Mike West
@mikewest
Followers
6K
Following
2K
Media
176
Statuses
15K
@[email protected] - Making the web marginally less insecure, one deprecation at a time. I work on Chrome, but my tweets are my own, etc, etc. He/him.
München, DE
Joined December 2006
We've improved our implementation of this feature, and are trying preflights again in Chrome 102 (which started rolling out yesterday). With luck, servers will be a little more tolerant of OPTIONS requests then they were the first time around... :)
FYI: Your intranet services will likely receive new OPTIONS requests with `Access-Control-Request-Private-Network` headers as Chrome 98 rolls out. We're experimenting with preflights for requests initiated outside of your local network as part of https://t.co/BbwEC1SRgK. (1/3)
1
7
12
#SecWeb on May 25 (co-located with S&P) has an exciting keynote speaker lineup with @arturjanc and Yinzhi Cao. Need a reason to go? Submit your papers until Feb 24 (see https://t.co/EgfQKh4iXR)!
0
3
8
We're about two weeks out from the next WebAppSec WG call, which means it's a good time to start pulling an agenda together. If you have thoughts on topics we ought to be paying attention to, https://t.co/ki6wg7Qv2i would be a great place to note them.
github.com
We ended up skipping the 2023-02-15 call due to lack of availability, and will pick back up on 2023-03-15 with the following sketch of an agenda: Deprecations and defaults: @johnwilander's link...
0
0
7
Some clever folks will get together in Munich (and beyond) this December to talk about this problem space at a W3C workshop on permissions. You're cordially invited to join that conversation, and submit a (very short!) position paper:
1
0
6
The web's permission prompts are the least we can possibly do to mediate the conversation about sites' capability between developers and users. They're necessary today, but they're not great: we can clearly do better. https://t.co/oYK01W8Wq8
2
5
11
An interesting info leak that (among other things) shows why using cookie name prefixes (`__Secure-` and `__Host-`) continue to be a solid recommendation.
0
1
8
This is going to be depressing, isn't it?
🔥 Announcing 👊Day 2 Keynote 😎 Dr. Mario Heiderich @cure53berlin 💡 Dr. Mario will fly in 🛸 a Time Machine to look at #WebSecurity 20 Years back to see if we are sitting on same web #security #vulnerabilities ⭐Checkout the title➡️ https://t.co/LpL9D2MfOb
#NullconGoa2022
0
0
7
"Burritos > Banks" shall henceforth be the canonical response whenever someone says "bank-grade security" un-ironically.
0
7
14
Hey folks! If you don’t know me, I’m the CISO of @Twitter – I run the information security, privacy engineering, and IT teams. We’ve got a bunch of roles open across infosec, privacy eng + legal, and IT. Come help Twitter build great things which respect our users! 🧵
193
1K
4K
That said, my most important takeaway from the podcast is that I should probably start pronouncing "nonce" as "N once".
1
0
7
This is a fantastic technical description of passkeys. @agl__ is an excellent communicator.
@EllipticKiwi Oh ha here's the link to Passkeys until your favorite podcast app updates: https://t.co/OStLSmhUSa
1
4
13
New V8 Sandbox design document on how to sandboxify pointers to objects outside the sandbox such as DOM nodes ("external pointers"):
docs.google.com
V8 Sandbox - External Pointer Sandboxing Author: saelo@ First Published: July 2022 Last Updated: July 2022 Status: Living Doc Visibility: PUBLIC This document is part of the V8 Sandbox Project and...
0
51
164
@JanesDueProcess @PPGreaterTX @Plancpills (I might or might not have made these donation in honor of Samuel Alito.)
0
0
2
Today, I donated to @JanesDueProcess, @PPGreaterTX, and @Plancpills. It feels like something, though it's clearly not enough.
1
0
4
The news coming out of the United States is horrific. My heart goes out to the millions of American women who are now set to lose their legal right to an abortion. I can’t imagine the fear and anger you are feeling right now.
19K
30K
226K
Just in case you (like I!) briefly worried that the CSSWG had snuck script execution in while no one was looking, they didn't. This is a misleading demo that jams the parsing/binding into <head> rather than showing it in the JS section of the codepen: https://t.co/PiBH0HGkhp.
Don’t forget to play with your code. Don’t forget to do weird stuff in CSS. This is genuine code written in CSS. Change the code or the selector. And don’t forget to play with your code. https://t.co/plpnhu0ZHv
1
0
10
If you're looking for more information about what this might mean for you and your servers, the spec lives at https://t.co/BbwEC1SRgK, and https://t.co/IpGMcaVBHC provides an excellent introduction.
0
4
6