fidzu : Mozilla

I updated the Baseline JIT patches to apply against Firefox 128ESR, though if you use the Mercurial rebase extension (and you should), it will rebase automatically and only one file had to be merged - which it did for me also. Nevertheless, everything is up to date against tip again, and this patchset works fine for both Firefox and Thunderbird. I kept the fix for bug 1912623 because I think Mozilla's fix in bug 1909204 is wrong (or at least suboptimal) and this is faster on systems without working Wasm. Speaking of, I need to get back into porting rr to ppc64le so I can solve those startup crashes.

01 Nov 2024 9:45pm GMT

Still in its "anti-hero" era, Ticketmaster has users reeling from a data breach last May, when a hacker group claimed to have stolen data from more than 500 million people.

The breach coincided with Taylor Swift's Eras Tour, one of the biggest tours ever that just so happened to have one of the most problematic rollouts ever. (So many fans tried to buy presale tickets that Ticketmaster's system crashed, forcing the company to cancel the general sale - yet bots and scalpers still managed to grab tickets.)

So what do you do after a massive data breach?

Use 2FA

Two-factor-authentication (2FA if you're into brevity) is a simple and effective way to add an extra layer of security to your logins.

Change old passwords

Look. We get it. "FearlessSwiftie13!" is a pretty solid password. But if you've been using it since 2008, it's time to update it. Make it something less obvious, maybe even use Firefox's password generator. Don't re-use passwords. If they're easy to remember, they're easy to hack.

Mozilla Monitor

Not to plug our own thing, but Mozilla Monitor does a pretty good job of showing what personal data was actually breached. We recommend the free scan; it'll tell you if your phone number, passwords or home address have been leaked and alert you to future breaches, so you can act accordingly and stay in the loop.

No phish

Because the Ticketmaster data breach was so big, many people's information could now be in the hands of scammers, who may use the data they got to pose as Ticketmaster or concert venues, to steal even more of your information. Be on the lookout for any emails or texts that seem suspicious or off.

Keep tabs on your statements

Regularly review your credit card statements. Pick a day and make it a habit. Even if you haven't been part of a headline-making breach, it's smart - you'll catch any unfamiliar charges and can report them to your card issuer right away.

Data breaches are no fun, but they do help people snap out of their old (and easily hackable) habits. By using a combination of these steps above and some good ol'-fashioned common sense, you'll minimize the risk of them happening again.

The post After Ticketmaster's data breach, it's time to secure your info appeared first on The Mozilla Blog.

01 Nov 2024 1:00pm GMT

Welcome to the latest edition of the Performance Testing Newsletter! The PerfTools team empowers engineers with tools to continuously improve the performance of Mozilla products.

Last quarter was MozWeek, and we had a great time meeting a number of you in our PerfTest Regression Workshop - thank you all for joining us, and making it a huge success! If you didn't get a chance to make it, you can find the slides here, and most of the information from the workshop (including some additional bits) can be found in this documentation page. We will be running this workshop again next MozWeek, along with a more advanced version.

See below for highlights from the changes made in the last quarter.

Highlights

• [mayankleoboy1] This quarter, Mayank became our first official Community Performance Sheriff!
• [mayankleoboy1] Filed some issues related to missing alerts.
• [myeongjun] AWSY now uses tp6 by default to match CI tests where only tp6 is tested.
• [julienw] PerfCompare now being shown by default in Mach Try Perf!
• [beatrice] Compare View now provides a helpful link to redirect to PerfCompare.
• [aglavic] Added new mobile app link startup tests in CI.
• [aglavic] Replaced Android Samsung S21 device with Samsung S24 devices.
• [kshampur] New mobile foreground resource usage tests are now available in CI.
• [kshampur] Android Samsung A51 devices have been replaced with Samsung A55 devices in CI (includes a larger device pool).
• [kshampur] AWFY has been updated with Windows 11, MacOSX M2, Safari Tech Preview, and much more!
• [sparky] New mobile background resource usage tests are now available in CI.
• [sparky] New option -tests is now available in mach try perf to specify tasks to run using test name.
• [sparky] Documentation for basics of performance testing now available (see here).
• [sparky] New tool available to run all alerting tests locally. Run with `mach perftest <ALERT-NUMBER>`.

Blog Posts ✍️

• [csevere] Announcing PerfCompare: the new comparison tool!

Contributors

• Myeongjun Go [:myeongjun]
• Mayank Bansal [:mayankleoboy1]

If you have any questions, or are looking to add performance testing for your code component, you can find us in #perftest on Element, or #perf-help on Slack.

31 Oct 2024 11:22pm GMT

In August 2020, as the pandemic confined people to their homes, the U.K. canceled A-level exams and turned to an algorithm to calculate grades, key for university admissions. Based on historical data that reflected the resource advantages of private schools, the algorithm disproportionately downgraded state students. Those who attended private schools, meanwhile, received inflated grades. News of the results set off widespread backlash. The system reinforced social inequities, critics said.

This isn't just a one-off mistake - it's a sign of AI bias creeping into our lives, according to Gemma Galdon-Clavell, a tech policy expert and one of Mozilla's 2025 Rise25 honorees. Whether it's deciding who gets into college or a job, who qualifies for a loan, or how health care is distributed, bias in AI can set back efforts toward a more equitable society.

In an opinion piece for Context by the Thomson Reuters Foundation, Gemma asks us to consider the consequences of not addressing this issue. She argues that bias and fairness are the biggest yet often overlooked threats of AI. You can read her essay here.

We chatted with Gemma about her piece below.

Can you give examples of how AI is already affecting us?

AI is involved in nearly everything - whether you're applying for a job, seeing a doctor, or applying for housing or benefits. Your resume might be screened by an AI, your wait time at the hospital could be determined by an AI triage system, and decisions about loans or mortgages are often assisted by AI. It's woven into so many aspects of decision-making, but we don't always see it.

Why is bias in AI so problematic?

AI systems look for patterns and then replicate them. These patterns are based on majority data, which means that minorities - people who don't fit the majority patterns - are often disadvantaged. Without specific measures built into AI systems to address this, they will inevitably reinforce existing biases. Bias is probably the most dangerous technical challenge in AI, and it's not being tackled head-on.

How can we address these issues?

At Eticas, we build software to identify outliers - people who don't fit into majority patterns. We assess whether these outliers are relevant and make sure they aren't excluded from positive outcomes. We also run a nonprofit that helps communities affected by biased AI systems. If a community feels they've been negatively impacted by an AI system, we work with them to reverse-engineer it, helping them understand how it works and giving them the tools to advocate for fairer systems.

What can someone do if an AI system affects them, but they don't fully understand how it works?

Unfortunately, not much right now. Often, people don't even know an AI system made a decision about their lives. And there aren't many mechanisms in place for contesting those decisions. It's different from buying a faulty product, where you have recourse. If AI makes a decision you don't agree with, there's very little you can do. That's one of the biggest challenges we need to address - creating systems of accountability for when AI makes mistakes.

You've highlighted the challenges. What gives you hope about the future of AI?

The progress of our work on AI auditing! For years now we've been showing how there is an alternative AI future, one where AI products are built with trust and safety at heart, where AI audits are seen as proof of responsibility and accountability - and ultimately, safety. I often mention how my work is to build the seatbelts of AI, the pieces that make innovation safer and better. A world where we find non-audited AI as unthinkable as cars without seatbelts or brakes, that's an AI future worth fighting for.

The post The AI problem we can't ignore appeared first on The Mozilla Blog.

31 Oct 2024 6:06pm GMT

The Rust project is currently working towards a slate of 26 project goals, with 3 of them designed as flagship goals. This post provides selected updates on our progress towards these goals (or, in some cases, lack thereof). The full details for any particular goal are available in its associated tracking issue on the rust-project-goals repository.

Flagship goals

The biggest elements of our goal are solving the "send bound" problem via return-type notation (RTN) and adding support for async closures. This month we made progress towards both. For RTN, @compiler-errors extended the return-type notation landed support for using RTN in self-types like where Self::method(): Send. He also authored a blog post with a call for testing explaining what RTN is and how it works. For async closures, the lang team reached a preliminary consensus on the async Fn syntax, with the understanding that it will also include some "async type" syntax. This rationale was documented in RFC #3710, which is now open for feedback. The team held a design meeting on Oct 23 and @nikomatsakis will be updating the RFC with the conclusions.

We have also been working towards a release of the dynosaur crate that enables dynamic dispatch for traits with async functions. This is intended as a transitionary step before we implement true dynamic dispatch. The next steps are to polish the implementation and issue a public call for testing.

With respect to async drop experiments, @nikomatsakis began reviews. It is expected that reviews will continue for some time as this is a large PR.

Finally, no progress has been made towards async WG reorganization. A meeting was scheduled but deferred. @tmandry is currently drafting an initial proposal.

We have made significant progress on resolving blockers to Linux building on stable. Support for struct fields in the offset_of! macro has been stabilized. The final naming for the "derive-smart-pointer" feature has been decided as #[derive(CoercePointee)]; @dingxiangfei2009 prepared PR #131284 for the rename and is working on modifying the rust-for-linux repository to use the new name. Once that is complete, we will be able to stabilize. We decided to stabilize support for references to statics in constants pointers-refs-to-static feature and are now awaiting a stabilization PR from @dingxiangfei2009.

Rust for Linux (RfL) is one of the major users of the asm-goto feature (and inline assembly in general) and we have been examining various extensions. @nbdd0121 authored a hackmd document detailing RfL's experiences and identifying areas for improvement. This led to two immediate action items: making target blocks safe-by-default (rust-lang/rust#119364) and extending const to support embedded pointers (rust-lang/rust#128464).

Finally, we have been finding an increasing number of stabilization requests at the compiler level, and so @wesleywiser and @davidtwco from the compiler team have started attending meetings to create a faster response. One of the results of that collaboration is RFC #3716, authored by Alice Ryhl, which proposes a method to manage compiler flags that modify the target ABI. Our previous approach has been to create distinct targets for each combination of flags, but the number of flags needed by the kernel make that impractical. Authoring the RFC revealed more such flags than previously recognized, including those that modify LLVM behavior.

