Nostr notes by Frederik Braun �

yeah, we will see how things go. Due to gestures wildly recent ...

2026-05-07T19:25:04Z

In reply to nevent1q…90y7
_________________________

yeah, we will see how things go. Due to *gestures wildly* recent events, we also had a bit less submissions, so… 🤷‍♂️

Nostr event nevent1qqsft3shvygexgzwzn43yjethngpvj25l7dh74ge0m092m7lnhu5gfszyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvumjk8w2

2026-05-07T18:58:05Z

In reply to nevent1q…xtuy
_________________________

https://attackanddefense.dev/2026/03/13/bug-bounty-program-updates-2026.html :)

You can just click the bugs and see the attachments? :)

2026-05-07T17:15:18Z

In reply to nevent1q…28lz
_________________________

You can just click the bugs and see the attachments? :)

You'll see attachments in some of the bugs. We asked the LLM ...

2026-05-07T16:23:08Z

In reply to nevent1q…n3sn
_________________________

You'll see attachments in some of the bugs. We asked the LLM to propose a patch, but it was real people who were assigned to the bug and they were of course free to pick a different approach.

As with all patches in Firefox, we need a human author and another human to review the patch. https://firefox-source-docs.mozilla.org/contributing/ai-coding.html

When we said that we found and fixed hundreds of bugs in Firefox ...

2026-05-07T16:15:27Z

When we said that we found and fixed hundreds of bugs in Firefox using AI, people were skeptical and said: Where are the bugs?

Well, here they are. We are unhiding 12 security bugs that are representative of the issues we have found.

https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/.

Nostr event nevent1qqsq6sst4v8h2net43vje59hfxz62r6vdaplv94g7yqxj8zatj0mauczyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvuy8d5lw

2026-05-05T11:03:53Z

https://blog.mozilla.org/netpolicy/2026/05/05/mozilla-calls-on-uk-policymakers-to-address-the-roots-of-online-harm-not-undermine-the-open-web/

did the vibes take you? :P

2026-05-01T17:10:04Z

In reply to nevent1q…5ekt
_________________________

did the vibes take you? :P

The SSD storage thing is a bit concerning from a pricing ...

2026-04-23T14:18:47Z

In reply to nevent1q…q2aj
_________________________

The SSD storage thing is a bit concerning from a pricing perspective, otherwise this could easily live behind my sofa ;D

What Mythos access got us. Now public. ...

2026-04-21T19:11:53Z

What Mythos access got us. Now public. https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/

Nostr event nevent1qqsfqajsxsgxe97df3d3tgn3wnx04ejqyey6ezl48ms0lfd38aw0egqzyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvuxlgqp5

2026-04-21T17:45:00Z

What? Blog post in 45 minutes?

ok cool, ich hab jetzt einen Meshcore Solarnode auf dem fünften ...

2026-04-21T11:26:00Z

ok cool, ich hab jetzt einen Meshcore Solarnode auf dem fünften Stock in Berlin Südwest und ich glaub es läuft. eine erste nachricht ging sogar schon bis Teltow-Fläming :))

lots of people are being / were hit by LLM-slop bugs first and ...

2026-04-21T11:25:04Z

In reply to nevent1q…whge
_________________________

lots of people are being / were hit by LLM-slop bugs first and foremost, which pretty much set a bad stage. Most who haven't been directly involved are just epxecting AI bugs to be slop. I wish this was true :)

they likely advertise specifically to your area because of the ...

2026-04-21T11:22:57Z

In reply to nevent1q…s86k
_________________________

they likely advertise specifically to your area because of the shitty ISP that everyone is using :(

This is to let you know that ...

2026-04-20T20:36:55Z

This is to let you know that https://en.wikipedia.org/wiki/Security.txt exists and it is kinda cool.

Do I know someone who works on security for freedesktop.org ...

2026-04-20T20:18:46Z

Do I know someone who works on security for freedesktop.org software projects? :)

erinnert mich daran, wie ich das gleiche Softwareprojekt mehrfach ...

2026-04-20T06:17:29Z

In reply to nevent1q…daga
_________________________

erinnert mich daran, wie ich das gleiche Softwareprojekt mehrfach angefangen habe, weil ich meine eigenen Prototypen vergessen habe. Gute Ideen wollen eben raus. Manchmal reicht einmal nicht.

