Viewing profile — ahochhaus

Recently Sam Mitrovic posted about a sophisticated phishing attack: https://sammitrovic.com/infosec/gmail-account-takeover-super-realistic-ai-scam-call/ As part of that attack, it …

SameGoal Inc | Staff Software Engineer | Madison, WI | ONSITE (Post-Covid) | Full-Time | https://samegoal.com/ SameGoal's web application allows districts to collaboratively and co…

Thanks for the clarification. I did not realize that `upgrade-insecure-requests` applies cross origin. If you do not load any insecure content is setting HSTS and `block-all-mixed-…

Does using `Content-Security-Policy: upgrade-insecure-requests` in addition to HSTS add value?

MS open sourced ChakraCore (the core of the Chakra JavaScript engine). EdgeHTML is still closed to the best of my knowledge.

Google's standard template language (soy / closure-templates) does mininfy whitespace by default [1]. However, it does not omit optional tags. I think this is why the style guide i…

I agree that the API limitation is most likely not malicious and I did not intend to imply otherwise. Still, lack of malice does not change the fact that the Google Cast extension …

One example of "google only APIs" that I ran into recently is the chrome extension browserAction.openPopup API. This API is whitelisted (in stable) for use by the Google Cast exten…

Fair point. It is reasonable to demote this post. Personally, I always read the release notes but am less interested in the press release. I think many others prefer the opposite, …

This post links to the release notes. The post you mention links to the press release. They contain similar but different information.