The Rust 2024 edition is progressing well and is on track to be released on schedule. The major milestones include preparing to stabilize the edition by November 22, 2024, with the actual stabilization occurring on November 28, 2024. The edition will then be cut to beta on January 3, 2025, followed by an announcement on January 9, 2025, indicating that Rust 2024 is pending release. The final release is scheduled for February 20, 2025.

The priorities for this edition have been to ensure its success without requiring excessive effort from any individual. The team is pleased with the progress, noting that this edition will be the largest since Rust 2015, introducing many new and exciting features. The process has been carefully managed to maintain high standards without the need for high-stress heroics that were common in past editions. Notably, the team has managed to avoid cutting many items from the edition late in the development process, which helps prevent wasted work and burnout.

All priority language items for Rust 2024 have been completed and are ready for release. These include several key issues and enhancements. Additionally, there are three changes to the standard library, several updates to Cargo, and an exciting improvement to rustdoc that will significantly speed up doctests.

This edition also introduces a new style edition for rustfmt, which includes several formatting changes.

The team is preparing to start final quality assurance crater runs. Once these are triaged, the nightly beta for Rust 2024 will be announced, and wider testing will be solicited.

Rust 2024 will be stabilized in nightly in late November 2024, cut to beta on January 3, 2025, and officially released on February 20, 2025. More details about the edition items can be found in the Edition Guide.

Goals with updates

• camelid has started working on using the new lowering schema for more than just const parameters, which once done will allow the introduction of a min_generic_const_args feature gate.
• compiler-errors has been working on removing the eval_x methods on Const that do not perform proper normalization and are incompatible with this feature.

• Posted the September update.
• Created more automated infrastructure to prepare the October update, utilizing an LLM to summarize updates into one or two sentences for a concise table.

Associated type position impl trait

• No progress has been made on this goal.
• The goal will be closed as consensus indicates stabilization will not be achieved in this period; it will be revisited in the next goal period.

• No major updates to report.
• Preparing a talk for next week's EuroRust has taken away most of the free time.

• Key developments: With the PR for supporting implied super trait bounds landed (#129499), the current implementation is mostly complete in that it allows most code that should compile, and should reject all code that shouldn't.
• Further testing is required, with the next steps being improving diagnostics (#131152), and fixing more holes before const traits are added back to core.

• A working-in-process pull request is available at https://github.com/weihanglo/cargo/pull/66.
• The use of wasm32-wasip1 as a default sandbox environment is unlikely due to its lack of support for POSIX process spawning, which is essential for various build script use cases.

• The Autodiff frontend was merged, including over 2k LoC and 30 files, making the remaining diff much smaller.
• The Autodiff middle-end is likely getting a redesign, moving from a library-based to a pass-based approach for LLVM.

• Significant progress was made with contributions by @x-hgg-x, improving the resolver test suite in Cargo to check feature unification against a SAT solver.
• This was followed by porting the test cases that tripped up PubGrub to Cargo's test suite, laying the groundwork to prevent regression on important behaviors when Cargo switches to PubGrub and preparing for fuzzing of features in dependency resolution.

• The team is working on a consensus for handling generic parameters, with both PRs currently blocked on this issue.

• Attempted stabilization of -Znext-solver=coherence was reverted due to a hang in nalgebra, with subsequent fixes improving but not fully resolving performance issues.
• No significant changes to the new solver have been made in the last month.

• GnomedDev pushed rust-lang/rust#130553, which replaced an old Clippy infrastructure with a faster one (string matching into symbol matching).
• Inspections into Clippy's type sizes and cache alignment are being started, but nothing fruitful yet.

• The linting behavior was reverted until an unspecified date.
• The next steps are to decide on the future of linting and to write the never patterns RFC.

• The PR https://github.com/rust-lang/crates.io/pull/9423 has been merged.
• Work on the frontend feature is in progress.

• Key developments in the 'Scalable Polonius support on nightly' project include fixing test failures due to off-by-one errors from old mid-points, and ongoing debugging of test failures with a focus on automating the tracing work.
• Efforts have been made to accept variations of issue #47680, with potential adjustments to active loans computation and locations of effects. Amanda has been cleaning up placeholders in the work-in-progress PR #130227.

• rust-lang/cargo#14404 and rust-lang/cargo#14591 have been addressed.
• Waiting on time to focus on this in a couple of weeks.

• Key developments: Added the cases in the issue list to the UI test to reproduce the bug or verify the non-reproducibility.
• Blockers: null.
• Help wanted: Help test the deadlock code in the issue list and try to reproduce the issue.

• Students from the CMU Practicum Project have started writing function contracts that include safety conditions for some unsafe functions in the core library, and verifying that safe abstractions respect those pre-conditions and are indeed safe.
• Help is needed to write more contracts, integrate new tools, review pull requests, or participate in the repository discussions.

• Progress has been made in matching rustc suggestion output within annotate-snippets, with most cases now aligned.
• The focus has been on understanding and adapting different rendering styles for suggestions to fit within annotate-snippets.

Goals without updates

The following goals have not received updates in the last month:

Implement "merged doctests" to save doctest time

31 Oct 2024 12:00am GMT

Just over two years ago, we announced our plans to bring Thunderbird to Android by taking K-9 Mail under our wing. The journey took a little longer than we had originally anticipated and there was a lot to learn along the way, but the wait is finally over! For all of you who have ever asked "when is Thunderbird for Android coming out?", the answer is - today! We are excited to announce that the first stable release of Thunderbird for Android is out now, and we couldn't be prouder of the newest, most mobile member of the Thunderbird family.

Resources

• What's New: https://support.mozilla.org/kb/new-thunderbird-android-version-8
• Detailed Release Notes: https://github.com/thunderbird/thunderbird-android/releases/tag/THUNDERBIRD_8_0
• Community Support Forum: Thunderbird for Android has its own home on the official Mozilla Support (SUMO) forums. Find the help you need to configure and use the newest Thunderbird from our community on a mobile friendly site.
• Import Settings: Whether you're importing your information from K-9 Mail or Thunderbird on the desktop, transfer your information quickly and easily with our guide.
• System Requirements: Thunderbird for Android runs on mobile devices running Android 5 and above.
• Platform Availability: Download Thunderbird for Android from the following places. Availability on F-Droid will be coming soon.
  • Google Play Store
  • GitHub Releases (apk)
  • The Thunderbird website (on an Android device)
• Get Involved: Thunderbird for Android thrives thanks to community support, and you can be part of the community! We are grateful to everyone who donates their skill and time to answer support questions, test releases, translate and more. Find out all the ways to get in where you fit in.
• Support Us: We are 100% donor-supported. Your gift helps us develop new apps (like this one!), improve speed and stability, promote Thunderbird and software freedom, and provide downloads free-of-charge to millions. Donate on our webpage or in the app.
• Suggest New Features: We know you have great ideas for future features. You can share them on Mozilla Connect, where community members can upvote and comment on them. Our team uses the feedback here to help shape our roadmap.

Thanks for Helping Thunderbird for Android Fly

Thank you for being a part of the community and sharing this adventure on Android with us! We're especially grateful to all of you who have helped us test the beta and release candidate images. Your feedback helped us find and fix bugs, test key features, and polish the stable release. We hope you enjoy using the newest Thunderbird, now and for a long time to come!

The post Thunderbird for Android 8.0 Takes Flight appeared first on The Thunderbird Blog.

30 Oct 2024 1:59pm GMT

Somebody brought to my attention that the Hide YouTube Shorts extension for Chrome changed hands and turned malicious. I looked into it and could confirm that it contained two undisclosed components: one performing affiliate fraud and the other sending users' every move to some Amazon cloud server. But that wasn't all of it: I discovered eleven more extensions written by the same people. Some contained only the affiliate fraud component, some only the user tracking, some both. A few don't appear to be malicious yet.

While most of these extensions were supposedly developed or bought by a person without any other traces online, one broke this pattern. Karma shopping assistant has been on Chrome Web Store since 2020, the company behind it founded in 2013. This company employs more than 50 people and secured tons of cash in venture capital. Maybe a mistake on my part?

After looking thoroughly this explanation seems unlikely. Not only does Karma share some backend infrastructure and considerable amounts of code with the malicious extensions. Not only does Karma Shopping Ltd. admit to selling users' browsing profiles in their privacy policy. There is even more tying them together, including a mobile app developed by Karma Shopping Ltd. whereas the identical Chrome extension is supposedly developed by the mysterious evildoer.

The affected extensions

Most of the extensions in question changed hands relatively recently, the first ones in the summer of 2023. The malicious code has been added immediately after the ownership transfer, with some extensions even requesting additional privileges citing bogus reasons. A few extensions have been developed this year by whoever is behind this.

Some extensions from the latter group don't have any obvious malicious functionality at this point. If there is tracking, it only covers the usage of the extension's user interface rather than the entire browsing behavior. This can change at any time of course.

Hiding in plain sight

Whoever wrote the malicious code chose not to obfuscate it but to make it blend in with the legitimate functionality of the extension. Clearly, the expectation was that nobody would look at the code too closely. So there is for example this:

if (window.location.href.startsWith("http") ||
    window.location.href.includes("m.youtube.com")) {
  …
}

It looks like the code inside the block would only run on YouTube. Only when you stop and consider the logic properly you realize that it runs on every website. In fact, that's the block wrapping the calls to malicious functions.

The malicious functionality is split between content script and background worker for the same reason, even though it could have been kept in one place. This way each part looks innocuous enough: there is some data collection in the content script, and then it sends a check_shorts message to the background worker. And the background worker "checks shorts" by querying some web server. Together this just happens to send your entire browsing history into the Amazon cloud.

Similarly, there are some complicated checks in the content script which eventually result in a loadPdfTab message to the background worker. The background worker dutifully opens a new tab for that address and, strangely, closes it after 9 seconds. Only when you sort through the layers it becomes obvious that this is actually about adding an affiliate cookie.

And of course there is a bunch of usual complicated conditions, making sure that this functionality is not triggered too soon after installation and generally doesn't pop up reliably enough that users could trace it back to this extension.

