The big try catch block to figure out the correct string to use depending on the version of browser the user has, really reminds me of iOS these days with all the switches depending on what kind of notch phone you have
Thanks guys Just one request: If you can assume a bit less knowledge from us next time, that'd be great :) Some of those concepts/examples seemed a bit advanced and were just glanced over, it would have been more helpful if they were explained a bit more. Thanks again :) Looking forward to the tracking episode
This is really good feedback, thanks. What kinds of things could have done with more detail? The first half of this episode ran longer than I intended, so I think I rushed the rest, sorry!
@@jakearchibald Thanks for your reply. Actually it's first section that I wish it had more explanation .. those mistakes/risks of current cookies implementation... how sending someone to some form on your website can result in you reading their cookies and causing damage? having an onLoad event on avatar image load? what's potentially being leaked? how's sending the Origin header with POST can prevent that? PS: I really enjoyed the episode, and have learned a lot from you guys here & on twitter (don't mean to be critical here). Thanks :)
@@jakearchibald With CORS's problems&solutions growing more mazelike, I'm not sure the discussion format alone can demystify it. I think it it has to be vid&handson maybe a walkthrough setup and pentest showing the problem, and not just a subtopic of other things like lab-fetch-api it's own focused lab on webfundamentals( or websecurityfundamentals even) .
@@jakearchibald I think a more detailed explanation or examples of a bad situation would be good. For example, many times it's not exactly clear which site is the evil site. Is it example.com or the site fetching from example.com? If i t's the site fetching from example.com, how can it read the cookie content of example.com? Can site A intercept the get request to site B?
+1 for a whole episode about unwanted information sharing (tracking) ("Sad User" ;) ). Your topics are always very interesting it is just hard to follow along sometimes as a non-native speaker.
1:50 pdfs, may be a competitor since mosaic could display them but AFAIK that may only been while on the file path so maybe not a pure sub resource except in however they programmed it to display in a html browser, and ummm actually there was no tag in the spec which probably also rules out any stylesheet prototypes.
If you're targeting browsers that don't support SameSite, then yes, you'll need an alternative. The Origin header can be simpler than tokens, but again it depends on browser support. Also, this stuff doesn't work if you have GET endpoints that perform actions, but y'know, you shouldn't have those.
What about the problem with losing the cookies (eg sessionid) when your app is added to homescreen on iOS, where your index.html has been cached by the service worker...and/or you're now offline? It works in-browser, but not from homescreen.
Hey Jake, I find it super interesting at 1:35 where you said you were not allowed on the internet, and "nobody knew what the internet was". So I wonder how you got into it? You often find that industry leaders like yourself started coding on a PC when they were around 9 (not that its necessary, but you tend to notice early introduction to tech), so I found it interesting that you seem to state the opposite.
Can you make a video explaining what Meltdown and Spectre is and how it worked and stuff like that? Cuz y'all keep mentioning it, and it honestly sounds pretty interesting!
@@jakearchibald When will I get my precious SharedArrayBuffers back in all the major browsers 😫? Shoutouts to Chrome at least for getting them back asap, but hard to invest a lot in them without support from WebKit. Cheers
Oh yeah, we haven't done this yet (although I've mentioned parts of it in other talks), although there's blog.google/products/ads-commerce/a-more-privacy-first-web if you want to know the latest
Guys, is it actually possible to Server Push self-hosted fonts? When I add crossorigin my push degrades to a preload. It's super annoying and I can't find a solution. You are my last hope. :)
You might be being tripped up by jakearchibald.com/2017/h2-push-tougher-than-i-thought/#requests-without-credentials-use-a-separate-connection. Server push is generally bad.
Http 203 is easily one of my favourite shows on RUclips :D
I was with you up until CORP and then I got lost 😂. I'll have to rewatch and pause it.
Alright, got it!
Is it my imagination or has this vid been sped up by 10% or so?
Nah, we just talk a bit too fast
@@jakearchibald - I bet 10 Google Bucks its sped up = interesting vid though.
@@brentgreeff1115 you just lost 10 Google Bucks
I need a 3 hr deep dive video on this
when are we going to give these guys their golden globe award
I liked the plot progression in this episode, especially the reveal in the end. Felt like some super villain was defeated!
This was a fantastic episode. I learned a bunch, and now I want more! You should make a bonus episode with all the "boring" details you cut out
thank you for explaining CORS. I can finally stop having recurring nightmares about it. my therapist will be pleased.
The big try catch block to figure out the correct string to use depending on the version of browser the user has, really reminds me of iOS these days with all the switches depending on what kind of notch phone you have
Waited 23 minutes for the dog promised by the video thumbnail.
Worth it.
