Church Member Flummoxed By Non-Standard Sermon Application

I’ve been enjoying The Babylon Bee recently. Here’s a submission which apparently did not make the grade over there:

DAYTON, OH—The household of George Arnason, a faithful church member at the Seventh Street Bible Church in Dayton, Ohio, has been reportedly thrown into confusion after a visiting preacher gave a sermon where the application did not involve any exhortations to read the Bible more, pray more or evangelise more.

Sermons at Seventh Street are normally given by Rev. Jeremiah Scholes, who has been the minister for the last 43 years, and has presided over a period of unparalleled stability in the membership and teaching. The trouble arose when Mr Steven Prendeghast, who was asked to speak because he is a candidate for the pastorship when Mr Scholes retires, preached on Matthew 22:36-40, with the controversial application being to “love your neighbour”.

“A passage like that, I’d expect to be a ‘read the Bible more’ passage”, said Mr Arnason. “After all, it does say to love the Lord with all your mind, and it mentions the Law and the Prophets. Those are two parts of the Bible, you know”, he explained helpfully.

Rev. Scholes was unavailable for interview but issued a written statement to the Bee. “At Seventh Street, we are clear on the fundamentals of the faith. All passages of scripture instruct us to either read our Bibles more, pray more, or evangelise more – or even two or three of those things at once, for the really practical passages in Paul’s letters. That’s what our church has been faithfully teaching since 1878 and, God willing, will still be teaching it long after I’ve gone. The elders will be reviewing the cassette of this guest sermon to find out what went wrong.”

Mr Arnason proudly showed off his sermon application calendar. “I bought a three-pack of markers, ” he explained, “and I use this to keep track of what we’re learning. ‘Read the Bible More’ Sundays get coloured in red, ‘Pray More’ Sundays in green, and ‘Evangelise More’ Sundays in blue. Those are the three primary colours, so if the preacher makes more than one application on a given Sunday, I can cope with it by blending.” But the recent sermon has thrown the viability of this scheme into doubt. “Love your neighbour? I don’t have a colour for that,” he said worriedly.

Mr Arnason was last seen getting into his car, reportedly on his way to Staples.

Thank You For Trying, Switzerland

Various bits of the TiSA (Trade in Services Agreement, yet another multilateral trade treaty) were leaked recently. On the very first page of General Provisions:

[CH propose; AU/CA/CL/TW/CO/EU/IL/JP/MX/NZ/PE oppose; MU/PK considering:
Without prejudice to the policy objectives and legislation of the Parties in areas such as the protection of intellectual property, the protection of privacy and of the confidentiality of personal and commercial data, the protection of consumers and the protection and promotion of the diversity of cultural expressions (including through public funding and assistance) and fiscal measures.]

So the Swiss said “Hey, wouldn’t it be good if we had a thing at the start that said that this treaty doesn’t stop governments protecting privacy, the confidentiality of data, consumer rights, cultural diversity or other important things like that? Wouldn’t that be neat?”

And Australia, Canada, Chile, Taiwan, Colombia, the EU, Israel, Japan, Mexico, New Zealand and Peru all said “Er, no. We want this agreement to be capable of preventing us from protecting those things, thanks. Where it speaks, it should be more important than the domestic law enacted by your elected representatives.”

Seems like that tells you a lot of what you need to know about the way such treaties are assembled. At least Mauritius and Pakistan are still thinking about it… Sheesh.

Eurovision Bingo (again)

Some people say that all Eurovision songs are the same. (And some say all blog posts on this topic are the same…) That’s probably not quite true, but there is perhaps a hint of truth in the suggestion that some themes tend to recur from year to year. Hence, I thought, Eurovision Bingo.

I wrote some code to analyse a directory full of lyrics, normally those from the previous year of the competition, and work out the frequency of occurrence of each word. It will then generate Bingo cards, with sets of words of different levels of commonness. You can then use them to play Bingo while watching this year’s competition (which is on Saturday).

There’s a Github repo, or if you want to go straight to pre-generated cards for this year, they are here.

Here’s a sample card from the 2014 lyrics:

fell cause rising gonna rain
world believe dancing hold once
every mean LOVE something chance
hey show or passed say
because light hard home heart

Have fun :-)


My ISP, the excellent Mythic Beasts, has started offering a managed DNSSEC service for domains they control – just click one button, and you’ve got DNSSEC on your domain. I’ve just enabled it on (which, incidentally, as of a couple of weeks ago, is also available over a secure channel thanks to MB and Let’s Encrypt).

If you have any problems accessing any resources on, please let me know by email – gerv at mozilla dot org should be unaffected by any problems.