Affiliate fraud functionality

The affiliate fraud functionality is tied to the kra18.com domain. When this functionality is active, the extension will regularly download data from https://www.kra18.com/v1/selectors_list?&ex=90 (90 being the extension ID here, the server accepts eight different extension IDs). That's a long list containing 6,553 host names:

Whenever one of these domains is visited and the moons are aligned in the right order, another request to the server is made with the full address of the page you are on. For example, the extension could request https://www.kra18.com/v1/extension_selectors?u=https://www.tink.de/&ex=90:

The shortsNavButtonSelector key is another red herring, the code only appears to be using it. The important key is url, the address to be opened in order to set the affiliate cookie. And that's the address sent via loadPdfTab message mentioned before if the extension decides that right now is a good time to collect an affiliate commission.

There are also additional "selectors," downloaded from https://www.kra18.com/v1/selectors_list_lr?&ex=90. Currently this functionality is only used on the amazon.com domain and will replace some product links with links going through jdoqocy.com domain, again making sure an affiliate commission is collected. That domain is owned by Common Junction LLC, an affiliate marketing company that published a case study on how their partnership with Karma Shopping Ltd. (named Shoptagr Ltd. back then) helped drive profits.

Browsing profile collection

Some of the extensions will send each page visit to https://7ng6v3lu3c.execute-api.us-east-1.amazonaws.com/EventTrackingStage/prod/rest. According to the extension code, this is an Alooma backend. Alooma is a data integration platform which has been acquired by Google a while ago. Data transmitted could look like this:

Yes, this is sent for each and every page loaded in the browser, at least after you've been using the extension for a while. And distinct_id is my immutable user ID here.

But wait, it's a bit different for the Karma extension. Here you can opt out! Well, that's only if you are using Firefox because Mozilla is rather strict about unexpected data collection. And if you manage to understand what "User interactions" means on this options page:

Well, I may disagree with the claim that url addresses do not contain personably identifiable information. And: yes, this is the entire page. There really isn't any more text.

The data transmitted is also somewhat different:

The user_id field no longer contains the extension ID but my personal identifier, complementing the identifier in distinct_id. There is a tab_id field adding more context, so that it is not only possible to recognize which page I navigated to and from where but also to distinguish different tabs. And some more information about my system is always useful of course.

Who is behind this?

Eleven extensions on my list are supposedly developed by a person going by the name Rotem Shilop or Roni Shilop or Karen Shilop. This isn't a very common last name, and if this person really exists it managed to leave no traces online. Yes, I also searched in Hebrew. Yet one extension is developed by Karma Shopping Ltd. (formerly Shoptagr Ltd.), a company based in Israel with at least 50 employees. An accidental association?

It doesn't look like it. I'm not going into the details of shared code and tooling, let's just say: it's very obvious that all twelve extensions are being developed by the same people. Of course, there is still the possibility that the eleven malicious extensions are not associated directly with Karma Shopping but with some rogue employee or contractor or business partner.

However, it isn't only the code. As explained above, five extensions including Karma share the same tracking backend which is found nowhere else. They are even sending the same access token. Maybe this backend isn't actually run by Karma Shopping and they are only one of the customers of some third party? Yet if you look at the data being sent, clearly the Karma extension is considered first-party. It's the other extensions which are sending external: true and component: external_extension flags.

Then maybe Karma Shopping is merely buying data from a third party, without actually being affiliated with their extensions? Again, this is possible but unlikely. One indicator is the user_id field in the data sent by these extensions. It's the same extension ID that they use for internal communication with the kra18.com server. If Karma Shopping were granting a third party access to their server, wouldn't they assign that third party some IDs of their own?

And those affiliate links produced by the kra18.com server? Some of them clearly mention karmanow.com as the affiliate partner.

Finally, if we look at Karma Shopping's mobile apps, they develop two of them. In addition to the Karma app, the app stores also contain an app called "Sudoku on the Rocks," developed by Karma Shopping Ltd. Which is a very strange coincidence because an identical "Sudoku on the Rocks" extension also exists in the Chrome Web Store. Here however the developer is Karen Shilop. And Karen Shilop chose to include hidden affiliate fraud functionality in their extension.

By the way, guess who likes the Karma extension a lot and left a five-star review?

I contacted Karma Shopping Ltd. via their public relations address about their relationship to these extensions and the Shilop person but didn't hear back so far.

Update (2024-10-30): An extension developer told me that they were contacted on multiple independent occasions about selling their Chrome extension to Karma Shopping, each time by C-level executives of the company, from official karmanow.com email addresses. The first outreach was in September 2023, where Karma was supposedly looking into adding extensions to their portfolio as part of their growth strategy. They offered to pay between $0.2 and $1 per weekly active user.

What does Karma Shopping want with the data?

It is obvious why Karma Shopping Ltd. would want to add their affiliate functionality to more extensions. After all, affiliate commissions are their line of business. But why collect browsing histories? Only to publish semi-insightful articles on people's shopping behavior?

Well, let's have a look at their privacy policy which is actually meaningful for a change. Under 1.3.4 it says:

Browsing Data. In case you a user of our browser extensions we may collect data regarding web browsing data, which includes web pages visited, clicked stream data and information about the content you viewed.

How we Use this Data. We use this Personal Data (1) in order to provide you with the Services and feature of the extension and (2) we will share this data in an aggregated, anonymized manner, for marketing research and commercial use with our business partners.

Legal Basis. (1) We process this Personal Data for the purpose of providing the Services to you, which is considered performance of a contract with you. (2) When we process and share the aggregated and anonymized data we will ask for your consent.

First of all, this tells us that Karma collecting browsing data is official. They also openly state that they are selling it. Good to know and probably good for their business as well.

As to the legal basis: I am no lawyer but I have a strong impression that they don't deliver on the "we will ask for your consent" promise. No, not even that Firefox options page qualifies as informed consent. And this makes this whole data collection rather doubtful in the light of GDPR.

There is also a difference between anonymized and pseudonymized data. The data collection seen here is pseudonymized: while it doesn't include my name, there is a persistent user identifier which is still linked to me. It is usually fairly easy to deanonymize pseudonymized browsing histories, e.g. because people tend to visit their social media profiles rather often.

Actually anonymized data would not allow associating it with any single person. This is very hard to achieve, and we've seen promises of aggregated and anonymized data go very wrong. While it's theoretically possible that Karma correctly anonymizes and aggregates data on the server side, this is a rather unlikely outcome for a company that, as we've seen above, confuses the lack of names and email addresses with anonymity.

But of course these considerations only apply to the Karma extension itself. Because related extensions like Hide YouTube Shorts just straight out lie:

Some of these extensions actually used to have a privacy policy before they were bought. Now only three still have an identical and completely bogus privacy policy. Sudoku on the Rocks happens to be among these three, and the same privacy policy is linked by the Sudoku on the Rocks mobile apps which are officially developed by Karma Shopping Ltd.

30 Oct 2024 1:03pm GMT

Hello and welcome to another issue of This Week in Rust! Rust is a programming language empowering everyone to build reliable and efficient software. This is a weekly summary of its progress and community. Want something mentioned? Tag us at @ThisWeekInRust on X (formerly Twitter) or @ThisWeekinRust on mastodon.social, or send us a pull request. Want to get involved? We love contributions.

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Project/Tooling Updates

• An update on Apple M1/M2 GPU drivers
• Announcing Toasty, an async ORM for Rust
• gitoxide - October 2024
• Glues v0.4 - MongoDB support and Vim editing features
• Meilisearch 1.11 - AI-powered search & federated search improvements

Observations/Thoughts

• Toward safe transmutation in Rust
• The performance of the Rust compiler
• A new approach to validating test suites
• Why You Shouldn't Arc a HashMap in Rust
• Implementing the Tower Service Trait
• Best Practices for Derive Macro Attributes in Rust
• Trimming down a rust binary in half
• A deep look into our new massive multitenant architecture
• Unsafe Rust Is Harder Than C
• Generators with UnpinCell
• Which LLM model is best for generating Rust code?
• Learnings from Contributing to the Rust Project
• Dyn Box Vs. Generics: What is the best approach for achieving conditional generics in Rust?

Rust Walkthroughs

• Basic Integer Compression

Miscellaneous

• Rust Prism
• [audio] Rust vs. C++ with Steve Klabnik and Herb Sutter
• [audio] What's New in Rust 1.76, 1.77, and 1.78
• [video] Talk on Chrome's new Rust font stack, fontations
• [video] Architecting a Rust Game Engine (with Alice Cecile)
• [video] Gitoxide: What it is, and isn't - Sebastian Thiel

Crate of the Week

This week's crate is tower-http-client, a library of middlewares and various utilities for HTTP-clients.

Thanks to Aleksey Sidorov for the self-suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization. The following RFCs would benefit from user testing before moving forward:

RFCs

• No calls for testing were issued this week.

Rust

• No calls for testing were issued this week.

Rustup

• No calls for testing were issued this week.

If you are a feature implementer and would like your RFC to appear on the above list, add the new call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

• wtx - [HTTP/2] Investigate requests latency

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on X (formerly Twitter) or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on X (formerly Twitter) or Mastodon!

