Conversation

When you're reading articles and papers about interesting attacks, it's helpful to remember that there are very concrete things you can do to protect your web applications from side-channels: w3c.github.io/webappsec-post lays out effective mitigation strategies. Try them out!
Quote Tweet
New CPU side-channel attack named Spook.js takes aim at Chrome’s Site Isolation feature therecord.media/new-cpu-side-c
Show this thread
Image
2
49
Replying to and
I practically tried to deploy these on my very simple private webpage and stumbled upon several bugs in firefox that I was surprised weren't really prioritized. As long as this breaks things people won't deploy.
1
3
Replying to and
Thunderbird issue is definitely a bug. However, there's not much loss from Cross-Origin-Resource-Policy: cross-origin for completely static assets. It's needed to permit image hotlinking which is unfortunately broadly used for favicon, open graph images, etc. despite being gross.
2
Can see various notes in github.com/GrapheneOS/gra about where we had to enable cross-enable CORP. Mostly need it for image hotlinking for images with a stable URL but there was also a terrible Chromium PDF viewer bug which they worked around by disabling range-based loading.
1