the dialog on animation end to prevent flicker on Activity.finish(). r=margaret, a=lmandel - 9fb3cc1f7ff6
Alessio Placitelli	Bug 1128500 - Put |HiddenFrame| from CustomizationTabPreloader.jsm in HiddenFrame.jsm. r=ttaubert, a=lmandel - 3d6eaf96ca69
Alessio Placitelli	Bug 1128500 - Make CustomizationTabPreloader.jsm use HiddenFrame.jsm. r=ttaubert, a=lmandel - cae785163094
Robert Strong	Bug 1044443 - Release off main thread crash in nsXPCWrappedJS::Release() via nsUpdateProcessor::~nsUpdateProcessor(). r=bbondy, a=lmandel - 8ac02f8d22e5
Matthew Noorenberghe	Bug 1126756 - Listen for |message-manager-disconnect| instead of |TabClose| to teardown UITour. r=Unfocused, a=lmandel - 9ff796be0d67
Alessio Placitelli	Bug 1128564 - Whitelist Self Repair (self-repair.mozilla.org) origin for UITour. r=MattN, a=lmandel - de7488acda8a
Alessio Placitelli	Bug 1111022 - Load self-support page in a hidden tab. r=ttaubert, a=lmandel - 41fd4a4df8ac
Alessio Placitelli	Bug 1111022 - Tests for the SelfSupport backend. r=gfritzsche, a=lmandel - e7a0f9cd3482
Alessio Placitelli	Bug 1111022 - Changes UITour.jsm to work with windowless browsers. r=MattN, a=lmandel - f8c1586998ef
Alessio Placitelli	Bug 1111022 - Add a test to make sure UITour works with no tabs/windowless browsers. r=MattN, a=lmandel - 9b32fd0a9844
Alessio Placitelli	Bug 1111022 - Fix the accessibility test_docload.html test failing with hidden windows. a=lmandel - 87d76aead804
Jordan Santell	Bug 1135752 - Add tracking params in the dev edition doorhanger promo URL. r=jwalker, a=lsblakk - abb350df1154
Michael Comella	Bug 1056002 - Backout changeset c56275d516ec. r=mfinkle, a=lsblakk - e8a752491ccc
Jean-Yves Avenard	Bug 1133633 - Part 1: Add logging reporting if we are using HW accelerated decode. r=rillian, a=lmandel - 85e3bc280be6
Stephen Pohl	Bug 1130682 - Add homepage URL for Adobe EME. r=dolske, a=lmandel - 1ba1e8df6e2f
Stephen Pohl	Bug 1129721 - Add license URL for Adobe EME. r=dolske, a=lmandel - 7bbbe05d19d4
Ryan VanderMeulen	Bug 1131433 - Re-add accidentally-removed GetMediaSourceLog() declaration. a=bustage - 25ae310c7cfd
Ryan VanderMeulen	Bug 1131433 - Re-add another accidentally-removed GetMediaSourceLog() declaration. a=bustage - e32cd39a1917
Wes Kocher	Bug 1131433 - Further fixes to SourceBufferDecoder.cpp a=bustage - 20ea789e69df
J. Ryan Stinnett	Bug 1128027 - Clean up protocol.js pools after connection close. r=bgrins a=lsblakk - 021aac3d7804
J. Ryan Stinnett	Bug 1128027 - Repair sourceeditor test after protocol.js cleanup change. r=bgrins a=lsblakk - 4c02cca13dbe
J. Ryan Stinnett	Bug 1128027 - Inspector destroy error was holding document alive. r=bgrins a=lsblakk - 569e2110f0ff
J. Ryan Stinnett	Bug 1128027 - Record protocol.js request headers for debugging. r=bgrins a=lsblakk - b82653e56ec9
J. Ryan Stinnett	Bug 1128027 - Rework Console tests that click links. r=bgrins a=lsblakk - 012e92feffe6
Richard Newman	# - cea5c7cdfa13
J. Ryan Stinnett	Backout 012e92feffe6 (Bug 1128027). r=bgrins a=lsblakk - eed281422403
