entuno

If that'd been the design from the start, then sure. But it's not at all obvious that setHTML is safe with arbitrary user input (for a given value of "safe") and innerHTML is dangerous.

It's certainly an improvement over people trying to homebrew their own sanitisers. But that distinction of being XSS-safe is a potentially subtle one, and could end up being dangerous if people don't carefully consider whether XSS-safe is good enough when they're handling arbitrary users input like that.

This kind of thing always makes me nervous, because you end with a mix of methods where you can (supposedly) pass arbitrary user input to them and they'll safely handle it, and methods where you can't do that without introducing vulnerabilities - but it's not at all clear which is which from the names. Ideally you design that in from the state, so any dangerous functions are very clearly dangerous from the name. But you can't easily do that down the line.

I'm also rather sceptical of things that "sanitise" HTML, both because there's a long history of them having holes, and because it's not immediately clear what that means, and what exactly is considered "safe".

And that it took this long to get an answer to that question.

"Critical security fixes may be evaluated on a case-by-case basis" didn't exactly give much confidence that they'd even be doing that.

And hopefully they're the same four same bullet points..

I've argued for a long time that adblocking isn't just a quality of life thing, it's an essential security control for browsing the Internet in the same way that patching your system and running malware protection is. I didn't expect it to be protecting your physical security quite so soon..

This sort of thing should also help put the "adblocking is unethical" argument to bed.

Also depends on the size of your fuel tank and how full it already is. The time taken to refuel is (almost) the same regardless, but if you've got a 40l fuel tank vs a 70l one or you're only half-empty then it's going to be less worthwhile.

7p cheaper for 10 minutes works out at about minimum wage if you're buying 30 litres, but with a bigger car you could easily be buying twice that, which works out much better.

Although of course you also need to factor in how much fuel you burn driving to the cheaper place, and the extra wear and depreciation on the car. If you take the HMRC standard rate of 45p/mile (which was meant to cover all of that kind of thing, but hasn't been updated for years) then even going a few miles out of your way quickly ends up costing more than it's likely to save.

Set's an good precedent for places that offer electric charging having to do the same thing in future though.

I almost never go out of my way for fuel, because as you say, it's rarely worth it once you factor in your time (never mind the fuel spent).

But it's still useful to know about price variation so that you can plan ahead. I regularly drive past several different petrol stations, and if I know that one of them is usually cheaper or usually more expensive then I choose to use or avoid it, or to decide that I'll fill up tomorrow when I'm going that way rather than today at a more expensive one.

And that'd be more useful built into satnav, so that if I know I have to fill up somewhere along my route then I can pick the cheapest place, since there's no real time cost to any of the options compared to each other.

The variation in even a couple of miles can be pretty big. I almost never go out of my way to visit a cheaper petrol station because that's usually a false economy, but there are definitely some local places that I favour or avoid because they're almost always cheaper/more expensive than the surrounding ones.

The Teams Android app just asked for location permission today for me for the first time. And got denied.

I wondered why the Teams Android app suddenly decided to ask for location permissions today.

Denied.

Yes, they did.

> Eight titles were excluded from the analysis due to them being either shorter than the other full-length novels (Eric, 1990; The Last Hero, 2001), or because they are part of his titles for younger readers (The Amazing Maurice and His Educated Rodents, 2001; The Wee Free Men, 2003; A Hat Full of Sky, 2004; Wintersmith, 2006; I Shall Wear Midnight, 2010; The Shepherds Crown, 2015).

Is there actually any difference? I'd have though that the self-driving car would need to be insured to be allowed on the road, so in both cases you're going up against the insurance company rather than the actual owner.

Not having to setup and maintain your own self hosted platform. And it also makes it easier to share with specific individuals if you want to.

Trust is a about the author, not the code.

Open source is a bare minimum, although even that's not worth as much given how much harder it is now to load extensions that you've compiled yourself.

But those features you're talking about sound like they need extensive privileges within the browser. And while your extension might do what it says today, what's stopping you sticking a load of malware and adverts in there tomorrow? Or selling it to someone else who does?

If the author is an established person whose been known for years to develop good quality extensions and not sell out, then that gives some assurance. If it's an organisation like the EFF, even better?

But a random anonymous person making their first extension? No chance.

