Time for a (serious) Firefox Fork

*** tcaud2 joined #jetpack
We moved the documentation to MDN, check it out!
Topic set by canuckistani on Tue Jan 07 2014 14:10:45 GMT-0500 (Eastern Standard Time)
16:10 tcaud2 Hi I'm having issues with my game maker addon.
16:11 KWierso tcaud2: what's happening?
16:11 tcaud2 I'm trying to load in a font by loading an image on the user's HDD, but I'm getting a security exception when I try to copy the characters using Canvas getImageData.
16:12 *** jsantell joined #jetpack
16:12 +++ ChanServ has given op to jsantell
16:12 tcaud2 (url removed)
16:13 tcaud2 "Operation is insecure"
16:13 tcaud2 Does it have to do with the fact that it's in an onload event...?
16:14 *** gabor quit (Ping timeout)
16:15 KWierso tcaud2: that link is failing to load for me, can you try pasting to pastebin.mozilla.org ?
16:17 tcaud2 (url removed)
16:18 *** joshua-s quit (Quit: Try Firetext ((url removed)), a word processor for Firefox OS!)
16:18 KWierso tcaud2: and this is being run in the context of a webpage or page-mod?
16:18 tcaud2 page-mod
16:19 tcaud2 file// + the path
16:19 KWierso tcaud2: just out of curiosity, what if you replaced "window" with "unsafeWindow"?
16:20 tcaud2 In the main module?
16:20 KWierso on line one of that pastebin
16:21 tcaud2 I'll give it a try.
16:22 tcaud2 It says unsafeWindow is undefined.
16:24 KWierso hrm
16:24 KWierso canuckistani: do you know what the status of bug 930069 is?
16:24 firebot Bug (url removed) nor, P1, ---, nobody, NEW, Deprecate unsafeWindow and issue a deprecation warning if it is used.
16:25 canuckistani KWierso: I thought that was part of slaughterhouse
16:25 *** Gijs quit (Ping timeout)
16:25 canuckistani if so, ask gabor
16:26 *** Gijs joined #jetpack
16:26 KWierso tcaud2: I guess the other option would be to try to load that file from your main.js file and pass in the contents somehow to the page-mod?
16:26 *** joshua-s joined #jetpack
16:27 tcaud2 What is the reason that it's not letting one canvas access another canvas' data?
16:27 KWierso no clue
16:27 *** kinger joined #jetpack
16:28 tcaud2 How would I even pass a canvas through page-mod?
16:28 tcaud2 or an image?
16:29 KWierso postMessage or port.emit the value?
16:32 tcaud2 So I would have to ask the main module to read the image, copy it to a canvas, and send the canvas over postMessage.
16:32 jsantell tcaud2: there's the getImageData on canvases to serialize the info
16:34 tcaud2 So I get the image data and send that over.
16:35 jsantell tcaud2: if you're trying to serialize image data, yes. or base64 it
16:36 tcaud2 don't care about base64.
16:37 tcaud2 ugh I'm really dreading going back to the module... that thing took days to figure out.
16:38 tcaud2 the simplest change takes hours.
16:40 jsantell tcaud2: ?
16:42 tcaud2 It's just so hard to comprehend the mechanics of relaying across three different scripts.
16:50 *** KWierso is now known as KWierso|sheriffduty
16:50 *** joshua-s quit (Quit: Try Firetext ((url removed)), a word processor for Firefox OS!)
16:50 *** joshua-s joined #jetpack
16:52 *** joshua-s quit (Quit: Try Firetext ((url removed)), a word processor for Firefox OS!)
16:53 *** joshua-s joined #jetpack
16:56 tcaud2 OK now I asked jetpack how to privilege the code so I don't have to go back to the main module for this thing.
16:56 tcaud2 They said they didn't know.
16:56 *** brambles joined #jetpack
16:57 jsantell tcaud2: doesn't serialized event communication fix the issue?
16:57 tcaud2 well it does, but it's kinda hard to do.
16:58 tcaud2 Page modding is actually very tricky when it comes to file access.
16:58 tcaud2 I miss the days when you could just call the file api and be done with it.
16:59 tcaud2 I'd complain but nobody will listen.
17:01 tcaud2 I guess I just gotta tread water until people arrive at mozilla who listen. And at the rate Chrome is overtaking Firefox... that wont' be much longer, I'd think... or maybe Firefox will just keep sliding back to what it was in mozilla suite days...
17:01 tcaud2 and everyone will just use Chrome or IE.
17:03 tcaud2 Which'll be a tragedy because neither of them have user's interests at heart. It's clear Moz has user interests at heart, in that it lets you do stuff IE and chrome don't, but you make it so hard on devs that nobody knows how to take advantage of it.
17:04 tcaud2 I mean jsapi, not jetpack.
17:07 *** darrin is now known as darrin_away
17:12 gregglind_okay do sidebars have an 'isShowing' or such anymore?
17:13 tcaud2 Really jetpack api is atrocious.
17:13 tcaud2 I thought it was supposed to be an improvement. All I see is a phenomenal time sink.
17:15 tcaud2 How hard would it be to give all the content in an XPI file the same privilege? There's no excuse for having to run back and forth between the main module and page mods.
17:15 *** philor|away is now known as philor
17:16 tcaud2 The design is horrible. Whoever is in charge of the thing should be replaced.
17:21 zombie_ tcaud2: the image canvas data is probably because of a Same Origin Policy
17:21 zombie_ and the jetpack design is dictated by the need for multi-process and security isolation
17:21 *** arron_ joined #jetpack
17:21 zombie_ (though it could undoubtedly be easier to work with)

Click to expand...