J. Ryan Stinnett	Backout b82653e56ec9 (Bug 1128027). r=bgrins a=lsblakk - 85ca6f646762
J. Ryan Stinnett	Backout 569e2110f0ff (Bug 1128027). r=bgrins a=lsblakk - 21120474140d
J. Ryan Stinnett	Backout 4c02cca13dbe (Bug 1128027). r=bgrins a=lsblakk - 6f6ec57ce6b9
J. Ryan Stinnett	Backout 021aac3d7804 (Bug 1128027). r=bgrins a=lsblakk - e49cd895e078
Matt Woodrow	Bug 1136984 - Always call DrainComplete in response to Drain, even if it wasn't called on the active decoder. r=cpearce a=lmandel - 5a7e83327249
Matt Woodrow	Bug 1136984 - Use correct units for comparing timestamps in TrackBuffer::RangeRemoval. r=jya a=lmandel - 09b2c7fed10f
Andrea Marchesini	Bug 1125940 - File should not unlink FileImpl. r=khuey, a=lmandel - c16968de534c
Matthew Noorenberghe	Bug 1124888 - Record the effect of the saved formSubmitURL on autofilling login forms. r=dolske, a=lmandel - 191548235ce3
Hannes Verschore	Bug 1130679 - Disable optimization due to fuzzer failures. r=nbp, a=lmandel - ae07b3862c27
Andy Pusch	Bug 1124884 - Clear search history in Firefox Search after using 'Clear Private Data' in Firefox. r=margaret, a=lmandel - 12b0612ba016
Timothy Nikkel	Bug 1134293 - Report the bounds of a tree body as needing component alpha and support disable component alpha in the text it might draw if asked. r=roc, a=lmandel - a12ea2668d1c
Timothy Nikkel	Bug 1102896 - Save and restore the subpixel AA settings of the draw target when drawing an inactive layer manager so they don't get clobbered. r=mattwoodrow, a=lmandel - bc3e9b98d90f
Steve Fink	Bug 1133909 - Fix hazards revealed by adding in new GCPointers. r=terrence, a=lmandel - 3a352baeeca4
Mike de Boer	Bug 1137141 - Fix for making the Loop contacts tab show and/ or hide when the user logs in or out of FxA. r=Standard8, a=sledru - d5def3938b6e
Mike de Boer	Bug 1137141 - Extend Loop toolbarbutton tests to check for correct panel states upon opening. r=Standard8, a=sledru - 824656d7ad0d
Seth Fowler	Bug 1128769 (Part 1) - Propagate the imgIContainer::Draw result through the nsLayoutUtils::PaintBackground* functions. r=tn a=lmandel - 759ad062242f
Seth Fowler	Bug 1128769 (Part 2) - Check if we invalidated for a sync decode and never painted before invalidating for sync decoding again. r=tn a=lmandel - 69da299d5e49
Seth Fowler	Bug 1128769 (Part 3) - Record the last draw result when drawing CSS backgrounds and use it to decide whether to sync decode. r=tn a=lmandel - d80f4050e348
Seth Fowler	Bug 1128769 (Part 4) - Record the last draw result when drawing CSS tables and use it to decide whether to sync decode. r=tn a=lmandel - 782bd163aeed
Seth Fowler	Bug 1128769 (Part 5) - Record the last draw result for various less common frame types and use it to decide whether to sync decode. r=tn a=lmandel - 498290d95f1c
Seth Fowler	Bug 1128769 (Part 6) - Remove imgIContainer::IsDecoded and all remaining callers. r=tn a=lmandel ba=lmandel - 7b3c7ba30dfe
Ben Hearsum	Bug 1138924: fix win64's xulrunner mozconfig. r=rail, a=bustage - e8ec4e64fe84

