Mozilla Firefox

The goal of free open source development is empowerment: everyone can not only use code for free but also contribute to and influence it. This model allows people to teach and learn from each other, improves businesses by sharing work on similar ... [More] ideas, and has given some people the chance to break out and become well-known leaders. Unfortunately, in reality open source development is rife with problems and is ultimately unsustainable. Somebody has to pay the cost of maintaining a project. Actually writing code is only a small part of running a project, so it's never as simple as mutually benefitting from sharing code. Somebody, or a group of people, needs to step up and spend lots of hours every week to make sure code actually gets pushed through the pipeline and issues are triaged. Even if that problem was solved, human beings are complex and full of conflict when we try to work together, and open source has little structure for dealing with these problems like a normal workplace would. For businesses, an active open source project may not make sense. I've seen projects go open source just for the "warm fuzzies" that unfortunately embody that model, only to drown in all the work that goes into powering open source. When most of the time is spent trying to help contributors, call it for what it is: charity. Which is great! But it may be more efficient to focus on the project internally. I love open source! I think it's a net win for society, even if there are big problems we still need to solve. I wouldn't be close to where I am today without it, and it felt amazing to release prettier and watch its success (even if I'm dealing with the above problems now). I think we need to change how we talk about it and change our expectations. Because right now open source is full of guilt. Tell people that it's OK to neglect a project for a while. It's OK to let PRs pile up for a few weeks, and then close some that you don't have time to look into. It's OK to tell contributors that nobody has time to help them. The best solution is to find other people to help, but if that doesn't happen, all of the above are totally OK to do. Now that I got that off my chest, I wanted to explain why I am frequently absent from my open source projects. I haven't even looked at prettier's issues for days, and I've let other projects die because of lack of time. The reason is simple: family. Sarah and I have been married for 6 years as of today (with 2 kids, Evy and Georgia). I write about a lot about technology on my blog but I don't write about the thing that I spend more time on and is way more important than tech: my family. I thought our 6-year anniversary is a good time to acknowledge that! For a while I put myself in a lucky position of not maintaining any open source projects. But recently I released prettier and it's been interesting to try to balance work on it with my family (and not to mention change of jobs). While it's an important project to me, most of the time I intentionally ignore it to spend time with my family at nights and weekends. (Thanks to Christopher for spending so much time on prettier and making my time away less guilty). I'll be honest, it's a struggle sometimes. Being married and raising kids is a lot of work by itself, and balancing free time is complicated. There's no question in my mind though that, by comparison, tech has little meaning in the greater context of life. Happy 6th anniversary babe! [Less]