Click to collapse

16:40 tcaud2 The characters, I mean.
16:40 bz It's all really noisy, but also not obviously better.
16:40 bz I guess we can try making the change and pushing to tinderbox....
16:41 terrence bz: so if you look at the dromaeo-css mac 10.6 charts....
16:41 tcaud2 The problem is that getImageData is throwing a security error.
16:41 bz tcaud2: did you draw a cross-origin image into the canvas?
16:41 *** luke quit (Quit: luke)
16:41 terrence bz: there was a definate slowdown, but if you zoom out to 30 days... it's pretty clear that there was something that kicked it up 2 weeks ago and exact rooting just bumped it back down to where it was before
16:41 *** jeffdyer joined #jsapi
16:41 bz terrence: hmm
16:42 tcaud2 I'm not sure. See it's an addon, so maybe that's a different origin than "file//"?
16:42 tcaud2 Though I'm not sure why.
16:42 bz yes
16:42 terrence bz: so it's not really clear to me that this is even a real issue
16:42 bz it is
16:42 bz terrence: That's fair
16:42 tcaud2 why?
16:42 bz terrence: So one option is to declare ourselves done for now
16:42 bz tcaud2: um.... in what sense why? Addons aren't file/; they have a lot more privileges than that
16:43 terrence wonders why he closed that chart tab
16:43 bz On the other hand, I'd expect this to be a subsumes check....
16:43 terrence bz: let me go open that up again and I'll let you make the call
16:43 bz terrence: And then work on making it so we don't even call ::get here
16:43 bz terrence: trying to see whether I can share roots in the codegen in a safe way, though
16:44 tcaud2 Right, so why don't addons encompass file/ as well?
16:44 terrence bz: yeah, this may just be too ugly to live even if it did get us a perf win
16:44 terrence bz: but it seems like it may not even do that
16:45 tcaud2 All it really does is create a lot of unnecessary trips back and forth from main module to page mod, and that even requires a middle man script.
16:45 terrence bz: (url removed)
16:45 tcaud2 It's made a 1 minute job into a 2 hour job, iow.
16:45 *** sunfish joined #jsapi
16:45 bz tcaud2: We're doing a subsumes check
16:46 bz tcaud2: so drawing a file/ image into a system-principal canvas should work
16:46 bz tcaud2: and allow you to getImageData
16:46 bz tcaud2: So where is the addon in question getting its canvas?
16:46 *** turova quit (Ping timeout)
16:47 tcaud2 the canvas is made in the page level code, in a resources module.
16:47 bz "made" how?
16:47 tcaud2 javascript.
16:47 bz What is the ownerDocument of the <canvas> element?
16:47 bz Yes, I know javascript.
16:47 tcaud2 (url removed)
16:47 *** turova joined #jsapi
16:47 *** Ms2ger quit (Quit: nn)
16:47 bz So "document" there is some random web page?
16:47 tcaud2 ownerDocument?
16:48 bz If so, then the canvas has the security permissions of that web page
16:48 bz and then if you paint file/ stuff to it it gets tainted
16:48 bz and you can no longer extract pixel data from it
16:48 tcaud2 No, it's an html file inside the xpi.
16:48 bz (if you could, then the web page could do it too)
16:48 bz OK
16:48 bz How is this html file being loaded?
16:48 bz That is, what is the URI used to load teh HTML file?
16:49 bz Or most simply....
16:49 tcaud2 The main module calls it when the icon is clicked.
16:49 bz That tells me nothing about the security situation
16:49 bz What is document.URI at that createElement callsite?
16:49 bz terrence: hmm
16:49 bz terrence: non-10.6 doesn't show that earlier jump?
16:49 *** RyanVM|sheriffduty is now known as RyanVM
16:49 bz is more interested in Windows numbers than Mac 10.6, in all honesty
16:50 *** KWierso is now known as KWierso|sheriffduty
16:50 terrence fedora x64 is not stable enough to tell
16:50 terrence bz: that would have been the sensible one to check
16:50 terrence goes to check
16:50 tcaud2 (url removed)
16:50 *** RyanVM left #jsapi
16:50 bz tcaud2: I have no idea what the addon sdk is deciding to do to you, sorry
16:51 bz tcaud2: what I'm interested in is document.URI
16:51 tcaud2 resource/jid0-fdh1ciwasj26bbesaogwlcvhv0k-at-jetpack/gamestar-gcs/data/GamestarEditor.html
16:51 bz tcaud2: and better yet, document.nodePrincipal.URI
16:51 bz ah
16:51 bz "resource//" means it's not privileged
16:51 terrence bz: maybe? (url removed)
16:51 bz and not same-origin with "file/"
16:51 terrence bz: it's much less of a sharp drop
16:51 tcaud2 how do I privilege it?
16:51 bz terrence: yeah... but has the same rise back on the 9th
16:52 bz tcaud2: normally, by loading from a chrome/ URI
16:52 terrence bz: yup! need to find out what that was
16:52 bz tcaud2: when using the SDK, I have no clue. Worth asking somewhere where the SDK people hang out (which isn't this channel)
16:53 *** sunfish quit (Ping timeout)
16:54 terrence bz: ah, the first commit with the faster time on 10.6, where there is a super-sharp change is: (url removed)
16:54 terrence bz: which actually makes some sense
16:54 terrence so, till++
16:54 bz terrence: seems plausible, yeah..
16:54 tcaud2 That's the thing you see, nobody knows.
