Top all-time · #6690
Frederik Braun
Personal blog · frederik-braun.comsecurityprogramming
Frederik Braun's personal blog at frederik-braun.com covers security and programming. Since 2014, 12 different Hacker News readers have linked it 14 times, most often “Firefox gives special permissions to some domains”. It is still writing: the last post was on 2026-05-30, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN commenters cite Frederik Braun's web security posts, including his Subresource Integrity content-addressable storage section and a Service Worker SRI challenge, as background for their own points.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Frederik Braun is a security engineer at Mozilla, working on Firefox security.
Most-linked posts?
- Firefox gives special permissions to some domains2 people · 2 mentions · first linked 2024-02-02
- A CDN that cannot XSS you (2015)2 people · 2 mentions · first linked 2017-11-02
- Remote Code Execution in Firefox beyond Memory Corruptions2 people · 2 mentions · first linked 2019-09-30
What Hacker News says?
The X-XSS-Protection header recommendation is a Zombie recommendation which is at best outdated and at worst harmful. Its origins are based on old IE bugs but it introduces worse issues. IMHO, the best value for X-XSS-Protection is either 0 (disabling it completely like Facebook does) or not providing the value at all and just letting the client browser use its default. Why? First, XSS 'protection' is about to not b…
Comment linking /xssauditor-bad.html
on “HTTP Security Headers – A Complete Guide”Submitted Remote Code Execution in Firefox beyond Memory Corruptions as a story · 106 points
HN discussionWe've been toying with this idea in earlier revisions of the spec, basically using the hash as a cache key and not loading the same file from websiteB if it has already been loaded form websiteA. Unfortunately, this could be used as a cache poisoning attack to bypass Content Security Policy. See the section about "Content addressable storage" at < https://frederik-braun.com/subresource-integrity.html >. (If you can…
Comment linking /subresource-integrity.html
on “Do not let your CDN betray you: Use Subresource Integrity”Submitted Thoughts on Tor appliances as a story · 58 points
HN discussionService Workers can be used to increase security as well, though. You can use it to intercept and check requests and responses against any criteria you like. You can reimplement (variations on) CSP or SRI in them [1], or implement signed web apps [2]. There are probably other possibilities. [1]: https://frederik-braun.com/sw-sri-challenge.html [2]: http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Ap...
Comment linking /sw-sri-challenge.html
on “The Tangled Web: A Guide to Securing Modern Web Applications (2011)”Submitted Firefox gives special permissions to some domains as a story · 3 points
HN discussionThe old Opera had an excellent integration with its M2 email client. There's also Seamonkey. Most email programs use a built-in rendering engine anyway, and sometimes browsers can actually use the email code (e.g. MHTML is basically MIME+HTML, HTML sanitization[0], Opera used M2 for RSS support). So a browser having a built-in email client might be undesirable, but it is not "insane". [0] https://frederik-braun.com/…
Comment linking /firefox-ui-xss-leading-to-rce.html
on “Mastodon 3.0”Submitted Firefox gives special permissions to some domains as a story · 2 points
HN discussionSubmitted A CDN that cannot XSS you (2015) as a story · 2 points
HN discussionSubmitted Origins, Sites and Other Terminologies as a story · 1 points
HN discussionSubmitted Understanding Web Security Checks in Firefox as a story · 1 points
HN discussionSubmitted A CDN That Can Not XSS You: Using Subresource Integrity as a story · 1 points
HN discussionSubmitted X-Frame-Options: All about Clickjacking? (2013?) [pdf] as a story · 1 points
HN discussionSubmitted FirefoxOS 2.1 will have the ability to revoke granular app permissions as a story · 1 points
HN discussion
