Viewing profile — johannh

Both the more technical blog post as well as the MDN page are linked shortly after that paragraph.

No, there’s no allow-list, you get the same heuristics as described on that MDN page.

Yes, it’s essentially that, FPI with workarounds for common breakage. You should switch from FPI, this is essentially another take on FPI by some of its original developers, so it …

(I’m one of the developers of this feature and co-author of the blog posts) This is a great question and I’m glad you found the answer, you probably understand that for many blog p…

If your users are clicking a button then it should actually show the permission prompt, unless you're losing the user interaction somewhere in the callback (by doing something asyn…

Congrats! Please note that Servo is a work in progress that is still lacking some modern browser security features, so enjoy responsibly. See also https://github.com/servo/servo/la…

https://en.wikipedia.org/wiki/Egg_of_Columbus

I find it ironic if banks and post offices are using combination locks as advertised security measures but the people selling those install steel doors on their storefront.

True, I'm not surprised at all. HTTPS Everywhere-like functionality should be integrated into browsers and not a downloadable extra, tricking people into feeling fully secured.

> AMO doesn't do any code signing for extensions, so they're only protected by HTTPS. As we saw with Heartbleed, SSL private keys can be compromised. I find it quite ironic that HT…

This was originally published a year ago in this blog post: http://berzniz.com/post/68001735765/javascript-hacks-for-hip... Makes for a nicer read than slideshare imo.

True, but it still feels like the right thing to do. I'd like people do be responsible when they discover a serious flaw in my programs, so I'll try to be responsible when discover…

This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't.…