16:55 tcaud2 I just asked jetpack about it and they said they didn't know.
16:55 terrence wonders if exact rooting just happens to exactly counterbalance this change or if it accidentally disabled the effect somehow
16:56 *** smaug quit (Ping timeout)
16:56 *** luke joined #jsapi
16:56 *** brambles joined #jsapi
16:56 *** cpeterson quit (Input/output error)
16:56 *** ehsan quit (Input/output error)
16:57 *** luke quit (Quit: luke)
16:57 *** ehsan joined #jsapi
16:57 *** geo quit (Input/output error)
16:58 *** geo joined #jsapi
16:59 terrence okay, so exact rooting could /only/ possibly lead to scripts getting lazified earlier
17:00 *** luke joined #jsapi
17:00 terrence so could the conservative scanner have been keeping some scripts live and unlazified for longer and thus getting performance boost?
17:01 terrence but then why was the patch such a performance boost at all?
17:01 *** cpeterson joined #jsapi
17:01 terrence would this be reflected in areweslimyet numbers, maybe?
17:01 *** smaug joined #jsapi
17:02 *** mikeh quit (Ping timeout)
17:02 *** laurel is now known as livia
17:03 *** ehsan quit (Input/output error)
17:03 terrence so looks like exact rooting saves 10MiB on startup memory usage; nice!
17:04 *** jrmuizel quit (Connection reset by peer)
17:04 *** jrmuizel joined #jsapi
17:04 tcaud2 OK now I asked jetpack how to privilege the code so I don't have to go back to the main module for this thing.
17:04 terrence but the other graphs look flat... or at least the variance is too high to put a finger on lazifation
17:04 *** smaug quit (Ping timeout)
17:04 *** abstractj joined #jsapi
17:05 tcaud2 They said they didn't know.
17:05 *** jrmuizel quit (Client exited)
17:05 tcaud2 Page modding is actually very tricky when it comes to file access.
17:05 tcaud2 miss the days when you could just call the file api and be done with it.
17:05 tcaud2 I'd complain but nobody will listen.
17:05 tcaud2 I guess I just gotta tread water until people arrive at mozilla who listen. And at the rate Chrome is overtaking Firefox... that wont' be much longer, I'd think... or maybe Firefox will just keep sliding back to what it was in mozilla suite days...
17:06 tcaud2 and everyone will just use Chrome or IE.
17:06 *** mikeh joined #jsapi
17:06 tcaud2 Which'll be a tragedy because neither of them have user's interests at heart. It's clear Moz has user interests at heart, in that it lets you do stuff IE and chrome don't, but you make it so hard on devs that nobody knows how to take advantage of it.
17:08 bz terrence: so this is annoying
17:08 bz terrence: I can nix one root easily
17:08 bz terrence: nixing the second one is really hard as long as JSAutoCompartment can gc.
17:08 terrence bz: I thought we fixed that!
17:08 *** jrmuizel joined #jsapi
17:08 bz oh?
17:08 bz mrgiggles, can JSAutoCompartment gc?
17:08 mrgiggles bz: No, nothing matching |JSAutoCompartment| can GC. Matches are: void JSAutoCompartment::~JSAutoCompartment(int32)
17:08 mrgiggles void JSAutoCompartment::JSAutoCompartment(JSContext*, JSScript*)
17:08 mrgiggles void JSAutoCompartment::JSAutoCompartment(JSContext*, JSObject*)
17:08 terrence bz: yeah, I thought it was lazy now
17:08 bz aha
17:08 bz So then we can just back out bug (url removed)
17:08 firebot Bug 950991 nor, --, mozilla29, bzbarsky, RESO FIXED, Root on-stack Value and JSObject* return values in bindings
17:09 bz And assume that if it becomes an issue the analysis will tell us
17:09 terrence bz: ah, nice!
17:09 jwalden naveed: are you poking the big huge table on the work week thing manually/periodically or so? I am in a slight limbo state between no and yes, either that or I'm at yes but haven't gotten the final flight confirmation yet :-\
17:10 bz terrence: at this point I have a patch that is even safe
17:10 terrence bz: fast work!
17:10 bz terrence: in that it obviously guarantees non-overlapping lifetimes
17:11 till terrence: I don't see how the relazification stuff could speed anything up. Except for very specific cases of memory pressure maybe? If anything, I'd expect slight regressions, though I didn't see any
17:11 terrence till: there's a definite boost to dromaeo-css across the board
17:11 terrence till: of course I didn't expect exact rooting to speed up anything either
17:12 terrence till: it's basically impossible to predict with these sorts of changes
17:12 naveed jwalden : pseudo automagically of course
17:12 till terrence: interesting. I'm not complaining or anything, but I also won't pretend to understand it
17:12 terrence till: no one does
17:12 naveed jwalden : I am scraping the registration website and pushing from there via python :|
17:12 *** asuk joined #jsapi
17:12 naveed but it is when i feel like it
17:13 *** asuk quit (Quit: Textual IRC Client: (url removed))
17:14 fitzgen here
17:14 shu fitzgen: so you can ask like
17:14 shu mrgiggles: can Atomize gc?
17:14 mrgiggles shu: No, |JSAtom* js::Atomize(js::ExclusiveContext*, int8*, uint64, uint32)| cannot GC
17:15 fitzgen shu: very nice
17:15 fitzgen mrgiggles: much obliged, sir
17:15 *** philor|away is now known as philor
17:16 *** abstractj quit (Quit: Computer has gone to sleep.)
17:16 tcaud2 Am I right in thinking that Jetpack is being hamstrung by your end?
