Topics /
The most popular blog posts about web & frontend on Hacker News. 8,469 posts.
Recently, I was performing a research on Same Origin Policy attacks, I managed to realize that the la version of Firefox (currently 67) is vulnerable to local files theft attack (on any supported OS), due to improper implementation of Same Origin Policy for file scheme URIs. Let’s go over the PoC details then I will…
Native-like Navigation for Web apps
Previous: I'm Briefly Discussing President Obama's Reported Internet Wiretapping Proposal Tonight on "Coast to Coast AM" Radio
A dns-prefetch tag in an HTML email makes Evolution Mail do a DNS lookup on open, even with remote content blocked. The developers blame WebKitGTK.
We’ve written quite a bit in the past about our approach to building hybrid mobile apps. Basecamp 3 represents the latest generation of this architecture, taking everything we’ve learned from previ…
Posted by Natalia Bidart on Oct. 22, 2025
Welcome to the Internet! By following the simple rules below, you make sure your internet experience is smooth and risk free.
On the need for a simpler, smaller internet to stand out from the crowd, meet interesting people, and build a calmer business.
We’re pleased to announce that Safari 11.1 on macOS and Safari on iOS 11.3 now support the W3C Payment Request API for conducting Apple Pay transactions on the web.
Deno 1.31 adds support for package.json, stabilizes Node-API, Deno.Command API, adds `node:v8` module, and more.
Brave has identified a new category of tracking vulnerability, forms of which are present in all browsers. We call this category of attack “pool-party” attacks because the attack uses collections (or “pools”) of limited-but-shared resources to create side channels.
The recent Firefox attacks are an example of active in-the-wild exploitation of a serious software vulnerability.
We want to remove CAPTCHAs completely. The idea is rather simple: a real human should be able to touch or look at their device to prove they are human, without revealing their identity. Let's explore!
As SPDY works its way through IETF ratification I began wondering whether it was really necessary to add a complex, binary protocol to th...
Have a look at this URL linking to this post: https://kaspars.net/blog/invisible-click-tracking Notice any tracking variables? Me neither! But check out the HTTP request and response in the network inspector of your browser -- it is redirecting to the "same" URL: URL encoded special characters in the browser console…
An Unexpected Consequence of a Bad Header
This is a set of apps which creates the same application in various Python web micro-frameworks.
New Twitter uses a massive amount of javascript (for a webapp). Nearly 1 Megabyte of minified, obfuscated javascript powers the site's frontend.
There are ways that your software as a service web application can make more money today. They aren’t complicated or revolutionary, but instead are practical ideas that you should consider implementing right now. Before we jump in you should take a moment to check out my latest book on designing web applications. It…
A short list of common mistakes in Python web applications in terms of security and architecture.
