91–99 of 99 posts
Earlier quoted context omitted.
The problem is when a zero day is found on safari engine there's no alternative one can use till it gets patched.
Do you think there is a browser available with no zero-days on any platform?
Earlier quoted context omitted.
TablePlus looks cool! Also the only one started in the last decade. Inertia is the most powerful force in the universe, and gravity is up there as well. Adobe & Microsoft dynastyware dating back to 1990, and two also rans devoured by the web (Figma/Postman). And TablePlus which genuinely looks cool and gives just enough hope to mourn again.
I think Paw and Sketch are better than Postman and Figma, respectively. But I see your point. You're basically right, but at least we have much more cross-compatibility now. Not something we could say about Macs of yore. Pros and cons.
I will say as a former Mac developer who came of age and experience during the Carbon Y2K transition days, the fact you can just expect some form of availability regardless of Linux or iOS or macOS or Chrome or Safari is a genuine fucking achievement for the human race, how far and low we’ve come.
It's very interesting seeing exploits like this from this organization. On one hand their service fingerprints users and offers extended metadata like whether the user is in incognito via sketchy web apis. On the other hand they report (and help close) some gnarly exploits like this via sketchy web apis. What do you all make of this? It's hard to not see it as some weird "were not doing a bad thing" gaslighting (perh…
I had the same thoughts; it seems to present a friendly picture but there are a lot of unanswered problems with this technology, even if only used for fraud protection. What if clients use it for tracking and other shady purposes, would they do something about it? Btw I tried with Tor Browser and it did not accurately fingerprint it between sessions which makes me wonder how effective it really is. Especially for fra…
There's also an extra session on one of my incognito tabs listed in the session history on the demo page.
Earlier quoted context omitted.
Given that there’s really no way around Safari on the iPhone, developers should perhaps just not use IndexedDB if the browser is Safari, given how buggy the implementation is. It pretty clear that Apple isn’t giving Safari/WebKit the focus it needs, but it’s also clear that developers just continue to push for more and more features in the browser. I’d much prefer that browsers started to cut back. While Google is ex…
Unfortunately, if I advertised my webapp as "Works Best in Chrome", people would claim I was "supporting the browser monoculture".
How is this not a P1 thing in the iOS/iPadOS/macOS/security teams at Apple? Seriously? Bare minimum, why didn't they let people know about this? We know the whole "we care about privacy" thing is marketing fluff now but holy F this is just unacceptable. And this kind of an issue is exactly why Apple needs to stop screwing around and do the following things ASAP: 1. Decouple Safari from the OS so that it can be update…
On iOS, there's nothing stopping them from releasing a critical fix to iOS that auto-installs as quickly as a decoupled update would.
It’s clear that Safari is not a top prio at Apple, even though it’s probably the most important app on their operating systems. Contrast with Google that needs Chrome to exert their control over the web.
Earlier quoted context omitted.
Given that there’s really no way around Safari on the iPhone, developers should perhaps just not use IndexedDB if the browser is Safari, given how buggy the implementation is. It pretty clear that Apple isn’t giving Safari/WebKit the focus it needs, but it’s also clear that developers just continue to push for more and more features in the browser. I’d much prefer that browsers started to cut back. While Google is ex…
Unfortunately, if I advertised my webapp as "Works Best in Chrome", people would claim I was "supporting the browser monoculture".
Is it usual to disclose (what appears to me to be) a vulnerability with massive potential for exploitation towards disastrous ends, before the developers of the software have shipped a fix? I guess I'm curious as to what the norms are around disclosure of such discovered vulnerabilities are in general.
It's a hot topic of debate. Some people advocate for full disclosure, which means tell everyone as soon as you find it. The idea behind that is that attackers might have already found it and be exploiting it, so people should know in order to protect themselves. Others advocate for coordinated disclosure (sometimes called responsible disclosure, a controversial term[1]), with some sort of time limit. Google Project Z…
