Nostr notes by Frederik Braun �

RE: https://chaos.social/@emz/116721057551353811 ...

2026-06-13T10:04:43Z

RE: https://chaos.social/@emz/116721057551353811

uberspace.de (npub19lm…m6sc) Too bad there's no HTTP/3 on uberspace. Is this on your roadmap? :)

quoting
note1tzg…5h7p

TIL that there are DNS HTTPS records you can use to signal that your webserver supports HTTP/3 (and ECH).

If the browser sees a HTTPS record indicating HTTP/3 support it can use that on the first connection, speeding up the load.

Max Inden (npub15mh…h268) built a great website for it where you can also test if that record is set for your site: https://savearoundtrip.com

RE: https://mastodon.social/@JulianOliver/116731404722832495 ...

2026-06-12T04:14:04Z

RE: https://mastodon.social/@JulianOliver/116731404722832495

Reminder that Let’s Encrypt is a wonderful miracle but also a single point of failure.

Nobody’s stopping you from starting a local clone of Let’s Encrypt in your country. With technology like Certificate Transparency, it’s pretty safe to use whatever available certificate authority is available to folks anyway.

quoting
note13yk…e244

A bit disappointed to see ISRG/LetsEncrypt fall inline with the US's punitive sanctions, now effectively illegal for use by any in the long list of territories the US gov seeks to push down.

That's a lot of people and NGOs doing good work in places that need it, and for whom commercial SSL/TLS certs may be prohibitively expensive.

Screenshot from the new Subscriber Agreement, shared to me by themadhatter (npub1a0g…mzku), whom alerted me to this change.

https://linuxiac.com/lets-encrypt-certificate-rules-now-include-u-s-sanctions-warranties/

RE: https://social.security.plumbing/@freddy/116685551584070386 ...

2026-06-03T09:53:52Z

RE: https://social.security.plumbing/@freddy/116685551584070386

The presentation will also finally answer the question whether I am a one trick pony. 🫣🤫

quoting
note168u…98rf

Hey, any plans for the end of this month already?
If not, consider visiting the beautiful city of Vienna and joining me at the OWASP AppSec from June 22nd to 26th.

I will be talking about my favorite topic: Cross-Site Scripting (XSS)

My presentation is titled "The Devil is in the Defaults" and I'll share what I think we as web developers, as security engineers, as browser folks and standards people can now do to fix this once and for all ;)

Hey, any plans for the end of this month already? If not, ...

2026-06-03T09:50:18Z

Hey, any plans for the end of this month already?
If not, consider visiting the beautiful city of Vienna and joining me at the OWASP AppSec from June 22nd to 26th.

I will be talking about my favorite topic: Cross-Site Scripting (XSS)

My presentation is titled "The Devil is in the Defaults" and I'll share what I think we as web developers, as security engineers, as browser folks and standards people can now do to fix this once and for all ;)

Apparently the all hosted nexclouds are unreachable because the ...

2026-06-03T06:16:35Z

Apparently the all hosted nexclouds are unreachable because the wildcard `*.your-storageshare.de` certificate has expired. Good morning and #hugops. Phone support is overloaded and this is a cert from DigiCert.

If this was Let's Encrypt, I'd at least have the confidence that it's fixable in mere minutes....

yeah, we will see how things go. Due to gestures wildly recent ...

2026-05-07T19:25:04Z

In reply to nevent1q…90y7
_________________________

yeah, we will see how things go. Due to *gestures wildly* recent events, we also had a bit less submissions, so… 🤷‍♂️

Nostr event nevent1qqsft3shvygexgzwzn43yjethngpvj25l7dh74ge0m092m7lnhu5gfszyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvumjk8w2

2026-05-07T18:58:05Z

In reply to nevent1q…xtuy
_________________________

https://attackanddefense.dev/2026/03/13/bug-bounty-program-updates-2026.html :)

You can just click the bugs and see the attachments? :)

2026-05-07T17:15:18Z

In reply to nevent1q…28lz
_________________________

You can just click the bugs and see the attachments? :)

You'll see attachments in some of the bugs. We asked the LLM ...