Last year, we started thinking about how to improve themes in Firefox. We asked theme designers and developers for their thoughts too, and received over 250 responses. After sorting through the responses and a few months of deliberation and ... [More] experimentation, we have a plan, and would like to share what we’re going to do and why. Let’s start with the “why.” Currently, Firefox supports two types of themes. Complete Themes and Lightweight Themes (aka LWTs, formerly “Personas”, and now just “Themes” on addons.mozilla.org). Lightweight Themes are very popular. There are currently over 400,000 such themes on addons.mozilla.org (AMO). They’re extremely simple to create; anyone can create one by just uploading an image to AMO. I made my first LWT eight years ago, and it still works fine today without any changes. However, LWTs are very limited in what they can do. They can lightly modify the default Firefox appearance with a background image and set a couple of colors, but nothing else. The survey confirmed that there’s a lot of interest in giving LWTs more creative control over how the browser looks. More backgrounds, colors, and icons on more UI elements. Complete Themes, the second type of theme, completely replace the default Firefox appearance. Authors must provide all the needed CSS, images, and icons for the entire browser (from scratch!), which makes Complete Themes flexible but difficult to create and maintain. Authors have to understand Firefox’s complex and ever-changing UI internals, and there’s little documentation beyond Firefox’s source code. This leads to a serious compatibility burden, as authors need to invest time to keep their theme working with each Firefox release – only 60 of the 500 Complete Themes on AMO are compatible with current Firefox releases. Further, we’re not able to directly fix these issues without limiting our ability to improve Firefox. And since only 0.089% of Firefox users use a Complete Theme (less than 4% of the usage of LWTs), we’re going to focus on improving theming in other ways. Firefox extensions (as opposed to themes) can also run into these problems, as there is no JavaScript API to control the appearance of the browser. Legacy add-ons wanting to do this had to directly alter the UI’s internal DOM and CSS. As with Complete Themes, this can give an extension great power, but it comes with a serious price in complexity and compatibility. WebExtensions are unable to access any UI internals, and so are particularly in need of a solution. What we’re doing We want to fix Firefox so theming is better for everyone. The next generation of Firefox themes will blend LWTs’ ease of authoring with the additional capabilities we see most often used in Complete Themes. At its core is a JSON manifest, mapping defined property names to the underlying UI elements. Theme developers will be able to control a variety of styles on these properties (such as colors, icons, and background images), and Firefox will ensure the manifests are supported in a stable and well-documented way across future releases and UI updates. These themes will be layered on top of the default Firefox appearance, so you can create a trivial theme that just changes one property, or a complex theme that changes all of them. The goal is to provide capabilities that enable people to make themes they love and use. We think it’s possible to make themes in Firefox powerful without the previous pitfalls. To get started, we’ll initially support the same properties as Chrome, to make the thousands of Chrome themes more easily available in Firefox. Then we’ll expand the set of properties in our API, so that Firefox themes will be able to do more. We expect to continue adding to this theming framework over time, with your feedback helping to guide what’s needed. We also recognize that a property manifest won’t have all the capabilities of direct CSS manipulation, especially during the time we’re expanding coverage to cover the most common use cases. So, for theme authors who need additional capabilities (and are willing to bear the burden of supporting them), we’ll provide an “experimental” section of the manifest to continue to allow direct CSS manipulation of the Firefox UI. This is similar in spirit to WebExtension Experiments, and usage will also be restricted to pre-release versions of Firefox. A WebExtensions API Finally, we’re adding a WebExtensions API for theming. It will have the same capabilities as the JSON manifest’s properties, except via a JavaScript API, so add-ons can make dynamic changes at runtime. This will enable add-ons to do things like adjusting colors based on the time of day (e.g. Flux), or matching your theme with the weather outside. Questions and Feedback For more information on our current work, see our Engineering Plan. We’ve just started some of the foundational work, but would welcome your input as we move towards building the first version that will be usable by theme authors. Our goal is to have this in place before Firefox 57 ships in November, which will end support for Complete Themes. We currently expect early testing to begin in Nightly over the next few months. Please address your questions and feedback to the Dev-Addons list at [email protected]. We’re also keeping a list of Frequently Asked Questions, check it out to see if it answers your question. [Less]

Summary I work on a lot of different things. Some are applications, are are libraries, some I started, some other people started, etc. I have way more stuff to do than I could possibly get done, so I try to spend my time on things "that matter". For ... [More] Open Source software that doesn't have an established community, this is difficult. This post is a wandering stream of consciousness covering my journey figuring out who uses Bleach. Read more… (4 mins to read) [Less]

webcompat life How should the HTTP conditional requests should be rendered in devtools. Interesting visualization issue. ongoing discussions about appearance and select I spent quite a bit of time going through the source code of WebKit: ... [More] ViewportConfiguration.cpp and more specifically SimpleViewportController.cpp. I'm trying to assess if c++ fuzzyCompare(minimumScale, m_minimumScaleToFit, 0.0001) is the reason behind the magical value used by developers for coping with iOS change in between iOS 8 and iOS 9. It's awsome in some ways, because it is not really documented and if it is the reason. Web developers are using a value from the C++ code not intended for it to overcome a change in a platform, which in itself creates Web compatibility isssues on Firefox. I will write a bit more about it once I really understood what is happening. webcompat issues webc-4728 landofknown on Firefox iOS receives the desktop version. webc-4744. No music. The second song never comes. webc-4746. Another issue with viewport and large content. Chrome resizes the content, but Firefox respects the initial value. webc-4782. Interaction between column layout and float. webc-4804. London Transport with issues. webcompat.com dev Discussions about accepting HTTPS issues on webcompat.com Otsukare! [Less]

On February 23rd, we're hosting an Internet Trivia Night (HTTPS: Humans + Tech Trivia Party(s)) at WeWork Civic Center in San Francisco. We also want...

On February 23rd, we're hosting an Internet Trivia Night (HTTPS: Humans + Tech Trivia Party(s)) at WeWork Civic Center in San Francisco. We also want...

