Major announcement: My highly successful Applied Cryptography course taught last year at the American University of Beirut is returning as an online course, available for FREE for any qualifying student from any Lebanese university! Read more + apply today — and please spread the word!

Next up, 'Improving the Trustworthiness of Javascript on the Web', presented by Michael Rosenberg, Giulio Berra, Ezzudin Alkotob, and Dennis Jackson #realworldcrypto

OK, ok. I'll stop blogging for today. I promise.

Composing Sanitizer configurations (https://frederikbraun.de/composable-sanitizers.html): The HTML Sanitizer API allows multiple ways to customize the default allow list and this blog post aims to describe a few variations and tricks we came up with while writing the specification.

New blog post: Perfect types with `setHTML()` - https://frederikbraun.de/perfect-types-with-sethtml.html - TLDR: Use require-trusted-types-for 'script'; trusted-types 'none'; in your CSP and nothing besides setHTML() works, essentially removing all DOM-XSS risks....

c'mon Safari

I was invited to join the @shoptalkshow.com podcast and talk about my favorite topic. The HTML Sanitizer API and `setHTML()`. Give it a spin in your favorite podcast player :) shoptalkshow.com/704/

we did a thing! Congrats to the team for getting this out.

this is your regular reminder that centralized, single-ownership social media is doomed

⚡ I've been contributing micro-optimisations to Go's standard library in my spare time: github.com/golang/go/co... 💸 I don't intend to stop any time soon, but if you benefit from my work and would like to support it, consider sponsoring me on GitHub: github.com/sponsors/jub... #golang #OpenSource

The Open Source Cryptography Workshop is returning for 2026, before Real World Crypto in Taipei. We are calling for session proposals, both presentations and hands-on workshops, on topics of interest to those who work on and with open source crypto. oscwork.shop/2026 #oscw #rwc #oscw2026 #rwc2026

Hey #39c3. Come see my lightning talk on a safe variant for `.innerHTML ` that is built right into the browser. Tomorrow (day 2), at approximately 12:25 - events.ccc.de/congress/202...

Hey #39c3, chat me up if you want to talk about web security, browser security. I will be one of the tall dudes with a Firefox hoodie :)

lol, bsky wanting everyone's my birthday. Follow me on mastodon, you cowards.

New blog post: Why the Sanitizer API is just `setHTML()` - https://frederikbraun.de/why-sethtml.html

New blog post. Something off-topic to feed the search engine. A bug in Lego Star Wars: The Complete Saga (2007). https://frederikbraun.de/lego-star-wars-complete-saga-c3po-bug.html

I don't know who needs a kitty headbutt right now, but here's one for you

Firefox nightly introduces the setHTML() method. Which is like a native DOMPurify. You can easily test it here: portswigger-labs.net/mxss/ Set HTMLSanitizer ✅ Auto update ✅ I'm trying to break it, I encourage you to break it too

Hej! We are thrilled to announce Hack.lu CTF 2025 starts on Friday, October 17. Top teams can win prizes from our sponsors: OffensiveCon, Zellic, PortSwigger, Binary Ninja, and HackTheBox. All information on flu.xxx

I'm in a phenomenal talk on gender inequality in cybersecurity this morrning and this is such a great cheat sheet for intersectional fair employment.

firefox container tabs are lowkey goated when $11/year VPS in dublin w/ socks5 over ssh is the vibe

Wait, container tabs support individual proxy settings?

We just opened the Call-for-Papers for the German OWASP Day 2025. The event will be held November 25th-26th in Düsseldorf. god.owasp.de/2025/cfp.html We're looking for all sorts of presentations about web security and beyond for an audience of builders, breakers and defenders.

cut my heap into pieces, this is my crash report: allocation, no alignment don't give a fuck if it faults on assignment this is fatal abort()

CUT MY LIST IN TWO PIECES THAT’S HOW YOU START QUICKSORT

end of an era 💔 blog.glitch.com/post/changes... I know Glitch is working on project export but if you're git-capable, I built a tool that will mass-git-clone your public glitch projects: github.com/potch/glitch...