2026-05-07T16:23:08Z

In reply to nevent1q…n3sn
_________________________

You'll see attachments in some of the bugs. We asked the LLM to propose a patch, but it was real people who were assigned to the bug and they were of course free to pick a different approach.

As with all patches in Firefox, we need a human author and another human to review the patch. https://firefox-source-docs.mozilla.org/contributing/ai-coding.html

When we said that we found and fixed hundreds of bugs in Firefox ...

2026-05-07T16:15:27Z

When we said that we found and fixed hundreds of bugs in Firefox using AI, people were skeptical and said: Where are the bugs?

Well, here they are. We are unhiding 12 security bugs that are representative of the issues we have found.

https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/.

Nostr event nevent1qqsq6sst4v8h2net43vje59hfxz62r6vdaplv94g7yqxj8zatj0mauczyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvuy8d5lw

2026-05-05T11:03:53Z

https://blog.mozilla.org/netpolicy/2026/05/05/mozilla-calls-on-uk-policymakers-to-address-the-roots-of-online-harm-not-undermine-the-open-web/

did the vibes take you? :P

2026-05-01T17:10:04Z

In reply to nevent1q…5ekt
_________________________

did the vibes take you? :P

RE: https://infosec.exchange/@metacurity/116397875382563012 Must ...

2026-04-13T20:28:34Z

RE: https://infosec.exchange/@metacurity/116397875382563012

Must read if you work in security.
nostr:note1ey4a3nejcf7hgxt2tyxvmd90rncyev77npc8ht2g2vfvkr5ypgsqxtxmzp

Will damit sagen: Es ist viel Hype und daher auch viel ...

2026-04-10T14:29:20Z

In reply to nevent1q…r85q
_________________________

Will damit sagen: Es ist viel Hype und daher auch viel gerechtfertigte Skepsis.

Aber nur weil wir skeptisch gegenüber dem AI-Hype sind, können wir auch nicht die Augen vor der Wahrheit verschließen. Es kommt gerade eine riesige Tsunami-Welle an Security bugs auf alles an OSS-Software zu. Manche spüren schon die Tropfen, aber eben noch nicht alle :|

ach und noch was: Ich wünscht es wäre anders :)

2026-04-10T11:08:31Z

In reply to nevent1q…d4u0
_________________________

ach und noch was: Ich wünscht es wäre anders :)

Deine Kritik ist nicht so ganz angebracht: 1) Zu Firefox: alle ...

2026-04-10T06:43:51Z

In reply to nevent1q…axqk
_________________________

Deine Kritik ist nicht so ganz angebracht: 1) Zu Firefox: alle diese Bugs waren sehr gut, wir haben auch sandbox-escape exploits gesehen. Dass wir die "sec-high" nennen, ist nach gründlicher Analyse passiert. 2) NFS ist ziemlich oft "offen für alle im Netzwerk". Wenn der Angreifer 1 socket aufmachen kann, kann er auch 2 aufmachen.

Was ich sagen will: ich mach seit über 15 Jahren Security. Ich habe die Bugs gesehen. Sie sind wirklich krass.

her designs were amazing :)

2026-03-30T18:22:51Z

In reply to nevent1q…pshv
_________________________

her designs were amazing :)

…progress still remains as an inventive to get it done as first ...

2026-03-28T11:31:37Z

In reply to nevent1q…92q8
_________________________

…progress still remains as an inventive to get it done as first team, so might make sense to show progress as in "everything that is solvable because it has been solved" rather than "who has done the most".

did you see https://alexandmanu.com/blog/immich-vs-ente-photos/?

2026-03-28T11:21:41Z

In reply to nevent1q…skvm
_________________________

did you see https://alexandmanu.com/blog/immich-vs-ente-photos/?

sehr cool! Glückwunsch! :)

2026-03-27T16:31:53Z

In reply to nevent1q…vwew
_________________________

sehr cool! Glückwunsch! :)

Is there a shorter reference? Written words work better for me ...