RE: https://glauca.space/@r/116434222890632831 @npub1dey…2ty4 ...

2026-04-20T04:28:20Z

RE: https://glauca.space/@r/116434222890632831

Greg Stoll 🌈 (npub1dey…2ty4) 👀

quoting
note1w6e…w5cn

🌟 Project Release Announcement Time! 🎉

I wrote a WebUSB extension for Firefox.

This lets web pages access USB devices (with your permission). This has long been supported by Chrome, but Mozilla has not wanted it, at least by default. Fortunately, because add-ons are a thing (for now. make sure to keep fighting for this!), it's possible to change that!

Common reasons for wanting this include programming microcontrollers, 3d-printers, smartphone bootloaders, and similar "physical computing" projects.

This works on Windows, Linux, and macOS

You can get the source code here: https://github.com/ArcaneNibble/awawausb

In order to make this work, you will need to install a small program on your computer. This is explained in the README. You can then install the .xpi file (on the GitHub Releases page) into your browser (which was _just_ auto-approved while I was typing this announcement up).

Please boost (if you want), test, report bugs, etc. etc. (although do keep in mind that this code is entirely written by a single catgirl)

i think this is the perfect type of project to drop late on a sunday / very early on a monday?

browsers have reacted and this kind of attack should no longer be ...

2026-04-19T11:00:21Z

In reply to nevent1q…hgyf
_________________________

browsers have reacted and this kind of attack should no longer be possible. That being said...yes. These vendors should have no place on a well maintained phone :)

Ach, schade. Vielleicht klappt es beim nächsten. Ein Stoffteil ...

2026-04-18T14:19:52Z

In reply to nevent1q…v8ea
_________________________

Ach, schade. Vielleicht klappt es beim nächsten. Ein Stoffteil der Tochter heißt auf meinen Vorschlag Sabiene. Nachdem sie jemand darauf hingewiesen hat, dass sie für eine Biene zu dick sei, heißt sie Sabummel. :)

das nervt mich am meisten. man müsste irgendso eine art ...

2026-04-18T13:37:43Z

In reply to nevent1q…ncp8
_________________________

das nervt mich am meisten. man müsste irgendso eine art monitoring haben, dass meckert wenn etwas ausfällt. aber dann braucht man monitoring fürs monitorung. oder man macht sich ein dashboard auf das man regelmäßig guckt?

Oder man steht ab und zu vom Schreibtisch auf und guckt sich um in der Welt.. Aber wer will das schon :D :D

Yeah, I have a take or two. What I like about David's idea is ...

2026-04-18T13:33:22Z

In reply to nevent1q…gvje
_________________________

Yeah, I have a take or two. What I like about David's idea is that this is on the improving side rather than the bug-finding side. It's surely a nice way to get a cleaner codebase that violates less analyzers/compiler warnings, sort of self-correcting if you let it iterate. On the offensive side, we have seen that you don't even need the analyzer right now. With a sufficiently smart enough model (Opus 4.6 was already there), you just ask it to find bugs and create a test.

Sales email started with a poem. I must have put a prompt ...

2026-04-17T11:20:16Z

Sales email started with a poem. I must have put a prompt injection in my profile, but can't remember where. Was a good poem though. Thank you.

RE: https://infosec.exchange/@attackanddefense/116418875523198922 ...

2026-04-17T10:21:50Z

RE: https://infosec.exchange/@attackanddefense/116418875523198922

Q1 2026 was a very strong quarter for Firefox Security & Privacy.

some highlights:
- We expanded AI-assisted vulnerability discovery through our collaboration with Anthropic, helping identify and fix a high number of real security issues.
- We shipped the Sanitizer API in Firefox 148, making Firefox the first browser to support this stronger defense against XSS.

More in the newsletter linked below :)

quoting
note13el…rl6c

We just published our recent Firefox Security and Privacy highlights in the Q1 newsletter. Take a look —> https://attackanddefense.dev/2026/04/14/Firefox-Security_and_Privacy_Newsletter_2026_Q1.html

+1 von mir. Würde such zum Telefon greifen

2026-04-17T10:12:02Z

In reply to nevent1q…kwey
_________________________

+1 von mir. Würde such zum Telefon greifen

This will be like what AddressSanitizer did to fuzzing but ...

2026-04-16T19:50:04Z

This will be like what AddressSanitizer did to fuzzing but bigger...

there was some early research that claimed a correcter / better ...

