nchmy

22 ms·

541.
by nchmy 1y ago
Pray tell, what is it that only react can do that makes you "require" it?
542.
by nchmy 1y ago
The browser bubbles events natively... https://developer.mozilla.org/en-US/docs/Learn_web_developme...
543.
by nchmy 1y ago
If Html and browser APIs might be abandonned in a few years, We've got bigger issues to worry about than react vs backbone
544.
by nchmy 1y ago
The average speed/connection is not 4G LTE. And react usually is not just 100kb. SSR html is vastly faster for all parties involved. So much so that all spa frameworks have introduced some sort of server rendering, astro is growing a l
545.
by nchmy 1y ago
Just wait til you discover hypermedia, the actual language of the web...
546.
by nchmy 1y ago
So what you're saying is that people should be taking ozempic rather than just getting some self discipline and eating some salad?
547.
by nchmy 1y ago
Consider PopOS - I just moved to that after flailing with omarchy/hyprland for a day. Very happy.
548.
by nchmy 1y ago
I don't know much about flatpak. How does it solve these issues?
549.
by nchmy 1y ago
Found linus' alt
550.
by nchmy 1y ago
sauce?
551.
by nchmy 1y ago
Once again, you have no idea what you're talking about. Moreover, you lack critical thinking skills - the Sec-Fetch-Site section in that doc is senseless and will now be modified to say that Sec-Fetch-Site is sufficient on its own. ht
552.
by nchmy 1y ago
It doesn't actually fail to protect 5%, as the top-line 5% aren't really "browsers". Even things like checkboxes often top out at around 95%! You can change a setting on caniuse.com and it excludes untracked browsers. Se
553.
by nchmy 1y ago
You might want to develop some critical thinking skills. The doc is wrong, and will soon be updated to say that Sec-Fetch-Site is sufficient on its own. https://github.com/OWASP/CheatSheetSeries/issues/1803
554.
by nchmy 1y ago
The doc is wrong and will be updated soon to say that Sec-Fetch-Site is sufficient on its own. https://github.com/OWASP/CheatSheetSeries/issues/1803
555.
by nchmy 1y ago
False. OWASP will now be modifying it's doc on the topic to say that Sec-Fetch-Site is sufficient on its own, rather than defense in depth. You really have no idea what you're talking about. https://github.com/OWAS
556.
by nchmy 1y ago
Off to the gulag with you!
557.
by nchmy 1y ago
Thanks for everything you've done. Caddy is beautiful. I hope this helps you enjoy life more, as well as ultimately help caddy grow further.
558.
by nchmy 1y ago
it is included in Baseline and passes more tests than safari, so i would hardly call it arcane
559.
by nchmy 1y ago
I suppose that we could just reject anything that doesnt have these tokens, depending on whether you want to allow curl etc... I might just do that, in fact.
560.
by nchmy 1y ago
Wait, but if those headers are missing, then isn't there a vulnerability if someone is using an old browser and clicks on a malicious link? Do we need to also check user agent or something else?
561.
by nchmy 1y ago
In what way did I call Firefox arcane? Firefox generally has better support for web features than safari.
562.
by nchmy 1y ago
Yeah, I'm very amenable to this take. WordPress, for example, is infamous for having extreme backwards compatibility. But that often results in many sites being on ancient versions of php (and surely other tech as well). I'm of th
563.
by nchmy 1y ago
Caniuse.com shows both origin and referer headers have 96.3% support, with Sec-Fetch-Site not far behind at 94.2. So it's probably a moot point. Ive read in various places though that referer has all sorts of issues, gotchas etc such t
564.
by nchmy 1y ago
Apparently less than 1.5% of global internet users are on versions of safari that don't support Sec-Fetch-Site.
565.
by nchmy 1y ago
There's plenty of other chromium browsers - Vivaldi seems to do a good job in this regard. Also, Firefox exists, though they don't seem to care about privacy much anymore either. And, of course, safari, which is terrible in most r
566.
by nchmy 1y ago
Don't major browsers essentially auto update? And to the extent that a device is so old that it can't support newer versions, surely it must be VERY old and perhaps is somewhat likely to be replaced sooner than later. I think I&#x
567.
by nchmy 1y ago
Yes, I assumed this is what they were ignorantly pointing towards. Indeed, Csrf tokens are an ancient concept. WordPress, for example, introduced nonces a couple years before rails. Though, it does appear that rails might have been thr firs
568.
by nchmy 1y ago
I see what you mean. You were saying why tls in addition to Sec-Fetch-Site. The sibling comment seems to have addressed it
569.
by nchmy 1y ago
> The Sec-Fetch-Site header can't be read / written by Javascipt Perfect. It's not even meant or needed to be. The server uses it to validate the request came from the expected site. As i and others have said in various co
570.
by nchmy 1y ago
Sorry, but you seem to be lost. I, the article and most comments here quite explicitly talked about server security via Auth and csrf protections. None of this has anything to do with browser security, such as stealing csrf tokens (which te

More ›