Updates from the Rust Project

447 pull requests were merged in the last week

• add wasm32v1-none target
• AIX: use /dev/urandom for random implementation
• rustc_target: Add pauth-lr aarch64 target feature
• add a note for ? on a impl Future<Output = Result<..>> in sync function
• add support for ~const item bounds
• consider param-env candidates even if they have errors
• const stability checks v2
• coverage: consolidate creation of covmap/covfun records
• coverage: don't rely on the custom traversal to find enclosing loops
• coverage: emit LLVM intrinsics using the normal helper method
• coverage: pass coverage mappings to LLVM as separate structs
• deeply normalize TypeTrace when reporting type error in new solver
• deny calls to non-#[const_trait] methods in MIR constck
• do not remove .cargo directory
• don't stage-off to previous compiler when CI rustc is available
• emit future-incompatibility lint when calling/declaring functions with vectors that require missing target feature
• enable LSX feature for LoongArch Linux targets
• error on alignments greater than isize::MAX
• expand: stop using artificial ast::Item for macros loaded from metadata
• fixup Windows verbatim paths when used with the include! macro
• hashStable for rustc_feature::Features: stop hashing compile-time constant
• lint against getting pointers from immediately dropped temporaries
• move cmp_in_dominator_order out of graph dominator computation
• pass constness with span into lower_poly_trait_ref
• prevent overflowing enum cast from ICEing
• refactor change detection for rustdoc and download-rustc
• replace an FTP link in comments with an equivalent HTTPS link
• replace some LLVMRust wrappers with calls to the LLVM C API
• represent hir::TraitBoundModifiers as distinct parts in HIR
• represent trait constness as a distinct predicate
• round negative signed integer towards zero in iN::midpoint
• simplify force-recompile logic for "library"
• simplify param handling in resolve_bound_vars
• taking a raw ref (&raw (const|mut)) of a deref of pointer (*ptr) is always safe
• use Enabled{Lang,Lib}Feature instead of n-tuples
• validate args are correct for UnevaluatedConst, ExistentialTraitRef/ExistentialProjection
• x86 target features: make pclmulqdq imply sse2
• x86-32 float return for 'Rust' ABI: treat all float types consistently
• miri: add option for generating coverage reports
• miri: android: added syscall support
• miri: clear eval_libc errors from unix shims
• miri: consistently use io error handlers
• miri: fix error returned from readdir_r when isolation is enabled, and uses of raw_os_error
• miri: implement LLVM x86 vpclmulqdq intrinsics
• miri: indicate more explicitly where we close host file/dir handles
• (Big performance change) Do not run lints that cannot emit
• optimize Rc<T>::default
• specialize read_exact and read_buf_exact for VecDeque
• stabilize isqrt feature
• stabilize shorter-tail-lifetimes
• support char::is_digit in const contexts
• remove the Arc rt::init allocation for thread info
• provide a default impl for Pattern::as_utf8_pattern
• vectorized SliceContains
• avoid using imports in thread_local_inner! in static
• better default capacity for str::replace
• musl: use posix_spawn if a directory change was requested
• cargo resolver: Make room for v3 resolver
• cargo complete: Include descriptions in zsh
• cargo env: remove unnecessary clones
• cargo: fingerprint: avoid unnecessary fopen calls
• cargo: added unstable-schema generation for Cargo.toml
• cargo: deprecate cargo verify-project
• cargo fix: add source replacement info when no matching package found
• cargo fix: trace config [env] table in dep-info
• cargo test: add fixes in the sat resolver
• rustdoc: Do not consider nested functions as main function even if named main in doctests
• rustdoc: extend fake_variadic to "wrapped" tuples
• rustdoc: hash assets at rustdoc build time
• allow type-based search on foreign functions
• clippy: borrow_deref_ref: do not trigger on &raw references
• clippy: don't trigger const_is_empty for inline const assertions
• clippy: fire large_const_arrays for computed array lengths
• clippy: fix incorrect suggestion for !(a >= b) as i32 == c
• clippy: fix not working lint anchor (generation and filtering)
• clippy: remove unnecessary filter_map usages
• clippy: stop linting unused_io_amount in io traits
• rust-analyzer: add text edits to more inlay hints
• rust-analyzer: implement diagnostics pull model
• rust-analyzer: render docs from aliased type when type has no docs
• rust-analyzer: resolve range patterns to their structs
• rust-analyzer: split macro-error diagnostic so users can ignore only parts of it
• rust-analyzer: support cfg(true) and cfg(false)
• rust-analyzer: fix diagnostic enable config being ignored
• rust-analyzer: fix dyn incompatible hint message
• rust-analyzer: fix formatting on welcome page, read only paths setting example
• rust-analyzer: add missing cfg flags for core crate
• rust-analyzer: allow public re-export of extern crate import
• rust-analyzer: correctly handle #"" in edition <2024
• rust-analyzer: don't compute diagnostics for non local files
• rust-analyzer: fix checking for false labelDetailsSupport value
• rust-analyzer: fix incorrect parsing of use bounds
• rust-analyzer: handle missing time offsets gracefully
• rust-analyzer: implement mixed site hygiene
• rust-analyzer: nail destructuring assignment once and for all
• rust-analyzer: prevent public re-export of private item
• rust-analyzer: properly resolve prelude paths inside modules inside blocks
• rust-analyzer: put leading | in patterns under OrPat
• rust-analyzer: turn "Remove dbg!" into a quick fix for better prioritization
• rust-analyzer: move text-edit into ide-db
• rust-analyzer: only construct a resolver in macro descension when needed
• rust-analyzer: swap query call order in file_item_tree_query

Rust Compiler Performance Triage

This week saw a lot of activity both on the regressions and improvements side. There was one large regression, which was immediately reverted. Overall, the week ended up being positive, thanks to a rollup PR that caused a tiny improvement to almost all benchmarks.

Triage done by @kobzol. Revision range: 3e33bda0..c8a8c820

Summary:

6 Regressions, 6 Improvements, 4 Mixed; 6 of them in rollups 58 artifact comparisons made in total

Full report here

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

• No RFCs were approved this week.

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

RFCs

• No RFCs entered Final Comment Period this week.

Tracking Issues & PRs

Rust

• [disposition: merge] Decide whether blocks inside asm goto should default to safe
• [disposition: merge] #[inline(never)] does not work for async functions
• [disposition: not specified] Add LowerExp and UpperExp implementations to NonZero

Cargo

• No Cargo Tracking Issues or PRs entered Final Comment Period this week.

Language Team

• No Language Team Proposals entered Final Comment Period this week.

Language Reference

• No Language Reference RFCs entered Final Comment Period this week.

Unsafe Code Guidelines

• No Unsafe Code Guideline Tracking Issues or PRs entered Final Comment Period this week.

New and Updated RFCs

• [new] RFC: Labeled match
• [new] RFC: Never patterns
• [new] [RFC] Allow packed types to transitively contain aligned types
• [new] [RFC] Target Modifiers

Upcoming Events

Rusty Events between 2024-10-30 - 2024-11-27 🦀

Virtual

• 2024-10-31 | Virtual (Charlottesville, NC, US) | Charlottesville Rust Meetup
  • Crafting Interpreters in Rust Collaboratively
• 2024-10-31 | Virtual (Nürnberg, DE) | Rust Nurnberg DE
  • Rust Nürnberg online
• 2024-11-01 | Virtual (Jersey City, NJ, US) | Jersey City Classy and Curious Coders Club Cooperative
  • Rust Coding / Game Dev Fridays Open Mob Session!
• 2024-11-02 | Virtual( Kampala, UG) | Rust Circle Kampala
  • Rust Circle Meetup
• 2024-11-06 | Virtual (Indianapolis, IN, US) | Indy Rust
  • Indy.rs - with Social Distancing
• 2024-11-07 | Virtual (Berlin, DE) | OpenTechSchool Berlin + Rust Berlin
  • Rust Hack and Learn | Mirror: Rust Hack n Learn Meetup
• 2024-11-08 | Virtual (Jersey City, NJ, US) | Jersey City Classy and Curious Coders Club Cooperative
  • Rust Coding / Game Dev Fridays Open Mob Session!
• 2024-11-12 | Virtual (Dallas, TX, US) | Dallas Rust
  • Second Tuesday
• 2024-11-14 | Virtual (Charlottesville, NC, US) | Charlottesville Rust Meetup
  • Crafting Interpreters in Rust Collaboratively
• 2024-11-14 | Virtual and In-Person (Lehi, UT, US) | Utah Rust
  • Green Thumb: Building a Bluetooth-Enabled Plant Waterer with Rust and Microbit
• 2024-11-14 | Virtual and In-Person (Seattle, WA, US) | Seattle Rust User Group
  • November Meetup
• 2024-11-15 | Virtual (Jersey City, NJ, US) | Jersey City Classy and Curious Coders Club Cooperative
  • Rust Coding / Game Dev Fridays Open Mob Session!
• 2024-11-19 | Virtual (Los Angeles, CA, US) | DevTalk LA
  • Discussion - Topic: Rust for UI
• 2024-11-19 | Virtual (Washington, DC, US) | Rust DC
  • Mid-month Rustful
• 2024-11-20 | Virtual and In-Person (Vancouver, BC, CA) | Vancouver Rust
  • Embedded Rust Workshop
• 2024-11-21 | Virtual (Charlottesville, NC, US) | Charlottesville Rust Meetup
  • Trustworthy IoT with Rust--and passwords!
• 2024-11-21 | Virtual (Rotterdam, NL) | Bevy Game Development
  • Bevy Meetup #7
• 2024-11-26 | Virtual (Dallas, TX, US) | Dallas Rust
  • Last Tuesday

Europe

• 2024-10-30 | Hamburg, DE | Rust Meetup Hamburg
  • Rust Hack & Learn October 2024
• 2024-10-31 | Berlin, DE | OpenTechSchool Berlin + Rust Berlin
  • Rust and Tell - Title
• 2024-10-31 | Copenhagen, DK | Copenhagen Rust Community
  • Rust meetup #52 sponsored by Trifork and OpenZeppelin
• 2024-11-05 | Copenhagen, DK | Copenhagen Rust Community
  • Rust Hack Night #10: Rust <3 Nix
• 2024-11-06 | Oxford, UK | Oxford Rust Meetup Group
  • Oxford Rust and C++ social
• 2024-11-06 | Paris, FR | Paris Rustaceans
  • Rust Meetup in Paris
• 2024-11-12 | Zurich, CH | Rust Zurich
  • Encrypted/distributed filesystems, wasm-bindgen
• 2024-11-13 | Reading, UK | Reading Rust Workshop
  • Reading Rust Meetup
• 2024-11-14 | Stockholm, SE | Stockholm Rust
  • Rust Meetup @UXStream
• 2024-11-19 | Leipzig, DE | Rust - Modern Systems Programming in Leipzig
  • Daten sichern mit ZFS (und Rust)
• 2024-11-21 | Edinburgh, UK | Rust and Friends
  • Rust and Friends (pub)
• 2024-11-21 | Oslo, NO | Rust Oslo
  • Rust Hack'n'Learn at Kampen Bistro
• 2024-11-23 | Basel, CH | Rust Basel
  • Rust + HTMX - Workshop #3

