Hadyn Cotton

Web application security, performance, and development topics. Opinions are my own.

[Hadyn Cotton @hadyncotton]

https://t.co/YsE7UDC8A0 An in-depth solar-powered website experiment, courtesy @lowtechmagazine, that brings you back to the web of yesteryear where content is prioritized over all else. Watch that battery meter!

[Timothy De Block @TimothyDeBlock]

Pro tip for those in a junior IT position: Have a notepad and pen ready for notes during meetings and when someone is showing you how to do something.

[Hadyn Cotton @hadyncotton]

https://t.co/iyAoaRwmtU has been invaluable for highlighting the kinds of issues that UselessCSP points out.

[Hadyn Cotton @hadyncotton]

I'm torn on https://t.co/N9jBId0PZT. The good: As advertised it calls out directives in the wild such as 'https://*'. The bad: CSP isn't as simple as "it's either secure or it's not". The range of their usefulness runs the gamut but clearly 'unsafe-inline' is a problem for many.

[Hadyn Cotton @hadyncotton]

An interesting look at the HTML <embed> element, what JS you can get browsers to execute based on varying values of its 'type' attribute, and the security implications of that.

[Daniel Harper @djhworld]

I wrote a thing about the time I thought I found a browser security bug https://t.co/JkdfbSnfDT

[Sean Wright @SeanWrightSec]

Hey kids guess what tomorrow is? Yes that's right, the day when Chrome 68 is released! Why is that important you ask? Well all HTTP sites will be marked as "Not Secure".

[Mariko Kosaka @kosamari]

HTTP what? : I drew what HTTP is & how HTTP1.x and HTTP2 are different✨

(tweetzine, drawsplainer, codedoodles…I don't know what to call it)

[Jake Archibald @jaffathecake]

HTTPS = "Is the response untampered & from the expected sender?"

CORS = "Can I access the content of this resource?"

CSP = "Only allow requests that look like this…"

SRI = "Only allow content that looks like this…"

CORB = "Don't allow my data into another origin's process"

[Marcel Freinbichler @fr3ino]

Because of #GDPR, USA Today decided to run a separate version of their website for EU users, which has all the tracking scripts and ads removed. The site seemed very fast, so I did a performance audit. How fast the internet could be without all the junk! 🙄
5.2MB → 500KB

[Hadyn Cotton @hadyncotton]

My go-tos for confirming that TLSv1.0 has truly been disabled on sites:
Firefox: about:config -> security.tls.version.max -> 1
Curl: curl --tlsv1.0 https://t.co/oi6xVTaccp

[Hadyn Cotton @hadyncotton]

This is a really well written look into the history of CORS that covers the details and reasoning behind preflighting requests. Not to spoil the ending, but in the final scene the response to the preflight request gets cached by yet-another Access-Control header. https://t.co/vmORR6XTah

[Ryan Miller @ryanmillerdev]

A quick primer on CORS and how it's actually doing you a huge favor: https://t.co/AhT8fGevgM

[Justin Searls @searls]

It's hard to express just _how useful_ Mozilla's technical documentation about web technology concepts has gotten. Kudos to all my friends at Mozilla putting in the mostly thankless work to make new CSS and JavaScript concepts easily learnable with a Google search.

[Brad Frost @brad_frost]

I wonder how many JS libraries would have never been born if we had the ability to properly style <select> and <input type="checkbox" />?

[Jake Archibald @jaffathecake]

30 minutes ago I got curious… what do browsers do when downloading a gzip-encoded resource? Do they report the size of the data being written to disk, or bytes down the wire?

So I created a 100mb text file that gzips down to ~100k and throttled the server…

[Geoffrey Thomas @geofft]

We've gotten so bad at handling captive portals, my hotel is telling me to visit an unrelated mattress startup to use the wifi.

[Hadyn Cotton @hadyncotton]

@pedrofortuna Hah, and that may only be a matter of time! This is a topic that doesn’t get the attention I think it deserves but your presentation handed out valuable insights into the power extensions are given, so thank you.

[Hadyn Cotton @hadyncotton]

The elephant in the room of Man-in-the-Browser attacks are extensions, which receive little review and are generally granted complete control on all sites. Beyond [obviously] having full control of the DOM, extensions can override or remove HTTP headers including CSP (by design).

[Sherif Mansour @[email protected] @Kerberosmansour]

Happy to see this banner on a website. If the rest of the internet pulls this off by the end of June we will step into a generation which the majority of browsers have silent updates, and thus faster rollout of new tech such as tls1.3 many thanks @JeremyKingPCI