17:17 *** sunfish joined #jsapi
17:18 shu efaust: ping
17:18 shu efaust: ready to talk when you are
17:19 *** mccr8 quit (Quit: computer sleep)
17:19 *** mccr8 joined #jsapi
17:20 tcaud2 well I'm gone. You know you've only got a few more percentage points to shed before the bloggers begin calling for your heads.
17:20 tcaud2 This org has seriously bad leadership given the intelligence of the people backing it.
17:21 terrence tcaud2: I'm not really clear, what is your problem?
17:21 tcaud2 my problem is that I don't have a javascript-driven cross-platform solution for file access.
17:22 tcaud2 Firefox, now with addons, is the closest thing.
17:22 jwalden that's what OS.File was supposed to be, no? or is this just in SpiderMonkey itself?
17:22 terrence tcaud2: well, it probably exists... maybe the person who knows is in europe and thus asleep right now?
17:22 jwalden or do you mean as some sort of web API to access the file system
17:22 shu jwalden: are you downstairs? do you see efaust anywhere?
17:22 tcaud2 No, it was your project, called XUL runner, and then you killed it.
17:22 efaust shu: heyyy
17:22 terrence tcaud2: I think it's actually spelled firefox -app now, right?
17:22 efaust I'm in foxhole
17:22 jwalden shu: I am sitting in arm's reach of him in foxhole
17:23 shu efaust: oh hi, okay, i'll be down in a sec
17:23 shu jwalden: ty
17:23 *** mconley quit (Input/output error)
17:23 terrence tcaud2: I'm pretty sure it's the same code as xulrunner
17:23 terrence tcaud2: just moved inside firefox so that it gets the same testing as the rest of the platform
17:23 *** piscisaureus joined #jsapi
17:24 *** luke quit (Quit: luke)
17:24 efaust shu: awesome.
17:24 *** Yves left #jsapi
17:25 *** sunfish quit (Ping timeout)
17:25 till terrence: it is, pretty much
17:26 tcaud2 I just googled it and found "App Manager".
17:26 tcaud2 What is that?
17:26 till tcaud2: something entirely different: a devtool for managing apps for FFOS
17:26 tcaud2 Can those apps access the local file system?
17:27 till tcaud2: this is the blog entry for you: (url removed)
17:27 tcaud2 Also firefox -app won't load on android, will it?
17:27 till tcaud2: and for your addons+file loading thing - what's wrong with (url removed) ?
17:28 terrence tcaud2: I'm not sure... I'm not sure how well xul was ever supported there
17:28 terrence tcaud2: I'd expect firefox -app to work better than xulrunner, although you might have to use webcomponents instead of xul
17:29 *** abstractj joined #jsapi
17:29 tcaud2 If it can't access local files, it's useless.
17:29 mjrosenb terrence: so, unrelate to mozilla, I did a bunch of project euler problems this weekend. I think I'm going to switch from python to rust though.
17:29 terrence tcaud2: yeah, agreed... I'd think it'd have to
17:29 terrence mjrosenb: makes sense... how are you getting on with python after having used it a bit more?
17:30 tcaud2 My beef with addon-sdk is that it is extremely cumbersome to access local files with.
17:30 terrence tcaud2: are you sure OS.File doesn't work there?
17:30 tcaud2 the only way is by posting messages and that's haphazard.
17:30 tcaud2 development times become hideous.
17:31 terrence tcaud2: hurm, that does seem pretty bad
17:31 *** billm quit (Quit: Leaving)
17:31 terrence tcaud2: I know I saw a bug a couple years ago about implementing OS.File... I just assumed that would be available and make this all nice
17:31 mjrosenb terrence: I'm pretty good at using it for numerical calculations
17:31 tcaud2 OS.File? what's that for?
17:32 terrence tcaud2: of course, I haven't used the sdk in at least 4 years, so I'm probably the wrong person to ask
17:32 mjrosenb terrence: there was one that required a whole bunch of backtracking, and I ended up going back to haskell.
17:32 tcaud2 All I know is what's in the SDK docs.
17:32 terrence tcaud2: It's for fast and easy local file access
17:32 tcaud2 even that didn't have the solution #jetpack helped me cobble together.
17:32 tcaud2 That was like 40 hours of experimentation.
17:32 *** billm joined #jsapi
17:33 tcaud2 what does it work with?
17:33 terrence tcaud2: maybe try this? (url removed)
17:34 tcaud2 And I should make the point, if I have to go to module-level to work with it, it's no better than the rest. Because it's the interface between modules that gives me fits.
17:34 terrence tcaud2: I assumed it would be available to extensions and apps, but I'm not really familiar with this side of the platform, sorry
17:35 till tcaud2: this isn't the arbitrary decision made by stupid management you make it out to be. If you need file access in a page mod, message passing is the only way to go for technical reasons
17:35 tcaud2 that's for priveleged code. Resource files aren't privileged. Which is the root of the problem.
17:35 terrence tcaud2: #jsapi is mostly dealing with the C++ JSAPI platform bits
17:35 tcaud2 Web pages aren't privileged.
17:36 tcaud2 technical reasons that you designed.
17:36 till yes, with good reasons
17:36 terrence tcaud2: the asynchrony of modern processor architectures isn't really our fault
17:36 *** cpeterso_ joined #jsapi
17:36 till tcaud2: it's in preparation for moving web pages into a separate process, and that io will keep on happening in the main process, so you need async communication
17:37 *** victorporof quit (Quit: victorporof)
17:37 *** cpeterson quit (Ping timeout)
17:38 till tcaud2: I understand you don't like it, but waltzing in here and saying that mozilla as an organisation is stupid and doomed because of this being a stupid decision is not only wrong, it's also pretty rude
17:38 tcaud2 "it's in preparation"
17:38 *** abstractj quit (Quit: Computer has gone to sleep.)