North America

• 2024-10-30 | Chicago, IL, US | Deep Dish Rust
  • Rust Workshop: deploying your code
• 2024-10-31 | Mountain View, CA, US | Mountain View Rust Meetup
  • Rust Meetup at Hacker Dojo
• 2024-11-04 | Brookline, MA, US | Boston Rust Meetup
  • Coolidge Corner Brookline Rust Lunch, Nov 4
• 2024-11-07 | Montréal, QC, CA | Rust Montréal
  • November Monthly Social
• 2024-11-07 | St. Louis, MO, US | STL Rust
  • Game development with Rust and the Bevy engine
• 2024-11-12 | Ann Arbor, MI, US | Detroit Rust
  • Rust Community Meetup - Ann Arbor
• 2024-11-14 | Mountain View, CA, US | Hacker Dojo
  • Rust Meetup at Hacker Dojo
• 2024-11-15 | Mexico City, DF, MX | Rust MX
  • Multi threading y Async en Rust parte 2 - Smart Pointes y Closures
• 2024-11-15 | Somerville, MA, US | Boston Rust Meetup
  • Ball Square Rust Lunch, Nov 15
• 2024-11-19 | San Francisco, CA, US | San Francisco Rust Study Group
  • Rust Hacking in Person
• 2024-11-23 | Boston, MA, US | Boston Rust Meetup
  • Boston Common Rust Lunch, Nov 23
• 2024-11-25 | Ferndale, MI, US | Detroit Rust
  • Rust Community Meetup - Ferndale
• 2024-11-27 | Austin, TX, US | Rust ATX
  • Rust Lunch - Fareground

Oceania

• 2024-10-31 | Auckland, NZ | Rust AKL
  • Rust AKL: Rust on AWS: Sustainability + Peace: Zero Stress Automation
• 2024-11-12 | Christchurch, NZ | Christchurch Rust Meetup Group
  • Christchurch Rust Meetup

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

An earnest effort to pursue [P1179R1] as a Lifetime TS[P3465R0] will compromise on C++'s outdated and unworkable core principles and adopt mechanisms more like Rust's. In the compiler business this is called carcinization: a tendency of non-crab organisms to evolve crab-like features. - Sean Baxter on circle-lang.org

Thanks to Collin Richards for the suggestion!

Please submit quotes and vote for next week!

This Week in Rust is edited by: nellshamrell, llogiq, cdmistman, ericseppanen, extrawurst, andrewpollack, U007D, kolharsam, joelmarcey, mariannegoldin, bennyvasquez.

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

30 Oct 2024 4:00am GMT

WebDriver is a remote control interface that enables introspection and control of user agents. As such it can help developers to verify that their websites are working and performing well with all major browsers. The protocol is standardized by the W3C and consists of two separate specifications: WebDriver classic (HTTP) and the new WebDriver BiDi (Bi-Directional).

This newsletter gives an overview of the work we've done as part of the Firefox 132 release cycle.

Contributions

Firefox - including our WebDriver implementation - is developed as an open source project, and everyone is welcome to contribute. If you ever wanted to contribute to an open source project used by millions of users, or are interested in some experience in software development, jump in.

We are always grateful to receive external contributions, here are the ones which made it in Firefox 132:

• Liam (ldebeasi) refactored our internal logic tracking navigation events to remove a redundant map and simplify the implementation
• Liam (ldebeasi) also improved the signature of one of our internal helpers used to retrieve browsing context details

WebDriver code is written in JavaScript, Python, and Rust so any web developer can contribute! Read how to setup the work environment and check the list of mentored issues for Marionette, or the list of mentored JavaScript bugs for WebDriver BiDi.

WebDriver BiDi

Retry commands to avoid AbortError failures

In release 132, one of our primary focus areas was enhancing the reliability of command execution.

Internally, we sometimes need to forward commands to content processes. This can easily fail, particularly when targeting a page which was either newly created or in the middle of a navigation. These failures often result in errors such as "AbortError: Actor 'MessageHandlerFrame' destroyed before query 'MessageHandlerFrameParent:sendCommand' was resolved".

<- {
  "type":"error",
  "id":14,
  "error":"unknown error",
  "message":"AbortError: Actor 'MessageHandlerFrame' destroyed before query 'MessageHandlerFrameParent:sendCommand' was resolved",
  "stacktrace":""
}

While there are valid technical reasons that prevent command execution in some cases, there are also many instances where retrying the command is a feasible solution.

The browsingContext.setViewport command was specifically updated in order to retry an internal command, as it was frequently failing. Then we updated our overall implementation in order to retry commands automatically if we detect that the page is navigating or about to navigate. Note that retrying commands is not entirely new, it's an internal feature we were already using in a few handpicked commands. The changes in Firefox 132 just made its usage much more prevalent.

New preference: remote.retry-on-abort

To go one step further, we decided to allow all commands to be retried by default when the remote.retry-on-abort preference is set to true. Note that true is the default value, which means that with Firefox 132, all commands which need to reach the content process might now be retried (documentation). If you were previously relying on or working around the aforementioned AbortError, and notice an unexpected issue with Firefox 132, you can update this preference to make the behavior closer to previous Firefox versions. Please also file a Bug to let us know about the problem.

Bug fixes

• The browsingContext.contextCreated event is now correctly emitted for lazy-loaded frames. Previously the event would only be emitted when the iframe actually started loading its content.
• Network events are now correctly emitted for cached stylesheet requests.
• Network event timings were previously using the wrong unit and were provided in microseconds. They are now set in milliseconds as expected by the specification.
• The requestTime from network event timings should now be more accurate and really match the time where the request actually started.
• Fixed a bug where some commands (such as session.subscribe) could fail if a browsing context was not initialized or was being destroyed.

29 Oct 2024 2:00pm GMT

Hi Mozillians,

In today's edition, I'd like to introduce you all to Michele Rodaro, a locale leader for Italian in the Mozilla Support platform. He is a professional architect, but finding pleasure and meaning in contributing to Mozilla since 2006. I've met him on several occasions in the past, and reading his answers feels exactly like talking to him in real life. I'm sure you can sense his warmth and kindness just by reading his responses. Here's a beautiful analogy from Michele about his contributions to Mozilla as they relate to his background in architecture:

I see my contribution to Mozilla a bit like participating in the realization of a project, the tools change but I believe the final goal is the same: helping to build a beautiful house where people feel comfortable, where they live well, where there are common spaces, but also personal spaces where privacy must be the priority.

Q: Hi Michele, can you tell us more about yourself and what keeps you busy these days?

I live in Gemona del Friuli, a small town in the Friuli Venezia Giulia region, in the north-east of Italy, bordering Austria and Slovenia. I am a freelance architect, having graduated from Venice's University many years ago. I own a professional studio and I mainly deal with residential planning, renovations, and design. In my free time I like to draw, read history, art, literature, satire and comics, listen to music, take care of my cats and, of course, translate or update SUMO Knowledge Base articles into Italian.

When I was younger, I played many sports (skiing, basketball, rugby, and athletics). When I can, I continue to go skiing in the beautiful mountains of my region. Oh, I also played piano in a jazz rock band I co-founded in the late 70s and early 80s (good times). In this period, from a professional point of view, I am trying to survive the absurd bureaucracy that is increasingly oppressive in my working environment. As for SUMO, I am maintaining the Italian KB at 100% of the translations, and supporting new localizers to help them align with our translation style.

Q: You get started with the Italian local forum in 2006 before you expand your contribution to SUMO in 2008. Can you tell us more about what are the different types of contributions that you're doing for Mozilla?

I found out about Firefox in November 2005 and discovered the Mozilla Italia community and their support forum. Initially, I used the forum to ask for help from other volunteers and, after a short time, I found myself personally involved in providing online assistance to Italian users in need. Then I became a moderator of the forum and in 2008, with the help of my friend @Underpass, I started contributing to the localization of SUMO KB articles (the KB was born in that year). It all started like that.

Today, I am an Italian locale leader in SUMO. I take care of the localization of KB articles and train new Italian localizers. I continue to provide support to users on the Italian forums and when I manage to solve a problem I am really happy, but my priority is the SUMO KB because it is an essential source to help users who search online for an immediate solution to any problem encountered with Firefox on all platforms and devices or with Thunderbird, and want to learn the various features of Mozilla applications and services. Forum support has also benefited greatly from KB articles because, instead of having to write down all the procedures to solve a user's problem every time, we can simply provide them with the link to the article that could solve the problem without having to write the same things every time, especially when the topic has already been discussed many times, but users have not searched our forum.

Q: In addition to translating articles on SUMO, you're also involved in product translation on Pontoon. With your experience across both platforms, what do you think SUMO can learn from Pontoon, and how can we improve our overall localization process?

I honestly don't know, they are quite different ways of doing things in terms of using translation tools specifically. I started collaborating with Pontoon's Italian l10n team in 2014… Time flies… The rules, the style guides, and the QA process adopted for the Italian translations on Pontoon are the same ones we adopted for SUMO. I have to say that I am much more comfortable with SUMO's localization process and tool, maybe because I have seen it start off, grow and evolve over time. Pontoon introduced Pretranslation, which helps a lot in translating strings, although it still needs improvements. A machine translation of strings that are not already in Pontoon's "Translation Memory" is proposed. Sometimes that works fine, other times we need to correct the proposal and save it after escalating it on GitHub, so that in the future that translation becomes part of the "Translation Memory". If the translation of a string is not accurate, it can be changed at any time.

I don't know if it can be a solution for some parts of SUMO articles. We already have templates, maybe we should further implement the creation and use of templates, focusing on this tool, to avoid typing the translation of procedures/steps that are repeated identically in many articles.

Q: What are the biggest challenges you're currently facing as a SUMO contributor? Are there any specific technical issues you think should be prioritized for fixing?