Some reference material:
CORP: developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy
CORB: www.chromium.org/Home/chromium-security/corb-for-developers
nosniff: developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
COEP: wicg.github.io/cross-origin-embedder-policy/
Thanks guys
Just one request: If you can assume a bit less knowledge from us next time, that'd be great :)
Some of those concepts/examples seemed a bit advanced and were just glanced over, it would have been more helpful if they were explained a bit more.
Thanks again :)
Looking forward to the tracking episode
This is really good feedback, thanks. What kinds of things could have done with more detail? The first half of this episode ran longer than I intended, so I think I rushed the rest, sorry!
@@jakearchibald Thanks for your reply.
Actually it's first section that I wish it had more explanation .. those mistakes/risks of current cookies implementation...
how sending someone to some form on your website can result in you reading their cookies and causing damage?
having an onLoad event on avatar image load? what's potentially being leaked? how's sending the Origin header with POST can prevent that?
PS: I really enjoyed the episode, and have learned a lot from you guys here & on twitter (don't mean to be critical here). Thanks :)
@@jakearchibald With CORS's problems&solutions growing more mazelike, I'm not sure the discussion format alone can demystify it.
I think it it has to be vid&handson maybe a walkthrough setup and pentest showing the problem, and not just a subtopic of other things like lab-fetch-api it's own focused lab on webfundamentals( or websecurityfundamentals even) .
@@jakearchibald I think a more detailed explanation or examples of a bad situation would be good. For example, many times it's not exactly clear which site is the evil site. Is it example.com or the site fetching from example.com? If i t's the site fetching from example.com, how can it read the cookie content of example.com? Can site A intercept the get request to site B?
+1 for a whole episode about unwanted information sharing (tracking) ("Sad User" ;) ). Your topics are always very interesting it is just hard to follow along sometimes as a non-native speaker.
Web workers gonna love Cross-Origin-Embedder-Policy !
Glad to know the sameSite policy change has been resumed😂
1:50 pdfs, may be a competitor since mosaic could display them but AFAIK that may only been while on the file path so maybe not a pure sub resource except in however they programmed it to display in a html browser, and ummm actually there was no tag in the spec which probably also rules out any stylesheet prototypes.
Yeah, I don't think it was a subresource, just a top-level navigation.
Well, this turned into a reality show quickly ...
Already subscribed, but Watson got me to click the bell!
Especially with micro front ends coming up. Something needs to be worked out
So we should still implement CSRF tokens until all browsers support SameSite=Lax?
If you're targeting browsers that don't support SameSite, then yes, you'll need an alternative. The Origin header can be simpler than tokens, but again it depends on browser support. Also, this stuff doesn't work if you have GET endpoints that perform actions, but y'know, you shouldn't have those.
yeah... 2020 is pretty bad for breaking changes...
«got me notes» - it’s awesome 😎 😂
omg this is such a hot topic!!!
What about the problem with losing the cookies (eg sessionid) when your app is added to homescreen on iOS, where your index.html has been cached by the service worker...and/or you're now offline? It works in-browser, but not from homescreen.
I feel like you should have introduced the class of problems at the beginning, as well as a walkthrough of some examples.
That's a lovely dog :)
Hey Jake, I find it super interesting at 1:35 where you said you were not allowed on the internet, and "nobody knew what the internet was". So I wonder how you got into it? You often find that industry leaders like yourself started coding on a PC when they were around 9 (not that its necessary, but you tend to notice early introduction to tech), so I found it interesting that you seem to state the opposite.
I tinkered around with bits of BASIC when I was 7 I guess, but I was more interested in graphical design & animation until I was in my late teens
Jake Archibald interesting. Thanks for the reply
CORB-on-the-COB.
Can you make a video explaining what Meltdown and Spectre is and how it worked and stuff like that? Cuz y'all keep mentioning it, and it honestly sounds pretty interesting!
ruclips.net/video/dBuykrdhK-A/видео.html might do the trick
@@jakearchibald When will I get my precious SharedArrayBuffers back in all the major browsers 😫? Shoutouts to Chrome at least for getting them back asap, but hard to invest a lot in them without support from WebKit. Cheers
Would you share that presentation?
When is the cross sure tracking episode
Oh yeah, we haven't done this yet (although I've mentioned parts of it in other talks), although there's blog.google/products/ads-commerce/a-more-privacy-first-web if you want to know the latest
Guys, is it actually possible to Server Push self-hosted fonts?
When I add crossorigin my push degrades to a preload. It's super annoying and I can't find a solution. You are my last hope. :)
You might be being tripped up by jakearchibald.com/2017/h2-push-tougher-than-i-thought/#requests-without-credentials-use-a-separate-connection. Server push is generally bad.
You should show Watson more often
This was hard to learn much from it :,-)
what about cors at firebase ?
Guys please provide a gist of entire code at the final minutes..
Eye opening!
what is subresource? :
Wow nice secret in description.
caring about privacy on the web.
working at Google. :D
I had to unsubscribe in order to subscribe....ditto for the bell.
Tongue twister