http://release.mozilla.org/statistics/37/2015/03/04/fx-37-b1-to-b2.html

I really like these badges, part of work carried out by Hive Toronto and funded by the Office of the Privacy Commissioner of Canada.

• Data Trail Timeline
• IP Address Tracer
• Privacy Coach

I’m an advisor to the project, but most of the hard work is being done by Karen Smith. The badges are informed (of course!) by the Privacy competency of Mozilla’s Web Literacy Map.

Each of the badges links to activities that help learners get to grips with the various aspects of privacy. As these have been created using Webmaker’s Thimble tool it’s straightforward to remix them for your own use!

http://literaci.es/privacy-badges

Could we reach a state where most hardware and software is compromised by third parties at its creation, because the hardware and software you need to develop more hardware and software has already been compromised by those third parties? I think we could. Apart from all the challenges we already face, the "Internet Of Things" may make it extremely difficult to isolate potentially vulnerable systems from the Internet. Imagine an environment saturated with poorly secured devices capable of monitoring RF side channels, for a start.

So far I've seen little evidence of systematic attempts to compromise software at source. Perhaps the organizations with the capability do it undetectably, but you would expect some less-competent actors to try it and be exposed. The best explanation I've heard is that people aren't trying to do this because currently it's cheaper to find vulnerabilities in other ways. Hopefully that won't always be true.

If we get into that everything-compromised state, would we know? Would there be a single winner, able to use its unlimited reach to undermine and outflank its competitors? Or would there be multiple winners, with every system containing an entire ecosystem of backdoors and subversion? How could we get out of that state? Would the bugginess of computer systems turn out to be a blessing or a curse?

http://robert.ocallahan.org/2015/03/what-is-endgame-of-weak-computer.html

I’ve previously blogged indirectly about attached input queues, but today I want to address the issue directly. What once was a nuisance in the realm of plugin hangs has grown into a more serious problem in the land of OMTC and e10s.

As a brief recap for those who are not very familiar with this problem: imagine two windows, each on their own separate threads, forming a parent-child relationship with each other. When this situation arises, Windows implicitly attaches together and synchronizes their input queues, putting each thread at the mercy of the other attached threads’ ability to pump messages. If one thread does something bad in its message pump, any other threads that are attached to it are likely to be affected as well.

One of the biggest annoyances when it comes to knowledge about which threads are affected, is that we are essentially flying blind. There is no way to query Windows for information about attached input queues. This is unfortunate, as it would be really nice to obtain some specific knowledge to allow us to analyze the state of Firefox threads’ input queues so that we can mitigate the problem.

I had previously been working on a personal side project to make this possible, but in light of recent developments (and a tweet from bsmedberg), I decided to bring this investigation under the umbrella of my full-time job. I’m pleased to announce that I’ve finished the first cut of a utility that I call the Input Queue Visualizer, or iqvis.

iqvis consists of two components, one of which is a kernel-mode driver. This driver exposes input queue attachment data to user mode. The iqvis user-mode executable is the client that queries the driver and outputs the results. In the next section I’m going to discuss the inner workings of iqvis. Following that, I’ll discuss the results of running iqvis on an instance of Firefox.

Input Queue Visualizer Internals

First of all, let’s start off with this caveat: Nearly everything that this driver does involves undocumented APIs and data structures. Because of this, iqvis does some things that you should never do in production software.

One of the big consequences of using undocumented information is that iqvis requires pointers to very specific locations in kernel memory to accomplish things. These pointers will change every time that Windows is updated. To mitigate this, I kind of cheated: it turns out that debugging symbols exist for all of the locations that iqvis needs to access! I wrote the iqvis client to invoke the dbghelp engine to extract the pointers that I need from Windows symbols and send those values as the input to the DeviceIoControl call that triggers the data collection. Passing pointers from user mode to be accessed in kernel mode is a very dangerous thing to do (and again, I would never do it in production software), but it is damn convenient for iqvis!

Another issue is that these undocumented details change between Windows versions. The initial version of iqvis works on 64-bit Windows 8.1, but different code is required for other major releases, such as Windows 7. The iqvis driver theoretically will work on Windows 7 but I need to make a few bug fixes for that case.

