91–100 of 109 posts
Is there anything Mozilla/Firefox has done in the past 10 years that at least CAN BE ARGUED is for the improvement of the user's experience? I've been following their work pretty closely, but I'm at a loss trying to think of anything...
Is there anything Mozilla/Firefox has done in the past 10 years that at least CAN BE ARGUED is for the improvement of the user's experience? I've been following their work pretty closely, but I'm at a loss trying to think of anything...
- getting onto webextension based extensions has allowed Firefox to become much snappier than it used to be
- Firefox sync for history syncing is fantastic
- Firefox on mobile (Android) is a delight and the only browser I use on mobile now
- Rust (from Mozilla) is cool and is being used to build cool and important things
Earlier quoted context omitted.
Safari truly is IE in 2021
This is a story that you can often hear on HN but I don't think it's correct. There were three correlated reasons for the bad reputation of IE some years ago: 1. it was largely dominant, so people thought they could develop just taking that browser in consideration 2. for the previous point, MS started to develop proprietary features (like ActiveX) 3. at a certain point its development was stopped for a long time Saf…
> Safari certainly cannot match the first two reasons.
1. Most users view websites on their phones. Safari is the only browser on iPhone (there are other browser skins, but they're all forced to run on top of Safari). The market share of iOS devices is usually about at least 50% in developed nations.
2. iOS has proprietary features, it is known as the App Store. If you want to develop certain things, you must use the app store, the browser is locked out of those features (even if all other browser vendors have them).
> But it cannot match the third either, because the development of standard web features is going on at good pace (see https://webkit.org/status/>).
3. I probably don't need to go into this point since it's common knowledge that Safari has always been the least compliant browser in terms of web standards. Their history of holding back features or implementing features with critical flaws that make them useless has been a recurring trend for the last decade. Just because they have checked a box on a table, doesn't mean the feature is anything close to useable.
Earlier quoted context omitted.
There's a difference between only allowing that behaviour, and explicitly creating features to enable it. This sounds like Referer, but worse.
(1) How is it like Referer? (2) How is Referer bad? Like it "tracks" you? Seems like the 1000th least bad tracker you probably run.
Earlier quoted context omitted.
Firefox, Chrome, Edge and Opera support it (including mobile). Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users). Safari is sadly not yet supported. The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients. I.e. you can automatically reject requests if the headers are given and have a bad value, which wou…
Safari truly is IE in 2021
Earlier quoted context omitted.
In the web, requests are made in either `cors` mode or `no-cors` mode. In `cors` mode, the `Origin` header is sent in the request. So yes, in `cors` mode the server could reject the request based on the `Origin` header. But in `no-cors` mode (the default if you do something like ` `) the `Origin` header isn't set, so CORS doesn't help defend against any attacks.
Can you explain the risk with regards to no-cors requests? Like presumably an attacker requesting an image isn't scary, right? I'd think the real issue would be the attacker making credential'd requests.
This is FUD: > Hence the banking server or generally web application servers will most likely simply execute any action received and allow the attack to launch. While these are useful headers, there are protections today via XSRF tokens to prevent these attacks that all major sites implement, so it isn’t likely your bank is vulnerable.
It's not FUD. There are protections, but csrf tokens are a workaround while these headers are more akin to proper solution. Also, it won't magically make CSRF obsolete same way Origin header and CORS didn't make CSRF obsolete, but it's another tool in the appsec toolbox.
Earlier quoted context omitted.
Safari truly is IE in 2021
Let's completely sidestep the whole debate that we always have. This is a safety feature, Safari will implement it, you can bet on it. It's merely going to be the last to do it.
Earlier quoted context omitted.
Can you explain the risk with regards to no-cors requests? Like presumably an attacker requesting an image isn't scary, right? I'd think the real issue would be the attacker making credential'd requests.
The point is that the endpoint can be anything, it doesn't need to have anything to do with images. But because of the context of the request, it's no cors.
This isn't my area of security so I'm trying to figure out what the scenario is supposed to be where this mitigation is important.