Hacker Newsnew | past | comments | ask | show | jobs | submit | DangerousPie's commentslogin

They also demonstrated how this could be used to silently find out someone’s phone number and then hijack a TFA validation call from an app like WhatsApp to take over their account with no user interaction.

This attack was not silent, it was noisy. They specifically pointed that out in their talk.

Right, but isn't it noisy ... at the headphone level? (i.e. not heard when not wearing them?).

What I'm getting at is that I think the risk varies depending on how often you leave the headset paired; for example, if the headphones are over-ear, those are more prone to not be turned off --- and remain connected; thus, a greater chance of success for establishing a BlueTooth classic connection without getting noticed and performing the WhatsApp account take-over until they listen to "I'm gonna take a shower, honey!" in the distance.


It's still better than <span> or <div> though, isn't it? Which is what most people are using right now...


Unlike <div> and <span>, <output> becomes part of the form and you can target it as a named form item, e.g.

    <form id="my-form">
      <input name="number" type="number">
      <output name="result"></output>
    </form>

    <script>
      const myForm = document.getElementById("my-form");
      const inputField = document.elements.namedItem("number");
      const outputField = document.elements.namedItem("result");

      outputField.textContent = inputField.valueAsNumber ** 2;
    </script>


Too late to edit, but there is a mistake s/document.elements/myForm.elements/r :

    -   const inputField = document.elements.namedItem("number");
    -   const outputField = document.elements.namedItem("result");
    +   const inputField = myForm.elements.namedItem("number");
    +   const outputField = myform.elements.namedItem("result");


"better" in what sense? If in hypothetical semantic meaning then another old zombie <var> is better in that sense, isn't it?


Those semantics make it more accessible for free.


https://www.science.org/content/blog-post/sarepta-sarepta

Thoughts from Derek Lowe (In The Pipeline).


Also Derek Lowe's previous ones as context (subset I could quickly find),

https://www.science.org/content/blog-post/sarepta-s-approval... ("Sarepta's Approval Woes" (2013))

https://www.science.org/content/blog-post/sarepta-s-duchenne... ("Sarepta's Duchenne Therapy Is A Lot Further Away" (2014))

https://www.science.org/content/blog-post/sarepta-s-day-fda ("Sarepta's Day at the FDA " (2016))

https://www.science.org/content/blog-post/sarepta-gets-appro... ("Sarepta Gets An Approval - Unfortunately" (2016))

https://www.science.org/content/blog-post/gene-therapy-duche... ("Gene Therapy for Duchenne" (2018))

https://www.science.org/content/blog-post/opening-lid-sarept... ("Opening the Lid on Sarepta's Drug Approvals" (2020))

https://www.science.org/content/blog-post/sarepta-tries-agai... ("Sarepta Tries Again" (2023))

https://www.science.org/content/blog-post/sarepta-why ("Sarepta. Why?" (2024))


How are you expecting to run an entity with developers, support, and operations without any leadership?

I don't know if you have ever worked in a larger team that lacked someone to make decisions, take responsibility and set a strategy, but in my experience that is almost always a disaster.


I'm worked on many larger teams and leadership is independent of compensation.

The fact that "high performance leaders" need to make tens of millions of dollars is one of the greatest lies being told in the modern age.

Right now my chief in the fire company where I volunteer makes the same amount of money I do: $0.00. He is the greatest leader I have ever personally met, and I've been around for a while.

When I was in the Army, my company commander (a Captain) made ~4x what the newest private did. The highest-paid officer makes ~9x.

There are government senior executives and university professors running labs with budgets and teams that make Mozilla look like a lemonade stand for practically nothing.

Mozilla should ask the Linux Foundation what their budget is, what their leadership structure is, and do that.

Mozilla, no matter what they say or think or try, is and will always be a web browser developer. A web browser. Anything else is a side project, a hobby. A distraction. Every single molecule of fuel used by their brains while at work and every single microwatt of power used by their infrastructure should be wholly and aggressively dedicated to building the tools and organization needed to create the best web browser possible.

Bloated payrolls are tolerable if the decisions made are wise, responsibility is taken, and strategies exist and make sense.

Mozilla seems to have none of these.

But man they're spending a shit-ton on "AI"!


Three examples off the top of my head — PostgreSQL, FreeBSD, and Debian — are doing just fine without someone "taking responsibility" (when have Mozilla's CEO ever done that?).

