I don't know who needs a kitty headbutt right now, but here's one for you

Firefox nightly introduces the setHTML() method. Which is like a native DOMPurify. You can easily test it here: portswigger-labs.net/mxss/ Set HTMLSanitizer ✅ Auto update ✅ I'm trying to break it, I encourage you to break it too

Hej! We are thrilled to announce Hack.lu CTF 2025 starts on Friday, October 17. Top teams can win prizes from our sponsors: OffensiveCon, Zellic, PortSwigger, Binary Ninja, and HackTheBox. All information on flu.xxx

I'm in a phenomenal talk on gender inequality in cybersecurity this morrning and this is such a great cheat sheet for intersectional fair employment.

firefox container tabs are lowkey goated when $11/year VPS in dublin w/ socks5 over ssh is the vibe

Wait, container tabs support individual proxy settings?

We just opened the Call-for-Papers for the German OWASP Day 2025. The event will be held November 25th-26th in Düsseldorf. god.owasp.de/2025/cfp.html We're looking for all sorts of presentations about web security and beyond for an audience of builders, breakers and defenders.

cut my heap into pieces, this is my crash report: allocation, no alignment don't give a fuck if it faults on assignment this is fatal abort()

CUT MY LIST IN TWO PIECES THAT’S HOW YOU START QUICKSORT

end of an era 💔 blog.glitch.com/post/changes... I know Glitch is working on project export but if you're git-capable, I built a tool that will mass-git-clone your public glitch projects: github.com/potch/glitch...

Uh, pwn2own was...today? And we're shipping a bugfix release also today? Cool. Update your Firefoxes, please :D blog.mozilla.org/security/202...

We just published @firefox.com updates to fix the exploits used at the Pwn2Own contest yesterday and today. Both contestants achieved RCE in our content process but did not escape the sandbox. blog.mozilla.org/security/202...

We have an initial plan for talks and breakout sessions at the Web Engines Hackfest 2025: github.com/Igalia/weben... • Monday: 9 talks and the W3C Web Apps WG F2F • Tuesday & Wednesday: 23 breakout sessions in 3 parallel tracks There might be still small changes, but it gives a good overall picture.

I made this diagram for a talk on encrypted messaging I recently gave, and I didn’t get to use it in the talk. I figured I’d share it here because I think it tells a story.

New blog post: With Carrots & Sticks - Can the browser handle web security? https://frederikbraun.de/madweb-keynote-2025.html - This is the blog version of my keynote from MADWeb 2025 earlier this year. It's about how web security could become the browser's responsibility.

Blog post about the road to HTTPS-First in Firefox. Early reports show an uptick in encrypted traffic by at least 1.5% for our global users. 😎 attackanddefense.dev/2025/03/31/h...

Based on the traffic I see - Mastodon is number 1, then LinkedIn, then Reddit, then Microsoft Teams, then Google, then BlueSky, then Twitter.

Firefox 136 was just released. As of now, Firefox will open all pages using 🔒https, if possible. If the connection does not succeed (port closed, certificate untrusted etc), the browser will automatically switch back to http.

They need him to be a genius because they cannot handle what it means for them to be tricked by a fool.

We're in the consumer HTTPS endgame. We need to finish the job so I can be certain all my mobile traffic is protected. Please join me in asking the OS and browser makers to keep pushing and to finish the job in 2025, perhaps by Halloween! 👻 🔐 https://buff.ly/41qPpUM

#FUZZING'25 CALL FOR PAPERS ────── ✨ New OC members: * Ruijie Meng (@ruijiemeng.bsky.social; NUS) * Rohan Padhye (@rohan.padhye.org; CMU). ✨ New paper type: Fuzzing Nuggets (short papers). 🔗 fuzzingworkshop.github.io 📅 20.March (Submission) 📅 17.April (Notification) 📅 28.June (Workshop)

@boblord.bsky.social Did you stop looking at your account on infosec.exchange? I (finally) have a paper for you to preview, if you can tell me your primary email address.

I posted a blog about how browser permissions work. albertofdr.github.io/web-security...

An updated to the Firefox Bug Bounty Hall of Fame for Q4 of 2024 just dropped. Thank you to the many folks who helped keep Firefox secure! 🏆👏 www.mozilla.org/en-US/securi...

Gecko: Intent to ship: HTTPS-First / HTTPS Upgrades

This is your reminder that the HTML specification features the picture of a kitchen sink.

On this day 12 years ago, @kcg.bsky.social posted the “This is Fine” comic.

Given that simps0n isn’t on Bluesky, allow me to post a link to his excellent weekly ezine 💎 Here’s today’s edition, "AppSec Ezine - 568th" 📚 pathonproject.com/zb/?47a5c4d2...

Happy new year to you all :)

Kids these days don't even know how much opportunity they have to learn hacking from actual pros. I know there is a lot of content out there, so it can be hard to find the good stuff. But 10 years ago you had to be lucky to find at least something. Anyway, watch this 👇

VPN vendors have huge budgets to advertise on your favorite podcasts. We don't have marketing for the IETF, browser and OS security teams, CAs (Let's Encrypt), CDNs, researchers, open source authors, website builders, digital rights activists... We made the web secure and didn't tell anyone.

I have discount codes for *annuals plans* of Mozilla VPN, Firefox Relay Premium Email Masking and Monitor Plus (US only). Message me in private. Happy to hook you up, if we know each other :) #ad

Hey y'all, the madweb.work Program Committee was just announced (featuring yours truly). Please remember to submit your papers about web security by January 9th 2025. We are interested in research at the junction of web & browser security. More on the website :)

Hey followers. I'll be at #38C3 and am happy to talk about browser/web security with strangers :) Find me IRL by looking for the Firefox hoodie/backpack or ping me here.

Imagine opening a Discord message and suddenly your computer is hacked. We discovered a bug that made this possible and earned a $5,000 bounty for it. Here's the story and a beginner-friendly deep dive into V8 exploit development. watch: youtu.be/R3SE4VKj678?...

Home Assistant can not be secured for internet access (frederikbraun.de/home-assista...): Home automation is a cool toy but also allows my house hold to be more energy efficient: My aim was to configure my home's heating to switch off when my family is away and turn back on when we return. However..

techcrunch.com/2024/12/05/b... 👀

TIL about WebTransport serverCertificateHash. But where do websites get the hash from if it can't talk to the device in the first place? ;) Are people relying on a rendezvous server on the internet where the local device needs to register its public key/hash? And what would TOFU look like here?

Can someone remind me? How and why did cloudflare get a valid certificate for an IP address (1.1.1.1) and how does that align with baseline requirements?

Modern solutions against cross-site attacks (frederikbraun.de/modern-solut...): An article about cross-site leak attacks and browser-based defenses. You will also learn why web security best practices is always opt-in and finally how YOU can get increased security controls.

Modern solutions against cross-site attacks (frederikbraun.de/modern-solut...): An article about cross-site leak attacks and browser-based defenses. You will also learn why web security best practices is always opt-in and finally how YOU can get increased security controls.

Testing again. API Changes? You can't hold us back

test, 1, 2, 3, test.

Hi friends. I consider my primary thing to be the homepage at frederikbraun.de and my mastodon account at @[email protected], but I'll try to post here every once in a while if I remember that some cool stuff happened.