Being able to better train potential new localizers, and help infuse the same level of passion that I have in managing the Italian KB of SUMO. As for technical issues, staying within the scope of translating support articles, I do not encounter major problems in terms of translating and updating articles, but perhaps it is because I now know the strengths and weaknesses of the platform's tools and I know how to manage them.

Maybe we could find a way to remedy what is usually the most frustrating thing for a contributor/localizer who, for example, is updating an article directly online: the loss of their changes after clicking the "Preview Content" button. That is when you click on the "Preview Content" button after having translated an article to correct any formatting/typing errors. If you accidentally click a link in the preview and don't right-click the link to select "Open Link in New Tab" from the context menu, the link page opens replacing/overwriting the editing page and if you try to go back everything you've edited/translated in the input field is gone forever… And you have to start over. A nightmare that happened to me more than once often because I was in a hurry. I used to rely on a very good extension that saved all the texts I typed in the input fields and that I could recover whenever I wanted, but it is no longer updated for the newer versions of Firefox. I've tried others, but they don't convince me. So, in my opinion, there should be a way to avoid this issue without installing extensions. I'm not a developer, I don't know if it's easy to find a solution, but we have Mozilla developers who are great ;)

Maybe there could be a way to automatically save a draft of the edit every "x" seconds to recover it in case of errors with the article management. Sometimes, even the "Preview Content" button could be dangerous. If you accidentally lost your Internet connection and didn't notice, if you click on that button, the preview is not generated, you lose everything and goodbye products!

Q: Your background as a freelance architect is fascinating! Could you tell us more about that? Do you see any connections between your architectural work and your contribution to Mozilla, or do you view them as completely separate aspects of your life?

As an architect I can only speak from my personal experience, because I live in a small town, in a beautiful region which presents me with very different realities than those colleagues have to deal with in big cities like Rome or Milan. Here everything is quieter, less frenetic, which is sometimes a good thing, but not always. The needs of those who commission a project are different if you have to carry it out in a big city, the goal is the same but, urban planning, local building regulations, available spaces in terms of square footage, market requests/needs, greatly influence the way an architect works. Professionally I have had many wonderful experiences in terms of design and creativity (houses, residential buildings, hotels, renovations of old rural or mountain buildings, etc.), challenges in which you often had to play with just a centimeter of margin to actually realize your project.

Connection between architecture and contribution to Mozilla? Good question. I see my contribution to Mozilla a bit like participating in the realization of a project, the tools change but I believe the final goal is the same: helping to build a beautiful house where people feel comfortable, where they live well, where there are common spaces, but also personal spaces where privacy must be the priority. If someone wants our "cookies" and unfortunately often not only those, they have to knock, ask permission and if we do not want to have intrusive guests, that someone has to turn around, go away and let us do our things without sticking their nose in. This is my idea of ​​Mozilla, this is the reason that pushed me to believe in its values ​​(The user and his privacy first) and to contribute as a volunteer, and this is what I would like to continue to believe even if someone might say that I am naive, that "they are all the same".

My duty as an architect is like that of a good parent, when necessary I must always warn my clients about why I would advise against certain solutions that I, from professional experience, already know are difficult to implement or that could lead to future management and functionality problems. In any case I always look for solutions that can satisfy my clients' desires. Design magazines are beautiful, but it is not always possible to reproduce a furnishing solution in living environments that are completely different from the spaces of a showroom set up to perfection for a photo shoot… Mozilla must continue to do what it has always done, educate and protect users, even those who do not use its browser or its products, from those "design magazines" that could lead them to inadvertently make bad choices that they could regret one day.

Q: Can you tell us more about the Italian locale team in SUMO and how do you collaborate with each other?

First of all, it's a fantastic team! Everyone does what they do best, there are those who help users in need on the forums, those who translate, those who check the translations and do QA by reporting things that need to be corrected or changed, from punctuation errors to lack of fluency or clarity in the translation, those who help with images for articles because often the translator needs the specific image for an operating system that he does not have.

As for translations, which is my main activity, we usually work together with 4- 5 collaborators/friends, and we use a consolidated procedure. Translation of an article, opening a specific discussion for the article in the forum section dedicated to translations with the link of the first translation and the request for QA. Intervention of anyone who wants to report/suggest a correction or a change to be made, modification, link to the new revised version based on the suggestions, rereading and if everything is ok, approval and publication. The translation section is public - like all the other sections of the Mozilla Italia forum - and anyone can participate in the discussion.

We are all friends, volunteers, some of us know each other only virtually, others have had the chance to meet in person. The atmosphere is really pleasant and even when a discussion goes on too long, we find a way to lighten the mood with a joke or a tease. No one acts as the professor, we all learn something new. Obviously, there are those like me who are more familiar with the syntax/markup and the tools of the SUMO Wiki and those who are less, but this is absolutely not a problem to achieve the final result which is to provide a valid guide to users.

Q: Looking back on your contribution to SUMO, what was the most memorable experience for you? Anything that you're most proud of?

It's hard to say… I'm not a tech geek, I don't deal with code, scripts or computer language so my contribution is limited to translating everything that can be useful to Italian users of Mozilla products/programs. So I would say: the first time I reached the 100% translation percentage of all the articles in the Italian dashboard. I have always been very active and available over the years with the various Content Managers of SUMO. When I received their requests for collaboration, I did tests, opened bugs related to the platform, and contributed to the developers' requests by testing the procedures to solve those bugs.

As for the relationship with the Mozilla community, the most memorable experience was undoubtedly my participation in the Europe MozCamp 2009 in Prague, my "first time", my first meeting with so many people who then became dear friends, not only in the virtual world. I remember being very excited about that invitation and fearful for my English, which was and is certainly not the best. An episode: Prague, the first Mozilla talk I attended. I was trying to understand as much as possible what the speaker was saying in English. I heard this strange word "eltenen… eltenen… eltenen" repeated several times. What did it mean? After a while I couldn't take it anymore, I turned to an Italian friend who was more expert in the topics discussed and above all who knew the English language well. Q: What the hell does "eltenen" mean? A: "Localization". Q: "Localization???" A: "l10n… L ten n… L ocalizatio n". Silence, embarrassment, damn acronyms!

How could I forget my first trip outside of Europe to attend the Mozilla Summit in Whistler, Canada in the summer of 2010? It was awesome, I was much more relaxed, decided not to think about the English language barrier and was able to really contribute to the discussions that we, SUMO localizers and contributors from so many countries around the world, were having to talk about our experience, try to fix the translation platform to make it better for us and discuss all the potential issues that Firefox was having at the time. I really talked a lot and I think the "Mozillians" I interacted with even managed to understand what I was saying in English :)

The subsequent meetings, the other All Hands I attended, were all a great source of enthusiasm and energy! I met some really amazing people!

Q: Lastly, can you share tips for those who are interested in contributing to Italian content localization or contributing to SUMO in general?

Every time a new localizer starts collaborating with us I don't forget all the help I received years ago! I bend over backwards to put them at ease, to guide them in their first steps and to be able to transmit to them the same passion that was transmitted to me by those who had to review with infinite patience my first efforts as a localizer. So I would say: first of all, you must have passion and a desire to help people. If you came to us it's probably because you believe in this project, in this way of helping people. You can know the language you are translating from very well, but if you are not driven by enthusiasm everything becomes more difficult and boring. Don't be afraid to make mistakes, if you don't understand something ask, you're among friends, among traveling companions. As long as an article is not published we can correct it whenever we want and even after publication. We were all beginners once and we are all here to learn. Take an article, start translating it and above all keep it updated.

If you are helping on the support forums, be kind and remember that many users are looking for help with a problem and often their problems are frustrating. The best thing to do is to help the user find the answer they are looking for. If a user is rude, don't start a battle that is already lost. You are not obligated to respond, let the moderators intervene. It is not a question of wanting to be right at all costs but of common sense.

29 Oct 2024 6:11am GMT

Satire Without Purpose Will Wander In Dark Places Broadly labelling the entirety of Warhammer 40,000 as satire is no longer sufficient to address what the game has become in the almost 40 years since its inception. It also fails to answer the rather awkward question of why, exactly, these fascists who are allegedly too stupid to understand satire are continually showing up in your satirical community in the first place.

Why I'm staying with Firefox for now - Michael Kjörling [T]he most reasonable option is to keep using Firefox, despite the flaws of the organization behind it. So far, at least these things can be disabled through settings (for example, their privacy-preserving ad measurement), and those settings can be prepared in advance.

Google accused of shadow campaigns redirecting antitrust scrutiny to Microsoft, Google's Shadow Campaigns (so wait a minute, Microsoft won't let companies use their existing Microsoft Windows licenses for VMs in the Google cloud, and Google is doing a sneaky advocacy campaign? Sounds like content marketing for Amazon Linux^®

Scripting News My friends at Automattic showed me how to turn on ActivityPub on a WordPress site. I wrote a test post in my simple WordPress editor, forgetting that it would be cross-posted to Mastodon. When I just checked in on Masto, there was the freaking post. After I recovered from passing out, I wondered what happens if I update the post in my editor, and save it to the WordPress site that's hooked up to Masto via ActivityPub. So I made a change and saved it. I waited and waited, nothing happened. I got ready to add a comment saying ahh I guess it doesn't update, when-it updated. (Like being happy when a new web site opening in a new browser, a good sign that ActivityPub is the connecting point for this kind of connected innovation.) Related: The Web Is a Customer Service Medium (Ftrain.com) by Paul Ford.

China Telecom's next 150,000 servers will mostly use local processors Among China Telecom's server buys this year are machines running processors from local champion Loongson, which has developed an architecture that blends elements of RISC-V and MIPS.

Removal of Russian coders spurs debate about Linux kernel's politics Employees of companies on the Treasury Department's Office of Foreign Assets Control list of Specially Designated Nationals and Blocked Persons (OFAC SDN), or connected to them, will have their collaborations subject to restrictions, and cannot be in the MAINTAINERS file.

The TikTokification of Social Media May Finally Be Its Undoing by Julia Angwin. If tech platforms are actively shaping our experiences, after all, maybe they should be held liable for creating experiences that damage our bodies, our children, our communities and our democracy.

Cheap Solar Panels Are Changing the World The latest global report from the International Energy Agency (IEA) notes that solar is on track to overtake all other forms of energy by 2033.