Mozilla’s Root Store Housekeeping Program Bears Fruit

Just over a year ago, in bug 1145270, we removed the root certificate of e-Guven (Elektronik Bilgi Guvenligi A.S.), a Turkish CA, because their audits were out of date. This is part of a larger program we have to make sure all the roots in our program have current audits and are in other ways properly included.

Now, we find that e-Guven has contrived to issue an X509 v1 certificate to one of their customers.

The latest version of the certificate standard X509 is v3, which has been in use since at least the last millennium. So this is ancient magic and requires spelunking in old, crufty RFCs that don’t use current terminology but as far as I can understand it, whether a certificate is a CA certificate or an end-entity certificate in X509v1 is down to client convention – there’s no way of saying so in the certificate. In other words, they’ve accidentally issued a CA certificate to one of their customers, much like TurkTrust did. This certificate could itself issue certificates, and they would be trusted in some subset of clients.

But not Firefox, fortunately, thanks to the hard work of Kathleen Wilson, the CA Certificates module owner. Neither current Firefox nor the current or previous ESR trust this root any more. If they had, we would have had to go into full misissuance mode. (This is less stressful than it used to be due to the existence of OneCRL, our system for pushing revocations out, but it’s still good to avoid.)

Now, we aren’t going to prevent all misissuance problems by removing old CAs, but there’s still a nice warm feeling when you avoid a problem due to forward-looking preventative action. So well done Kathleen.


Almost 20 years ago, two Christians from the Jubilee Centre pondered the possible consequences of the Euro:

Unfortunately, EMU [European Monetary Union] may well foster conflicts and increase nationalism among EU countries. If the system works well and an active fiscal policy compensates for the lack of an independent monetary policy, some countries will need to raise taxes in order to cool their economy even though the government is in strong surplus. Quite correctly, electorates will blame the system. However, if EMU fails, endemic unemployment will result in some countries due to an overvalued exchange rate for their needs and excessively high interest rates. Wage cuts in, or labour movements from, the countries thus affected seem unlikely, and the current treaty does not provide for fiscal transfers from a prospering country to a depressed one as a result of EMU. Hence, some countries will feel neglected in the interest rate setting process, and will demand restitution from the centre. To make matters worse, they could be having to cut spending and raise taxes in a recession to avoid being fined for an ‘excessive’ deficit, while having to bail out a collapsing banking system due to inappropriate interest rate levels.

If a country faces an unsustainable fiscal situation, it may be forced to threaten default on its debt or request help from other members. If a transfer or debt guarantee is granted, those populations in solvent countries may resent their taxes being used to bail out irresponsible governments elsewhere. If these payments have no democratic mandate, resentment of neighbouring countries within EMU may result.

— Paul Mills and Michael Schluter, Should Christians Support the Euro?, December 1998

The only thing they missed is that the bailed-out would also resent those who did the bailing…

Type 1 vs Type 2 Decisions

Some decisions are consequential and irreversible or nearly irreversible – one-way doors – and these decisions must be made methodically, carefully, slowly, with great deliberation and consultation. If you walk through and don’t like what you see on the other side, you can’t get back to where you were before. We can call these Type 1 decisions. But most decisions aren’t like that – they are changeable, reversible – they’re two-way doors. If you’ve made a suboptimal Type 2 decision, you don’t have to live with the consequences for that long. You can reopen the door and go back through. Type 2 decisions can and should be made quickly by high judgment individuals or small groups.

As organizations get larger, there seems to be a tendency to use the heavy-weight Type 1 decision-making process on most decisions, including many Type 2 decisions. The end result of this is slowness, unthoughtful risk aversion, failure to experiment sufficiently, and consequently diminished invention. We’ll have to figure out how to fight that tendency.

Jeff Bezos

Facebook Switches Off Email Forwarding

You remember that email address that Facebook set up for you in 2010, and then told everyone viewing your Facebook profile to use in 2012 (without asking)?

Well, they are now breaking it:

Hello Gervase,

You received this email because your account is set up to forward messages to [personal email address]. After 1 May 2016, you will no longer be able to receive email sent to

Please update your email address for any services that currently send email to

Thank You,
Email Team at Facebook

Good work all round, there, Facebook.

DMCA Section 512 Comments Submitted

A small milestone: the first post in my name on the Mozilla Net Policy blog has just been published. It concerns our filing comments for a US Copyright Office consultation on section 512 of the DMCA – the section dealing with safe harbo(u)rs for intermediary liability. Section 512 contains the rules that mean Facebook, Twitter and other platforms actually let you have a conversation and upload images and videos to talk about, rather than restricting that capability because they are too afraid of immediate copyright liability.

