Skip Navigation
Posts
140
Comments
223
Joined
2 yr. ago
Linux @lemmy.ml
Karna @lemmy.ml
Open Source @lemmy.ml
Karna @lemmy.ml

GNOME's Help Browser Affected By A Serious Security Issue For Arbitrary File Reads

cross-posted from: https://lemmy.ml/post/28675331

Linux @lemmy.ml
Karna @lemmy.ml

GNOME's Help Browser Affected By A Serious Security Issue For Arbitrary File Reads

Linux @lemmy.ml
Karna @lemmy.ml

KDE Plasma 6.4 Lands Initial Support For The Wayland Session Restore Protocol

Linux @lemmy.ml
Karna @lemmy.ml
Open Source @lemmy.ml
Karna @lemmy.ml
Firefox @lemmy.ml
Karna @lemmy.ml

Summary

We have rewritten over 600 JavaScript event handlers to mitigate XSS and other injection attacks in the main Firefox user interface. This mitigation will ship in Firefox 138. However, blocking the execution of scripts in the parent process is not the end - we will expand this technique to other contexts in the near future. There is still more work to do as the UI requires JavaScript APIs with a high level of privileges. However: We still eliminated a whole class of attacks, significantly raising the bar for attackers to exploit Firefox. In fact, we hopefully just broke someone’s exploit chain.

Open Source @lemmy.ml
Karna @lemmy.ml
Firefox @lemmy.ml
Karna @lemmy.ml
  • Did you compile the kernel by yourself, or used Mainline to install?

  • Operated by MZLA Technologies Corporation, a subsidiary of the Mozilla Foundation, Thunderbird is an independent, community-driven project that is managed and overseen by the Thunderbird Council, which is elected by the Thunderbird community.

    Source: https://en.m.wikipedia.org/wiki/Mozilla_Thunderbird

  • Linux @lemmy.ml
    Karna @lemmy.ml

    Ubuntu 25.04 Beta Delivering Some Nice Performance Improvements Over Ubuntu 24.10

    Linux @lemmy.ml
    Karna @lemmy.ml
  • Yes, Gnome extensions shall be impacted once again for sure. But, at least that is not a deal breaker for me.

  • Linux @lemmy.ml
    Karna @lemmy.ml

    GNOME 48 Release Notes

    Firefox @lemmy.ml
    Karna @lemmy.ml
    Linux @lemmy.ml
    Karna @lemmy.ml

    "some workloads saw improvements, overall system performance slightly declined, and binary sizes increased." So -O3 isn't paying off in the Ubuntu packaging world for now and will be reverted soon.

    Firefox @lemmy.ml
    Karna @lemmy.ml

    Firefox 136 Available With AMD GPU Linux Video Acceleration, AArch64 Linux Binaries

    Linux @lemmy.ml
    Karna @lemmy.ml
  • I guess it takes time to built a DE from scratch.

  • No native support for DoH in Pi-Hole yet. Additional setup is required to enable it on Pi-Hole[1].

    [1] https://docs.pi-hole.net/guides/dns/cloudflared/

  • If Pi-Hole starts supporting DoH out-of-the-box, I'll happily switch from AdguardHome.

  • NextDNS doesn't support unlimited DNS query for free, I think.

  • Linux @lemmy.ml
    Karna @lemmy.ml

    Context:

    Reproducible builds ensure software can be rebuilt in an identical, bit-for-bit manner anywhere at any time using the same tools. This means that someone rebuilding the software from the same source code will get exactly the same results.

    Why is this important? Because it’s a crucial aspect for supply-chain security.

    Source: https://news.opensuse.org/2025/02/18/rbos-project-hits-milestone/

    karolherbst 🐧 🦀 (@[email protected]) "MAINTAINERS: Remove myself"

  • Thanks for the context!

  • Linux @lemmy.ml
    Karna @lemmy.ml
    Linux @lemmy.ml
    Karna @lemmy.ml
    Firefox @lemmy.ml
    Karna @lemmy.ml

    Firefox ForkServer Getting Ready To Enhance Linux Browser Performance

  • Alpine has been used in Docker, and Docker is now run everywhere

    This is exactly what came to my mind while reading through the article.

  • Your home server might have the required bandwidth but not requisite the infra to support server load (hundreds of parallel connections/downloads).

    Bandwidth is only one aspect of the problem.

  • That solves the media distribution related storage issue, but not the CI/CD pipeline infra issue.

  • Exactly the same rationale as mine.

  • Users are only shown Big Tech “3rd-party” options. Mozilla made this choice intentionally.

    Well, how many users really have LLM local-hosted?

  • To be honest, I never tried publicly available instances of any privacy front-ends (SearxNG, Nitter, Redlib etc.). I always self-host and route all such traffic via VPN.

    My initial issue with SearxNG was with the default selection of search engines. Default inclusion of Qwant engine caused irrelevant and non-english results to return. Currently my selection is limited to Google, Bing and Brave as DDG takes around 2 sec to return result (based on the VPN server location I'm using).

    If you still remember the error messages, I might help to help fix that.

  • Though it is an off-topic but what exact issues you faced with SearxNG?

  • On Ubuntu, replacing Firefox/Thunderbird snap version with actual deb version.