There are plenty of places you can sell exploits other than OCGs. At the more legitimate end of that market is people like ZDI who will then collaborate with the vendors (after a time), or companies making exploit kits/tooling for pentesters/red teaming. More questionable ones are companies that make things like forensics tools or spyware who are legal, but perhaps ethically dubious. All completely legal, but not great for the wider community if they're getting the vulns rather than the developers.

If you're trying to protect your own website and servers, those markets won't be a concern for you. If you ship a widely used product that's an attractive target (like web browser, mobile device, network kit, etc) then they definitely are.

I remember seeing a prank program years ago that showed the SETI@home screensaver for a bit, then popped up an alert box saying "Alien Life Found!" with options to submit or cancel(!).

If you tried to submit it would spend a while with a really slow progress bar, and then say it failed to submit and asked you to contact SETI directly. I wonder if anyone actually did....

Vulnerability disclosure is general is just miserable. Before all the bug bounty issues it was pretty common to:

* Spend ages trying to find someone to submit a report to.

* Waste a whole load of time fighting through the generic contact and support desks to try and get your report to someone who understood it.

* Get completely ignored by the developers.

* Spend time reporting a bug only for them to silently fix it without even bothering to respond to you, let alone acknowledge you.

* Get legal threats for making a good-faith bug report, even if you found it in an locally deployed instance of the software.

* Get called a black hat and more legal threats when you give up and just go down the full disclosure route.

There's also the issue of what happens to my money as a researcher. Is it paid to the company, or is someone holding it in escrow? What if it takes the developer months to respond, or they never do? Do they just get to keep my money indefinitely? What if the vendor pulls out of the scheme? What if I do a chargeback on the payment I made? Etc, etc

I wonder if a better model would be to make the platform pay to entry, but not the specific bugs? So you have to pay a fee to gain access to a platform like HackerOne, and if your signal:noise ratio gets too bad then your account gets revoked? That would make it feel like less of a gamble than having to pay for every individual bug - but still has the same problem that it's putting a big barrier in front of legitimate good-faith researchers.

A problem with this approach is that one of the key functions of a bug bounty program is to encourage people to report vulnerabilities to the developers, rather than selling them elsewhere.

If I have to pay money to submit a vulnerability to the developers with no guarantee that I'll even get refunded for a high quality and good faith report, let alone any actual payout, there's much less incentive for me to do so compared to selling them to someone else who won't charge me money for the privilege.

Does NPM require MFA to be used?

If so I could understand this (although there are certainly arguments to have had about it). But if they allow accounts without MFA then this would seem counterproductive, because while TOTP has issues it's a lot better than nothing.

Does this same argument not apply to other areas of music though? By that line of reasoning, should sites not also have to declare whether they used synthesisers rather than real instruments, or autotune for vocals, or all kinds of other things like that so that the listeners can make informed decisions?

I've seen several places that have a note printed on their menus offering a discount for a positive review.

The interesting question would be how many products came in lower, but sadly the article doesn't include that.

If 23% were higher and 23% were lower then you could make a reasonable argument that it's just incompetence from the store.

But if 23% are higher and none are lower, then that looks a lot more like malice - because the odds of you happening to have a 23% error rate than just happens to always work out in the retailer's favour are basically zero.

Yeah, they didn't really think through the fact they're publishing big lists of sites without effective age verification in all the investigation notices on their website..

> It's just hard to justify engaging. Worst case, I get a fight on my hands with someone who's as dogmatic as they are wrong, which is both frequent and also a complete waste of my time.

The three mindset changes I found that really help with this are understanding that:

* You don't have to try and get the last word in.

* Other people are not entitled to your time, especially if they're engaging in bad faith.

* Outside of small and curated communities, there's pretty good odds that you're not interacting with a real and honest person.

So whenever I click into the comment box, I always ask myself "Can I really be bothered with this? Is this really what I want to be spending my free time doing?"

And then I often close the comment box and get on with my life.

The simple solution is that whenever you start to write a comment, ask yourself: do I want to have a discussion about this?

If the answer is "yes", then make your comment, check back and interact with the responses (assuming they seem to be in good faith). If it's "no" then just close the comment box and get on with your life.

But then I realise that it's fairly pointless writing this in the first place...

Many blogs support RSS (even if they don't link to it - check the page source), so that's usually the best way to do it.

There are lots of different RSS readers out there depending on whether you want a web based or local one. Personally I use Thunderbird.