leenify

10 ms·

1.
by leenify 11mo ago
As the stuff is rendered on the front-end how do you deal with tags where you do not even have the information to decide how they shall be parsed on the server? This seems rather ignorant and, in my experience, leads to security issues, suc
2.
by leenify 11mo ago
Thank you for the effort to bring this to life together with Freddy!
3.
by leenify 11mo ago
Are you certain that this is secure? What about parsing depth/DOM clobbering, etc? See https://mizu.re/post/exploring-the-dompurify-library-bypasse... for an example of why this is really hard. Please do not roll
4.
by leenify 1y ago
I'm somewhat uncertain personally about the future of Mozilla myself, as well as compatibility issues and a lack of mindshare. Also, I feel working with the Chromium codebase is easier if you only apply superficial changes, e.g., the l
5.
by leenify 1y ago
> The real problems with Gecko is just that it’s harder to fork That goes contrary to my experience. I'm a maintainer of a Firefox fork (with rather extensive changes to a lot of the internals), and it is pretty manageable to mainta
6.
by leenify 1y ago
Hmm, is that really true? I spoke at BH last year and was not required to submit a paper. And based on the briefings link, there surely isn't a paper link, only slides and tool.
7.
by leenify 1y ago
That can work, but it can also bring quite a few issues. Mozilla effectively does this; their build process downloads the build toolchain, including a specific clang version, during bootstrap, i.e., setting up the build environment. This is