News for hackers. Stuff that matters.

A comment on All extensions disabled due to expiration of intermediate signing cert. Parent comment

Re:All extensions disabled due to expiration of intermediate... by bostik on Saturday May 04, 2019 @02:38AM (#19824832)
Isn't that how most programming, security or not, works these days anyway?

Joe Random Developer googles for a problem, hits SO, tries a couple of the different proposed snippets and keeps the one that happens to work. (For given values of "work".)

This would be a great spot to end the post with a "</snark>", but sadly that'd be lying. Up until ~2 years ago the most common solution to requests between different subdomains subdomains failing was... "just use CORS: *"

[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by adrianN on Saturday May 04, 2019 @03:14AM (#19824962)
More dangerous than copypasting code from SO is using some 0.0.1alpha library you found on Github/crates.io/npm... At least with the copypaste snippet you had a cursory look at the implementation.
[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by floatingatoll on Saturday May 04, 2019 @02:42AM (#19824844)
I believe the Mozilla Observatory has given CORS: * a -50 score penalty since the day it launched, precisely because of how horrifically dangerous that advice is.
[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by snazz on Saturday May 04, 2019 @11:56AM (#19827218)
You can even automate the procedure: https://gkoberger.github.io/stacksort/
[ Parent | on HN ]