skeggse

4 ms·

1.
by skeggse 3y ago
https://docs.aws.amazon.com/whitepapers/latest/security-desi... seems like the relevant docs?
2.
by skeggse 3y ago
DIY Edition. I restarted on my laptop instead of my phone and was able to get it through, though not before missing out on batch 2 :( I think there was something squirrely with my selection of keyboard options - I wanted two sets of spacers
3.
by skeggse 3y ago
When I click "Add pre-order to bag" it tells me "Please make a selection for each option." I have quadruple-checked, and I have definitely made a selection for each option. What gives? Take my money!
4.
Precisely observing structural page changes(mixmax.com)
4 points by skeggse 9y ago|0 comments
5.
by skeggse 9y ago
You're right, support for cross-origin form POSTs isn't important for us. What is important, however, is same-origin requests, and Firefox doesn't send the Origin header with those. For us, the Referer serves its most importa
6.
by skeggse 9y ago
For our specific solution, we also rely on (partial) support for Referrer-Policy: https://caniuse.com/#feat=referrer-policy
7.
by skeggse 9y ago
Well, it's a bug. It absolutely should send the origin header, but it doesn't ¯\_(ツ)_/¯
8.
by skeggse 9y ago
I would like to note that not all frameworks are viable at-scale. We ran into that with Meteor, as it scaled extremely poorly. It didn't implement CSRF tokens, but also didn't use cookies to store auth data, so it didn't much
9.
by skeggse 9y ago
I'm curious about your comment. We (attempted) to address cases where we needed to infer the Origin from the Referer due to incomplete browser support. What about using both makes this necessarily worse, when the use of the Referer is
10.
Securing your API: a modern alternative to CSRF tokens(mixmax.com)
156 points by skeggse 9y ago|56 comments
11.
Self-signed certificates for fun and profit(mixmax.com)
8 points by skeggse 10y ago|0 comments