JanSt

22 ms·

241.
by JanSt 5y ago
* Employees would have a right to ask their employer for sex-disaggregated information on the average pay of other workers doing the same work or work of equal value.
242.
by JanSt 5y ago
Maybe pay shouldn't be based on the personal ability to negotiate, which is not a core competency for most jobs, but on a equal compensation for equal work then...
243.
by JanSt 5y ago
I have only great experiences with DO support. Really fast and helpful. I even got some free credits ($50?) at some point for a small inconvenience .
244.
by JanSt 5y ago
New EU legislation makes it mandatory to add a prominent button to cancel your subscription! It‘s not allowed to force you to give a call or, in Germany, even login. https://www.mofo.com/resources/insights/211006-n
245.
by JanSt 5y ago
Well I‘ve read that math many times and I don‘t understand the intention here. Of course the number is very low - Spotify did not allow subscriptions through apps for a long time (do they now?) Even if they have to pay 15% now (I don‘t know
246.
by JanSt 5y ago
I‘m sure the fee will be slapped down later too. It gives Apple unfair competetive advantages in the industries it operates in. (e.g Apple Music vs Spotify)
247.
by JanSt 5y ago
They also added a bunch of requirements. Example (besides what was already mentioned): You have to report every single transaction to them. Apple is making it practically impossible AND they put a 27% fee on top. This behaviour might really
248.
by JanSt 5y ago
You don't even need CSRF protection if you use localstorage for the tokens
249.
by JanSt 5y ago
We are not arguing about the usefulness of CORS, of course it is useful. It does not protect you though.
250.
by JanSt 5y ago
CORS does not protect the website at all…
251.
by JanSt 5y ago
How am I assuming that? How exactly does CORS add security?
252.
by JanSt 5y ago
There are misunderstandings arising - reading this thread or the articles makes it clear for me…
253.
by JanSt 5y ago
I disagree. Just read the article „cors protects us“ - things like these come from misunderstandings like this one.
254.
by JanSt 5y ago
That doesn't matter at all in a security context. POST can (and is used) for everything DELETE and PUT are used. Adding DELETE and PUT did not relax anything. The only question is whether requests are restricted (i.e. in terms of sendi
255.
by JanSt 5y ago
SOP is certainly not a relaxation. SOP restricts all those cross-origin request. I don't quite understand what you mean with PUT and DELETE not being allowed before SOP? What exact operations where not possible before SOP and are now (
256.
by JanSt 5y ago
Apart from the misunderstanding that CORS protects you, you are describing two scenarios. I don't really understand the first one or why you think SOP should protect you in that case. Could you restate that problem? The second one is a
257.
by JanSt 5y ago
Because most people don't understand what CORS is nor what it does. As I said, even the author of the article that is linked does not seem to fully understand it.
258.
by JanSt 5y ago
Care to expand? I don‘t see the point
259.
by JanSt 5y ago
CORS cannot be defeated, because it does not protect
260.
by JanSt 5y ago
The request does not send resource/cookie data if CORS does not explicitly relax the SOP. CORS does not protect!
261.
by JanSt 5y ago
CORS does allow to share, not disallow! The default under SOP is not to share.
262.
by JanSt 5y ago
No XSS is another class of vulnerabilities
263.
by JanSt 5y ago
I will have done anything I want to within one second of you logging in. There is no need for later attacks
264.
by JanSt 5y ago
As long as it stays on the server the end user can not access it (unless they are exposed somehow).
265.
by JanSt 5y ago
Again, CORS does not protect, the SOP does :-)
266.
by JanSt 5y ago
How does it protect the user? If there is a XSS vulnerability I can do anything in your name anyways. Stealing the cookie is not necessary.
267.
by JanSt 5y ago
httpOnly secure same-site cookie. Even storing a session token in localStorage is not a problem if you‘re protected against xss (if your not, nothing else will protect you anyway)
268.
by JanSt 5y ago
Even this article gets it wrong: CORS does not protect you in any way. It‘s a relaxation of the SOP! Thus it decreases security.
269.
by JanSt 5y ago
our tech is so primitive compared to the ability and complexity of life. Out of a tiny part, a complex machine with the ability to grow, harvest energy and replicate comes into being. Astounding.
270.
by JanSt 5y ago
Law is not about making people happy

More ›