Debian has an elected leader that is not paid and has pretty limited authority overall.

There's also the Linux kernel, with Linus doing both managerial and technical work, running circles around Mozilla's leadership in both. He makes just a few millions per year, less than Baker did even two years ago AFAIK.


PostgreSQL is just a community of volunteers as far as I'm aware, not full-time developers employed by the project.

FreeBSD seems to have three paid directors: https://freebsdfoundation.org/about-us/our-team/

Debian has a leader and also seems to be more a volunteer organisation than a full company: https://www.debian.org/intro/organization


All of the people on Postgres, FreeBSD, and Debian combined make a tiny fraction of what the Mozilla CEO does.


Like what?


I agree that probably the three mentioned projects don't total a 6 million USD budget, which is the CEO salary at Mozilla, but is only close to it.


I think all of these projects have contributors who are getting paid at other companies for the work, notably Linux. Not quite so for Firefox. I mean, tell me where does Linus get his income? You think that can be fully replicated for Firefox?


They wrote "pad the CEO salary", not "support any leadership"

Compare to Torvalds. You may or may not like his leadership, but nobody feels sour about his salary.


It can be done; an example is Igalia: https://www.igalia.com/jobs/

> We are a worker-owned, employee-run company with more than 20 years of experience building open source software in a wide range of exciting fields.

If there's enough money to go to the developers actively working on a product to make it sustainable, I think a lot of people would get on board with that and would pay for FF.


> If there's enough money to go to the developers actively working on a product to make it sustainable

That's a big if. AFAIK most open source project developers don't get remotely enough donations to support them working on it full-time. The ones that do are the exception, not the norm.


I've been in organisations with great developers but no leadership. It's a shit show.


Leadership doesn’t mean earning more money.

I’m fine with twice the amount of a developer. Taking into account responsibility, public involvement and special clothing. Travel costs and so on are separate. The developers are doing the hard work.

There is not “team” if a MBA or lawyer gets 38 times the wage of an actual person doing the work.


Worth thinking of it also "the other way". As long as some people (developers) accept an MBA above them getting 38x, without adding much value, this will happen.

I don't personally like it (so generally did not allow to happen to me), but if some people feel "safer" getting lower pay (less chance of getting fired, easier to get re-hired as there are more low paid positions than high paid positions), the natural result is that it will happen.

My experience is that both high and low paid positions are not as "safe" as people think they are (seen multiple changing in various organizations types), so people should care more about finding a reasonable organization.


I think you need a CEO, you just don't need a CEO that is paid $7m/year. That's ludicrous. What amazing decisions have they been making that were worth that amount? Have they really contributed more than a team of 70 developers could?

There are plenty of competent people that could be CEO for far less, like $200k/year.


It doesn't even have to be that. Take that and bump it 5 times like a million dollars. Throw in more cash if they can increase Firefox's market share. Have clauses to penalize anything about opt-out telemetry or anti-privacy features. I'm happy to add more carrots as well as more sticks.

All said and done, that will still be way more reasonable than that ludicrous salary.


I would be fine with $6 million if it was making at least that much more in revenue because of the CEO, but I highly suspect that it is not. I think $600K would be PLENTY and would pull in talented execs and managers.


> don't know if you have ever worked in a larger team that lacked someone to make decisions, take responsibility and set a strategy

I had once. The ultra micro-managing boss went to surgery and was off for two months. The whole company happily cruised along, numbers kept going up, his toxic pressure was absent, people kept working and making things.

I don't know how it would go for long term, but these were some of the best months.


If the CEO changes his salary to 200k then fine I have no problem with that. CEOs are overpaid relative to skill and that does not sit well with my sense of generosity.


It's bizarre. In Japan, the custom is to revere your elders, in the US its apparently whoever is titled "leader". All of HN shivers in exaltation at the mention of the word.

The reality is that Firefox would have done much better had Mozilla fired their CEO 15 years ago and never hired another one. All of them executed significantly worse than mere government bonds did.


Leaving aside the (valid) sibling commenters here pointing out that it can be done well, but you're making a strawman argument - the gp never said anything about eliminating managers or organisational structure.

