kevinyew

You can if you want to deliberately CORF yourself for some reason - it's there to protect you, but spoofing it doesn't give you any special access you wouldn't otherwise have.

The point is that arbitrary user's browsers out in the world won't spoof the Origin header, which is protecting them from CORF attacks.

Maybe it you're running Windows XP, but that is absolutely not true for a supported version of Windows. It is absolute FUD to say simply connecting a Windows 10/11 machine to the internet will cause it to be automatically infected.

This doesn't make any sense, this vulnerability is in the context of browsers, not server side runtimes.

Love this reference, that MattKC video is so good.

For the uninitiated, I present this masterpiece: https://youtu.be/CTUMNtKQLl8

I didn't know Typeform offered payment processing, huh.

Been enjoying playing a couple games of Seven Wonders Duel so far, but one immediate issue is that there is no way to unsubscribe from the emails telling me it's my turn. I've already got browser notifications turned on, so these emails are filling up my inbox fast.

I've also reported a couple bugs so far, the main one being not being able to build Wonders even though I have adequate resources, but other than that, amazing work! I'm keen to implement a game myself sometime soon.

WAN show reference?

There is nothing about HTML/CSS/JS that prevents simplicity. It is purely how it has been used and abused. You can also disable JS and use user agent stylesheets in any modern web browser.

Sadly, boardgame arena also pushes advertising for new games and features through the notifications as well. I'm sure it's possible to disable specific categories, but it unfortunately undermines their value even more when otherwise legitimate sites still somewhat abuse push notifications.

They're already picking a fight with Cellebrite simply by existing, as Signal is antithetical to everything that Cellebrite stands for.

I wish there was something like this for JAMstack/JS only websites that you host on eg Netlify. I know Netlify has their own analytics but they're paid, which is fair enough, but hard to bite the bullet when Google Analytics is free.

Not to sound miserly, but how is this a bonus for the employee whatsoever?

Yeah, or you could also use a trusted APK repository like APKMirror, no phone required.

PHP is definitely not a meme, it's got a ton of actively developed frameworks, PHP 7 was a huge step forward for the language and PHP 8 is shaping up to be as well.

It's been used at every workplace I've been at, sometimes well, sometimes not so well, just like any language. No idea what the point of blanket statements like this is.

It's likely that it already had that default association set up out of the box. If you open up the system App Info screen for YouTube, you should see a section that says "Set as default", and when you open that, it shows you which URLs it hijacks under "Supported web addresses", but in that same screen there should be a "Go to supported URLs" option, where you can choose "In this app", "Ask every time", or "In other app".

I am running Android 10 so it's possible it looks different on Android 6.

Except they get a cut of app sales and in app purchases, so this doesn't make any sense. Why would they bother running the Play Store at all if it didn't make them money?