The cat is finally out of the bag! Amazon Relational Database Service is offering PostgreSQL!
This is an incredibly exciting development to have Postgres as easily deployable in AWS as MySQL, Oracle or SQL Server.
Would love to hear who is planning to try it out in the comments.
In one of my older posts I’m describing how the Mozilla Platform decides on whether this high precision timer function is behaving properly or not. That algorithm is now obsolete and we have a better one.
The current logic, that seems proven stable, is using a faults-per-tolerance-interval algorithm, introduced in bug 836869 – Make QueryPerformanceCounter bad leap detection heuristic smarter. I decided to use such evaluation since the only real critical use of the hi-res timer is for animations and video rendering where large leaps in time may cause missing frames or jitter during playback. Faults per interval is a good reflection of stability that we want to ensure in reality. QueryPerformanceCounter is not perfectly precise all the time when calibrated against GetTickCount while it doesn’t always need to be considered a faulty behavior of QueryPerformanceCounter result.The improved algorithm
There is no need for a calibration thread or a calibration code as well as any global skew monitoring. Everything is self-contained.
As the first measure, we consider QueryPerformanceCounter as stable when TSC is stable, meaning it is running at a constant rate during all ACPI power saving states [see HasStableTSC function]
When TSC is not stable or its status is unknown, we must use the controlling mechanism.Definable properties
- what is the number of failures we are willing to tolerate during an interval, set at 4
- the fault-free interval, we use 5 seconds
- a threshold that is considered a large enough skew for indicating a failure, currently 50ms
- keep an absolute time checkpoint, that shifts to the future with every failure by one fault-free interval duration, base it on GetTickCount
- each call to Now() produces a timestamp that records values of both QueryPerformanceCounter (QPC) and GetTickCount (GTC)
- when two timestamps (T1 and T2) are subtracted to get the duration, following math happens:
- deltaQPC = T1.QPC – T2.QPC
- deltaGTC = T1.GTC – T2.GTC
- diff = deltaQPC – deltaGTC
- if diff < 4 * 15.6ms: return deltaQPC ; this cuts of what GetTickCount’s low resolution unfortunately cannot cover
- overflow = diff – 4 * 15.6ms
- if overflow < 50ms (the failure threshold): return deltaQPC
- from now on, result of the subtraction is only deltaGTC
- fault counting part:
- if deltaGTC > 2000ms: return ; we don’t count failures when timestamps are more then 2 seconds each after other *)
- failure-count = max( checkpoint – now, 0 ) / fault-free interval
- if failure-count > failure tolerance count: disable usage of QueryPerformanceCounter
- otherwise: checkpoint = now + (failure-count + 1) * fault-free interval
You can check the code by looking at TimeStamp_windows.cpp directly.
I’m personally quite happy with this algorithm. So far, no issues with redraw after wake-up even on exotic or older configurations. Video plays smoothly, while we are having a hi-res timing for telemetry and logging where possible.
*) Reason is to omit unexpected QueryPerformanceCounter leaps from failure counting when a machine is suspended even for a short period of time
I moved to http://blog.swarnava.in.
I’m trying to live Flash-free on my desktop. The first thing that didn’t work was Vimeo. I use Aurora, and so I set media.gstreamer.enabled to true, to turn on the gstreamer backend for the <video> tag. However, this still didn’t work. I tried installing more codec packs, but no luck. It turns out Ubuntu 13.10 comes with both gstreamer-1.0 and gstreamer-0.10, and Firefox only supports gstreamer-0.10. So I had to find the appropriate codec packs for 0.10 and install those also. Then, Vimeo worked (using H.264).
YouTube seems to work fine using WebM. :-) I do have the YouTube Flash to HTML5 addon installed so I don’t need to keep opting back in to the ‘trial’.
OASIS has a rule that at least 15% of members must affirmatively vote to approve a new standard. Therefore, by being a member and not participating in such votes, we make it slightly harder for standards to be approved. Recently, I was emailed by the implementers of an open source version of one such standard asking for my vote in order to reach this threshold.
However, I do not have time to evaluate the purpose and technical merits of all the standards OASIS produces.