Conceptual models of space colonization - Charlie's Diary (one more: Kurt Vonnegut's concept for spreading genetic material)

(protip: you can always close your browser tabs with creepy tech news, there will be more in a few minutes… Location tracking of phones is out of control. Here's how to fight back. LinkedIn fined $335 million in EU for tracking ads privacy breaches Pinterest faces EU privacy complaint over tracking ads Dems want tax prep firms charged for improper data sharing Dow Jones says Perplexity is "freeriding," sues over copyright infringement You Have a 'Work Number' on This Site, and You Should Freeze It Roblox stock falls after Hindenburg blasts the social gaming platform over bots and pedophiles)

It Was Ten Years Ago Today that David Rosenthal predicted that cryptocurrency networks will be dominated by a few, perhaps just one, large participant.

Writing Projects (good start for a checklist before turning in a writing project. Maybe I should write Git hooks for these.)

Word.(s). (Includes some good vintage car ads. Remember when most car ads were about the car, not just buttering up the driver with how successful you must be to afford this thing?)

Social Distance and the Patent System [I]t was clear from our conversation that [Judge Paul] Michel doesn't have a very deep understanding of the concerns of many in the software industry. And, more to the point, he clearly wasn't very interested in understanding those concerns better or addressing them. On a theoretical level, he knew that there was a lot of litigation in the software industry and that a lot of people were upset about it. But like Fed and the unemployment rate, this kind of theoretical knowledge doesn't always create a sense of urgency. One has to imagine that if people close to Michel-say, a son who was trying to start a software company-were regularly getting hit by frivolous patent lawsuits, he would suddenly take the issue more seriously. But successful software entrepreneurs are a small fraction of the population, and most likely no judges of the Federal Circuit have close relationships with one.

(Rapids is the script that gathers these, and it got a clean bill of health from the feed reader score report after I fixed the Last-Modified/If-Modified-Since and Etag handling. So expect more link dump posts here, I guess.)

29 Oct 2024 12:00am GMT

We've recently finished two significant changes to how Mozilla Accounts handles password hashes which will improve security and increase flexibility around changing emails. The changes are entirely transparent to end-users and are applied automatically when someone logs in.

Randomizing Salts

If a system is going to store passwords, best practice is to hash the password with a unique salt per row. When accounts was first built we used an account's email address as the unique salt for password hashing. This saved a column in the database and some bandwidth but overall I think was a poor idea. It meant people couldn't re-use their email addresses and it leaves PII sitting around unnecessarily.

Instead, a better idea is just to generate a random salt. We've now transitioned Mozilla Accounts to random salts.

Increasing Key Stretching Iterations

Eight years ago Ryan Kelly filed bug 1320222 to review Mozilla Accounts' client-side key stretching capabilities and sparked a spirited conversation about iterations and the priority of the bug. Overall, this is routine maintenance - we expect any amount of stretching we do will have to be revisited periodically due to hardware improving and the value we choose is a compromise between security and time to login, particularly on older hardware.

Since we were generating new hashes for the random salts already we took the opportunity to increase our PBKDF2 iterations from 1000 to 650000 - a number we're seeing others in the industry using. This means logging in with slower hardware (like older mobile phones) may be noticeably slower. Below is an excerpt from the analysis we did showing a Macbook from 2007 will take an additional ~3 seconds to log in:

Implementation

Dan Schomburg did the heavy lifting to make this a smooth and successful project. He built the v2 system alongside v1 so both hashes are generated simultaneously and if the v2 exists the login system will use that. This lets us roll the feature out slowly and gives us control if we need to disable it or roll back.

We tested the code for several months on our staging server before rolling it out in production. When we did enable it in production it was over the course of several weeks via small percentages while we watched for unintended side-effects and bug reports.

I'm pleased to say everything appers to be working smoothly. As always, if you notice any issues please let us know.

28 Oct 2024 7:00am GMT

Right now I'm not using these, but they look useful and/or fun.

• Departure Mono: vintage-looking, pixelated, lo-fi technical vibe.

• Atkinson Hyperlegible Font was carefully developed by the Braille Institute to help low-vision readers. It improves legibility and readability through clear, and distinctive letters and numbers.

I'm trying to keep this site fairly small and fast, so getting by with Modern Font Stacks as much as possible.

Related

colophon

Bonus links

(these are all web development, editing, and business, more or less. Yes, I'm still working on my SCALE proposal, deadline coming up.)

Before you buy a domain name, first check to see if it's haunted

Discover Wiped Out MFA Spend By Following These Four Basic Steps (This headline underrates the content. If all web advertisers did these tips, then 90% of the evil stuff on the Internet would be gone-most of the web's problems are funded by advertisers and agencies who fail to pay attention to the context in which their ads appear.)

Janky remote backups without root on the far end

My solar-powered and self-hosted website

Let's bring back browsing

Hell Gate NYC doubled its subscription revenue in its second year as a worker-owned news outlet

Is Matt Mullenweg defending WordPress or sabotaging it?

Gosub - An open-source browser engine

Take that

Thunderbird Android client is K-9 Mail reborn, and it's in solid beta

A Bicycle for the Mind - Prologue

Why I Migrated My Newsletter From Substack to Eleventy and Buttondown - Richard MacManus

My Blog Engine is the Erlang Build Tool

A Developer's Guide to ActivityPub and the Fediverse

27 Oct 2024 12:00am GMT

Doc Searls writes, in Personal Agentic AI,

Wouldn't it be good for corporate AI agents to have customer hands to shake that are also equipped with agentic AI? Wouldn't those customers be better than ones whose agency is merely human, and limited to only what corporate AI agents allow?

The obvious answer for business decision-makers today is: lol, no, a locked-in customer is worth more. If, as a person who likes to watch TV, you had an AI agent, then the agent could keep track of sports seasons and the availability of movies and TV shows, and turn your streaming subscriptions on and off. In the streaming business, like many others, the management consensus is to make things as hard and manual as possible on the customer side, and save the automation for the company side. Just keeping up with watching a National Football League team is hard…even for someone who is ON the team. Automation asymmetry, where the seller gets to reduce service costs while the customer has to do more and more manual work, is seen as a big win by the decision-makers on the high-automation side.

Big company decision-makers don't want to let smaller companies have their own agentic tools, either. Getting a DMCA Exemption to let McDonald's franchisees fix their ice cream machines was a big deal that required a lengthy process with the US Copyright Office. Many other small businesses are locked in to the manual, low-information side of a business relationship with a larger one. (Web advertising is another example. Google shoots at everyone's feet, and agencies, smaller firms, and browser extension developers dance.)Google employees and shareholders would be better off if it were split into two companies that could focus on useful projects for independent customers who had real choices.

The first wave of user reactions to AI is happening, and it's adversarial. Artists on sites like DeviantArt went first, and now Reddit users are deliberately posting fake answers to feed Google's AI. On the shopping side, avoiding the output of AI and made-for-AI deceptive crap is becoming a must-have mainstream skill, as covered in How to find helpful content in a sea of made-for-Google BS and How Apple and Microsoft's trusted brands are being used to scam you. As Baldur Bjarnason writes,

The public has for a while now switched to using AI as a negative-using the term artificial much as you do with artificial flavouring or that smile's artificial. It's insincere creativity or deceptive intelligence.

Other news is even worse. In today's global conflict between evil oligarchs and everyone else, AI is firmly aligned with the evil oligarch side.

• Google, Microsoft, and Perplexity promote scientific racism in AI search results

• Chatbot that caused teen's suicide is now more dangerous for kids, lawsuit says

• Thousands of creatives sign petition against AI data scraping

• Authors who release under Creative Commons licenses are disagreeing with the CC organization about whether AI training is fair use: fair use alignment chart

• The AI Boom Could Use a Shocking Amount of Electricity, and-Baldur Bjarnason again-Your use of AI is directly harming the environment I live in.

But today's Big AI situation won't last. Small-scale and underground AI has sustainable advantages over the huge but money-losing contenders. And it sounds like Doc is already thinking post-bubble.

Adversarial now, but what about later?

So how do we get from the AI adversarial situation we have now to the win-win that Doc is looking for? Part of the answer will be resolving the legal issues. Today's Napster-like free-for-all environment won't persist, so eventually we will have an AI scene in which companies that want to use your work for training have to get permission and disclose provenance.

The other part of the path from today's situation-where big companies have AI that enables scam culture and chickenization while individuals and small companies are stuck rowing through funnels and pipelines-is personal, aligned AI that balances automation asymmetries. Whether it's solving CAPTCHAs, getting data in hard-to-parse formats, or other awkward mazes, automation asymmetries mean that as a customer, you technically have more optionality than you practically have time to use. But AI has a lot more time. If a company gives you user experience grief, with the right tools you can get back to where you would have been if they had applied less obfuscation in the first place. (icymi: Video scraping: extracting JSON data from a 35 second screen capture for less than 1/10th of a cent Not a deliberate obfuscation example, but an approach that can be applied.)

So we're going to see something like this AI cartoon by Tom Fishburne (thanks to Doc for the link) for privacy labour. Companies are already getting expensive software-as-a-service to make privacy tasks harder for the customers, which means that customers are going to get AI services to make it easier. Eventually some companies will notice the extra layers, pay attention to the research, and get rid of the excess grief on their end so you can stop running de-obfuscation on your end. That will make it work better for everyone. (GPC all the things! Data Rights Protocol)

The biggest win from personal AI will, strangely enough, be in de-personalizing your personal information environment. By doing the privacy labour for you, the agentic AI will limit your addressability and reduce personalization risks. The risks to me from buying the less suitable of two legit brands are much lower than the risk of getting stuck with some awful crap that was personalized to me and not picked up on by norms enforcers like Consumer Reports. Getting more of my privacy labour done for me will not just help me personally do better #mindfulConsumption, but also increase the rewards for win-win moves by sellers. Personalization might be nifty, but filtering out crap and rip-offs is a bigger immediate win: Sunday Internet optimism Doc writes, When you limit what customers can bring to markets, you limit what can happen in those markets. As far as I can tell, the real promise for agentic AI isn't just in enabling existing processes or making them more efficient. It's in establishing a credible deterrent to enshittification-if you're trying to rip me off, don't talk to me, talk to my bot army.