2026-03-25T10:07:20Z

In reply to nevent1q…6lwg
_________________________

Is there a shorter reference? Written words work better for me than videos. Ironic, I know :)

In this household we don't say "The young people ...

2026-03-25T08:43:35Z

In this household we don't say "The young people don't work anymore", instead we say "surveillance capitalism, the ad industry and big tech have broken our attention span using mobile phones, notifications and social media FOMO" and I just think that's beautiful.

Hello internet, I am actively looking for speaking opportunities ...

2026-01-09T19:53:20Z

Hello internet, I am actively looking for speaking opportunities in central Europe (e.g., a train-ride from Berlin) to talk about Web security, XSS, `innerHTML` and the Sanitizer API. Ideally to an audience of web developers, framework engineers and the like :)

it's been a while but I liked https://ropemporium.com/ when I ...

2026-01-07T12:38:52Z

In reply to nevent1q…je0x
_________________________

it's been a while but I liked https://ropemporium.com/ when I got back in the game

Fwiw, we don't do CVSS for Firefox CVEs and someone is doing ...

2026-01-01T12:46:30Z

In reply to nevent1q…w2yh
_________________________

Fwiw, we don't do CVSS for Firefox CVEs and someone is doing nonsense-CVSS numbers for us. (People downstream look at the nonsense-CVSS and make decisions based on them, which saddens me. But I don't think we should play the cvss game)

Hey #39c3, Come see my lightning talk on a sage variant for ...

2025-12-27T08:44:54Z

Hey #39c3, Come see my lightning talk on a sage variant for `.innerHTML ` that is built right into the browser. https://events.ccc.de/congress/2025/hub/event/detail/lightning-talks-tag-2 on Day 2.

Do I know anyone working on freedesktop.org / mesa? A direct ...

2025-12-09T07:37:29Z

Do I know anyone working on freedesktop.org / mesa? A direct contact would be ideal :)

New blog post: Why the Sanitizer API is just `setHTML()` - ...

2025-12-07T21:14:39Z

New blog post: Why the Sanitizer API is just `setHTML()` - https://frederikbraun.de/why-sethtml.html

New blog post. Something off-topic to feed the search engine. A ...

2025-12-07T13:00:04Z

New blog post. Something off-topic to feed the search engine. A bug in Lego Star Wars: The Complete Saga (2007). https://frederikbraun.de/lego-star-wars-complete-saga-c3po-bug.html

Hello from Düsseldorf. I am at German OWASP day and you can ...

2025-11-26T08:18:11Z

Hello from Düsseldorf. I am at German OWASP day and you can follow along too. There’s a live stream on https://media.ccc.de/.
Full program at https://god.owasp.de/2025/

Talks are about all sorts of appsec things, from langsec over pdf to passkeys and so on. All talks will be recorded :)

Do I know someone who is (remotely) involved in running the `.hm` ...

2025-11-24T09:30:24Z

Do I know someone who is (remotely) involved in running the `.hm` domain registry?

spent 6 hours on a query last week. I am not sure it was correct.

2025-11-23T17:53:27Z

In reply to nevent1q…w38s
_________________________

spent 6 hours on a query last week. I am not sure it was correct.

I meant the 1990s IDE thing, like in Delphi, where you would just ...

2025-11-13T08:22:50Z

In reply to nevent1q…qzda
_________________________

I meant the 1990s IDE thing, like in Delphi, where you would just drag and drop interactive elements on canvas and when you hit build, you get an app. But you do you :)

When is someone finally building the rapid application ...

2025-11-13T07:56:29Z

When is someone finally building the rapid application development IDE for the web?

Has anyone EVER written a switch/case statement WITHOUT ...

2025-10-31T11:32:31Z

Has anyone EVER written a switch/case statement WITHOUT forgetting `break` in their first run?

Didn't somebody recently ask me what the Sanitizer API status ...

2025-10-28T08:49:07Z

Didn't somebody recently ask me what the Sanitizer API status is? Well anyway, it's in Firefox Nightly for testing now.