Here is my proposed attitude to such requests; comments welcome:
“If the OASIS proposal is under a proper royalty-free IPR policy (known in OASIS-speak as “RF on limited terms”), and does not obviously harm Mozilla’s mission or the open web, I will vote Yes if specifically requested. Otherwise, I will not normally vote. Any member of the Mozilla community is welcome to make the case to me for a different vote in a particular case.”
the following changes have been pushed to bugzilla.mozilla.org:
-  MyDashboard display of last change for a bug no longer working due to API change for Bug.history
-  remove mcoates from the auto-CC list on employee-incident bugs
-  Include status and summary for bugs listed in `depends_on` and `blocks` fields
-  Simple bug-change push extension
-  Project Kickoff Form: require explicit public/private choice
-  Add a script for bulk updating of tracking flags
-  Ember.show API returns unchanged fields when called with last_updated param
-  Don’t show email address without logged in on the User Profile
discuss these changes on mozilla.tools.bmo.
Filed under: bmo, mozilla
For a little while now, there has been an apps “Show and Tell” session hosted by Mozilla where app developers could showcase cool things they are working on. Last Friday, I got the opportunity to show off our Screen Reader emulator, and how to use it to test web apps. If you could bear the bad audio, you could watch the session here.
Ready to have your mind blown? Here’s how you can “copy” from the entire medium of television news and “paste” into your blog, Tumblr, Twitter feed or Facebook wall. With this technique, you can quote media the same way you quote text. You can be like Jon Stewart from the comfort of your bedroom.
1. Head over to the Internet Archive’s TV News Archive, which is already the most impressive public interest technology project in recent history.
2. Opt into the preview version, which has some new experimental features. (There’s a ribbon on the top right.)
3. Search the last 4 years of television news by transcript. The archive is current to the last 24 hours. You can search for any term. How about something timely, like something related to electronic surveillance?
How about “not wittingly,” the paradoxically least untruthful part of the untruthful Senate testimony by Director of National Intelligence James Clapper? This was made in March 2013, several months before Edward Snowden defected for Hong Kong.
SEN. RON WYDEN (D-Ore.): “I wanted to see is if you could give me a yes or no answer to the question, does the NSA collect any type of data at all on millions or hundreds of millions of Americans?”
DNI JAMES CLAPPER: “No, sir.”
SEN. WYDEN: “It does not?”
DIN CLAPPER: “Not wittingly. There are cases where they could inadvertently perhaps collect, but not wittingly.”
Search for “not wittingly.” You’ll be presented with TV news clips in which the speaker says “not wittingly.” That will include the original clip and a lot of subsequent commentary throughout the news networks.
4. Find the one you want, and click the “quote” button in the top right.
5. Now, use the handles to isolate the exact part of the transcript that you’re interested in, and click “Share” again.
You have a range of options on how to share the clip. The most interesting share option is with Popcorn Maker, Mozilla’s cloud based media editor. (I was part of the team that designed the software, but that’s not why it’s interesting!)
This clip will be added to a new video project inside of Popcorn Maker. Now you can add videos, audio, GIFs, titles, and any other media from across the web into your composition. Throw in you talking to a webcam from a clever script, and you can be Jon Stewart (though probably less funny).
I took 20 minutes to create a template that demonstrates this in action. You can take and remix it using the tools described above:
It’s not that people can pretend to be Jon Stewart that’s so exciting. Few people are as funny as Jon Stewart. It’s that anyone with a web browser can have the same power as the Daily Show production team. This brings the powerful but specialist medium of political remix video to everyone: now anyone can read and write the media. Media becomes just like hypertext. Anyone can “copy” from the visual memory and effortlessly “paste” into a video, entirely in the cloud. Anyone can quote, contrast, or re-contextualize news video to tell a story, critique power structures, deconstruct social myths or challenge dominate media messages. This could be a big media literacy moment.
This is the most interesting part of what the TV News Archive—together with audiovisual writing tools and open video tools like Popcorn Maker—represents. I’ve written about the transformative potential of the TV News Archive before, and also how Popcorn Maker can be most powerful in an age where video is the medium of record. This set of features, though still in testing, are a tangible realization of that vision for media literacy.