2026-04-15T16:33:05Z

In reply to nevent1q…72xg
_________________________

there was some early research that claimed a correcter / better reply is statistically more likely, because the training data on the web has the same property. Not sure if that holds though..

None of this is hype. Just look at the increasing length of the ...

2026-04-15T09:44:21Z

In reply to nevent1q…xf4e
_________________________

None of this is hype. Just look at the increasing length of the security advisories for major software release notes (eg Firefox, Chrome, Apple). The suggested, updated security program makes sense to me, but I'll acknowledge that a full implementation would look very differently from org to org.

oh, I had no idea Chrome had a guest mode. Firefox should steal ...

2026-04-14T06:12:32Z

In reply to nevent1q…j0ak
_________________________

oh, I had no idea Chrome had a guest mode. Firefox should steal that.

should be easy to do, too. Could just use a throwaway profile.

2026-04-14T06:01:18Z

In reply to nevent1q…8s6z
_________________________

should be easy to do, too. Could just use a throwaway profile.

yep this is still largely subsidized by cheap inference and ...

2026-04-13T20:31:53Z

In reply to nevent1q…r8vx
_________________________

yep this is still largely subsidized by cheap inference and essentially free training (for the consumer). I don’t bet on it staying this cheap.

RE: https://infosec.exchange/@metacurity/116397875382563012 Must ...

2026-04-13T20:28:34Z

RE: https://infosec.exchange/@metacurity/116397875382563012

Must read if you work in security.
nostr:note1ey4a3nejcf7hgxt2tyxvmd90rncyev77npc8ht2g2vfvkr5ypgsqxtxmzp

not really. Some bugs are truly hard to find with fuzzing and are ...

2026-04-13T19:55:32Z

In reply to nevent1q…7ukp
_________________________

not really. Some bugs are truly hard to find with fuzzing and are more easily identified by seeing codesmell and trying to trace it back to user. Reading and remembering code is limited by brain power / will power. As sad as it is: LLMs scale better here.

this is a good change. We adjusted the Firefox bug bounty policy ...

2026-04-13T12:51:47Z

In reply to nevent1q…jtnn
_________________________

this is a good change. We adjusted the Firefox bug bounty policy to essentially say "no test case? no pay out". Though the amount of bugs coming in has (unfortunately) not really gone down yet :-/

I got into a (mild) argument multiple times with our localizers ...

2026-04-12T18:22:17Z

In reply to nevent1q…cjn5
_________________________

I got into a (mild) argument multiple times with our localizers and gave up. I disagree with them but I also don’t have to live with the feedback they get elsewhere. Firefox in English it is… :)

Will damit sagen: Es ist viel Hype und daher auch viel ...

2026-04-10T14:29:20Z

In reply to nevent1q…r85q
_________________________

Will damit sagen: Es ist viel Hype und daher auch viel gerechtfertigte Skepsis.

Aber nur weil wir skeptisch gegenüber dem AI-Hype sind, können wir auch nicht die Augen vor der Wahrheit verschließen. Es kommt gerade eine riesige Tsunami-Welle an Security bugs auf alles an OSS-Software zu. Manche spüren schon die Tropfen, aber eben noch nicht alle :|

ach und noch was: Ich wünscht es wäre anders :)

2026-04-10T11:08:31Z

In reply to nevent1q…d4u0
_________________________

ach und noch was: Ich wünscht es wäre anders :)

Deine Kritik ist nicht so ganz angebracht: 1) Zu Firefox: alle ...

2026-04-10T06:43:51Z

In reply to nevent1q…axqk
_________________________

Deine Kritik ist nicht so ganz angebracht: 1) Zu Firefox: alle diese Bugs waren sehr gut, wir haben auch sandbox-escape exploits gesehen. Dass wir die "sec-high" nennen, ist nach gründlicher Analyse passiert. 2) NFS ist ziemlich oft "offen für alle im Netzwerk". Wenn der Angreifer 1 socket aufmachen kann, kann er auch 2 aufmachen.

Was ich sagen will: ich mach seit über 15 Jahren Security. Ich habe die Bugs gesehen. Sie sind wirklich krass.

looks so pretty, I can’t shake the feeling it was trained for ...