TLDR:
```diff
- foo.innerHTML = DOMPurify.sanitize(untrusted);
+ foo.setHTML(untrusted);
```

Download on https://nightly.mozilla.org

1900s: Computers allow me to do things. Early 2000s: Computers do ...

2025-09-16T10:22:29Z

1900s: Computers allow me to do things.
Early 2000s: Computers do things for me.
Now: Computers do things to me.

thanks. Surprisingly long to leave it unpatched?

2025-07-29T19:43:58Z

In reply to nevent1q…x24d
_________________________

thanks. Surprisingly long to leave it unpatched?

I was thinking of ...

2025-07-14T11:40:05Z

In reply to nevent1q…v63k
_________________________

I was thinking of https://gitlab.gnome.org/GNOME/libxslt/-/issues/139#note_2421963 in particular.

(I did see the presentation, I was there :))

Did I read https://gitlab.gnome.org/GNOME/libxslt/-/issues/139 ...

2025-07-14T10:38:59Z

In reply to nevent1q…d0ck
_________________________

Did I read https://gitlab.gnome.org/GNOME/libxslt/-/issues/139 correctly that they disclosed this even though some affected browser vendor (cough cough) is still affected? Feeling bad for them.

"Belgium is unsafe for CVD" - ...

2025-07-08T08:54:31Z

"Belgium is unsafe for CVD" - https://floort.net/posts/belgium-unsafe-for-cvd/ by Floor (npub1sjf…h6tr)

Do you want full disclosure, Belgium?
This is how you get full disclosure.

(cf. https://mastodon.social/@floort/114806039846236450)

Nostr event nevent1qqs0dpg6q9hyz9kjukw04a263dc00pd8flayjtugfwdl80rc7qgn30szyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvug8ueas

2025-07-05T08:58:49Z

Fediverse. Gnome or KDE?

The fact that these apps can launch local web servers to collude ...

2025-06-05T08:23:38Z

In reply to nevent1q…hcdt
_________________________

The fact that these apps can launch local web servers to collude with tracking scripts and completely de-anonymize the users is wild. It's appalling. But here is what's not new:

Native apps from huge advertising companies (née "social" networks) are nothing but a slot machine where you pay with your data.

Get off these apps. Remove them now. Best yet, get off these addictive shit sites. And if you can't, visit them in at truly privacy preserving browser. 2/3.

Great research by folks from IMDEA Networks, Radboud University, ...

2025-06-05T08:23:38Z

Great research by folks from IMDEA Networks, Radboud University, Digital Security Group & iHub, and COSIC, KU Leuven on the "localmess" disclosure (https://localmess.github.io/).

We have always known that native mobile apps will maximize the data collection and use whatever the operating system gives them as long as it doesn't cause a prompt (and often times even if it causes a prompt). 1/3

Tired: Naming your conference rooms after regions and actual ...

2025-05-08T12:37:55Z

Tired: Naming your conference rooms after regions and actual places. "I am in Spadina", "I am in Burgundy"

Wired: Giving your conference rooms fictional names: "I am in Mordor", "I am in agony"

I am writing the approximately third blog post referencing ...

2025-04-23T13:21:16Z

I am writing the approximately third blog post referencing "The Science of Insecurity" from Meredith L. Patterson and Sergey Bratus at the 28c3.
At this point, I consider it necessary education for security people out there (and I really do not say these things lightly).
https://www.youtube.com/watch?v=3kEfedtQVOY

New blog post: With Carrots & Sticks - Can the browser handle ...

2025-04-10T08:43:08Z

New blog post: With Carrots & Sticks - Can the browser handle web security? https://frederikbraun.de/madweb-keynote-2025.html - This is the blog version of my keynote from MADWeb 2025 earlier this year. It's about how web security could become the browser's responsibility.

The nagging feeling if "having missed a bug" described ...

2025-02-26T07:20:52Z

In reply to nevent1q…vnnm
_________________________

The nagging feeling if "having missed a bug" described here is totally self inflicted and totally misaligned with incentives for someone working in offense now? You get asked to show a couple of glorious bugs and nobody expects you to be 100% exhaustive.

