Does it work on Chrome (nightly or with that support enabled)?
Does anybody disagree that this is a no brainer for Mozilla: they should work that around ASAP (with a HTTP/2 blacklist for example). The impact is so high and it affects too many users.
Also note that Google in its deepest feelings wants FF down so this may by even intentional since people will always blame the client.
In no way does Google want Firefox down. Besides basically funding Firefox by sponsoring Mozilla, Chrome's official position is simply to drive forward web technology. The Chrome team may want to make their browser better than the competition, but they also want the competition to challenge, and help improve Chrome and the web.
This will simply boil down to someone not fully testing the implementation, especially since it's an extra, not a base feature. If this was an issue with Firefox stable, it would be more pronounced and worrying.
Of course they do. One less browser to support for all their properties, one annoying group in the standardization process less that keeps clamoring for annoying things like user privacy, proper spec documentation, independent implementations or god forbid, tried to oppose DRM.
If Google wouldn't want Firefox down, they wouldn't aggressively market Chrome on the search pages that Firefox users are served.
The "sponsoring" argument is totally lame. Google pays hard cash to shove their search machine down Firefox users' throat and collect the advertising dollars from it. That isn't charity.
Why should Mozilla act? This only affects nightlies and beta, as the article stated. If you use one of those, you should expect things to occasionally not work.
When I asked my 11-year-old brother what browser he used (since I saw chrome and firefox on the desktop), he informed me that he used "Firefox Nightly" (which I hadn't noticed, but was also present), because "it's a little better". He had no idea what it was. I don't know how he found it in the first place.
Also, this hash function is linear so it has the equivalent substrings property.
One can take advantage of it and be able to generate preimages even faster. Take a preimage and find m equivalent strings for n substrings of it. Replacing the substring with their equivalent will get you n to the m-th preimages that hash to the same value.
You can brute force it insanely fast by iterating from the rightmost character and caching the entire hash prefix.
This hash doesn't scramble input very well, so you can fiddle with individual characters to converge on any desired hash value.
Record the "closest" hash value to your target generated by this loop, apply (only) that character change, repeat. If the hash value stops converging, add a character. This naive version pretty often does the job in 5 full iterations or so, which means (5 * len(s) * len(alphabet)) = maybe ~3000 total hashes to get a solution.
for i in xrange(len(s)):
copy = s
for c in alphabet:
copy[i] = c
diff = abs(hash(copy) - 666)
best = min(diff, best)