They specifically targetted two things:

1. directing funding towards Firefox development. Mozilla have been criticised for spending large portions of their income on non-Firefox endeavours while not publishing breakdowns of Firefox-specific spending in their annual reports

2. The CEO's salary: the commenter said nothing about not wanting the CEO position to exist, merely a desire for the funding to the Foundation to not be excessively funnelled into salary increases while the company's resources contract. Which seems reasonable.


CEO is typically needed for-profit purposes on a scale. Donating for devs to build browser without that purpose does not need CEO. Just a lead engineer and accountants.


> How are you expecting to run an entity with developers, support, and operations without any leadership?

Unfortunately, CEO is not always leadership.

Aside from that, leadership can come from the people doing the work. It is working in many cases.


If dev work is paid for by the community, the CEO payments can increase since the budget of Mozilla will stay the same but now have less cost to carry elsewhere?


I don't know, but ask Mitchell Baker or the board because that's exactly what happened during her tenure.


They have cut back on those a lot now, haven't they?


Aren't they just piggybacking on Mozilla's work though? The point is to make the work that Mozilla is doing sustainable, not to pay someone else to ship a slightly modified version of it.


Yes, forks do indeed piggyback off of their code; that's the point of free and open source software anyway. And Mozilla, in its current state and current leadership, is not sustainable and still won't be with people paying for Firefox. Its marketshare is dwindling, and people are moving to forks such as Zen or to other browsers like Vivaldi. Adding a paid version will just make that trend go faster. And you don't even need to make a fork, because user.js tweaks such as Arkenfox or Betterfox exist anyway.


The point is that people want to fund the development of the actual browser engine which is more important than the customization scripts that those forks maintain. The engine is what people are worried about.


Or in slightly less fatalistic words: In any entity with more than 1-2 employees you need someone to make decisions and be accountable for them. The normal solution is to have a director/CEO for this. You may be able to get away with paying them slightly less than market rates if they are doing it for a good cause, but if you want someone competent you will need to pay them a relatively high salary to compete with other employers.

Expecting Mozilla to somehow function without a CEO, unlike pretty much every other charity in the world, is just not reasonable.


Interesting article, but picking Johnson and Cummings's handling of Covid as a positive example is a very odd choice, given their falling out and the numerous corruption allegations and parliamentary inquiries into their actions since then.


I 100% agree with you, but it looks like that specific, single instance is a clear example of the famous broken clock being right twice a day.


Surely it is that specific example that counts. It seems perverse to dismiss one sensible decision on the grounds that the persons concerned made many other bad decisions. It's the decision that is the focus not the persons making it.


Sounds like all of this could be solved by not manually paying your rent at the last minute?


This is a blind spot. Generally speaking the devs are comparatively well off people and they don't live paycheck-to-paycheck. So by default devs won't even conceive of the difficulties of people who are in fact living paycheck-to-paycheck and have little buffer in their bank accounts. That's the blind spot. They won't know this is a problem unless a good PM tells them about it. Ultimately it is the job of the PM to tell the devs how important (or not) it is to do these optimizations, and how important (or not) it is to test with low-end devices with little RAM or free disk space.


This is something I struggle with a bit as a dev

I am pretty well off now but I come from a pretty poor background. I used to have to drive a cheque to my landlord's office when rent was due, during university in the late 2000s

I thought a lot of my fellow devs would be from similar backgrounds, but that is not the case at all mostly. I find a lot of my coworkers come from white collar families, or relatively well off immigrant families and I am the outlier coming from a very blue collar family

It is very common for me to have a very different perspective on things than my coworkers.

Economic background shapes us so much more than people realize


First sentence in that (made up) story:

>Rent's due today, thank heavens I just got paid.

I assume the "last minute" wasn't entirely their choice.


This is hideous.


A lot of people live paycheck to paycheck. They can't afford to pay rent before they get paid.


Besides the fact that the story is an example, is fully made up, and you clearly didn't read the actual article: what an incredibly out of touch response.


> I don't set up standing orders, got burned once with unarranged overdraft fees, that wasn't a good month. Better to be late a day or two with rent payment.

Anyway, this same sort of nonsense could also make it very difficult to enroll in autopay, so the main points stand.


They made up the story


Doesn't matter if the story is made up or not. It's a believable story so we should treat it as if it's real.


They are also available as part of their excellent (and free) The Intelligence podcast. Always worth a listen.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: