Category: Uncategorised

A single Firefox process. (credit: Roger)

Firefox 48 shipped today with two long-awaited new features designed to improve the stability and security of the browser.

After seven years of development, version 48 is at last enabling a multiprocess feature comparable to what Internet Explorer and Google Chrome have offered as stable features since 2009. By running their rendering engines in a separate process from the browser shell, IE and Chrome are more stable (a Web page crash does not take down the entire browser) and more secure (those separate processes can run with limited user privileges). In order to bring the same multiprocess capability to Firefox, Mozilla started the Electrolysis project in 2009. But the organization has taken substantially longer than Microsoft, Google, and Apple to ship this feature.

Mozilla's delay was partly driven by changing priorities within the organization—Electrolysis development was suspended in 2011 before being resumed in 2013—and partly because Firefox's historic extension architecture made this kind of separation much harder to achieve. Traditional Firefox extensions can invasively meddle with parts of the browser and assume equal access both to the rendering engine and to the browser's shell. Firefox's developers had to both create a new extension system (they've ended up using HTML-and-JavaScript based extensions closely related to those pioneered by Chrome and also adopted by Edge) and create shim layers to offer developers a temporary way to continue to support their old extensions.

(credit: Björn Láczay)

On Tuesday, investigators in Japan released a report attempting to explain how Japanese automaker Mitsubishi was able to falsify its fuel economy numbers on certain cars sold in Japan. The three-month-long investigation pointed to a “collective failure,” at an executive level, to deal with concerns that employees brought up.

The automaker’s cheating was discovered earlier this year when Nissan, which rebrands some of Mitsubishi’s cars and sells them in Japan, found discrepancies in emissions rates between reported and real-world mileage. Mitsubishi later admitted to having falsified data for over 25 years, in some cases overstating fuel economy by 16 percent, according to CBS News. Nissan’s discovery crushed Mitsubishi’s share price. Since then, Nissan scooped up 34 percent of Mitsubishi for a bargain $2.2 billion (¥237 billion).

In an unrelated discovery in March, Japan’s Department of Transportation publicly called out Mitsubishi, as well as Toyota and Nissan, for selling diesel cars with higher-than-allowed nitrogen oxide (NO_x) emissions in Japan, echoing the scandal that has embroiled Volkswagen since last September in the US.

Out of all of Elon Musk's recent "Master Plan Part Deux," the part that really caught our eye was a short paragraph about a Tesla semi. Much of the rest—solar, autonomous driving, ride-sharing—wasn't exactly unforeseen. But the idea of a heavy duty Tesla electric vehicle took us by surprise and left us scratching our heads. Tesla isn't the only company going after this market; Wrightspeed, Proterra, and BYD are already building heavy duty urban electric vehicles, and Mercedes-Benz is about to enter the fray. The Nikola Motor Company (no connection to Tesla Motors) already has 7,000 orders for a zero-emission heavy duty freight hauler that won't be revealed until December. To find out if our confusion over the Tesla Semi is unwarranted, we spoke to some of the big players in the heavy duty EV market.

Even though heavy duty vehicles only account for about eight percent of US carbon emissions (light duty vehicles make up roughly 20 percent), Wrightspeed CEO Ian Wright says electrifying that sector makes more economic sense. In fact, Wright doesn't think the economics work in favor of electric passenger vehicles. "A Nissan Leaf is twice the price of a Versa and you only save $800 a year," he told Ars, "that's a 20-year payback time."

Wright goes on:

Crazy 3D dragon, courtesy of Tilt Brush.

Every virtual-reality tester at Ars Technica has a favorite app on either the Oculus Rift or the HTC Vive, especially when it comes to introducing newbies to the format. For my money, Audioshield is the most breathtaking for musically inclined users (and our own Lee Hutchinson might agree), but that rhythm-action game can be too stressful and movement-heavy for casual testing.

Now, I have a new feather in my VR-demo cap: Tilt Brush's new "Audio Reactor" mode. This update, which was added to the HTC Vive's best-known paint-sculpting app for free on Tuesday, lets VR creators add PC audio sensitivity to any of the app's strokes of paint. Certain Tilt Brush creations now react to the rhythm and dynamics of whatever song is being played on your VR computer. This means different types of paint strokes will glimmer or animate in time with the music.

Enabling Audio Reactor's music feature is a little clunky right now since Tilt Brush has neither its own dedicated MP3 interface nor a convenient YouTube search tool. Currently, you'll need to alt-tab out of Tilt Brush, turn on your music-playing interface of choice, and make sure it's playing on Windows' "default playback device" before switching back to your VR window. Thankfully, Steam includes a music-playing interface in its VR "chaperone" system, but it's a bit inelegant since it requires going into Steam's menus.

Enlarge / FTC Chief Technologist Lorrie Cranor speaking at PasswordsCon 2016, part of the Bsides security conference in Las Vegas.

Shortly after Carnegie Mellon University professor Lorrie Cranor became chief technologist at the Federal Trade Commission in January, she was surprised by an official agency tweet that echoed some oft-repeated security advice. It read: "Encourage your loved ones to change passwords often, making them long, strong, and unique." Cranor wasted no time challenging it.

The reasoning behind the advice is that an organization's network may have attackers inside who have yet to be discovered. Frequent password changes lock them out. But to a university professor who focuses on security, Cranor found the advice problematic for a couple of reasons. For one, a growing body of research suggests that frequent password changes make security worse. As if repeating advice that's based more on superstition than hard data wasn't bad enough, the tweet was even more annoying because all six of the government passwords she used had to be changed every 60 days.

"I saw this tweet and I said, 'Why is it that the FTC is going around telling everyone to change their passwords?'" she said during a keynote speech at the BSides security conference in Las Vegas. "I went to the social media people and asked them that and they said, 'Well, it must be good advice because at the FTC we change our passwords every 60 days."