Mozilla Hacks

Release notes are generally very concise. They are typically followed up with a detailed blog on https://hacks.mozilla.org/

OP here, I discovered this via Planet Mozilla. If you can't bear the firehose, I don't know of anything close to a "knowledge base (e.g., a wiki)" curating Mozilla news. Maybe you could subscribe to https://hacks.mozilla.org/ and https://blog.mozilla.org/ , but yeah you'll only scratch the surface and e.g. would have missed this post.

I'm likewise pretty surprised that this made it to the top of HN. If you want straightforward, technical announcements, watch https://hacks.mozilla.org/ instead of https://blog.mozilla.org. The latter is predominantly press releases and less-technical announcements. Not that those things are bad, they're just meant for a different audience. If you want more moonshot-y stuff, emscripten, asm.js, rust, and servo are all pretty worthy of your attention. :)

Mozilla Hacks [0] is pretty much the only feed that makes sense recommending here. There's a lot of very detailed explanations for technical problems and their solution in there, which I find pretty interesting. Otherwise, though, less so a specific feed and more a general idea what to put in there: YouTube channels. There's a few channels which I follow, but I don't particularly fancy visiting youtube.com for it, and neither do I particularly fancy having a Google-account. But YouTube offers RSS feeds for pretty much every channel, which solves both problems. Also has the added advantage of all the features that your RSS reader offers, particularly being able to filter out any video series that you don't care about has been incredibly useful to me. If you want to migrate your subscriptions to RSS, there's also a button in YouTube to export all of them to an OPML-file, which you can then import into your RSS reader (if it supports import). Assuming Google hasn't changed the design of YouTube since last time visited, this button should be at the bottom of the "Manage Subscriptions"-page. As for RSS reader recommendation, on desktop I use QuiteRSS [1], mainly because it's the most feature-rich RSS reader that I've found so far. On Android, SpaRSS [2] is my preferred reader, with my main-criteria being that it supports at least filtering and OPML-import, is preferably FOSS, and plays nicely with my YouTube-usage (I use it together with NewPipe [3]). [0]:…

> did you evaluate various information sources (Ghostery, etc.) before settling on Disconnect? Monica Chew, the engineer who did the bulk of the work on this feature, did consider a number of available lists before settling on this one. The Disconnect list was the best freely-licensed (GPL) one at the time. Also, they now have a web form to let users suggest new trackers to block (https://disconnect.me/trackerprotection) so it should get even better. > Does anyone understand why Mozilla publishes valuable information like this over random personal blogs, rather than a central place like a knowledge base (e.g., a wiki)? It's pretty tricky to share information in the "right place" because of the amount of information produced by everyone at Mozilla. Someone's preferred channel is often another person's blind spot. In this particular example, all of the information is on the wiki page I maintain (https://wiki.mozilla.org/Security/Tracking_protection) but it felt like a more accessible description of the overall system would also be useful. I put it on my blog because it seemed too detailed/technical for my team's blog (https://blog.mozilla.org/security/) or Hacks (https://hacks.mozilla.org/).

No, we actually just posted a follow-up story with more details and opened several bugs, see also: https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/

I would argue the exact opposite: Linux is great, but it wasn't really designed with a focus on containing hostile software, and while containers have come to be a decent security barrier, they're still one kernel bug away from compromise. On the other hand, the browser is very accustomed to being the most exposed security-sensitive software on a machine, and modern browsers and wasm in particular are designed against that threat. Heck, wasm is so good for security that Mozilla started compiling components to wasm and then back into native code to get memory safety ( https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/ ).

Using Rust instead of a Go would provide a smaller binary since it doesn't need a runtime. Compared to JavaScript apps, it's not terrible but also not great. One thing WASM has over JS is that it can decode and compile code in parallel across multiple threads as it streams in. https://hacks.mozilla.org/2018/01/making-webassembly-even-faster-firef…

Ah yeah, I see Firefox ran into that and added retries: https://hacks.mozilla.org/2022/11/improving-firefox-stability-with-thi… Seems like a worthwhile change, though I'm not sure when I'll get around to it.

