zemnmez

18 ms·

151.
by zemnmez 9y ago
thank you. I may have reacted excessively. I'm glad you enjoyed it :)
152.
by zemnmez 9y ago
yeah, I'm sorry there ... I thought this was pointed directly at my article. I agree on the scale of things that could have potentially happened that these things are in middle of the scale. But I do respectfully disagree that they can
153.
by zemnmez 9y ago
while, yes I did want to make out in the second half just how difficult it was to get in contact with a CERT, it's sad to hear the other half put down to 'alright findings'... Sure, the first issue that made me get into tax b
154.
by zemnmez 12y ago
It's important to note that CSP2 aims to mitigate this problem by adding a header that is used when CSP is active. Web applications can then be more careful about the kind of responses they give under those conditions. https:/&#x
155.
by zemnmez 12y ago
> It seems like this class of attacks is based on embedding content that is not designed to be embedded in the first place. It's not the case that this type of attack hinges on the use of images.
156.
by zemnmez 12y ago
This isn't the case. Embedding a non-image as an image is only used to trip the CSP. If the X-Frame-Options header is not set to DENY or SAMEORIGIN, you can equally iframe the contents. CSP restrictions are capable of controlling almos
157.
by zemnmez 12y ago
Not sure what happened, restarted the server.
158.
Detecting login state for almost any website on the internet(words.zemn.me)
250 points by zemnmez 12y ago|61 comments