Security
summary
A live demo shows a TweetDeck XSS caused by emoji parsing that used innerHTML to reintroduce unescaped script and a WordPress comment proves javascript: links still enable XSS, so Content Security Policy with nonces blocks the exact inline exploit in the demo. A free CA called Let's Encrypt launches an automated ACME flow on Sept 14 to issue and auto‑renew certificates. Publishers report ~500 items/day with ~40% containing third‑party scripts and ad networks like DoubleClick serve ~30% of ads. Known attacks like POODLE, FREAK and Logjam push work on TLS 1.3 and HSTS preload adoption.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:34How Do People Attack Websites
- 2:17Code Injection
- 4:47Content Security Policy
- 7:13Prevent Man-in-the-Middle Attacks Https
- 10:14Miscellaneous Topics