For just a minute, put yourself in the shoes of a product manager with a proposal for some legit project that they're trying to get approved. If that proposal is up against a quick win for the company, like one based on creepy surveillance, it's going to lose. But if the customers have the automation power to lower the ROI from creepy growth hacking, the legit project has a chance. And that pushes up the long-term value of the entire company. An individual locked-in customer is more valuable to the brand than an individual independent customer, but a brand with independent customers is more valuable than a brand with an equal number of locked-in customers.

Anyway, hope to see you at VRM Day.

Bonus links

Space is Dead. Why Do We Keep Writing About It?

It's Time to Build the Exoplanet Telescope

The tech startups shaking up construction in Europe

26 Oct 2024 12:00am GMT

Each quarter, we gather insights on all things SUMO to celebrate our team's contributions and showcase the impact of our work.

The SUMO community is powered by an ever-growing global network of contributors. We are so grateful for your contributions, which help us improve our product and support experiences, and further Mozilla's mission to make the internet a better place for everyone.

This quarter we're modifying our update to highlight key takeaways, outline focus areas for Q4, and share our plans to optimize our tools so we can measure the impact of your contributions more effectively.

Below you'll find our report organized by the following sections: Q3 Highlights at-a-glance, an overview of our Q4 Priorities & Focus Areas, Contributor Spotlights and Important Dates, with a summary of special events and activities to look forward to! Let's dive right in:

Q3 Highlights at-a-glance

Forums: We saw over 13,000 questions posted to SUMO in Q3, up 83% from Q2. The increased volume was largely driven by the navigation redesign in July.

• We were able to respond to over 6,300 forum questions, a 49% increase from Q2!
• Our response rate was ~15 hours, which is a one-hour improvement over Q2, with a helpfulness rating of 66%.
• August was our busiest and most productive month this year. We saw more than 4,300 questions shared in the forum, and we were able to respond to 52.7% of total in-bounds.
• Trends in forum queries included questions about site breakages, account and data recovery concerns, sync issues, and PPA feedback.

Knowledge Base: We saw 473 en-US revisions from 45 contributors, and more than 3,000 localization revisions from 128 contributors which resulted in an overall helpfulness rating of 61%, our highest quarterly average rating YTD!

• Our top contributor was AliceWyman. We appreciate your eagle eyes and dedication to finding opportunities to improve our resources.
• For localization efforts, our top contributor was Michele Rodaro. We are grateful for your time, efforts and expert language skills.

Social: On our social channels, we interacted with over 1,100 tweets and saw more than 6,000 app reviews.

• Our top contributor on Twitter this quarter was Isaac H who responded to over 200 tweets, expertly navigating our channels to share helpful resources, provide troubleshooting support, and help redirect feature requests to Mozilla Connect. Thank you, Isaac!
• On the play store, our top contributor was Dmitry K who replied to over 400 reviews! Thank you for giving helpful feedback, advice and for providing such a warm and welcoming experience for users.

SUMO platform updates: There were 5 major platform updates in Q3. Our focus this quarter was to improve navigation for users by introducing new standardized topics across products, and update the forum moderation tool to allow our support agents to moderate these topics for forum posts. Categorizing questions more accurately with our new unified topics will provide us with a foundation for better data analysis and reporting.

We also introduced improvements to our messaging features, localized KB display times, fixed a bug affecting pageviews in the KB dashboard, and added a spam tag to make moderation work easier for the forum moderators.

We acknowledge there was a significant increase in spam questions that began in July which is starting to trend downwards. We will continue to monitor the situation closely, and are taking note of moderator recommendations on a future resolution. We appreciate your efforts to help us combat this problem!

Check out SUMO Engineering Board to see what the platform team is cooking up in the engine room. You're welcome to join our monthly Community Calls to learn more about the latest updates to Firefox and chat with the team.

Firefox Releases: We released Firefox 128, Firefox 129 and Firefox 130 in Q3 and we made significant updates to our wiki template for the Firefox train release.

Q4 Priorities & Focus Areas

• CX: Enhancing the user experience and streamlining support operations.
• Kitsune: Improved article helpfulness survey and tagging improvements to help with more granular content categorization.
• SUMO: For the rest of 2024, we're working on an internal SUMO Community Report, FOSDEM 2025 preparation, Firefox 20th anniversary celebration, and preparing for an upcoming Community Campaign around QA.

Contributor Spotlights

We have seen 37 new contributors this year, with 10 new contributors joining the team this quarter. Among them, ThePillenwerfer, Khalid, Mozilla-assistent, and hotr1pak, who shared more than 100 contributions between July-September. We appreciate your efforts!

Cheers to our top contributors this quarter:

Our multi-channel contributors made a significant impact by supporting the community across more than one channel (and in some cases, all three!)

All in all it was an amazing quarter! Thanks for all you do.

Important dates

• October 29th: Firefox 132 will be released
• October 30th: RSVP to join our next Community Call! All are welcome. We do our best to create a safe space for everyone to contribute. You can join on video or audio, at your discretion. You are also welcome to share questions in advance via the contributor forum, or our Matrix channel.
• November 9th: Firefox's 20th Birthday!
• November 14th Save the date for an AMA with the Firefox leadership team
• FOSDEM '25: Stay tuned! We'll put a call out for volunteers and for talks in early November

Stay connected

• Join the conversation on the contributor forum to talk shop about our latest releases
• Learn about team updates on the SUMO Blog
• Connect with other contributors on our #SUMO Matrix group
• Follow us on X/Twitter
• Subscribe to our YouTube channel
• Get daily updates from around the web (M-F) by subscribing to the Firefox Daily Digest
• Check out AirMozilla if you're an NDA'ed contributor, where you'll find recordings of our bi-weekly Release Meetings

Thanks for reading! If you have any feedback or recommendations on future features for this update, please reach out to Kiki and Andrea.

25 Oct 2024 9:59pm GMT

With winter on the horizon, Chicago is ready to show that nothing - not wind, nor snow - can cool the fire of a united community.

As we toast Firefox's 20th anniversary, we're hosting "Free to Browse: Celebrating Chicago's Creatives," an IRL browsing experience to amplify the voices of 20 local creators and small businesses. The event will explore how they're creatively impacting their communities, as well as showcase the innovation that has defined the last 20 years of Firefox's journey. We're teaming up with these 20 local small businesses as part of our national campaign "Nothing Personal, Just Browsing," which highlights that when you choose Firefox, you choose a more private online experience.

"Free to Browse" is free and open to the public and will take place Nov. 16 from 4:00 p.m. to 10:30 p.m. CT at Inside Town, a local art collective in Chicago that celebrates diverse artists. The three-story space will bring the online world to life through a completely immersive experience. Guests can "browse" the skills of the featured small businesses, explore their services and shop for exclusive items, goods and more. It'll be an engaging environment featuring musical performances and interactive art while celebrating Firefox's impactful journey and technological legacy. We're all about making the web a private and safe open space for everyone, and there's no better way to cultivate that than with music, art, food and community.

The best parts of the internet are built by the communities that shape them. We're proud to celebrate these 20 bold and innovative businesses in Chicago that, like Firefox, are community-focused and not afraid to be different and challenge the status quo:

1. Lon Renzell, music producer/engineer and the founder of Studio SHAPES, a recording studio for musical creativity. | @renzell.wav

2. Kevin Woods, founder of streetwear brand and re-sale store, "The Pop Up." | @ogkwoods

3. Tatum Lynea, executive pastry chef and partner, named Chicago's 2024 pastry chef of the year. | @tatumlynea

4. Demir Mujagic, founder of Published Studios, a specialty design/print boutique. | @published.studios

5. Prosper Bambo, founder of Congruent Space, an interactive platform integrating art, design and fashion. | @prosperbambo

6. Akele Parnell, co-founder of ÜMI Farms, a cannabis ecosystem which includes craft brands and retail dispensaries. | @akele_j

7. Makafui Searcy, conceptual designer and founding director of the Fourtunehouse Art Center. | @makafuikofisearcy

8. Oluwaseyi Adeleke, creative director and fashion designer, focused on storytelling through a Black lens. | @olu.originals

9. Manny Mendoza, co-founder and chef of Herbal Notes, a cannabis lifestyle and experience collective. | @chefmanofrom18th

10. Angelica Rivera, founder of Semillas, a Mexican and Puerto Rican-owned floral design, plant, event experiences and coffee shop. | @sincerelyanngee

11. Kristoffer McAfee, artist/designer/traveler/scholar/business owner. | @km_designhq

12. Damiane Nickles, painter/marketer and founder of "Not A Plant Shop." | @notaplantshop

13. Danielle Moore, founder and creative director of Semicolon Books. | @danni.aint.write

14. Trevor Holloway, founder of Inside Town art collective. | @trevorholloway

15. Nicole Humphrey, creative consultant and founder of NAHcreate. | @childofgenius

16. Jason Ivy, singer-songwriter, actor and filmmaker. | @thejasonivy

17. Jackson Flores, co-founder of DishRoulette Kitchen, an SMB development center dedicated to addressing economic inequality. | @jacksonsays

18. Andre Muir, visual artist and filmmaker. | @andremuir

19. Diana Pietrzyk, multidimensional creative, designer and artist. | @dyanapyehchek

20. Preme, interdisciplinary artist, co-founder of Congruent Space and art director for Chicago music collective Goodbye Tomorrow. | @preme___xy

Here's a preview of the art these brilliant creators will have on display at the event:

<figcaption class="blocks-gallery-caption wp-element-caption">The featured small businesses will have exclusive items for sale and on display for attendees</figcaption>

This celebration isn't just about the past 20 years of Firefox. It's a stepping stone for the next 20 years of building an open and accessible internet for all. We're excited to kick it off with an unforgettable experience in Chicago.

See you there!

The post Celebrating Chicago's creators and small businesses at Firefox's 'Free to Browse' event appeared first on The Mozilla Blog.

25 Oct 2024 5:15pm GMT