Hacker GitHub

← All repos

w3c/webappsec

View on GitHub ↗ ★ 675 HTML

Web Application Security Working Group repo

11 mentions on Hacker News by 9 people: 1 story, 10 comments · first 2015-07-23 · latest 2024-11-24

Mentions per year 11 mentions · busiest year 2015 (3)
20082026
AllStoriesComments NewestTopOldest
  1. …by wrapping the untrusted code in an iframe and using child-src on the parent of the iframe) 1: https://github.com/w3c/webappsec/issues/656#issuecomment-246... 2: https://www.w3.org/TR/CSP3/#exfiltration
    comment by benatkin · 2024-11-24 · in This website is hosted on Bluesky
  2. …a different colour icon representing that the code is correctly signed with an unknown key. [0] https://github.com/w3c/webappsec/issues/449 [1] https://github.com/w3c/webappsec-subresource-integrity/issue...
    comment by dane-pgp · 2022-03-11 · in How Cloudflare verifies the code WhatsApp Web serves to users
  3. ▲ 2
    Distrusting the web server
    story by lle-bout · 2018-11-18 · 0 comments
  4. …would be nice if the W3C's SRI standard was extended to allow offline signing of JavaScript files: https://github.com/w3c/webappsec/issues/449 and for browsers to prompt you whether you wanted to run a new (offline signed, maybe…
    comment by dane-pgp · 2018-03-10 · in OpenPGPjs v3.0
  5. …declare that all (or just certain) included resources have been signed by an (offline) PGP key: https://github.com/w3c/webappsec/issues/449 so we might one day reach a point where running a webapp at least has the small security guarantee…
    comment by dane-pgp · 2017-10-28 · in Public Key Pinning Being Removed from Chrome
  6. …private networks or retrievable only with the victim's cookies have certain content. See, e.g., < https://github.com/w3c/webappsec/issues/418> for some broader discussion.
    comment by epriest · 2017-04-05 · in Do not let your CDN betray you: use subresource integrity (2015)
  7. …incredibly disappointing about SRI is that it requires CORS. There's some more information here: https://github.com/w3c/webappsec/issues/418 but it essentially means that you can't SRI-pin content on a sketchy/untrustworthy CDN without…
    comment by EE84M3i · 2017-01-27 · in Using Immutable Caching to Speed Up the Web
  8. It looks like there was a change on 19th August, 2014: https://github.com/w3c/webappsec/commit/b48b635f93a798da87c6... However, clicking the link to “Latest Version” at the top of the document you linked (from Dec 2015) takes you to the…
    comment by davecardwell · 2016-02-21 · in Where did all the HTTP referrers go? (2013)
  9. https://github.com/w3c/webappsec/issues/477
    comment by bugmen0t · 2015-10-01 · in Do not let your CDN betray you: Use Subresource Integrity
  10. The header is 9 days old, and now Chrome is sending it by default: https://github.com/w3c/webappsec/commit/eeac3922418bfa6cb254... Header bloat, ~28 extra bytes per request from every Chrome user in the world. The whole idea of the header…
    comment by tomsommer · 2015-07-23 · in Forcing Wordpress sites to use https even when not directed
  11. …is from what I can see.. there's even some fun debate about how many characters long it should be: https://github.com/w3c/webappsec/issues/216 ). Do they really expect webservers to handle this correctly? 2) Despite having a bug like this…
    comment by Twirrim · 2015-07-23 · in Forcing Wordpress sites to use https even when not directed