Henri Sivonen

Making Firefox load about:blank correctly

Web site: https://hsivonen.fi/
Twitter: https://twitter.com/hsivonen

Last Notes

2026-05-08 20:32:50 UTC

What going to happen first due to the situation with LLMs and security bug finding: Microsoft issues a patch to Windows 10 even for computers not enrolled into ESU to fix something really bad or a major LTS Linux distro declares kernel patch backporting bankruptcy and rolls the kernel forward instead of backporting?

2026-04-22 04:40:48 UTC

Reminder that Mozilla has been bundling multiple memory-safety bugs under one CVE number for, *checks notes*, a couple of decades. https://www.mozilla.org/en-US/security/advisories/mfsa2006-68/

2026-04-21 09:21:34 UTC

I keep seeing bad takes that express hostility towards security bug finding whether by Project Zero or by LLMs.
It’s as if folks with these takes are ignoring two basic things:
1) Google and Anthropic didn’t put the bugs in your code. The known risks of memory-unsafe programming languages are hitting the fan.
2) Attacks that exploit memory-unsafety hurt _users_.
(Take an ffmpeg vulnerability: Chances are that YouTube’s back end is already isolated but VLC users could have a very bad time.)

2026-04-13 20:08:24 UTC

- reply

Also, it looks to me that fuzzing requires more human setup of what part of code to fuzz and how to deal with stuff like checksums whereas reportedly LLMs can deal with less specific harnesses and figure out how to fill in checksums.

2026-04-13 17:24:56 UTC

- reply

Then there’s the dismissal that, yes, LLMs now find security bugs, but the bugs could have been found by other methods. But evidently defenders hadn’t actually found them by other methods. (Unknown what attackers had already found.)
Or folks find it objectionable that the new capability has been made available to attackers and the proposed cure is to pay for access to the same LLM. But that does make the existence of the capability untrue.

2026-04-13 17:24:28 UTC

- reply

And, yes, the Anthropic Mythos post fits a previously-seen pattern of “AI” companies marketing by danger, but saying that it’s marketing does not refute what the models that are already generally offered can do.
And people act like their own conjecture is more informative than what people from multiple projects that deal with security bug reports say. See e.g. https://mastodon.social/@bagder/116363034479757682 .

2026-04-13 17:24:10 UTC

I’m seeing a lot of denial and logical fallacies on Mastodon about LLM capability to find security bugs.
I get it that when folks have concluded that LLMs are harmful, they want to believe that LLMs fail at everything. But a list of correctly-identified bad things about LLMs does not logically imply that LLMs can’t find security bugs.

2026-03-25 11:17:42 UTC

Today in Web compat: Firefox and Safari are ahead of Chrome in ICU4C version and upsteam ICU4C changed the formatting of zero offset from GMT. This broke birthday date validation for a UK based site for birthdays before 1970 in Firefox and, on 26.x Apple OSs, in Safari, because the site performs a formatting-based check on the time zone of London on the date to be validated and the UK has changed time zone rules along the way.

2025-02-24 13:33:15 UTC

ISO isn’t that different from Elsevier: Others do the work without funding from them and then they put the result behind a paywall.
https://meshed.cloud/@webmink/114058954485365970

2025-01-17 20:33:45 UTC

Our team (DOM Core) has an open position: https://www.mozilla.org/en-US/careers/position/gh/6527472/
Remote in any of Finland, Sweden, Denmark, Poland, Spain, Belgium, Netherlands, France, Germany, UK, Canada, or US.