So, getting those details out of the way, we can address the crux of the problem: we need to query input queue attachment information from win32k.sys, which is the driver that implements USER and GDI system calls on Windows NT systems.

In particular, the window manager maintains a linked list that describes thread attachment info as a triple that points to the “from” thread, the “to” thread, and a count. The count is necessary because the same two threads may be attached to each other multiple times. The iqvis driver walks this linked list in a thread-safe way to obtain the attachment data, and then copies it to the output buffer for the DeviceIoControl request.

Since iqvis involves a device driver, and since I have not digitally signed that device driver, one can’t just run iqvis and call it a day. This program won’t work unless the computer was either booted with kernel debugging enabled, or it was booted with driver signing temporarily disabled.

Running iqvis against Firefox

Today I ran iqvis using today’s Nightly 39 as well as the lastest release of Flash. I also tried it with Flash Protected Mode both disabled and enabled. (Note that these examples used an older version of iqvis that outputs thread IDs in hexadecimal. The current version uses decimal for its output.)

Protected Mode Disabled

FromTID ToTID Count
ac8 df4 1

Looking up the thread IDs:

• df4 is the Firefox main thread;
• ac8 is the plugin-container main thread.

I think that the output from this case is pretty much what I was expecting to see. The protected mode case, however, is more interesting.

Protected Mode Enabled

FromTID ToTID Count
f8c dbc 1
794 f8c 3

Looking up the thread IDs:

• dbc is the Firefox main thread;
• f8c is the plugin-container main thread;
• 794 is the Flash sandbox main thread.

Notice how Flash is attached to plugin-container, which is then attached to Firefox. Notice that transitively the Flash sandbox is effectively attached to Firefox, confirming previous hypotheses that I’ve discussed with colleagues in the past.

Also notice how the Flash sandbox attachment to plugin-container has a count of 3!

In Conclusion

In my opinion, my Input Queue Visualizer has already yielded some very interesting data. Hopefully this will help us to troubleshoot our issues in the future. Oh, and the code is up on GitHub! It’s poorly documented at the moment, but just remember to only try running it on 64-bit Windows 8.1 for the time being!

http://dblohm7.ca/blog/2015/03/03/attached-input-queues-on-firefox-for-windows/

Remember those heady days back when people spelled out W-W-W and H-T-T-P in all their links, and we had to contend with "export only" versions of cryptography because if you let those 1024-bit crypto keys fall into the wrong hands, the terrorists would win? My favourite remnant of those days is this incredibly snide Apple ad where tanks surround the new Power Mac G4, the first personal computer classified by the Pentagon as a munition ("As for Pentium PCs, well ... they're harmless").

Unfortunately, a less amusing remnant of that bygone era has also surfaced in the form of the FREAK attack (see also POODLE, CRIME and BEAST). The idea with export-grade ciphers is that, at the time, those naughty foreign governments would have to make do with encrypting their network traffic using short keylengths that the heroic, not-at-all-dystopian denizens of the NSA could trivially break (which you can translate to mean they're basically broken by design). As a result, virtually no browser today will advertise its support for export-grade ciphers because we're not supposed to be using them anymore after the Feds realized the obvious policy flaw in this approach.

But that doesn't mean they can't use them. And to prove it, the researchers behind FREAK came up with a fuzzing tool that gets in the middle of the secure connection negotiation (which must happen in the clear, in order to negotiate the secure link) and forces the connection to downgrade. Ordinarily you'd realize that something was in the middle because completing the handshaking to get the shared secret between server and client requires a private key, which the malicious intruder doesn't have. But now it has another option: the defective client will accept the downgraded connection with only a 512-bit export-compliant RSA key from the server, trivial to break down with sufficient hardware in this day and age, which the intruder in the middle can also see. The intruder can factor the RSA modulus to recover the decryption key, uses that to decrypt the pre-master secret the client sends back, and, now in possession of the shared secret, can snoop on the connection all it wants (or decrypt stored data it already has). Worse, if the intruder has encrypted data from before and the server never regenerated the RSA key, they can decrypt the previous data as well!

