New Feature Announcements?

[JR Conlin]

Hi all,

Over the past week, I saw that there were a number of new features either
rolled out for FxA or soon to be. Things like avatar support, full name
support, permissions, etc. As a customer of FxA, I'd love to know about
these so that I can integrate them into my properties.

Is there an announcement of when these features are added? I'd prefer not
to watch ever commit to the repository (I get enough of those emails as is).

Thanks!

[Ryan Kelly]

I usually announce new releases on the dev-fxacct mailing list (cc'd) so
that's a good place to start.

We should make a lower-traffic "FxA Announcements" list for folks like
youself who may not be interested in our day-to-day chatter. I'll get
that wrangled once Whistler is over, and be sure to announce it on
dev-fxacct...


Ryan

[g]

-----Original Message-----
>From: Ryan Kelly <rfk...@mozilla.com>
>Sent: Jun 26, 2015 6:00 PM
Unsophisticated user response to Conlin msg below:

After downloading the new changes, I had a shock. I found that after I had closed my bank account site and exited Firefox, something weird happened upon my return...

The next time I opened the Firefox browser, there was my bank account, wide open, instantly.

I deleted all history and all temporary files and uninstalled Firefox, and then reinstalled. But, when I opened the browser, there was my bank account, open.

I did away with my shortcut on desktop and on two bars, deleted all cookies, deleted all downloads old and new... went to other heroics... and FINALLY I was able to open the Firefox browser and not see my bank account open, immediately upon startup of the browser.

I am not a programmer, nor an IT specialist, but I know enough to know this is scary.

After I was able to open Firefox browser without my wide-open bank account popping instantly onto the screen, I went into my bank account and changed my password.

CAUTION: At the very least, in my case at least, someone could have opened Firefox browser on my home PC and learned more than I want ANYBODY to know, other than myself.

I strongly recommend you quants diagnose what occurred, and quickly.







>To: dev-id...@lists.mozilla.org, dev-fxacct <dev-f...@mozilla.org>
>Subject: Re: New Feature Announcements?

>_______________________________________________
>dev-identity mailing list
>dev-id...@lists.mozilla.org
>https://lists.mozilla.org/listinfo/dev-identity

[Ryan Kelly]

On 26/06/2015 16:00, Ryan Kelly wrote:
> On 26/06/2015 15:54, JR Conlin wrote:
>> Is there an announcement of when these features are added? I'd prefer not
>> to watch ever commit to the repository (I get enough of those emails as is).
>
> I usually announce new releases on the dev-fxacct mailing list (cc'd) so
> that's a good place to start.
>
> We should make a lower-traffic "FxA Announcements" list for folks like
> youself who may not be interested in our day-to-day chatter. I'll get
> that wrangled once Whistler is over, and be sure to announce it on
> dev-fxacct...

I created fxacct-...@mozilla.org as a lower-traffic list for
important feature announcements, security things, etc:

https://mail.mozilla.org/listinfo/fxacct-notices

I'll find suitable places to link this from in our docs going forward.

I won't announce every little feature that we ship on there, but
big-ticket items like the impending refresh-token switch will certainly
be suitable for that list.


Cheers,

Ryan

[Ryan Kelly]

On 30/06/2015 01:22, Rémy Hubscher wrote:
> Should we use this list for storage release announcements or should
> we create a storage list for that?

Please use a separate list, the idea of *-notices is to be as
low-traffic as possible so that people won't hesitate to sign up for
important updates.

Cheers,

Ryan

>> Ryan _______________________________________________ Dev-fxacct
>> mailing list Dev-f...@mozilla.org
>> https://mail.mozilla.org/listinfo/dev-fxacct
>
>

[le...@consolejunkie.net]

Hi Ryan Kelly,

This probably isn't the right mailinglist to deal with these things
that
is probably why you didn't get any response.

What probably happened is that restore previous session had been
enabled:

https://support.mozilla.org/en-US/kb/restore-previous-session

Not sure if you yourself flipped that switch or some addon or whatever.

On an other note about your bank website:

If your bank allows people to do transactions only based on simple
cookie
then I say: find an other bank !

I life in the Netherlands, most banks send you a device something like
this:

https://www.rabodirect.ie/binaries/digipass_tcm97-153874.jpg

Without it you can't login or do transactions.

But I wouldn't be surprised if banks in for example the US still
haven't
figured that out. It took them what 10 years before they are now
finally
deploying 'chip & pin' ?

Not saying that chip & pin is perfect ;-)

https://media.ccc.de/browse/congress/2010/27c3-4211-en-chip_and_pin_is_broken.html#video

Small tip: if you are worried about your bank information:
- click on the logout button before you close your browser. If your
bank just uses
cookies then it's good to make that cookie invalid so even if an
attacker got your cookie
that cookie after logout became useless to them.

Have a nice day,
Leen.