You can see Roger MacDonald, the head of the TV News Archive, and Tracey Jacquith, its lead programmer—both heroes of the open web and democracy—introducing TV News Archive quotability at the annual Archive get-together. And you can see a Popcorn/TV News test project by Roger here.
Special props to Matthew Schranz for assisting Tracey to get proper clip attribution (and some other stuff) working in Popcorn Maker.
You should also check out the TV Archive’s special collection about the NSA, electronic surveillance and Snowden. It’s ripe fodder for doing rich media critique using the techniques described above. One quick note: because all these videos are encoded in h264, they don’t work in Firefox just yet. That’s another open video story, but it won’t be the case forever.
The Internet Archive just suffered a fire in their scanner facility—if the TV News Archive inspires you even one bit, donate to the Internet Archive to help them get back on their feet.
Server tuning is a topic that consumes many books, blog posts and wiki pages.
Below is some practical advice for getting low-hanging fruit out of the way if you’re new to tuning Postgres and just want something that will likely work well-enough on low volume systems. I’d say looking at this list and making changes on a new system should take 10 minutes or less.Run pgtune
Greg Smith open sourced a utility for making a first pass at tuning Postgres for a local system with pgtune. This tool is easy to run – just copy it to a target system and then point it at your existing Postgres config. It puts its changes into a new file at the very bottom.Use XFS
Filesystem choice matters. Greg Smith goes into some detail on why ext3 is a terrible performance choice for a database filesystem in his talk Righting Your Writes. At this point, XFS is the filesystem that should be your default choice. If you want to explore ext4 or zfs (if that’s an option for you), that may be worth looking at. It is “safe” however to choose XFS. Depending on your disk situation, recreating your filesystem might take a bit longer than 10 minutes, but hopefully this will save you time and bad performance in the future!Increase your readahead buffer
On Linux, the readahead buffer (brief explanation) is set way to small for most database systems. Increase this to about 1 MB with blockdev -setra 2048 [device].For further performance analysis
I wrote this performance checklist a while back for assessing a system’s health. I’d say a review of all the things on that list would take probably half a day. Following up and making the changes could take a day or more. These kinds of analysis are worth exploring periodically to ensure you haven’t missed important changes in your environment or your application over time.
It has been roughly 6 months since the Engineering meeting reboot. As I previously wrote, I consider the Engineering Meeting a work in progress. As such, I have made a few additional changes to the meeting during this time that I wanted to mention for those people who do not regularly attend the meeting.
- Air Mozilla: Don’t want to install Vidyo? Can’t attend at 11am PT? No problem. In addition to our standard Vidyo feed, the Engineering meeting is now broadcast live and archived on Air Mozilla.
- IRC Logs: A frequent request is better minutes that capture what happened at the meeting. In response, the minutes now include the #planning irc log from the meeting to record the online discussion. For an example, see this week’s minutes.
- Friends of the Tree: Want to know about our volunteer contributions? Josh Matthews now updates the minutes with a list of volunteers who have made a technical contribution to Mozilla’s products in the last week. For an example, see this week’s minutes.
Have additional ideas to improve the meeting? Please post to dev-platform, comment on this post, or get in touch with me privately.
Tagged: engineering, meeting, mozilla, mozilla community
This Friday I’ll be giving a talk to 250 primarily first-year students majoring in Computer Science at Michigan State University. This presentation is part of their CSE 100: Computer Science as a Profession course that students are required to take.
I’m planning on starting with an overview of Mozilla and some of the unique technical challenges that I’ve had to solve. One of the really cool things about working at Mozilla is getting to see and experience up front the wide spectrum of computing problems that are being tackled.
Within the Mozilla community, there are people working on the forefront of research by implementing a new memory-safe and concurrent programming language (Rust) and parallel browser engine (Servo) to finding innovative ways to get people more involved with producing web content (Webmaker).
I will try to record the presentation, but I can’t make any guarantees.
I feel very honored to receive an invitation to give this talk, and I’m greatly looking forward to it. If you have some helpful tips for college freshman, please do share in the comments below.
