w3c/webappsec
View on GitHub ↗ ★ 675 HTML
Web Application Security Working Group repo
11 mentions on Hacker News by 9 people: 1 story, 10 comments · first 2015-07-23 · latest 2024-11-24
20082026
-
…by wrapping the untrusted code in an iframe and using child-src on the parent of the iframe) 1: https://github.com/w3c/webappsec/issues/656#issuecomment-246... 2: https://www.w3.org/TR/CSP3/#exfiltration
comment by benatkin · 2024-11-24 · in This website is hosted on Bluesky -
…a different colour icon representing that the code is correctly signed with an unknown key. [0] https://github.com/w3c/webappsec/issues/449 [1] https://github.com/w3c/webappsec-subresource-integrity/issue...
comment by dane-pgp · 2022-03-11 · in How Cloudflare verifies the code WhatsApp Web serves to users -
…would be nice if the W3C's SRI standard was extended to allow offline signing of JavaScript files: https://github.com/w3c/webappsec/issues/449 and for browsers to prompt you whether you wanted to run a new (offline signed, maybe…
comment by dane-pgp · 2018-03-10 · in OpenPGPjs v3.0 -
…declare that all (or just certain) included resources have been signed by an (offline) PGP key: https://github.com/w3c/webappsec/issues/449 so we might one day reach a point where running a webapp at least has the small security guarantee…
comment by dane-pgp · 2017-10-28 · in Public Key Pinning Being Removed from Chrome -
…private networks or retrievable only with the victim's cookies have certain content. See, e.g., < https://github.com/w3c/webappsec/issues/418> for some broader discussion.
comment by epriest · 2017-04-05 · in Do not let your CDN betray you: use subresource integrity (2015) -
…incredibly disappointing about SRI is that it requires CORS. There's some more information here: https://github.com/w3c/webappsec/issues/418 but it essentially means that you can't SRI-pin content on a sketchy/untrustworthy CDN without…
comment by EE84M3i · 2017-01-27 · in Using Immutable Caching to Speed Up the Web -
It looks like there was a change on 19th August, 2014: https://github.com/w3c/webappsec/commit/b48b635f93a798da87c6... However, clicking the link to “Latest Version” at the top of the document you linked (from Dec 2015) takes you to the…
comment by davecardwell · 2016-02-21 · in Where did all the HTTP referrers go? (2013) -
https://github.com/w3c/webappsec/issues/477
comment by bugmen0t · 2015-10-01 · in Do not let your CDN betray you: Use Subresource Integrity -
The header is 9 days old, and now Chrome is sending it by default: https://github.com/w3c/webappsec/commit/eeac3922418bfa6cb254... Header bloat, ~28 extra bytes per request from every Chrome user in the world. The whole idea of the header…
comment by tomsommer · 2015-07-23 · in Forcing Wordpress sites to use https even when not directed -
…is from what I can see.. there's even some fun debate about how many characters long it should be: https://github.com/w3c/webappsec/issues/216 ). Do they really expect webservers to handle this correctly? 2) Despite having a bug like this…
comment by Twirrim · 2015-07-23 · in Forcing Wordpress sites to use https even when not directed