Uh, pwn2own was...today? And we're shipping a bugfix release also today? Cool. Update your Firefoxes, please :D blog.mozilla.org/security/202...

We just published @firefox.com updates to fix the exploits used at the Pwn2Own contest yesterday and today. Both contestants achieved RCE in our content process but did not escape the sandbox. blog.mozilla.org/security/202...

We have an initial plan for talks and breakout sessions at the Web Engines Hackfest 2025: github.com/Igalia/weben... • Monday: 9 talks and the W3C Web Apps WG F2F • Tuesday & Wednesday: 23 breakout sessions in 3 parallel tracks There might be still small changes, but it gives a good overall picture.

I made this diagram for a talk on encrypted messaging I recently gave, and I didn’t get to use it in the talk. I figured I’d share it here because I think it tells a story.

New blog post: With Carrots & Sticks - Can the browser handle web security? https://frederikbraun.de/madweb-keynote-2025.html - This is the blog version of my keynote from MADWeb 2025 earlier this year. It's about how web security could become the browser's responsibility.

Blog post about the road to HTTPS-First in Firefox. Early reports show an uptick in encrypted traffic by at least 1.5% for our global users. 😎 attackanddefense.dev/2025/03/31/h...

Based on the traffic I see - Mastodon is number 1, then LinkedIn, then Reddit, then Microsoft Teams, then Google, then BlueSky, then Twitter.

Firefox 136 was just released. As of now, Firefox will open all pages using 🔒https, if possible. If the connection does not succeed (port closed, certificate untrusted etc), the browser will automatically switch back to http.

They need him to be a genius because they cannot handle what it means for them to be tricked by a fool.

We're in the consumer HTTPS endgame. We need to finish the job so I can be certain all my mobile traffic is protected. Please join me in asking the OS and browser makers to keep pushing and to finish the job in 2025, perhaps by Halloween! 👻 🔐 https://buff.ly/41qPpUM

#FUZZING'25 CALL FOR PAPERS ────── ✨ New OC members: * Ruijie Meng (@ruijiemeng.bsky.social; NUS) * Rohan Padhye (@rohan.padhye.org; CMU). ✨ New paper type: Fuzzing Nuggets (short papers). 🔗 fuzzingworkshop.github.io 📅 20.March (Submission) 📅 17.April (Notification) 📅 28.June (Workshop)

@boblord.bsky.social Did you stop looking at your account on infosec.exchange? I (finally) have a paper for you to preview, if you can tell me your primary email address.

I posted a blog about how browser permissions work. albertofdr.github.io/web-security...

An updated to the Firefox Bug Bounty Hall of Fame for Q4 of 2024 just dropped. Thank you to the many folks who helped keep Firefox secure! 🏆👏 www.mozilla.org/en-US/securi...

Gecko: Intent to ship: HTTPS-First / HTTPS Upgrades

This is your reminder that the HTML specification features the picture of a kitchen sink.

On this day 12 years ago, @kcg.bsky.social posted the “This is Fine” comic.

Given that simps0n isn’t on Bluesky, allow me to post a link to his excellent weekly ezine 💎 Here’s today’s edition, "AppSec Ezine - 568th" 📚 pathonproject.com/zb/?47a5c4d2...

Happy new year to you all :)

Kids these days don't even know how much opportunity they have to learn hacking from actual pros. I know there is a lot of content out there, so it can be hard to find the good stuff. But 10 years ago you had to be lucky to find at least something. Anyway, watch this 👇

VPN vendors have huge budgets to advertise on your favorite podcasts. We don't have marketing for the IETF, browser and OS security teams, CAs (Let's Encrypt), CDNs, researchers, open source authors, website builders, digital rights activists... We made the web secure and didn't tell anyone.

I have discount codes for *annuals plans* of Mozilla VPN, Firefox Relay Premium Email Masking and Monitor Plus (US only). Message me in private. Happy to hook you up, if we know each other :) #ad