Tagged: mozilla, msu, planet-mozilla, presentation
Learning and problem solving are related to sleep. I see the same thing in playing music. I play woodwinds and really enjoy the tricky fast passages common in Baroque Music. Sometimes I will struggle for hours over some awkward fingering that I just can't seem to get. In music, it's called wood shedding: sitting somewhere and playing the same passage over and over until you get it right. Sometimes that works, sometimes it doesn't.
What does work every time? Practicing for a while, moving on to something else and then sleeping. The next morning, I find that performing the complicated or tricky fingering is much easier. If hack at it too much, I reinforce the errors instead of the correct fingering.
This is so true in programming. Case in point yesterday and today with a problem in the Socorro Middleware. We discovered the problem and I stepped up to fix it. Forty minutes later I submitted my patch only to find that it made the Middleware explode in a completely unrelated place. There seemed to be no logical connection between the work that I did and the failure. I banged my head on that problem for hours and hours pushing myself into a fourteen hour work day.
This morning, I looked at the problematic code and said, “I wonder...”, then spotted the problem, made the trivial fix, pushed the code to github, watched the Jenkins job feed it through the battery of tests and voilà it passed.
It is a lesson that is hard to learn. Maybe if I were to sleep on it, I'd learn it.
It’s been 4 years now since the first Mozilla Festival in Barcelona, and its now almost 4 times bigger. Each year there are more people, more activities, and more amazing builds to blow your mind. The never ending drums just getting louder, but now with a more unified rhythm. We need to not only #MakeTheWeb, but we need to #TeachTheWeb.
I feel privileged to have been a part of the teams that make these events happen each year. Each time doing something a little different, due not only to having the experience to know how to make things happen a little easier, a little quicker, and/or a little better, but also due to the ever evolving and growing nature of the festival.
If I’ve learned one thing about the Mozilla Festival over the years its that there is no definitive start point for organisation. The festival is more of a giant puzzle that gets put together by the organisers for the 3 day event. There is a framework that these puzzle pieces get put into, but its designed to keep out of the way.
- Identify themes of shared concern for participants. (i.e. making, mentoring, learning, hackable games, etc…) Mozilla Festival 2013 Themes
- Invite space wranglers to run areas relating to a handful of the key themes.
- Design sessions for participation. Talk with people, not at them, and avoid jargon to keep language accessible.
- Provide a fluid/dynamic schedule crafted by the participants. Combining traditional prescheduled content, with emergent/bar camp like scheduling.
- Give inspiration at the start with cool projects that converge on the themes, and show off new projects at the end to showcase the amazing work of participants over the event.
Even though the festival keeps getting bigger these 5 “steps” for creating the event have remained the same since 2010. Some of the puzzle pieces have changed, become bigger, and/or more efficient, however the basic concept remains.
There is one thing missing from this list that I’d like to cover in the rest of this post, and that is the people who make sure everything runs smoothly on the day. One group is already mentioned, but there are a few more groups that are just a crucial to the success of the event.Space Wranglers
These are the curators of spaces and themes. Each key theme for the festival has its own physical space it operates from, and this space is under the sound control of its owner, the Space Wrangler. Dealing with everything from room delegation, content curation, and facilitation of facilitators.
The space wrangler is the person to go to if you have any questions about a given theme.#MozHelp to the rescue!
One of the groups hiding behind the scenes, taking on the task of routing questions, requests, information and more, was the #mozhelp team. Headed up by Jess and Misty from AspirationTech, with help from Neil, Beatrice, and myself (when not hacking the schedule app).
These guys did an amazing job tackling the information firehose, and taming it. Dealing with, and resolving every single request (within their power).
— Zara Rahman (@zararah) October 29, 2013
The #mozhelp team spent most of the festival keeping a very close eye on the twitterverse looking for anyone calling out for help, as well as monitoring the radio waves for schedule changes.
Every year a team of dedicated, energised, superheros defend on the Mozilla Festival to answer your on the spot questions, make sure you get the supplies you need for sessions, and all in all do what it takes to ensure that you have a fantastic Mozilla Festival Experience.
For this team of supers the Mozilla Festival started a little over a week before the main event in the Mozilla London Space, with their team briefing.