This is not to be confused with section 1201 of the DMCA, which gives the rules for the 3-yearly process for getting DMCA exceptions for important things like phone unlocking. We also filed comments in a consultation on that recently.

We hope that the Copyright Office’s recent attention to these sections bodes well for useful reforms to US copyright law.

Respecting the Wishes of Software Authors

Software licenses are the constitution for a community. The license a group picks for their software is indicative of how they would like their community to work. GPL-using communities have one set of norms around sharing, BSD or Apache-using communities have another way of working together. That is, of course, as long as everyone using the code plays by the rules.

Basically the only organization attempting to make sure that users of GPL code respect the wishes of the authors of that code is the Software Freedom Conservancy. As well as other excellent work like providing a financial and organizational home for projects, they enforce the GPL – most recently, after five years of fruitless negotiation, in a lawsuit against VMWare, who have taken parts of Linux and put them in their proprietary ESXi product.

Whether you are a keen user of the GPL, or of BSD, or whether you don’t much care about licensing, I hope all my readers are keen that the wishes of authors of software about what happens to it, and the obligations you have if you take advantage of their hard work, are respected. The SFC is a small charity, and corporate donations have suddenly become harder to come by now they are insisting that corporations live up to their responsibilities. (How strange…) I’m proud to say Mozilla has supported SFC in the past, and I hope we will continue to do so. But please would you also consider signing up as a supporter, at the very reasonable cost of US$10 a month.

If people don’t like the terms of the GPL, they are free to write their own software to do whatever they want done. But if they use the hard work of others to save time and effort, they need to respect the wishes of those authors. SFC makes that happen; please give them your support.

An IoT Vision

Mark’s baby daughter keeps waking up in the middle of the night. He thinks it might be because the room is getting too cold. So he goes down to the local electronics shop and buys a cheap generic IoT temperature sensor.

He takes it home and presses a button on his home’s IoT hub, then swipes the thermometer across the top. A 5 cent NFC tag attached to it tells the hub that this is a device in the “temperature sensor” class (USB-style device classing), accessible over Z-wave, and gives its public key, a password the hub can use to authenticate back to the sensor, and a URL to download a JavaScript driver. The hub shows a green light to show that the device has been registered.

Mark sticks a AAA battery into the sensor and places it on the wall above his baby’s cot. He goes to his computer and brings up his hub’s web interface. It has registered the new device and connected to it securely over the appropriate protocol (the hub speaks Bluetooth LE, wifi and Z-wave). The connection is secure from the start, and requires zero additional configuration. The hub has also downloaded the JS driver and is running it in a sandboxed environment where it can communicate only with the sensor and has access to nothing else. If it were to want to communicate with the outside world, the hub manages the SSL (rather than the device or the driver) so it can log all traffic in cleartext.

Mark views the device’s simple web page (generated by the driver) and sees the room is at 21C. He asks the hub to sample the value every minute and make a chart of the results. The hub knows how to do this for various simple device classes, including temperature sensors.

The next morning, he checks the chart and indeed, at 3am when the baby woke up, the temperature was only 15C. He goes back to the electrical shop and buys an IoT mains passthrough plug and a cheap heater. He registers the plug with the hub as before, then plugs the heater into the passthrough, and the passthrough into a socket in the baby’s room.

Back at the web interface, he gives permission for the plug’s driver to see data from the temperature sensor. However, the default driver for the plug doesn’t have the ability to react to external events. So he downloads an open source one which drives that device class. Anyone can write drivers for a device class because the specs for each class are open. He then tells the new driver to read the temperature sensor, and turn the plug on if the temperature drops below 18C, and off if it rises to 21C. The next night, the baby sleeps through. Success!

The key features of this system are:

  • the automatic registration and instant security, based on a cheap NFC tag which implements an open standard, which allows device makers to make their devices massively easier to use (IoT device return/refund levels are a big problem at the moment);
  • the JS host environment on the hub, which means you can run untrusted code on your network in a sandbox so you can buy IoT devices without the risk of letting random companies snoop on your data, and every device or ecosystem doesn’t need to come with its own controller; and
  • the open standard and device classes which mean all devices and all software is hackable.

Wouldn’t it be great if someone built something like this?

What I’m Up To

It seems like I’m only managing one blog post a month at the moment. I’m doing loads of things, but don’t seem to have time to blog about them! Currently, the major components of my work are:

  • Helping Thunderbird get to a good and sustainable place (status update)
  • Running MOSS (applications always open!)
  • Copyright work for the public policy team

On that last point, we just submitted a filing to a US Copyright Office consultation on the famous section 1201 of the DMCA, which is the one which regulates the every three years exemption process for bypassing DRM. See our blog post here, which links to our filing. While this process is not really fixable in its current form, I hope we can help to make it a little better.