There is a way to sandbox native code without forking to a new process, and it looks like this https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/ Firefox employs processes for sandboxing but for small components they are not worth the overhead. For those they employed this curious idea: first compile the potentially unsafe code to wasm (any other VM would work), then compile the wasm code to C (using the wasm2c tool). Then use this new C source normally in your program. All UB in the original code becomes logical bugs in the wasm, that can output incorrect values but not corrupt memory or do things that UB can do. Firefox does this to encapsulate C code, but it can be done with Rust too

Nice. Did you use inolen/quakejs as a base, or new fork? Are you using WebRTC? Have you heard of HumbleNet? They also had a Q3 forked: https://hacks.mozilla.org/2017/06/introducing-humblenet-a-cross-platfo… For the curious, FTEQW has an emscripten port as well, and FTEQW allows you to play Q1, Q2 and most Q3 maps: https://github.com/fte-team/fteqw/blob/1f9f3635f0aef3b2eed6b40e35fcf62… Also, the LvL LiveView is a great way to check Q3 maps in your browser: https://q3js.lvlworld.com/play/2043/media/633a9623b1b6458735cad3d559a7… What a time to be alive. :)

From https://hacks.mozilla.org/2024/04/llamafiles-progress-four-months-in/ it sounds like it's a very active "feeder fork", with jart doing a massive amount of cutting-edge work on CPU inference and slashing through the driver thicket, then upstreaming (some of?) it to llama.cpp. (I don't know enough to know if all of her work applies to the upstream.) I don't follow the space enough to know how much work is going into llama.cpp, but from my naive outsider view, it sounds like llamafile is the place to be for "mere mortal" LLM usage. That's where they (ok, mostly she) care about those sorts of use cases.

Firefox's translation feature was built on Mozilla's Bergamot collab with Europe. It's an NMT as you note but it's also a set of language models trained on large language corpora using, among other techniques, the transformer architecture, so people calling it LLM translation don't bother me at all, and I'm the guy that brought it to Firefox (with my architect partner Andre Natal). The best article is probably https://hacks.mozilla.org/2022/06/training-efficient-neural-network-mo… though that was before we started integrating it into Firefox proper.

I strongly recommend reading through this site if this topic interests you at all (which it probably does if you’re reading this comments thread!). Lot of explanation and detail about how it works, what it does, and how to use it yourself. It’s good stuff. And yeah, it’s been in Firefox for two years now: https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grai…

Besides windows.open I'd wonder if iframes could also be vulnerable if they launch in the same process. Chrome and Firefox both support Out-Of-Process Iframes as part of their security setup; though I'm not sure if Firefox has it enabled by default yet. Firefox even drew some lovely pictures about it here: https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolati…

Further notes here: https://www.reddit.com/r/gamedev/comments/cgvqr5/anyone_use_webrtc_for… https://hacks.mozilla.org/2013/03/webrtc-data-channels-for-great-multi… http://blog.brkho.com/2017/03/15/dive-into-client-server-web-games-web…

The blog post describing their effort to implement fillable PDF forms is well worth a read: https://hacks.mozilla.org/2021/10/implementing-form-filling-and-access…

It's an open source project, they could've forked it and got their wish to keep the API unaffected by any changes to SQLite. This blog post[1], this amazing blog post gives us all the insight needed to know this was going to go badly. The bit about whiteboarding a replacement, is that better or worse than believing Javascript is really a replacement for SQL? Or that IndexedDB is somehow elegant? I can't tell, the whole thing makes me cringe. [1] https://hacks.mozilla.org/2010/06/beyond-html5-database-apis-and-the-r…

Agreed, and I would add that I have been keeping my bookmarks & tags synced on all devices using Firefox Sync for several years now without any issues. It's just great. Same for passwords. There is a in-depth article about the privacy features of their design [1]. If you add containers[2], then there is really no reason to use Chrome. [1] https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ [2] https://addons.mozilla.org/en-US/firefox/addon/multi-account-container…