Even though the briefing video is almost 40 minutes long, it’s well worth watching as you’ll get to know a little more about those who may at times have appeared to you as red streaks going up and down the stairs.Types of volunteer Info Guru
These are the more social people who were super eager to give you directions, schedule updates, and much, much, more. These were the ones with the walky-talkies.Runner
Making sure things get from A to B isn’t easy, but these marvellous people made it look like no work at all. If you want to know who covered the most miles at the festival, these are the people to ask. They’re also amazing note takers!Tech Support
Its a tech event, so you’d think that everything would just work… you though wrong. However, the wonderful tech support team fixed almost all problems before the occurred. They setup the AV, troubleshooted your wifi problems, and got the projectors working when you thought there was no chance of projecting again.The Storytellers
Finally we get to the storytellers. Without whom the whole festival would still be a mystery to most. Taking the mountain of creation and activity, digesting, then regurgitating in a form we can all understand. The storytellers took on the thankless task of ensure the event was document, and document well, rather than going to all the sessions themselves.The Festival Wranglers
Behind all of this activity there are a few people that deserve a special shout out. These are the people who’ve spent months making sure that this 1 billion piece puzzle fits together. Sleeping no more than a handful of hours, curating the curation, and getting everyone to the right place at the right time.
Their also incredibly hard to keep in one place long enough to get a photo of as well!
Michelle Thorne – Festival Director
Allen “Gunner” Gunn – Facilitator of Facilitation
Ella Thiele, Sarah Allen, and Ben Selby – Festival Management
Chris “Spike” Foote – Volunteer Coordinator
I often get questions about how to become an Evangelist. I can’t give you a magic recipe, but I can tell you how I managed to land my dream job.
Before I start, be sure to understand what the job is all about: it’s not just about doing conferences, and traveling. So, four years ago, I decided that my next step in my professional career would be to become an Evangelist (French post). I saw some of them, read about the job, and thought that it was a perfect fit for me: I’m technical, I like to help others, and I have a special skill many developers don’t have… I’m social. So like for any jobs you want, you need to understand what are the requirements or the skills for this particular job, and fill the gaps. If I have to summarize what I understood about the role a couple of years ago, it would fit into these five words (in no particular order): technical, speaking, communities, experience, and leadership.Technical
You need to be technical, to be a Technical Evangelist. It sounds stupid, but many people don’t understand it. Of course, you won’t develop software all day long, but since you are talking about technology, you need to be able to have a discussion with developers, build demos, and be credible in front of a crowd. On my side, it was easy as I was a Software Developer for about 10 years. I would say that it’s usually the profile of people who become Evangelist: I’ll write more about this in the experience point.Speaking
Even if the role isn’t just about public speaking, it’s still an important part. Furthermore, your role is to create connection with developers, so you’ll have to talk with them, discuss, and help them. On my case, I had no problem to discuss with people about technology, but I had no public speaking experience. I started to check where someone like me, with no experience, would be able to do a presentation in front of a crowd: I submit a talk to Podcamp Montreal (French post), and got accepted. It was the beginning of my public speaking career, as after that, I got some speaking offers. Even if it wasn’t about technical topics as I did a presentation on how to use social media to organize events, I was still sharing my passion in front of attendees. It helped me build some experience with public speaking, and build my case for the job I wanted.Communities
You cannot succeed as an Evangelist if you don’t work with communities. People that believe in your mission, love your product, use your technology will be there to support you, and be what I call, virtual Evangelists! When a company hires you, it’s not just about your skills: having a good network will help you. It’s also one of the reasons why those jobs are well-paid, as you are building an amazing network while you work for a company in that role, and it’s something enterprise wants to keep with them. I was already going to different technical user groups, but also social media events. I connected with other developers, user groups lead, conferences organizers… I like people so it wasn’t hard for me, but networking was a big part of it.Experience
I like to believe that all Evangelist jobs aren’t tight with a manager who likes to micro-manage: from my personal experience, it’s a job with a lot of freedom. In my own definition of leadership, you can find the word responsible too. So to land this kind of job, you need to show that you are responsible, and that you have the makings of a leader. You’ll have to manage your schedule, maybe work at home, decide how you’ll achieve your goals, even defining your own goals. It’s easy to ask your previous manager to speak for you on those points, but does it have a lot of impact? Who is giving references about someone who will say bad things about you? Fortunately, I started, and lead the Festival Geek de Montreal (French site) for two edition: I was able to show companies that I can lead a huge project, build a team of awesome volunteers, create something big, and make things happen without having a manager over my shoulder telling me what to do.
