lol768

68 ms·

721.
by lol768 7y ago
I don't see how this issue is unique to jsfiddle or this project.. Any static hosting service is going to have this issue no?
722.
by lol768 7y ago
Unsure I really understand the XSS risk that's discussed in the links you provided. Nobody cares about that origin because it has nothing of value hosted on it and it's not like you'd be able to access cookies from a differen
723.
by lol768 7y ago
Is there any reason they couldn't be vector SVGs?
724.
by lol768 7y ago
This is not a solution. JS still runs, it just has limited access to certain features. You also need to somehow <iframe> the ad content (and serve it from somewhere else with the feature policy header set/attribute on the iframe
725.
by lol768 7y ago
It's insane to me the extent to which companies will go in order to prevent cross-site scripting attacks.. and yet they're perfectly happy to include unvetted, potentially malicious JavaScript on the same origin in the form of a
726.
by lol768 7y ago
Another interesting discussion thread: https://news.ycombinator.com/item?id=18332918
727.
by lol768 7y ago
Images are struggling to load for me. Is this the behaviour you're seeing, or is it just completly broken?
728.
by lol768 7y ago
>I don't believe it offers most of those services Incorrect. >overdrafts in the UK are being restricted so be much less profitable Incorrect, the fees are being regulated to ensure they're reasonable and customers are not
729.
by lol768 7y ago
Yeah .. that's the entire premise of Monzo's marketplace concept. Really not sure what point you're trying to make here. Monzo offers the current account and works with other organisations to offer the savings accounts (with
730.
by lol768 7y ago
Overdrafts, interchange, reasonable fees (Monzo Plus, business accounts), commission (marketplace: savings accounts, insurance etc).
731.
by lol768 7y ago
Note that Starling will prevent you opening a business account if you've held a personal account in the past and closed it. That was the position I found myself in. For what it's worth, I've seen some suggestions regarding bu
732.
by lol768 7y ago
Yes, they've had job positions open for more web work. I think they will expand this. They already offer business accounts. I have one open for my Ltd company.
733.
by lol768 7y ago
Thanks, I missed this on first read! The lines are quite wide. Now wondering what the wiki software was that had implemented it as a GET (of course, opening up to CSRF too if there's no token param) and implemented poor search functi
734.
by lol768 7y ago
I don't understand how a crawler could change the language of the wiki without being authenticated.
735.
by lol768 7y ago
>Have you actually tried using Slack App without a mouse or a trackpad? Yes, I tried before I wrote my comment :) My experience informed everything I said. >SlackApp, unfortunately doesn't allow you to be efficient, because it&#x
736.
by lol768 7y ago
I think a lot of people don't realise it's there. Isn't Chrome installed by default on most devices?
737.
by lol768 7y ago
>Have you ever tried to jump to a thread without using the mouse? Or copy a link to the last message? Or share it? Or ask Slack to remind about it? Or snooze all notifications? I'm not sure these are issues? * Not sure what "ju
738.
by lol768 7y ago
LaTeX is one of the most important tools that I properly started using regularly whilst at unviersity. It's the typesetting tool in CS, and you can get some really beautiful results from it. There's great tooling for IDEs like I
739.
by lol768 7y ago
We had exactly this with the <portal> element https://news.ycombinator.com/item?id=19866584 It gets shipped in Chrome (often without a W3C spec or substantial discussion with other stakeholders), and then other browse
740.
by lol768 7y ago
Definitely not, it's a bug - not a redesign.
741.
by lol768 7y ago
Related discussion: https://news.ycombinator.com/item?id=20158002 Seems like it impacted VIP Go? https://lobby.vip.wordpress.com/2019/06/11/503-errors-and-av...
742.
by lol768 7y ago
>I could see F-Secure making an offer I'd be surprised if F-Secure made another acquisition so soon.
743.
by lol768 7y ago
Not personally a fan of the way they're (ab)using the browser brand for unrelated products, but it might help with recognition from your average person who doesn't know what Mozilla is.
744.
by lol768 7y ago
It's not massively advertised on the homepage (though in some respects, I think outside of infosec circles "Firefox Monitor" probably sounds more professional/neutral than "Have I been pwned"). I think they dis
745.
by lol768 7y ago
It's not exposed though, right? ACH is just for banks settling between themselves, is it not? The entire point of OB and PSD2 is that any regulated company can get access to this data.
746.
by lol768 7y ago
So .. did Hacker Noon leave or not? https://hackernoon.com still displays a Medium message. I've not watched the video, there doesn't appear to be a transcript.
747.
by lol768 7y ago
This mostly seems to be required because banks don't provide usable data properly. There should be a way to tie together authorisations and finalized transactions. Any API/interface that doesn't permit this is just broken. Mo
748.
by lol768 7y ago
>while it used to use Gecko How was it ever permitted to use Gecko underneath? Have the iOS app rules changed in recent years? Did they used to be more permissive?
749.
by lol768 7y ago
Interesting, it's a shame we never saw more (a PoC or write-up) following that though.
750.
by lol768 7y ago
I've heard that too.. I know it's been attacked successfully at pwn2own a few times, and in the past the sandbox on e.g. Linux wasn't as restricted. I think things have improved though.

More ›