17:38 tcaud2 That's fine.
17:38 till well, would you like your (and everyone else's) addons to break once that switch happens?
17:38 tcaud2 I don't care. And I don't buy your excuse, till. This is your agenda that you are pushing on me.
17:38 till this is not an agenda
17:39 terrence tcaud2: multicore is physics, not an agenda
17:39 till it's a technical requirement for something that everyone agrees is a good decision, and that we're really late to implementing precisely because of the many addons we have that do synchronous communication between chrome and content
17:40 terrence tcaud2: nobody /likes/ concurrency... it's just a property of the universe we live in that it is necessary
17:40 till tcaud2: in fact, the number of people predicting our impending doom because we haven't yet implemented that vastly outnumber you
17:41 terrence tcaud2: we can't really design our way out of reality
17:41 tcaud2 so basically, development with will continue to be a ***** with jetpack sdk.
17:41 terrence tcaud2: it's just a new way of thinking... it's not so bad once you get used to it
17:42 till tcaud2: also, check out task.js
17:42 till tcaud2: (url removed)
17:42 terrence tcaud2: look at the success of node.js to see how little it really matters
17:42 *** geo quit (Input/output error)
17:42 till that makes the asynchrony much more bearable
17:42 tcaud2 till I'm one of the few users you have left. 16% of the population... do you have any idea why they've stuck with you this far?
17:43 till tcaud2: ok. This is a bit too much entitlement for my taste, to be honest, so I'm out
17:43 *** brendan quit (Quit: brendan)
17:43 terrence tcaud2: accept our help or don't, but we don't really go for trolling here
17:43 tcaud2 I'll never be good at that way of thinking, nor will many others.
17:43 tcaud2 You're creating a new way to sort programmers.
17:43 tcaud2 that's all this async crap is.
17:44 terrence refuses to take the blame for reality's failings
17:44 *** roc quit (Ping timeout)
17:45 till tcaud2: should you even remotely be interested in an actual explanation for these changes, then this is a very good read: (url removed)
17:45 *** dougc joined #jsapi
17:46 tcaud2 You expect me to believe that an html file can't be given file access privileges because of multi-core CPUs.
17:46 tcaud2 I know all about that stuff. You aren't pulling the wool over my eyes.
17:47 *** bholley quit (Ping timeout)
17:47 *** philor is now known as philor|away
17:47 *** jrmuizel quit (Client exited)
17:47 *** bholley joined #jsapi
17:48 *** bholley quit (Quit: bholley)
17:48 till tcaud2: ok, I'll bite. What's your theory on why we're *really* doing this?
17:50 jdm gets the popcorn
17:50 *** brendan joined #jsapi
17:50 +++ ChanServ has given op to brendan
17:50 *** terrence quit (Ping timeout)
17:50 *** terrence joined #jsapi
17:51 *** gwty quit (Ping timeout)
17:51 *** piscisaureus quit (Ping timeout)
17:51 tcaud2 For one thing, it seems like you don't want browsers to be used for file access.
17:51 tcaud2 You think it's fundamentally insecure.
17:51 jwalden "pretty dangerous", yeah
17:52 tcaud2 No more dangerous than casual shopping at Target...
17:52 *** dherman quit (Quit: dherman)
17:52 tcaud2 but I digress.
17:52 *** bholley joined #jsapi
17:52 naveed sstangl : ping
17:52 tcaud2 Still, Mozilla is the organization of freedom.
17:53 tcaud2 You want people watching over your shoulder, you go to MS or Google (or Apple).
17:53 *** piscisaureus joined #jsapi
17:53 jwalden "freedom" is not a useful concept, you have to say what sorts of freedoms are desired
17:53 till ok, that would be a possible reason. In that case I don't understand why we're just making it a bit more cumbersome, instead of outright impossible
17:53 jwalden I don't think the concept inherently, intrinisically, must include file system access
17:53 *** jdm quit (Input/output error)
17:54 *** jdm joined #jsapi
17:54 *** turova quit (Ping timeout)
17:54 sstangl naveed: pong
17:55 tcaud2 Well for sake of platform independence, you need to have a means of accessing files. Although I'm not sure you even see platform independence as a good thing.
17:55 tcaud2 The whole purpose of me making that game maker in Firefox was so that I'd know it would run fine a decade, or two decades from now.
17:56 tcaud2 On the other hand, I can see the PoV that it's not bad, for economic reasons, to have software become incompatible every five years.
17:57 till I don't even know how to respond to that
17:57 tcaud2 creates a lot of work opportunities.
17:58 tcaud2 with little intellectual overhead. Kinda like remaking Final Fantasy for every new system that comes out: no intellectual overhead, just give someone the job and do it.
17:58 tcaud2 Shovel-ready, as they say.
17:58 *** ehsan joined #jsapi
17:58 evilpie dang what is going on
17:59 till and actually, I won't. As terrence said, take our help or don't, I won't feed your trolling any further
17:59 *** billm quit (Ping timeout)
17:59 *** saml quit (Quit: Leaving)
17:59 till evilpie: nothing to see, move right along
17:59 tcaud2 Microsoft/Google dominance certainly creates that environment. And Java well, who knows what will happen with it.