At the end, I listed what skills I thought I needed, and work on those to get more experiences, and be sure I would be able to sell myself as a good candidate for being a Technical Evangelist. I think it makes sense for all jobs: find what you need, and make it happen. All those points together helped me a lot as when Microsoft was looking for a new Evangelist in Montreal (French post), they heard about me from people in the communities. They were also able to see tangible things I did, and even if I didn’t officially have Evangelist experience (no job, not paid for doing it), I already started to Evangelize… So this is my own story, and I hope it’ll help you land your dream job as a Technical Evangelist too!
- One month as a Firefox OS Technical Evangelist Time flies; I thought I started at Mozilla last week,...
- What can you expect from me as an Evangelist? You probably know it by now, I’m looking for a...
- Do you want to become the next Technical Evangelist at Microsoft Canada? As you know, I’m leaving Microsoft on July 2nd, and...
Accomplishments & status:
Bug 905742 - Provide B2G Emulator builds for Darwin x86
Working on this with Simone.
This was main focus of the week, which started on Friday by getting into the topic, and having some face-to-face meetings. We’ve read through the B2G docs, grabbed a slave from slave alloc, and are working through manual builds at the moment.
We’re keeping a log of my activities here where you can follow progress.
This bug was not being progressed by IT, so I decided to see if I can resolve it myself. I cloned inv-tool, configured it, wrote a script to add the CNAMEs via the inv-tool api, had it reviewed (thanks Rail!), ran it, and confirmed the entries were added in DNS. So a new tool for my belt. =)
Reran the report, and found that pandas are still assigned to the dead retired buildbot-master39, but have been reassigned from buildbot-master40 and buildbot-master41 (so 2/3rds of the way there) =)
Raised this bug after stumbling across this error - Ben kindly fixed this week.
Raised this bug on Ed Morley’s request.
Created two new patches; i) to tidy up devices.json (sort entries and remove dead whitespace), and ii) to add new entries. Committed and in production.
Bug 936615 - Pandas should start buildbot when mozpool thinks the device is ready
Provided (elementary) feedback.
To look at over the next week:
Areas to develop:
To be discussed.
Quarterly goal tracking:
Notes / Actions:
The Naming of Hackers – a difficult matter,
It isn’t just one of your holiday games;
You may think at first I’m as mad as a hatter
When I tell you, a hacker has THREE DIFFERENT NAMES.
Today I received a very polite email from a citizen of a non-Western country asking that about:credits be updated to put the components of his and his colleagues names in the order customary in that country (family name first), while still sorting them by family name with the others. I use scripts to manage additions to about:credits, and the page is generated from a CSV file which contains fields for “family name” and “first/common/Christian name”. The system does indeed currently make some Western assumptions about the order of names, and so fulfilling his request requires changing it significantly.
Before I rewrite it, I want to make sure I rewrite it only once. I am aware of falsehoods programmers believe about names, and I’m glad that we don’t have to make a system which copes with every edge case. We are not planning to serve, for example, people without names or people whose names use non-Unicode characters. But we do want to serve people with one name, as I know of hackers in that category.
Here is my design. To test it: can anyone think of a hacker (on any project, not just Mozilla) whose name would not fit into this scheme?
- Name: name as they wish it to be printed
- Sortkey: part of the name that they wish to be used for sorting; would be the component corresponding to “family name” in almost all cases
The charset is Unicode. The sort is by base Latin letter. If a submission does not contain details of how they want their name to be sorted, I will make my best guess based on my knowledge of customs in their part of the world.
The other policies I have been implementing for about:credits (on which comments are also welcome) are:
- Names normally written in non-Latin letters should be in romanized form. (This is a common practice, makes them easier for everyone to read, and no-one has objected thusfar.)