Isn’t this feeling more likely to be associated with defense work, where you a absolutely have to find everything?

anderswo gelesen, der größte Erfolg von BSW sei es gewesen, die ...

2025-02-23T07:25:54Z

In reply to nevent1q…pndq
_________________________

anderswo gelesen, der größte Erfolg von BSW sei es gewesen, die Linkspartei wieder wählbar gemacht zu haben. Da musste ich schon schmunzeln 🤭

Really cool blog post about permissions in browsers and how they ...

2025-02-14T09:46:26Z

Really cool blog post about permissions in browsers and how they work. https://albertofdr.github.io/web-security-class/browser/browser.permissions

Never heard of it. Is it kerberos? an MSFT thing?

2025-02-11T11:06:00Z

In reply to nevent1q…23we
_________________________

Never heard of it. Is it kerberos? an MSFT thing?

Nostr event nevent1qqsqcka6mjqpur0c2rngrs9nknme7wpyscw4w5rps68j7m9r3v4hs0szyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvuw9l3x2

2025-02-11T10:36:21Z

With Same-Site cookies defaulting to lax is CSRF dead? Discuss.

excellent analysis. Fully agree that this attack doesn't ...

2025-01-22T07:54:26Z

In reply to nevent1q…mcrx
_________________________

excellent analysis. Fully agree that this attack doesn't match the average user's threat model and great suggestion that the probe can be eliminated by disabling read notifications. I would add that this is more of a Cloudflare bug. They should fix this.

my own code just never borrows. ...

2025-01-19T13:22:02Z

In reply to nevent1q…re23
_________________________

my own code just never borrows. `Arc<Mutex<Hashmap<_>>>`and `.clone()` like crazy. Totally fine for my private-use web/network applications (e.g. irc bot). I have actually profiled the allocations last holidays and it was so negligible, I will just keep it as is :D

Ah. Looks like I found this is directly serializing classes / ...

2025-01-15T09:31:06Z

In reply to nevent1q…svh5
_________________________

Ah. Looks like I found this is directly serializing classes / types from the piece of software to disk. A bit hard to guess the struct from just the file, but not impossible.

Forensic question as a windows-noob. I am trying to look into an ...

2025-01-15T09:27:15Z

Forensic question as a windows-noob. I am trying to look into an OLE2 "Compound File Binary Format" file. It seems to contain multiple streams that I can enumerate with e.g., https://github.com/microsoft/compoundfilereader but the actual data are so-called "steams" containing raw hex bytes. What exactly is a *stream*? Doesn't look like a file? Are there deeper decodings I should pursue? Is there a list of known serializations for e.g., arrays? I think the database contains sensor data.

Please Boost: To all Hacker Spaces in Berlin. I have a ...

2025-01-03T07:45:44Z

Please Boost: To all Hacker Spaces in Berlin. I have a decommissioned server to give away. So far, I have been unable to find a beneficiary.

**Who wants this server?**
HP ProLiant DL360 Gen9 - 2 CPU E5-2697 v3 @ 2.60GHz, 128 GB DDR4, 2x 900GB SAS.

Pick-up in Berlin Kreuzberg.

Hey y'all, the https://madweb.work/ Program Committee was ...

2024-12-18T08:03:38Z

Hey y'all,

the https://madweb.work/ Program Committee was just announced (featuring yours truly).
Please remember to submit your papers about web security by January 9th 2025. We are interested in research at the junction of web & browser security. More on the website :)

Modest proposal for the season of deadlines and holidays. Can you ...

2024-12-01T09:09:03Z

Modest proposal for the season of deadlines and holidays. Can you please postpone all zero day activities until the second week of 2025? Thank you in advance.

(This is a shit post. No zero day bug was observed. Happy December first, I guess)

I wrote some cool scripts that I want to share with the world but ...

