AntonyGarand

11 ms·

91.
by AntonyGarand 6y ago
Depending on what interactions you want, only the origin host would require https. If you need passive mixed content, I believe it is and will remain supported by browsers for some time. If you need active mixed content though you probably
92.
by AntonyGarand 6y ago
It does mention private to local requests will be affected, which is implying the private network host must be served via https > Requests from a private network to a local network https://web.dev/cors-rfc1918-feedback&#x
93.
by AntonyGarand 6y ago
Among the post, this article[0] is referenced, which does mention testing on outlook and is more technical! It might be it. > It turns out that all email services take your original message and conveniently wrap it in a div (with a clas
94.
by AntonyGarand 6y ago
While I do see the value of such a service, I wouldn't trust anyone with unsubscribe links I receive. I have seen companies generating an API key for the unsubscribe button, where the key can be used to perform other actions and lead t
95.
by AntonyGarand 6y ago
This one perhaps? https://news.ycombinator.com/item?id=5327469 Archive: https://web.archive.org/web/20171003162605/https://litmus.co...
96.
PedalPC – My human powered office(pedalpc.com)
2 points by AntonyGarand 6y ago|1 comments
97.
by AntonyGarand 6y ago
Seatable[0] is another alternative which is mostly open source, following a licensing similar to MongoDB for their server if I recall correctly. They're now on version 1.3, not sure if they're fully stable yet but it's a viab
98.
by AntonyGarand 6y ago
It absolutely is: https://github.com/kgretzky/evilginx2
99.
by AntonyGarand 6y ago
I would start with https://astexplorer.net , which handles many languages, and provides interactivity: click on a node within the ast, and il will highlight the corresponding code and vice versa. The ast's are usually langua
100.
by AntonyGarand 7y ago
I navigate through unfamiliar code almost daily, completely different projects and different authors. I use the blame feature a ton to understand in what context a method was added: by blaming it, I can usually see what other code was added
101.
by AntonyGarand 8y ago
I made a post few months ago regarding this exact vulnerability: https://dev.to/antogarand/why-facebooks-api-starts-with-a-fo... HN discussion: https://news.ycombinator.com/item?id=18443125 --- While t
102.
by AntonyGarand 8y ago
It is for older browser which do not support CORS, as well as different variants such as using a script with the UTF16BE charset: https://portswigger.net/blog/json-hijacking-for-the-modern-w...
103.
Lastpass is down(status.lastpass.com)
11 points by AntonyGarand 8y ago|0 comments
104.
by AntonyGarand 8y ago
I researched a similar effect few years ago when I was trying to replicate part of the game `AntiChamber` in Unity. At the time, I found out about Stencil Buffers, which did let us create a cube with various different rooms on the different
105.
Cloudflare: Concise Christmas Cryptography Challenges 2019(blog.cloudflare.com)
2 points by AntonyGarand 8y ago|0 comments
106.
XSS in Ghost: a technical analysis(dev.to)
3 points by AntonyGarand 8y ago|0 comments
107.
by AntonyGarand 8y ago
While the attack is using things for a different purpose, using JSON to provide data to a website is totally legit. I don't see how people could have prevented this without the knowledge of such an attack
108.
Why Facebook's API starts with a for loop(dev.to)
53 points by AntonyGarand 8y ago|13 comments
109.
by AntonyGarand 8y ago
They mentionned it in the article, this is required and only used by the third-party bug-reporting service (instabug)
110.
by AntonyGarand 8y ago
This is known as the Reverse Polish Notation: https://en.wikipedia.org/wiki/Reverse_Polish_notation
111.
Pwned together: Hacking dev.to(dev.to)
1 points by AntonyGarand 8y ago|0 comments
112.
SQL: Where spaces may not matter(dev.to)
1 points by AntonyGarand 8y ago|0 comments
113.
by AntonyGarand 8y ago
To be fair, there are tons of very low severity vulnerabilities disclosed on HackerOne and this does not mean the application is vulnerable. Slack is definetly not vulnerable because it is written in php and you can pollute an iframe on the
114.
by AntonyGarand 8y ago
Will we be able to report errors using the upcoming report-to header? I didn't see a report mechanism listed, but like with hpkp and cors I would like those errors to.be reporteable
115.
PHP: Return True to Win Writeup(dev.to)
1 points by AntonyGarand 8y ago|0 comments
116.
JavaScript: Equality insanity, or how (x === 1 && x === 2)(dev.to)
3 points by AntonyGarand 8y ago|0 comments
117.
by AntonyGarand 8y ago
Well, considering `x = x + await 2` and `x = await 2 + x` produces different behavior, it is more related to async/await than to the `+=` operator!
118.
by AntonyGarand 8y ago
The fun thing about this is that you're not expecting this code to be bad, I don't feel like it's wrong to expect the same behavior with and without the `await`
119.
JavaScript: Async math is hard(dev.to)
8 points by AntonyGarand 8y ago|6 comments
120.
JavaScript: Watch out for unwanted hoisting(dev.to)
1 points by AntonyGarand 8y ago|0 comments

More ›