- I include a family name, plus a person’s common/first/Christian name, that they normally use. I am Gervase Richard Markham, but most people know me as Gerv, so my entry would say Gerv Markham or Gervase Markham, at my option. But if someone’s name is John Mark Smith, and he is known as “John Mark”, then I would list him as John Mark Smith.
- I use initial caps for consistent presentation.
- I don’t include initials – names are either present in full or not present.
- Unless someone officially only has one name (e.g. on their passport), I ask for at least two so that names are as distinctive as possible (knowing that names are not unique in general).
Microsoft has announced that CAs in its root program may not issue certs signed using the SHA-1 algorithm, starting just over two years from now, and that Windows will start refusing to recognise such certs starting just over 3 years from now.
Make no mistake, this is a huge move and an aggressive timetable. 98% of certificates in use on the Internet today use SHA-1. Any certificate being used on the public web today which has an expiry date more than 3 years in the future will not be able to live out its full life. And it’s also an important and necessary move. SHA-1 is weak, and as computing power increases, is only getting weaker. If someone came up with a successful preimage attack on SHA-1, they could preimage a commonly-used intermediate cert from a popular CA and impersonate any website in a way only detectable by someone who examines certificates very, very carefully.
I strongly welcome this, and want to use it as an opportunity to make further improvements in the CA ecosystem. Currently, the maximum lifetime of a certificate under the Baseline Requirements is 5 years. It is due to reduce to 39 months in April 2015. Given that 98% of the certificates on the Internet are going to need to be thrown away 3 years from now anyway, I want to take the opportunity to reduce that figure early.
Long-lived certificates are problematic because CAs understandably strongly resist having to call their customers up and tell them to replace their working certificates before they would naturally expire. So, if there are certificates out there with a lifetime of N years, you can only rely on 100% coverage or usage of an improved security practice after N years. With N = 5, that reduces the speed at which the industry can move. N = 3 isn’t awesome, but it’s a whole lot better than N = 5.
So I will be bringing forward a motion at the CAB Forum to update the Baseline Requirements to reduce the maximum certificate lifetime to 3 years, effective from January 1st 2014.
The subject of where to host version control repositories comes up a lot at Mozilla. It takes many forms:
- We should move the Firefox repository to GitHub
- I should be allowed to commit to GitHub
- I want the canonical repository to be hosted by Bitbucket
When Firefox development is concerned, Release Engineerings puts down their foot and insists the canonical repository be hosted by Mozilla, under a Mozilla hostname. When that's not possible, they set up a mirror on Mozilla infrastructure.
I think a recent issue with the Jenkins project demonstrates why hosting your own version control server is important. The gist is someone force pushed to a bunch of repos hosted on GitHub. They needed to involve GitHub support to recover from the issue. While it appears they largely recovered (and GitHub support deserves kudos - I don't want to take away from their excellence), this problem would have been avoided or the response time significantly decreased if the Jenkins people had direct control over the Git server: they either could have installed a custom hook that would have prevented the pushes or had access to the reflog so they could have easily seen the last pushed revision and easily forced pushed back to it. GitHub doesn't have a mechanism for defining pre-* hooks, doesn't allow defining custom hooks (a security and performance issue for them), and doesn't expose the reflog data.
Until repository hosting services expose full repository data (such as reflogs) and allow you to define custom hooks, accidents like these will happen and the recovery time will be longer than if you hosted the repo yourself.
It's possible repository hosting services like GitHub and Bitbucket will expose these features or provide a means to quickly recover. If so, kudos to them. But larger, more advanced projects will likely employ custom hooks and considering custom hooks are a massive security and performance issue for any hosted service provider, I'm not going to hold my breath this particular feature is rolled out any time soon. This is unfortunate, as it makes projects seemingly choose between low risk/low convenience and GitHub's vibrant developer community.
Friday I attended the inauguration of the new Chancellor of the University of California at Berkeley. I spent a lot of time at UC Berkeley (or “Cal” as it is known among students and alums). I got my undergraduate degree (in Asian Studies, an interdisciplinary degree) from Berkeley. I worked as a staff member at the Center for Chinese Studies Library for a few years, where I was generally the only non-native Chinese speaker in the Library. In an odd turn of fate I returned to Berkeley for my graduate degree (in law).
