Re: Status of deprecating non-secure HTTP

2017-09-25 Thread Boris Zbarsky
On 9/25/17 11:45 AM, L. David Baron wrote: So I don't think this requires any new *features* to be spec'd in CSS (since @supports would work, and is the right thing to use), although it probably does require a small amount of new spec prose to explain how it works. Well, it would need spec text

Re: Intent to require `mach try` for submitting to Try

2017-09-25 Thread Aki Sasaki
On 9/16/17 6:43 AM, Eric Rescorla wrote: > 2. There are a lot more people writing code for Firefox than developing the > internal tools, so in general, costs on those people should be avoided. On Mon, Sep 18, 2017 at 5:16 AM, Eric Rescorla wrote: > And having something complex and scary on th

Re: Status of deprecating non-secure HTTP

2017-09-25 Thread L. David Baron
On Monday 2017-09-25 09:12 -0400, Boris Zbarsky wrote: > On 9/25/17 9:01 AM, Anne van Kesteren wrote: > > It does not seem hard to come up with solutions to those problems, if > > we're actually committed to going down this path. > > If we are, yes. We need to decide whether we are... > > > (E.g

Re: Intent to ship: CSP directive worker-src

2017-09-25 Thread Daniel Veditz
I'm not sure I agree with my own comment -- that's an insane fall-back path. Might ease some backwards compatibility problems, but we don't know how many of those there will be. But then we have to live with the insanity forever. -Dan Veditz On Mon, Sep 25, 2017 at 1:01 AM, Christoph Kerschbaumer

Re: Containers graduation from Test Pilot - we still care about 57+

2017-09-25 Thread Ben Kelly
Thanks Jonathan. Also, it seems the link to the web extension version of the container addon is broken above. This one works for me: https://github.com/mozilla/multi-account-containers/releases/latest On Sat, Sep 23, 2017 at 9:52 AM, Jonathan Kingston wrote: > Hi All, > > TL;DR - containers i

Re: Status of deprecating non-secure HTTP

2017-09-25 Thread Boris Zbarsky
On 9/25/17 9:01 AM, Anne van Kesteren wrote: It does not seem hard to come up with solutions to those problems, if we're actually committed to going down this path. If we are, yes. We need to decide whether we are... (E.g., just like globals have isSecureContext, there could be a media query

Re: Status of deprecating non-secure HTTP

2017-09-25 Thread Anne van Kesteren
On Mon, Sep 25, 2017 at 2:47 PM, Boris Zbarsky wrote: > On 9/25/17 3:18 AM, Anne van Kesteren wrote: >> But it would also be good if we could all communicate this on behalf >> of Mozilla without caveats. E.g., Chrome might ship worklets soon and >> being able to object to that happening (specifica

Re: Status of deprecating non-secure HTTP

2017-09-25 Thread Boris Zbarsky
On 9/25/17 3:18 AM, Anne van Kesteren wrote: But it would also be good if we could all communicate this on behalf of Mozilla without caveats. E.g., Chrome might ship worklets soon and being able to object to that happening (specification-wise) on insecure contexts on behalf of Mozilla would be go

Signaling Devices Market Growth Set to Surge Significantly during 2017 - 2025

2017-09-25 Thread sayalitip
Get Flat 25% Discount in This Report at http://www.theinsightpartners.com/discount/TIPTE10382 (Offer available up to October 15, 2017) The Signaling Devices market accounted for US$ 1520.0 million in 2016 and is expected to grow during the forecast period 2017 – 2025, to account for US$ 267

Re: Intent to ship: CSP directive worker-src

2017-09-25 Thread Christoph Kerschbaumer
> On Sep 22, 2017, at 10:27 PM, Daniel Veditz wrote: > ​Christoph said > For backwards compatibility child-src will still be enforced for: > * workers (if worker-src is not explicitly specified) > > ​But the spec says the fallback is script-src. Surely anyone who uses > child-src will also ha

Status of deprecating non-secure HTTP

2017-09-25 Thread Anne van Kesteren
It seems that with Richard leaving Mozilla we dropped the ball on requiring HTTPS more often: https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/ At least I can't find any follow-up with an agreed upon date and we're still rather hit-or-miss when it comes to using [SecureC