There are two faults here: the server for allowing such a request to downgrade the connection, and the client for accepting deficient keys. One would think that most current servers would not allow this to occur, stopping the attack in practice, and one would be wrong. On the FREAK Attack site (which doubles as a test page), it looks like over a quarter of sites across the IPv4 address space are vulnerable ... including nsa.gov!

What about the client side? Well, that's even worse: currently every Android phone (except if you use Firefox for Android, which I recently switched to because I got tired of Android Chrome crashing all the damn time), every iOS device, and every Mac running Safari or Chrome is vulnerable, along with anything else that ships with a vulnerable version of OpenSSL. Guess what's not? Firefox. Guess what's also not? TenFourFox. NSS does not advertise nor accept export-only keys or ciphers. TenFourFox is not vulnerable to FREAK, nor any current version of Firefox on any platform. Test it yourself.

Classilla is vulnerable in its current configuration. If you go into the settings for security, however, you can disable export-only support and I suggest you do that immediately if you're using Classilla on secure sites. I already intended to disable this for 9.3.4 and now it is guaranteed I will do so.

What about Safari or OmniWeb on Power Macs? I would be interested to hear from 10.5 users, but the test site doesn't work correctly in either browser on 10.4. Unfortunately, because all Macs (including 10.6 through 10.10) are known to be vulnerable, I must assume that both Tiger and Leopard are also vulnerable because they ship a known-defective version of OpenSSL. Installing Leopard WebKit fixes many issues and security problems but does not fix this problem, because it deals with site display and not secure connections: the browser still relies on NSURL and other components which use the compromised SSL library. I would strongly recommend against using a non-Mozilla browser on 10.7 and earlier for secure sites in the future for this reason. If you use Android as I do, it's a great time to move to Firefox for Android. Choice isn't just a "nice thing to have" sometimes.

http://tenfourfox.blogspot.com/2015/03/superfreak-superfreak-temptations-sing.html

Big thanks again to vaibhav1994, adusca and valeriat for their many contributions in this release.

Release notes

Release notes: https://github.com/armenzg/mozilla_ci_tools/releases/tag/0.2.5
PyPi package: https://pypi.python.org/pypi/mozci/0.2.5
Changes: https://github.com/armenzg/mozilla_ci_tools/compare/0.2.4...0.2.5

---

This work by Zambrano Gasparnian, Armen is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

http://feedproxy.google.com/~r/armenzg_mozilla/~3/qoh47nrReQM/mozci-025-released-major-bug-fixes-many.html

This year at Mobile World Congress, I participated in two formal discussions. I spoke alongside a panel of experts thinking about mobile and data which was hosted by the GSMA. I was also invited to a Fireside Chat hosted by … Continue reading

https://blog.mozilla.org/privacy/2015/03/03/trust-in-an-increasingly-connected-world/

…or trying to adapt to the inevitability of change.

---

Change is a reality of life common to all things; we all must adapt to change or risk obsolescence. I try to look at change as a defining moment, an opportunity to reflect, to learn, and to make an impact. It is in these moments that I reflect on the road I’ve traveled and attempt to gain clarity of the road ahead. This is where I find myself today.

How Did I Get Here?

In my younger days I wasted years in college jumping from program to program before eventually dropping out. I obviously did not know what I wanted to do with my life and I wasn’t going to spend thousands of dollars while I figured it out. This led to a frank and difficult discussion with my parents about my future which resulted in me enlisting in the Canadian military. As it happens, this provided me the space I needed to think about what I wanted to do going forward, who I wanted to be.

I served for three years before moving back to Ontario to pursue a degree in software development at the college I left previously. I had chosen a path toward working in the software industry. I had come to terms with a reality that I would likely end up working on some proprietary code that I didn’t entirely care for, but that would pay the bills and I would be happier than I was as a soldier.

