Viewing profile — anglebracket

Yes, this isn't even the first cross-domain leakage attack on iframes using CSS. [0] There were similar issues with how hit testing was implemented for `document.elementFromPoint()…

That's similar to what Kaminsky proposed with Iron Frame[0], but obviously it'd have to be opt-in. Applying Iron Frame-like rendering to all iframes would break a lot of content. […

Not a great sign when they have only a handful of pages and still manage to have super basic XSS issues.

I don't believe so. emacs-slack uses their official OAuth2 + Websocket integration https://github.com/yuya373/emacs-slack#how-to-get-token-the-...

Generally if you have a CSP without `unsafe-inline` you'd have have a policy that would restrict all subresources (`default-src 'none'`,) then punch holes in the policy by resource…

They shouldn't. These examples all rely on being able to cause an image load on a host the attacker controls if the CSS rule is applied. reddit blocks stylesheets that reference of…

> The screenshot of their app on the iOS App Store shows a bunch of credible logos of their mentions, but then quotes "VyperVPN is the best service on the market" as coming from a …

Yep, you can see that Ubuntu has been backporting security fixes: https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.1

Interesting! I haven't spent much time looking at OS X internals, but I'll remember this for next time. Have any resources for other OS X quirks like this?

>i've never seen the 'my' keyword before, what exactly is this language? It's Perl: http://perldoc.perl.org/functions/my.html

As a workaround you can go to "View > Page Style > No style". It honestly reads just fine without CSS.

To JetBrains' credit they were very responsive throughout the disclosure process. I received a reply to my initial report in under two hours. Generally response times are measured …

No, all that's necessary to trigger it is browsing to a page containing attacker-controlled JavaScript or Flash. The browser on your own computer would be connecting to the server …

As far as I'm aware, Unity does not have JavaScript. It has the superficially similar "UnityScript" [0]. [0]: http://wiki.unity3d.com/index.php/UnityScript_versus_JavaScr...

See https://github.com/JdeH/Transcrypt/blob/master/Transcrypt/de... There are spaces before subscript operators, before `.method()` calls, and between `def name` and `(param1, para…

That's fair. My point was that in reality, a ton of people end up doing it wrong in some way or another. You should cover your bases and keep your systems up to date with security …

> Often there is no need to install updates at all on machines [...] like HVAC and SCADA systems Which, incidentally, have been the target of a lot of recent high-profile attacks.[…

https://web.archive.org/web/20150811052336/https://blogs.ora...

Any number of things can out you as a fake. Whether or not the request's Accept-Encoding has sdch, can help you figure out if something's Chrome. You can also abuse parsing quirks …

>The attack made the code throw and exception and some of my escaping characters caused havoc with their error logger Heh, something similar happened to me during a recent audit. I…

True, but just because you trust someone to access the dashboard doesn't mean you trust them to execute code on your server. There are other things to consider as well, like MITM a…