17:59 tcaud2 Well it's just so simply to just say in code that "if X file is in Y XPI, give it specialpowers".
18:00 tcaud2 simple
18:00 *** billm joined #jsapi
18:01 tcaud2 I mean I'd fork it myself, probably with the help of several others who have expressed interest in the concept (the maker of AsYouWish in particular, who you've batted off deftly enough)
18:01 *** tilgovi joined #jsapi
18:02 tcaud2 but is that the right path...? Maybe it is...
18:02 evilpie till: btw are you going to the german meetup next week?

Click to expand...

Click to collapse

14:00 tcaud2 Hi I've got a serious issue with my game maker addon.
14:00 tcaud2 I need to rip a font from an image, but the image is loaded from a file// URI
14:00 tcaud2 I was told this was a cross-domain policy violation.
14:00 tcaud2 he solution, you said, was to load the image in the main module. But that's apparently impossible, because Jetpack has no concept of the HTML DOM, and thus, can't create image objects.
14:02 jsantell OtherRealm: what is 'window' in this case?
14:03 jsantell tcaud2: is the image in the data/ directory of your addon?
14:04 OtherRealm Just a nul var until it is called in this method
14:04 OtherRealm var window;
14:04 jsantell OtherRealm: can you post the code on a gist or pastebin?
14:04 tcaud2 It is not.
14:04 tcaud2 it's in the user's filesystem
14:06 tcaud2 Am I right that I have to read the image data itself and send it as a message to the web page, then data:uri it on the web page side?
14:09 OtherRealm (url removed)
14:12 OtherRealm or:
14:12 OtherRealm (url removed)
14:25 zombie_ tcaud2: yeah, i understand
14:25 zombie_ just use a file api, and read the _content_ of the file, convert it (base64 encode) to a data:uri and send that as a message to your web page
14:28 zombie_ margaret: do you maybe have some other mozilla tool/environment (i think it's called mozbuild? or something) for working with some other code base?
14:28 zombie_ i think i've seen a bug or two about conflicts with python environments
14:29 margaret zombie_: possibly, i know i've had to mess with my python setup for running tests on mozilla-central
14:30 zombie_ margaret: you can try searching the bugzilla on that, i think i've seen a workaround in one of the bugs
14:30 zombie_ (or i can try searching in a few minutes, after dinner)
14:32 margaret zombie_: okay, thanks
14:32 margaret i don't really *need* to use the add-on sdk, but i thought it would be easier for what i'm trying to do
14:32 margaret i figured it was a good excuse to try learning how to use it
14:38 jsantell margaret: yeah what version of py are you using?
14:39 margaret jsantell: 2.7.4
14:42 jsantell margaret: humm that should be fine..
14:42 *** lmandel quit (Input/output error)
14:42 *** brambles quit (Ping timeout)
14:43 *** brambles joined #jetpack
14:44 jsantell OtherRealm: so looking at your code
14:45 jsantell OtherRealm: window doesn't have a port, it doesnt have associated content scripts
14:48 OtherRealm Yes, do I need those in order for the ports to be broadcast from addon to content and the other way around?
14:49 jsantell OtherRealm: what kind of content do you have? what do you want it to do/communicate with
14:52 OtherRealm I want to send a json string to the window, have it be parsed and loaded into a form, then for this form to be able to be edited and saved, passing the changes back to the main.js in a json string
14:53 jsantell OtherRealm: what is the window? you can apply a page worker or page mod, things like that
14:53 jsantell OtherRealm: which have content scripts
14:53 jsantell OtherRealm: windows are just firefox windows
14:55 OtherRealm Ideally I would like to have it be a chrome window without all the extra nav features
14:55 *** joshua-s quit (Quit: Try Firetext ((url removed)), a word processor for Firefox OS!)
14:56 *** joshua-s joined #jetpack
14:57 *** philor|afk is now known as philor
15:00 *** phlsa joined #jetpack
15:02 *** Gijs quit (Connection reset by peer)
15:02 *** Gijs joined #jetpack
15:03 jsantell OtherRealm: you can have a pagemod attach itself to the search.html page you load
15:03 jsantell OtherRealm: and communicate with those ports
15:04 OtherRealm Alright, I will try that
15:04 OtherRealm Thanks
15:04 *** cers quit (Ping timeout)
15:06 *** cers joined #jetpack
15:13 canuckistani margaret that's a seriously weird error, maybe Python env weirdness
15:13 canuckistani Also, you don't need to activate the SDK, just call cox directly
15:14 *** bwinton is now known as bwinton_away
15:14 canuckistani Er, 'cfx', and goddammit autocorrect I did not mean 'CFO' either
15:16 *** bwinton_away is now known as bwinton
15:17 zombie_ any reason jetpack meeting notes aren't on planet.m.o?
15:17 zombie_ canuckistani: ^
15:17 canuckistani They never have been
15:18 canuckistani They get sent to the google group, but no-one has asked for rss before to my knowledge
15:19 zombie_ ok, if i'm the only one asking, i guess i can manage for myself..
15:21 *** TimAbraldes joined #jetpack
15:29 tcaud2 I've been thinking... firefox is trying to cater to both business users and desktop users.
15:29 tcaud2 That's bad.
15:30 tcaud2 Two different user classes. Good at the time of revolution against IE, but bad now that the revolution is over.
15:31 tcaud2 I see a pattern in the comments of domestic users taking umbrage to many of the changes being instituted, while business users take a more conciliatory, appeasing approach.
15:31 tcaud2 And you guys cite them as evidence for your supporty.