After a couple of years following this path I met David Humphrey, a man who would change my life by introducing me to the world of open source software development. On a whim, I attended his crash-course, sacrificing my mid-semester week off. It was here that discovered a passion for contributing to an open source project.

Up until this point I was pretty ignorant about open source. I had been using Linux for a couple years but I didn’t identify it as “open source”; it was merely a free as in beer alternative to Windows. At this point I hadn’t even heard of Mozilla Firefox. It was David who opened my eyes to this world; a world of continuous learning and collaboration, contributing to a freer and more open web. I quickly realized that choosing this path was about more than a job opportunity, more than a career; I was committing myself to world view and my part to play in shaping it.

Over the last eight years I have continued to follow this path, from volunteering nights at school, through internships, a contract position, and finally full-time employment in 2010.

Change is a way of life at Mozilla

Since I began my days at Mozilla I have always been part of the same team. Over the years I have seen my team change dramatically but it has always felt like home.

We started as a small team of specialists working as a cohesive unit on a single product. Over time Mozilla’s product offering grew and so did the team, eventually leading to multiple sub-teams being formed. As time moved on and demands grew, we were segmented into specialized teams embedded on different products. We were becoming more siloed but it still felt like we were all part of the QA machine.

This carried on for a couple of years but I began to feel my connection to people I no longer worked with weaken. As this feeling of disconnectedness grew, my passion for what I was working on decreased. Eventually I felt like I was just going through the motions. I was demoralized and drifting.

This all changed for me again last year when Clint Talbert, our newly appointed Director and a mentor of mine since the beginning, developed a vision for tearing down those silos. It appeared as though we were going to get back to what made us great: a connected group of specialists. I felt nostalgic for a brief moment. Unfortunately this would not come to pass.

Moving into 2015 our team began to change again. After “losing” the B2G QA folks to the B2G team in 2014, we “lost” the Web and Services QA folks to the Cloud Services team. Sure the people were still here but it felt like my connection to those people was severed. It then became a waiting game, an inevitability that this trend would continue, as it did this week.

The Road Ahead

Recently I’ve had to come to terms with the reality of some departures from Mozilla.  People I’ve held dear for, and sought mentorship from, for many years have decided to move on as they open new chapters in their lives. I have seen many people come and go over the years but those more recently have been difficult to swallow. I know they are moving on to do great things and I’m extremely happy for them, but I’ll also miss them intensely.

Over the years I’ve gone from reviewing add-ons to testing features to driving releases to leading the quality program for the launch of Firefox Hello. I’ve grown a lot over the years and the close relationships I’ve held with my peers are the reason for my success.

Starting this week I am no longer a part of a centralized QA team, I am now the sole QA member of the DOM engineering team. While this is likely one of the more disruptive and challenging changes I’ve ever experienced, it’s also exciting to me.

Overcoming the Challenge

As I reflect on this entire experience I become more aware of my growth and the opportunity that has been presented. It is an opportunity to learn, to develop new bonds, to impact Mozilla’s mission in new and exciting ways. I will remain passionate and engaged as long as this opportunity exists. However, this change does not come without risk.

The greatest risk to Mozilla is if we are unable to maintain our comradery, to share our experiences, to openly discuss our challenges, to engage participation, and to visualize the broader quality picture. We need to strengthen our bonds, even as we go our separate ways. The QA team meeting will become ever more important as we become more decentralized and I hope that it continues.

Looking Back, Looking Forward

I’ve experienced a lot of change in my life and it never gets any less scary. I can’t help but fear reaching another “drifting point”. However, I’ve also learned that change is inevitable and that I reach my greatest potential by adapting to it, not fighting it.

I’m entering a new chapter in my life as a Mozillian and I’m excited for the road ahead.

https://ashughes.com/?p=202

Web developers across the Mozilla community get together (in person and virtually) to share what cool stuff we've been working on.

https://air.mozilla.org/webdev-extravaganza-march-2015/