lol768

75 ms·

691.
by lol768 7y ago
Thanks for a very comprehensive answer!
692.
by lol768 7y ago
> A better headline may be "Google Chrome replacing XSS Auditor with Trusted Types" As I think a Googler has mentioned above, the XSS auditor is for reflected XSS vulns (caused by the server unsafely outputting user input).
693.
by lol768 7y ago
Nice write-up! It's a shame that your report wasn't handled with the usual prompt response & fix.
694.
by lol768 7y ago
> Trusted Types are an opt-in browser API that helps developers prevent DOM-based (~client-side) XSS by mandating that developer-specified rules are applied to data that reaches risky functions (like eval or innerHTML). We're worki
695.
by lol768 7y ago
Good. Whilst the XSS auditor was able to protect against quite a wide range of payloads for reflected vulns, I think it caused more harm than good. Quite often I'd have to try and argue that an issue was real because the PoC didn'
696.
by lol768 7y ago
>At a minimum, and by way of illustration not limitation, reasonable measures include i) preventing unlicensed third-party access, i.e. hotlinking and, ii) not allowing direct download of the fonts unrelated to the process of styling tex
697.
by lol768 7y ago
My point is, if you have a desktop license (which is fine to use in print) you'll be "redistributing" it in much the same way as a website which uses @font-face and serves you the font files.
698.
by lol768 7y ago
Don't PDFs and Word documents embed fonts, too?
699.
by lol768 7y ago
Let's ignore the issue of integrity and look at confidentiality: • Browsers will reuse the same TCP connection when downloading multiple resources. Does apt not do this? This seems like it would make inferring package versions and name
700.
by lol768 7y ago
> 2. Accounting. Any resources you would recommend that are worth looking at to help with this? I think I understand the basics, but particularly for larger companies things get much more complex.
701.
by lol768 7y ago
+1 for this, it really helped me. Also, Mathpix is neat - especially if you're citing results and need to include some equations from those papers.
702.
by lol768 7y ago
I think this would be more useful with some comparison points, so: * Firefox/Linux/AMD and default settings gives me 4dd1c8196b5a7f7fd5faecadd398a31e * Chromium/Linux/AMD and default settings gives me 3a255645100c90693ae
703.
by lol768 7y ago
Firefox Mobile will continue to be Fennec in the short-term. >when exactly is fenix supposed to replace fennec as Firefox for Android? Once the MVP is done, or when it reaches feature parity? >We are currently finalizing the transitio
704.
by lol768 7y ago
Are those bio-degradable?
705.
by lol768 7y ago
And the other point of view: > We're certainly aware of how significant ad blocking extensions are. This release required a great quantity of features with only a six month timeline until now. > We already support a very limited
706.
by lol768 7y ago
>port to other browsers Except it requires literally no 'porting' at all: it runs fine out of the box without modification https://lol768.com/i/ReveilleAgitationsIncurablesBicyclist This is just laziness.
707.
by lol768 7y ago
It makes me sad when WebExtensions are limited to Chrome for no real reason :(
708.
by lol768 7y ago
From https://www.gnu.org/software/hurd/faq/64-bit.html > There are currently no plan for 64-bit userland, but there are plans for 64-bit kernelland with 32-bit userland, which will notably permit to effici
709.
by lol768 7y ago
Interesting to hear! Do you mind sharing your rough location?
710.
by lol768 7y ago
I believe there's been a better solution to captive portal redirects for quite some time now, via the medium of DHCP and/or RAs - https://tools.ietf.org/html/rfc7710 . Unsure why we've not yet seen much a
711.
by lol768 7y ago
Tells me everything I ever wanted to know about ISPA. Did they even notice the juxtaposition of recognising Sir Tim Berners-Lee with an award for a campaign to "protect the open and free nature of the Internet" and simultaneously
712.
by lol768 7y ago
If you skip the survey you end up on scroll.com: > Thank you for participating in this survey! We would like to invite you to a free trial of Firefox Ad-free Internet, a name we used in this survey for a partnership with our friends at
713.
by lol768 7y ago
Reminds me of Mathpix Snap: https://mathpix.com/
714.
by lol768 7y ago
SOP isn't relevant here - it relates generally to _reading_ content from another origin. What is relevant here is whether the cookies are SameSite and/or whether a token is required.
715.
by lol768 7y ago
Doesn't Edge auto-update though? How easy would it be, as someone in enterprise IT, to keep users on an old version of Edge?
716.
by lol768 7y ago
No, I don't believe it would.
717.
by lol768 7y ago
Yes, seems to have impacted all CF sites. (UK here) Status was just updated here, but it was showing everything as operational for a while: https://www.cloudflarestatus.com/
718.
by lol768 7y ago
Yes, seems to have impacted all CF sites. (UK here)
719.
by lol768 7y ago
>What makes Safari so bad in your eyes? The rendering engine is poor. It's probably the browser I have the most trouble with when doing frontend work. iframe scrolling is broken, it's historically suffered from some frustrating
720.
by lol768 7y ago
You could, but you'd probably break a lot of legitimate functionality.

More ›