> The thing they rewrote also worked great in production. It may well have, but the Rust version “was faster, it crashed less, and we even knew it fixed some issues” https://hacks.mozilla.org/2022/06/everything-is-broken-shipping-rust-m…

> It's worth making it explicit that many home computing tasks are highly parrallelizable because the work is actually completely separate programs. That's a great point. At any point in time there are already dozens of processes running, of which only a fraction are tied to a GUI. Even GUI apps are currently resorting to launching multiple processes. For example, Firefox announced last year their new site isolation security architecture where they load each site as an independent process. https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolati… Also, here's a link to a recent HN discussion on Firefox's recent announcement. https://news.ycombinator.com/item?id=31355857

From: https://hacks.mozilla.org/2022/03/mozilla-and-open-web-docs-working-to… > Any revenue generated by MDN Plus will stay within Mozilla. Mozilla is looking into ways to reinvest some of these additional funds into open source projects contributing to MDN but it is still in early stages. > A subscription to MDN Plus gives paying subscribers extra MDN features provided by Mozilla while a donation to Open Web Docs goes to funding writers creating content on MDN Web Docs, and potentially elsewhere. It's not totally clear to me after a little research, but I think MDN is part of the corporation, not the foundation? (It's isn't listed as on the foundation website as one of their projects.

I didn't know what WASI was/stands for. Here an excellent explanation : https://hacks.mozilla.org/2019/03/standardizing-wasi-a-webassembly-sys…

No problem! If anyone is curious for more on this pattern, Firefox Sync had a great blog post breaking down their implementation: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

I considered Raindrop.io [1] at some point, but I ended up with Firefox bookmarks. I have an account and the bookmarks are synced. [2] Mobile app is inferior to competitors, but Mozilla products are trustworthy. [3] [1] https://raindrop.io [2] https://www.mozilla.org/en-US/firefox/sync [3] https://hacks.mozilla.org/2018/11/firefox-sync-privacy

The WASM ecosystem is exploring this through the use of what they call "nanoprocesses" wherein libraries are wrapped into modules and provided access to nothing by default [1]. This seems to be more of a pattern and consequence of how WASM works than a specific feature. 1. https://hacks.mozilla.org/2019/11/announcing-the-bytecode-alliance/ (ignore the title, it's irrelevant to the excellent explanation that constitutes 70% of the post)

This looks great. On a side note, I was wondering why the controls were freaking out when I was trying to depart, and then realised I had my foot on my rudder pedals I use for flight sim (not useful for trains despite my best efforts). I was trying to disable it in Brave browser but couldn't find a way. It seems any website can just read your gamepad input? This doesn't happen on Firefox and this [0] is probably why. I imagine this could be used for fingerprinting, am I missing something? Anyway, back to driving trains. [0]: https://hacks.mozilla.org/2020/07/securing-gamepad-api/

So great to see folks utilizing Pyodide, the WASM scientific python stack my Mozilla colleagues put together. The creator, Mike Droettboom, wrote a Mozilla Hacks post about it a while back: https://hacks.mozilla.org/2019/04/pyodide-bringing-the-scientific-pyth…

The blog posts in full can be found here https://payments.posthaven.com/tag/webassembly These build on Lin Clark's excellent series https://hacks.mozilla.org/2017/02/a-cartoon-intro-to-webassembly For minimal examples on compiling and running WebAssembly https://github.com/savarin/minimal To speed up Python with Rust via WebAssembly bridge https://github.com/savarin/bridge

Nope. Apple's WebKit is the best weapon against Chromium monoculture. Blink is already far diverged from WebCore, and V8 was made from scratch. On the other hand, Firefox is becoming a Chrom* copycat even under the hood: https://hacks.mozilla.org/2020/06/a-new-regexp-engine-in-spidermonkey/