2024-11-23T14:50:59Z

I wrote some cool scripts that I want to share with the world but I do not want to start being in the business of maintaining another open source project. I guess I will just describe it in my blog and tell the world that it's cool and they can use it?

Anyway, I now have an #indieweb #POSSE python script for my homepage.
Whenever I build my blog, it also generates an XML Atom feed (many static site generators do that). After adding an article and building, I can loop ... 1/2

through the machine-generated metadata and look at the titles of ...

2024-11-23T14:50:59Z

In reply to nevent1q…qyk4
_________________________

through the machine-generated metadata and look at the titles of each blog post. For those that are recognized as new (it uses a small ini file for config and caching), then it asks whether to publish to my syndication targets (currently mastodon & bluesky), similar to how `git add -p` would. Simple URL+title as the suggestion but allows to reply with yes/no/edit to improve what is being posted. Source here:

https://github.com/freddyb/homepage/blob/main/rss2posse.py

Nostr event nevent1qqs2xsmr2y7rm4gfac0mqrggy3tdwf2jswyyfqv7xdgs2jrfztu0yeqzyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvuz9ecps

2024-11-22T13:24:12Z

Kudos to the person who registered exmaple.com.

it’s https://www.huntress.com/

2024-11-20T20:26:51Z

In reply to nevent1q…k70q
_________________________

it’s https://www.huntress.com/

Sure this isn't a (misguided, terrible, shouldnt-be-a-thing) ...

2024-11-20T12:27:46Z

In reply to nevent1q…uyf8
_________________________

Sure this isn't a (misguided, terrible, shouldnt-be-a-thing) phishing assessment that someone higher up paid for to fill some sort of checkbox in the hope to "get better at security"? 🙄

I am going to talk at German OWASP Day in Leipzig today and I ...

2024-11-13T09:34:42Z

I am going to talk at German OWASP Day in Leipzig today and I just learned it will be live streamed.

Tune in if you want to learn about cross-site leaks at 5pm CET (9am US Pacific). There's lots of other interesting stuff before me. The event has already started 😊 https://streaming.media.ccc.de/god2024

I love that you all care that much. I think I will stick with ...

2024-11-11T14:01:33Z

In reply to nevent1q…wu23
_________________________

I love that you all care that much. I think I will stick with media queries, which also helps me with another thing I just spotted. I was so close to just giving up 😂 thank you so much 🙏

a couple of versions? 😳. I don’t want to know what that ...

2024-11-11T13:49:09Z

In reply to nevent1q…a8za
_________________________

a couple of versions? 😳. I don’t want to know what that means for security bugs in upstream. Thank you for sharing this.

Where do you see issues with browser support in particular? MDN ...

2024-11-11T09:20:58Z

In reply to nevent1q…2g6s
_________________________

Where do you see issues with browser support in particular? MDN claims that color-scheme is widely available and light-dark() is baseline as of this year https://developer.mozilla.org/en-US/docs/Web/CSS/color_value/light-dark. I hope my users have browsers newer than May 2024 (is that... naive?)

Oh and I also *just* found Sara Joy :happy_pepper: (npub1jpy…yfwv) 's article at https://css-tricks.com/come-to-the-light-dark-side/#aa-what-makes-using-color-scheme-and-light-dark-better-than-using-media-queries which points out that it makes implementing a JS based switcher easier, which is nice :)

On my page, I used a different approach. I define my colors as ...

2024-11-11T09:11:56Z

In reply to nevent1q…khtc
_________________________

On my page, I used a different approach.

I define my colors as #CSS variables like so `:root { --color-text: #000 }` which are then changed with a media query like here
`@media (prefers-color-scheme: dark) { :root { --color-text: #fff } }`.

So, should I change the variables with the media query or set them with `light-dark()` directly in the one `:root` declaration?

What would you do and why? I bet Manuel Matuzović (npub13dm…lj2t) and Christian "Schepp" Schaefer (npub1mgj…c2n2) have thoughts...

Had a great time at #IndieWebCamp Berlin this weekend. Actually ...

