The Line of Death
When building applications that display untrusted content, security designers have a major problem— if an attacker has full control of a block of pixels, he can make those pixels look like anything…
ericlaw talks about security, the web, and software in general
Visit textslashplain.com → RSS feedOn Hacker News Dec 2015 – Aug 2026
Web & Frontend 5Security & Privacy 5Systems & Performance 2Software Engineering 1Networking & Internet 1History & Retro Computing 1
When building applications that display untrusted content, security designers have a major problem— if an attacker has full control of a block of pixels, he can make those pixels look like anything…
In the late 1990s, the Windows Shell and Internet Explorer teams introduced a bunch of brilliant and intricate designs that allowed extension of the shell and the browser to handle scenarios beyond…
When I launched Chrome on Thursday, I saw something unexpected: While most users probably would have no idea what to make of this, I happened to know what it means– Chrome is warning me that …
Prelude In late 2004, I was the Program Manager for Microsoft’s clipart website, delivering a million pieces of clipart to Microsoft Office customers every day. It was great fun. But there wa…
The folks that build the NSIS Installer have released updates to mitigate a serious security bug related to DLL loading. (v2.5 and v3.0b3 include the fixes). To make a long and complicate…
It started innocently enough. I saw a tweet about a new product offering from one of my favorite companies, Cloudflare. Neat! I clicked through to the site and there it is: And huzzah!, my preferre…
It’s an interesting time. Microsoft now maintains three different web browsers: Internet Explorer 11Microsoft Edge Legacy (Spartan, v18 and below)Chromium-based Microsoft Edge (v79+) If you&#…
One unfortunate (albeit entirely predictable) consequence of making HTTPS certificates “fast, open, automated, and free” is that both good guys and bad guys alike will take advantage of the offer a…