stefanorri
Re:Planes, Ferries and Automobiles – How I Hacked Free Travel Across I...
on Monday March 04, 2024 @08:27AM (#39590185)
Author here - I should maybe have made the disclaimer at the end more prominent - "All the bugs were discovered, verified, and reported. Any issued tickets were canceled and not used."
Don't let Content Security Policy fool you into a false sense of security
Re:Securityheaders.io – Analyse your HTTP response headers
on Thursday February 11, 2016 @11:14AM (#11081009)
Thanks, glad to hear it!
Re:Securityheaders.io – Analyse your HTTP response headers
on Thursday February 11, 2016 @11:14AM (#11081005)
testssl.sh is also great for testing internal servers which aren't internet accessible.
Re:Securityheaders.io – Analyse your HTTP response headers
on Thursday February 11, 2016 @10:38AM (#11080709)
HTTPSecurityReport - https://httpsecurityreport.com - Disclaimer: I'm the creator.
Site Scan from MS - https://dev.windows.com/en-us/microsoft-edge/tools/staticsca...
Subresource Integrity scanner - https://sritest.io/
Show HN: HTTP Security Report – Test Your HTTP and HTML5 Security
Unblocking Netflix Could Put You at Risk
Show HN: HTTP Security Report - Analyzer for HTTP best practices
HTTP Public Key Pinning Usage Is Essentially Zero
Re:You've Been Framed. A survey of iframes and the sandbox attribute
on Thursday May 07, 2015 @03:02PM (#9507452)
Good point. But the sandbox attribute is around 90% [1] of browsers. The number of browsers which don't support it and don't run javascript may be too low to make supporting them practical, but YMMV.
Re:You've Been Framed. A survey of iframes and the sandbox attribute
on Thursday May 07, 2015 @11:42AM (#9505857)
If you apply the sandbox attribute to the iframes it should be ok. It allows fine grained control of what the iframe is allowed to do. Scripts, navigation, popups, etc. are forbidden except explicitly allowed.