A Web App Is As Secure As You Make It & the Browser It Runs On

Did you know about these security issues...

An IP addresses such as 74.125.19.99 can be written in ambiguous ways such as 74.0x7d.023.99 (mixing decimal, octal, and hexadecimal notation) or 74.8196963. This is a trick used in phishing exploits.

SVG natively permits embedded scripts and event handlers. Firefox, Safari, Opera, Chrome support SVG image format.

xssed.com, a site dedicated to tracking publicly reported issues about HTML injection flaws, amassed over 50,000 entries in under two years.

The recently released Browser Security Handbook has revelations like these and a thorough review of browser quirks that can affect security.
This 60-page document provides a comprehensive comparison of a broad set of security features and characteristics in commonly used browsers, along with (hopefully) useful commentary and implementation tips for application developers who need to rely on these mechanisms, as well as engineering teams working on future browser-side security enhancements.

This is a great resource for web developers keen on building secure cross-browser applications. Remember your web application is as secure as you make it and the browser that it runs on.

In the security interest of users and for better standards compliance, developers should encourage users to upgrade to newer browsers.

The Handbook is currently a kind of beta and I hope the final version of this handbook has numbers for the Browser Comparison Tables for better readability & reference and a way to download it as a PDF for offline use.

The Microsoft ACE (Application Consulting & Engineering) Team's blog is another good resource on security for ASP.NET developers.

Comments

Post a Comment

Popular posts from this blog

Maven Crash Course - Learn Power Query, Power Pivot & DAX in 15 Minutes

Image
In the Maven Crash Course " Learn Power Query, Power Pivot & DAX in 15 Minutes ", Chris Dutton walks through a hypothetical business case while showcasing the power of modern Excel tools like Power Query, Power Pivot and DAX. Power Query is used to extract, transform, and load data from external sources like SQL databases, PDF and CSV files. A relational model is created to join the tables without writing a single formula. Exploratory analysis is done using Power Pivot and Data Analysis Expressions (DAX). Data Analysis Expressions is the language that we can use to define new calculated columns and measures to enhance our Data Model instead of the traditional cell formulas that we'd typically use if our data was stored in worksheets. Pivot Charts and slicers are used to design a simple interactive report that the sales managers can use to analyze revenue trends and product performance.
Read more

"Data Prep & Exploratory Data Analysis" course by Maven Analytics

Image
The Maven Analytics course on " Data Prep & Exploratory Data Analysis " by Alice Zhao is a beginner-friendly introduction to machine learning with Python. It covers the key steps of the data science workflow, including: Gathering Data Scoping a Project Modeling Data Sharing Insights Cleaning Data Exploring Data Modeling Data  Sharing Insights The presentation deck which is available as a download crisply summarizes the essential details and is a great reference to keep going back to. The course is well-suited for aspiring data scientists looking to get hands-on experience with the data prep and EDA stages of the machine learning workflow using Python and Jupyter Notebook. 
Read more

Oracle Cloud Infrastructure 2024 Generative AI Professional Course & Certification Exam (1Z0-1127-24)

Image
I was happy to learn about the Oracle Cloud Infrastructure 2024 Generative AI Professional Course with video tutorials and the Certification Exam (1Z0-1127-24) from their newsletter. I found it extremely useful, timely, and relevant. The course, with about 6 hours of videos, provided me with a comprehensive view of what it takes to build a Generative AI application. Although some parts reference OCI services, much of the course remains vendor neutral. Rohit Rahi and his team at Oracle have done a great job of structuring the beginner-friendly yet comprehensive course so well, covering all the essentials across four modules. The curriculum strikes an excellent balance between depth and accessibility.  While Gen AI output is typically non-deterministic, I was surprised to learn that they can be made completely deterministic under certain conditions. Specifically, in the OCI Gen AI service, setting the temperature parameter to 0 produces consistent, deterministic output for a g...
Read more