2024-11-11T09:11:56Z

Had a great time at #IndieWebCamp Berlin this weekend. Actually spent much more time thinking about dark/light mode than I thought I ever would 😁

I believe I have understood two patterns to do that in #CSS.

Kagami is they/them 🏳️‍⚧️ (npub1ca7…7gzj) demoed their page and is using `html { color-scheme: light dark }` which then allows you to supply colors for links like `a { color: light-dark(darkblue, cyan) }`.

1/2

https://⒕ ₨ is just two glyphs.

2024-11-01T16:02:23Z

In reply to nevent1q…6a5v
_________________________

https://⒕ ₨ is just two glyphs.

Do I know anyone at Malwarebytes who works on ...

2024-10-28T14:45:18Z

Do I know anyone at Malwarebytes who works on "ThreatDown" / "OneView"? Looks like your page is broken in Firefox and we'd like to help :-) #followerpower

I seem to remember the EICAR test string ...

2024-10-27T06:47:12Z

I seem to remember the EICAR test string https://en.wikipedia.org/wiki/EICAR_test_file has been used in DoS attacks. Like, supply the string to a log/database such that it will be corrupted by antivirus. However, I cannot find any direct sources. Who can help?

Mozilla is looking for a Staff Software Engineer (remote US/EU/CA ...

2024-10-09T08:29:24Z

Mozilla is looking for a Staff Software Engineer (remote US/EU/CA ✨) working on sandboxing, hardening, crash-reporting, performance and integration with native widgets **on Linux**. As a staff-level position this will require strong technical and people skills, experience in C++ on Linux or Android. The team is distributed and amazing. Ask me in DM if you have any questions about Mozilla (I am *not* the hiring manager). Please apply at https://grnh.se/2c3dc0111us

We just published v4.1.0 of the eslint plugin `no-unsanitized`, ...

2024-09-02T08:01:38Z

We just published v4.1.0 of the eslint plugin `no-unsanitized`, which prohibits the usafe of XSS sinks (e.g., `innerHTML=` or `setHTMLUnsafe()`) without the use of a preconfigured sanitizer library.
The rule helps finding and preventing XSS in various Mozilla projects, including Firefox.
Technical Details at https://frederikbraun.de/finding-and-fixing-dom-based-xss-with-static-analysis.html and source at https://github.com/mozilla/eslint-plugin-no-unsanitized

Looks like we shipped Firefox 129 last week, where the address ...

2024-08-12T14:09:14Z

Looks like we shipped Firefox 129 last week, where the address bar is defaulting to use HTTPS (and falls back to HTTP if it doesn't work). Kudos to the team for shipping! 😀 It's nice to see something happen so smoothly when on vacation

nah. It’s unfortunately the thing that is holding the band’s ...

2024-08-02T09:56:52Z

In reply to nevent1q…s24x
_________________________

nah. It’s unfortunately the thing that is holding the band’s metal pins which broke off. ☹️

pretty sure the casio expert knows? Paging @npub1080…cr2f :)

2024-08-02T08:55:00Z

In reply to nevent1q…whgz
_________________________

pretty sure the casio expert knows? Paging Kev Quirk (npub1080…cr2f) :)

Wristband connection of my CASIO B640W watch broke. Second watch ...

2024-08-02T08:53:12Z

Wristband connection of my CASIO B640W watch broke. Second watch this is happening :-( is that a typical thing? Don’t want to buy a new watch every other year.

oh. I didn’t look deep enough while on mobile. You’re right. ...

2024-06-27T07:07:38Z

In reply to nevent1q…6wsk
_________________________

oh. I didn’t look deep enough while on mobile. You’re right. The patch is not theirs and it doesn’t show as "user contributed to…" in their profile.

Good. Less of a fraud too then. I was concerned from the "showing as a kernel comitter on their profile will get them a job interview" / "there are lies on your CV" angle.

TIL the commit hash protects the content and not the author , ...

2024-06-27T07:00:17Z

In reply to nevent1q…eakj
_________________________

TIL the commit hash protects the content and not the author , timestamp, email metadata. Neat trick.