15:32 tcaud2 I think I've figured the way to beat you. Yes, this is the method. That's the argument.
15:32 tcaud2 biz vs consumer.
15:35 jsantell im not even sure what that means
15:36 tcaud2 That will be good for you in that it will take the heat off you from domestic users, and allow you to focus on growing your userbase with business users.
15:36 tcaud2 Firefox is way too secure.
15:37 tcaud2 Many people want a browser that doesn't have these crazy security policies.
15:37 zombie_ tcaud2: you are not going to get very far if your argument is going to be "firefox needs to be less secure"
15:37 tcaud2 They don't want IE. They don't want Google.
15:37 tcaud2 No, I don't mean, "let's let security holes run free".
15:37 zombie_ especially in light of recent NSA fallout
15:37 jsantell all modern browsers have these "crazy security policies", and no one wants a browser that exposes them to even more dangerous vectors
15:38 tcaud2 I mean, let's let users decide what they want a given web page to be able to do.
15:38 jsantell hence the existance of jetpack
15:39 tcaud2 The AsYouWish addon basically does that by restoring enablePrivilege, which was removed on behalf of idiots and grandmothers.
15:40 tcaud2 I didn't create AsYouWish. It has a number of users. The only reason it's not used more is because Mozilla has made a point of suppressing it.
15:41 jsantell so if the addon gives you the capabilities you desire, whats the problem
15:42 tcaud2 It's not the capabilities I have, but the capabilities other users have.
15:43 tcaud2 There needs to be a movement of (smart) people towards using their webapps with (limited) access to their local file systems.
15:43 tcaud2 Like for example my game maker addon. Only intelligent users will be able to use it. So it's no big issue.
15:44 tcaud2 I can't just advise them to use AsYouWish, because they know nothing about it. It's not trusted.
15:44 zombie_ and you have that ability.. jetpack allows you to access files on the user's computer.. what is the problem?
15:45 tcaud2 It's ten times easier to write programs by accessing chrome in the webpage than by using jetpack and jumping through its security hoopla.
15:45 zombie_ yeah, and it's 100 times harder to protect users from possible bad actors with that approach
15:46 tcaud2 And there you go again with the protection thing. See, smart users don't want your protection.
15:46 jsantell tcaud2: i assure you, they do.
15:46 tcaud2 They want software that doesn't have security holes.
15:46 tcaud2 I know a number that don't.
15:46 zombie_ i'm a pretty smart user, and i'm in the rare position to be able to inspect *and understand* the the code of firefox addons
15:47 jsantell tcaud2: and if having the AsYouWish addon solves the issue, just make it a dependency
15:47 zombie_ and yet, i have ~20 addons in my firefox, and don't have time to inspect every one of them
15:47 tcaud2 AsYouWish is still in experimental status.
15:47 tcaud2 It doesn't have your sanction.
15:48 zombie_ you say users should trust you and your addon, but can't trust AsYouWish?
15:48 jsantell well luckily you can deploy your xpi anywhere on the internet
15:48 zombie_ what's the difference.. i have heard of that addon before, i would much rather trust them then you
15:48 tcaud2 Actually they are kinda leery about addons, too.
15:49 tcaud2 You have not approved as you wish.
15:49 tcaud2 AsYouWish
15:50 *** phlsa quit (Quit: My MacBook Pro has gone to sleep. ZZZzzz…)
15:51 tcaud2 It's only been experimentally reviewed.
15:53 tcaud2 I am in contact with the author of AsYouWish.
15:55 tcaud2 Can you pledge, if it is submitted, that it will be given a fair review, and not rejected on basis of its essential function?
15:58 *** philor is now known as philor|away
15:58 jsantell that's up to AMO
15:58 zombie_ tcaud2: people here don't review addons.. and there are rules for submitting your addons for review, if you follow them, i'm pretty sure the review will be fair
15:59 canuckistani also, AsYouWish isn't just any add-on
15:59 canuckistani it exposes system privileges to the web
16:01 zombie_ tcaud2: wait, just realized, your argument is not "firefox wont let me do this", but "i want this thing to be easier, at the cost of possible security issues, and the harder job of the AMO reviewers" ??
16:01 zombie_ in that case, you just lost all sympathy from me
16:03 *** humph quit (Ping timeout)
16:04 tcaud2 Right well, canuckistani, that's kinda immaterial. Policy is policy, right? So if AsYouWish is safe so long as users know what they are doing, it should be approved by AMO, right?
16:05 *** ejpbruel joined #jetpack
16:05 ejpbruel gozala: ping
16:05 gozala ejpbruel: hello
16:05 canuckistani tcaud2: that's up to AMO reviewers, you should go talk to them
16:05 ejpbruel gozala: hi! i have a generic js style question for you
16:05 ejpbruel gozala: how do you recommend doing something like enums in js?
16:06 canuckistani but the potential for AsYouWish to be insecure via a bug and therefore very harmful is quite high
16:06 canuckistani the good thin i guess is it is unlikely it will be very popular
16:06 canuckistani ...because the use case is quite specific

Click to expand...

Click to collapse

16:14 *** tcaud2 joined #amo-editors
Add-on code review discussions | Don't ask to ask | Mention the name and ID of your add-on | See #amo for (url removed) site, #addons for general add-on support, #extdev for extension development | (url removed) | Queue status: (url removed)
Topic set by John-Galt on Mon Oct 01 2012 16:43:17 GMT-0400 (Eastern Daylight Time)
16:15 tcaud2 Hi, I'd like to discuss the AsYouWish addon.
16:23 tcaud2 It has received preliminary review.