Our deprecation plan for the SHA-1 algorithm in the public Web, first announced in 2015, is drawing to a close. Today a team of researchers from CWI Amsterdam and Google revealed the first practical collision for SHA-1, affirming the insecurity of ... [More] the algorithm and reinforcing our judgment that it must be retired from security use on the Web. As announced last fall, we’ve been disabling SHA-1 for increasing numbers of Firefox users since the release of Firefox 51 using a gradual phase-in technique. Tomorrow, this deprecation policy will reach all Firefox users. It is enabled by default in Firefox 52. Phasing out SHA-1 in Firefox will affect people accessing websites that have not yet migrated to SHA-2 certificates, well under 0.1% of Web traffic. In parallel to phasing out insecure cryptography from Firefox, we will continue our outreach efforts to help website operators use modern and secure HTTPS. Users should always make sure to update to the latest version of Firefox for the most-recent security updates and features by going to https://www.mozilla.org/firefox. Questions about Mozilla policies related to SHA-1 based certificates should be directed to the mozilla.dev.security.policy forum. [Less]

This article is a continuing series about using and working with WebPush and Mozilla’s WebPush service. This article is not meant to be a general guide, but instead offer suggestions and insight into best using the service. Some knowledge of ... [More] Javascript, Python, or other technologies is presumed. Sending out push notifications to Customers is a great way to ensure that they’re up-to-date with information that is of importance to them. What’s also important is that your growing business use this service efficiently so you don’t wind up wasting money creating and sending out messages that no one will ever read. In addition, not honoring response codes could lead to your server being blocked or severely limited in how many Subscription Updates it may be able to send. Mozilla’s WebPush server will let you know if a Customer has unsubscribed, but it’s important that you notice and act on these. I have created a simple demonstration program that can help you understand what you will need to consider when creating a Push Subscription service. Definitions First off, let’s refresh a few terms we’ll use in this article: App – The javascript web application that receives the decoded Push Message. Customer – The end recipient of the Push Message. Push Message – The content of the Subscription Update to be provided to the App by the User Agent and potentially viewed by the Customer. Push Server – The service located at the endpoint URL which handles delivery of the Subscription Update to the User Agent. Subscription – A Customer request to be updated. A Subscription contains an endpoint URL, and a set of keys that are to be used to encode the Push Message. Subscription Provider – The subscription provider sends out Push Messages to User Agents to be read by Customers. Subscription Update – The message sent by the Subscription Provider to the Push Server. User Agent – The Customer’s browser, specifically, code internal to the browser which processes and routes Push Messages to your App. Sending Subscription Updates Sending a Push Message is a fairly simple operation, and thanks to modern libraries, easily done. It’s important to pay attention to the returned result. When a Subscription Provider sends a Subscription Update, the Push Service returns a response code. In most cases, the response code will be either 201 (Message Created) or 202 (Message Accepted). There’s subtle differences between those, but those differences are not important right now. What is important is to know that the Push Server will return an HTTP error code along with a body that has extra information about what may have happened. A possible 404 return message body might look like: { 'errno': 102, 'message': 'Request did not validate invalid token', 'code': 404, 'more_info': 'http://autopush.readthedocs.io/en/latest/http.html#error-codes', 'error': 'Not Found' } In this case, there was a problem with the URL. More than likely it was corrupted at some point. In any case, the URL is now invalid and should not be tried again. The Customer’s record can be safely removed from storage. This is also true for 410 return codes. These are subscribers who no longer wish to receive your updates. A Customer may unsubscribe for any number of reasons, and you should respect that choice. You can always ask the Customer to resubscribe later. The Demo App As an example, I’ve created a very simple demonstration project that uses Python3. This project does require Python3 to take advantage of native async programming to speed up delivery and message handling. Follow the steps in the README file to get it started. You can then navigate to http://localhost:8200 to see the page. The test page (located in the /page directory) is very simple and only starts the process of subscribing once the Customer has requested it. Clicking the one button on the page will automatically create a Subscription Request and offer some script snippets you can use to send messages to the App. To see what happens when a user unsubscribes, disable the permissions using the page information pip: If you try to send a Subscription Update to that customer again, you will receive an error and should drop the subscription. An example error from pusher may look like: Failed to send to HMV192av: No such subscription For more info, see: http://autopush.readthedocs.io/en/latest/http.html#error-codes Dropping no longer valid user: HMV192av In this case, the subscription for user HMV192av has been removed, and the record was dropped from the user database. It’s important to only ask your Customers to subscribe once they understand what they’re subscribing to. A Customer who is asked to subscribe to WebPush notifications without being given a clear indication of what they’re being offered may click the “Always Block Notifications” option. When a user blocks notifications from your site, you may never get a chance to ask them again. Following these simple guidelines will ensure that both you and your Customers are happy using the WebPush service. [Less]

We are holding a Meet up with speakers in two locations and audience in two locations- London and Berlin Mozilla offices.

We are holding a Meet up with speakers in two locations and audience in two locations- London and Berlin Mozilla offices.