Berkeley is part of the much larger system of public education in the state of California. “Public” higher education may seem obvious to some, if you come from a part of the world where this is standard. In the US, many universities (e.g., Harvard, Stanford, Yale) are private organizations, and so the public nature of the University of California is a big part of its identity. The entire system includes a set of 2-year Community Colleges, almost 25 California State University campuses and 10 University of California campuses. I was very fortunate because during my college and graduate years the State of California provided immense support to public education, and I was one of the many beneficiaries. I benefited from a world-class education without the kind of crushing debt that colors one’s choices for years afterwards. I see my work at Mozilla as possible in part because the State of California invested in me.
I have always found UC Berkeley to be a funny mix of radical, innovative, and traditional. The student body is politically active at Berkeley. The Free Speech Movement in the early 1960′s established the right of students to engage in political speech on campus, something I took for granted. The faculty at Berkeley is active. In the 1920′s a “faculty revolt” resulted in the faculty (through the Academic Senate) obtaining a much-extended role in shared governance of UC Berkeley. The staff at Berkeley is active as well, demanding respect as part of what makes Berkeley great. (I was staff at UC Berkeley for a few years before graduate school, so I remember this aspect as well.)
Both of these elements were present at the inauguration. The event started with a student protest about Janet Napolitano, ex head of US Homeland Security and recently appointed as the President of the UC system. It’s a controversial appointment since her background is in security and immigration/ deportation rather than education. The protest was actually quite moderate. The students sat up in the balcony, stood up as soon as the event started and chanted their position. This took maybe a couple of minutes. Then they left. No on-going heckling, no need to be tossed out.
A few things I noticed about the content of the event. During the procession (classes, faculty, other institutions, staff), I felt myself perk up at one point. I wondered why, especially as the law school classmate I went with didn’t seem to notice. Then I realized — the orchestra was playing the UC Berkeley “fight song”. I’ve heard this a million times — it’s like hearing your name. The song refers to the UC Berkeley mascot — the Golden Bear. It includes a verse:
From his Lair he fiercely growls.
What’s he say? He says:
From his Lair he fiercely growls.
What’s he say? He says:
Grrrr, Rrrr, Rrrrrah!
So, after the first Processional there was a very quiet sound from the hall:
Grrrr, Rrrr, Rrrrrah!
After each Processional group the Golden Bear got louder. Never as loud as at a football game, but still it felt like Berkeley. Funny tradition of activism and chants. Similarly, many of the speakers at the inauguration ended their remarks with the classic call “Go Bears!” You can hear it at the end of the Men’s Octet rendition of the fight song.
More seriously, the remarks made by all speakers reinforced a few key concepts:
- Cal seeks to be the world’s pre-eminent public research university, promoting both excellence and education as an important element of democratic societies, not just economic benefit of individual students.Cal aims for excellence, affordability, and diversity of students.
Calls for social justice, both for working people and for undocumented students. For those not familiar with US immigration issues, “undocumented students” refers to people who hold neither a US passport nor a visa to remain in the United States.
There were also many references to the difficulties the UC System faces. Finances are tight, the State of California has reduced its support dramatically and tuition rates have gone up. Undergraduate education vs graduate and research efforts are a topic. The value of studying humanity (“liberal arts”) as well as technology is a topic.
The new chancellor described all of these, plus the plans to move forward. This part of the talk was a bit long for me. It was a speech, rather than the short remarks of the other participants. This makes sense to me. But I have to admit that my working life is mostly focused around very short attention spans — like 15 seconds. Seriously, that’s advice I give people who are dealing with executives for the first time. You have about 15 seconds to get someone’s attention, especially via email. So even though I was a bit itchy during the end of this talk, I was still able to focus enough to appreciate the core content.
Since I moved to Silicon Valley, I’ve come to appreciate how amazing Stanford University is. It’s a key component of the innovation and intelligence and excellence that the Valley produces. I didn’t understand its important until I lived here a while. I’ve always found Stanford very difficult to develop any relationship with as a non-alum, but I have come to be awed by it as well.
I have to say though, it was wonderful to be at UC Berkeley, where I felt at home — utterly, totally, and completely at home.