16:24 tcaud2 It's function is to restore enablePrivilege, which was removed as of Firefox 17.
16:33 jorgev what would you like to discuss?
16:33 tcaud2 I would like to discuss its prospects for approval.
16:34 jorgev full approval? I don't think that'll happen
16:34 *** JesperHansen quit (Ping timeout)
16:34 tcaud2 Why not?
16:35 jorgev because it's a power tool and potential footgun
16:35 jorgev we generally give those preliminary approval only
16:36 tcaud2 So let me get this straight: you're not going to even give it the mark of trust that the tool does not steal a person's credit card information?
16:37 tcaud2 I mean it's coming from some guy nobody knows, they have to trust him personally, as it is, before even trying to use it as a power tool.
16:38 tcaud2 I know how your process works. You have two stages: preliminary, where you don't hardly even look it over, and full, where you pour over it and study every aspect.
16:39 jorgev you don't know it very well then
16:39 jorgev preliminary approval does go through code review and we make sure the add-on is safe to use
16:40 tcaud2 Then why do you state on the add button on MDN that it hasn't been reviewed?
16:40 tcaud2 That's all end users see.
16:40 jorgev if it says it hasn't been reviewed it's because it hasn't
16:40 tcaud2 you're mixing words.
16:41 jorgev AsYouWish has not been reviewed
16:41 jorgev it is awaiting preliminary review
16:41 tcaud2 What further review do you need beyond assessing whether it is safe?
16:41 tcaud2 No it's not.
16:41 John-Galt It is.
16:42 rctgamer3 It is.
16:42 jorgev (url removed)
16:42 jorgev it has been, for a very long time
16:42 jorgev I'm not sure what is blocking its review, but maybe John-Galt can clarify that
16:43 John-Galt The last time I reviewed it, it took an entire day, and I haven't had an entire day to devote to it since then.
16:44 tcaud2 However, even after preliminary review is completed, it states "the addon has not been reviewed by mozilla".
16:44 tcaud2 just below the button.
16:45 tcaud2 here's another example.
16:45 rctgamer3 tcaud2: After it has been preliminary reviewed, that line will change
16:45 jorgev tcaud2: (url removed)
16:45 jorgev that's how a preliminarily approved add-on looks like
16:47 *** fixanoid_ quit (Ping timeout)
16:50 tcaud2 yeah nevermind on that.
16:50 tcaud2 well when is the review?
16:51 *** JesperHansen joined #amo-editors
16:51 tcaud2 can you schedule someone to look at it?
16:51 jorgev the active admin reviewers are John-Galt and TheOne
16:51 jorgev it's up to them to make time for it
16:52 tcaud2 So you're not going to honor the expectation that it would be reviewed in three weeks.
16:52 tcaud2 as AMO states.
16:53 tcaud2 which of course you are already hideously overdue.
16:53 John-Galt The ideal is 3 days. It's not a guarantee, and for add-ons like this which require a thororugh security review, things can take considerably longer.
16:54 tcaud2 So there's no time frame.
16:54 jorgev there's an approximation
16:54 jorgev and most add-ons are reviewed within those times
16:54 jorgev some take longer, some take much longer
16:55 jorgev especially for the first review
16:55 tcaud2 that's not the first review.
16:55 tcaud2 It was updated.
16:56 tcaud2 it's not a huge task.
16:56 tcaud2 I think you could finish it in a couple hours.
16:56 jorgev by first review I mean it hasn't been approved before
16:56 tcaud2 but it has been approved previously.
16:56 tcaud2 hasn't it?
16:57 John-Galt It hasn't
16:57 tcaud2 well it's been 9 months.
16:57 tcaud2 or thereabouts.
17:00 John-Galt It's true, I'd have liked it to have been reviewed months ago. But it's been a busy year, and the several hours it would take to review that add-on could be used to review dozens of others.
17:01 John-Galt I'm also not especially happy about the idea of that add-on existing or being hosted on AMO, so it's not an especially high priority. But I will get to it soon, now that queue lengths are relatively low.
17:02 tcaud2 soon as in, two weeks?
17:02 John-Galt I can't give you a timeframe.
17:02 tcaud2 I don't believe you.
17:03 tcaud2 Be honest.
17:03 John-Galt *shrug*
17:04 TheOne he was
17:06 tcaud2 He's not honest about his intent to not review it.
17:07 John-Galt I think this conversation is over.
17:09 tcaud2 It's clear that you don't want to do it, hence you won't do it unless someone forces you to. But you're the boss and you've expressed your reservations, while manipulating the author of the addon. You'd might as well be president telling the government not to observe a law you don't like.
17:10 jorgev as much as I like fascism analogies, this is getting very derailed
17:10 jorgev I acknowledge that the waiting time for your add-on has been absurd
17:10 jorgev and I do think it should be reviewed soon (say, within the next month)
17:10 jorgev but we can't give you any promises
17:11 jorgev also, given that your add-on is targeted to a very specific audience, I wonder why it is so dependent on AMO
17:11 jorgev it's been around for over a year and has about 40 users
17:12 jorgev so I don't think it's than unreasonable for it to be a low priority given its complexity and potential for security problems
17:12 tcaud2 because people associate AMO reviews with trustworthiness.
17:12 tcaud2 but I'm done. I got what I came for.
17:12 tcaud2 BTW, I'm not the author.
17:13 rctgamer3 jorgev: replied to your needinfo
17:13 jorgev that's good to know
17:13 tcaud2 I'm an associate.

Click to expand...

Click to collapse