Top all-time · #5133
the world. according to koto
Personal blog · blog.kotowicz.netsecurityweb
the world. according to koto is a personal blog at blog.kotowicz.net about security and web. Since 2009, 15 different Hacker News readers have linked it 15 times, most often “Stripping HTTP referrer for client-side CSRF”. The last post was in 2016, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for web security writing: CSRF, stripping the Referer header, WebSockets security, and browser extension (Firefox add-on) changes. Commenters cite it as support for their own points.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
A blog on security, malware, cryptography, pentesting, javascript, php and whatnots
Most-linked posts?
- Stripping HTTP referrer for client-side CSRF2 people · 2 mentions · first linked 2011-10-24
- Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites2 people · 2 mentions · first linked 2013-07-12
What Hacker News says?
It's not entirely clear to me from the post whether the reason for changing the add-on API is to get rid of XUL/XPCOM (which was inevitable) or to limit what extensions can do for security reasons and/or to make AMO reviews easier. If it's really just about XUL/XPCOM, there are promises you (by which I mean Mozilla) could do to make developers happier: 1) That you'll figure out what will replace XUL/XPCOM in Firefox…
Comment linking /2013/07/jealous-of-prism-use-amazon-1-button.html.
on “The likely end of DownThemAll”Submitted Use "Amazon 1 Button" Chrome extension to sniff all HTTPS websites as a story · 516 points
HN discussionExcept an attacker can strip a referer header: if you fail open like that, you leave yourself open to attack. See http://blog.kotowicz.net/2011/10/stripping-referrer-for-fun-... for examples
Comment linking /2011/10/stripping-referrer-for-fun-and-profit.html
on “#1 CSRF Is A Vulnerability In All Browsers”Submitted Chrome addons hacking: Bye Bye AdBlock filters as a story · 137 points
HN discussionI agree, security in Web Socket must be robust/comprehensive in both ends. This post says so too: http://blog.kotowicz.net/2011/03/html5-websockets-security-n... . Thanks!
Comment linking /2011/03/html5-websockets-security-new-tool-for.html
on “An Introduction to Web Sockets”Submitted XSS in Gmail through Rapportive as a story · 110 points
HN discussionSubmitted “Amazon 1 Button” Chrome extension to sniff all your websites (2013) as a story · 14 points
HN discussionSubmitted Who's behind Facebook clickjacking scams? as a story · 5 points
HN discussionSubmitted Cross-domain 'content extraction' using fake captcha and iframe as a story · 3 points
HN discussionSubmitted XSS-Track: Hijacking a whole website with a single XSS vulnerability. as a story · 2 points
HN discussionSubmitted The sad state of DOM security (or how we all ruled Mario's challenge) (2011) as a story · 1 points
HN discussionSubmitted Stripping HTTP referrer for client-side CSRF as a story · 1 points
HN discussionSubmitted How to upload arbitrary file contents cross-domain as a story · 1 points
HN discussionSubmitted Analysis of New Generation Facebook Worm as a story · 1 points
HN discussionSubmitted 5 ways to prevent clickjacking on your website (and why they suck) as a story · 1 points
HN discussion
