GitHub's post-CSP journey
EngineeringSecurityGitHub’s post-CSP journeyLast year we shared some details on GitHub's CSP journey. A journey was a good way to describe it, as our usage of Content Security Policy (CSP) significantly changed from… Last year we shared some details on GitHub’s CSP journey. A journey was a good way to describe it, as our usage of Content Security Policy (CSP) significantly changed from our initial
GitHub's CSP journey
EngineeringSecurityGitHub’s CSP journeyWe shipped subresource integrity a few months back to reduce the risk of a compromised CDN serving malicious JavaScript. That is a big win, but does not address related content… We shipped subresource integrity a few months back to reduce the risk of a compromised CDN serving malicious JavaScript. That is a big win, but does not address related content inject
X-Content-Type-Options: nosniff の効果
Heads up: nosniff header support coming to Chrome and Firefox https://github.com/blog/1482-heads-up-nosniff-header-support-coming-to-chrome-and-firefox ChromeとFirefoxでnosniffってどういうことなんだろうと思って少し調べた。 IE8から、X-Content-Type-Options: nosniff があった場合は、ファイルの中身を自動判別する機能が無効になる。htmlじゃないものが自動判別でhtmlだと誤判別されて表示されることで起こるXSSを防ぐことができる。 Internet Explorer 8 のセキュリティ Part VI: Beta 2 の更新項目 http://msdn.microsoft.com/ja-j
Heads up: nosniff header support coming to Chrome and Firefox
EngineeringHeads up: nosniff header support coming to Chrome and FirefoxBoth GitHub and Gist offer ways to view "raw" versions of user content. Instead of viewing files in the visual context of the website, the user can see the actual… Both GitHub and Gist offer ways to view “raw” versions of user content. Instead of viewing files in the visual context of the website, the user can see the actual t
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