2026-04-08T06:21:42Z

In reply to nevent1q…e6dc
_________________________

looks so pretty, I can’t shake the feeling it was trained for this :)

true, using a mozilla build with our updater will ensure this ...

2026-04-07T13:23:19Z

In reply to nevent1q…ykrf
_________________________

true, using a mozilla build with our updater will ensure this doesn’t happen unexpectedly.

I think your configuration might be borked. We do not force a ...

2026-04-07T11:21:11Z

In reply to nevent1q…e0g8
_________________________

I think your configuration might be borked. We do not force a restart. You should only get this error if the binary file on disk changed while browsing. In that case, Firefox is unable to create a new process due to API incompatibility. Do you use multiple Firefoxes in parallel?

every browser, every library that does media parsing, ...

2026-04-07T09:13:21Z

In reply to nevent1q…madz
_________________________

every browser, every library that does media parsing, compression, …

duuuuude, just enable session restore 😓

2026-04-07T09:09:00Z

In reply to nevent1q…l4fw
_________________________

duuuuude, just enable session restore 😓

I got the neon pink "motherfucking devtools" sticker on ...

2026-03-31T06:37:08Z

In reply to nevent1q…vd45
_________________________

I got the neon pink "motherfucking devtools" sticker on my laptop at home (no photo because I'm on vacation right now :))

ist euch aufgefallen dass das Sommerloch-Tier dieses Jahr echt ...

2026-03-30T18:47:29Z

ist euch aufgefallen dass das Sommerloch-Tier dieses Jahr echt früh dran ist? - die beste Ehefrau von allen kommentiert, dass sei wegen der Klimakatastrophe.

her designs were amazing :)

2026-03-30T18:22:51Z

In reply to nevent1q…pshv
_________________________

her designs were amazing :)

guess if nobody disagrees, I will have to blog post. That’ll ...

2026-03-29T06:47:24Z

In reply to nevent1q…qj28
_________________________

guess if nobody disagrees, I will have to blog post. That’ll make them :D thank you both.

not CSS-only as I originally thought. But still pretty cool. I ...

2026-03-28T11:57:57Z

In reply to nevent1q…lzyl
_________________________

not CSS-only as I originally thought. But still pretty cool. I think doing THIS and then going CSS-only is the next frontier 🙂

…progress still remains as an inventive to get it done as first ...

2026-03-28T11:31:37Z

In reply to nevent1q…92q8
_________________________

…progress still remains as an inventive to get it done as first team, so might make sense to show progress as in "everything that is solvable because it has been solved" rather than "who has done the most".

@npub1k8h…4fm8 are you still involved with lakectf? Were you ...

2026-03-28T11:30:05Z

Mathias Payer (npub1k8h…4fm8) are you still involved with lakectf? Were you part of the decision making for the No LLM Policy at https://lakectf.epfl.ch/no-llm.html. I like the idea and have been thinking about the brokenness of CTF for a while. As a further step, I was wondering if it makes sense to provide scored/points only as a measurement of difficulty and stop showing a scoreboard altogether. Only show activity as "progress“ per category rather than points or rankings :).

… and @npub1s05…tnkj had a good tutorial including tips on ...

2026-03-28T11:24:25Z

In reply to nevent1q…w22n
_________________________

… and Michael Stapelberg 🐧🐹😺 (npub1s05…tnkj) had a good tutorial including tips on how to speed up the initial import https://michael.stapelberg.ch/posts/2025-11-29-self-hosting-photos-with-immich/

my take: if you don’t need encryption (because you self host at ...

2026-03-28T11:23:00Z

In reply to nevent1q…g0ry
_________________________

my take: if you don’t need encryption (because you self host at home), use immich.

did you see https://alexandmanu.com/blog/immich-vs-ente-photos/?

2026-03-28T11:21:41Z

In reply to nevent1q…skvm
_________________________

did you see https://alexandmanu.com/blog/immich-vs-ente-photos/?

this.

2026-03-27T17:45:35Z

In reply to nevent1q…jtep
_________________________

this.

OH: "Mich würd das auch total verstören, wenn ich es nicht ...

2026-03-27T17:37:27Z

OH: "Mich würd das auch total verstören, wenn ich es nicht verdrängen würde."

@npub1xcc…khle Have you seen this? You must see this :) ...

2026-03-27T17:03:20Z

Gareth Heyes :verified: (npub1xcc…khle) Have you seen this? You must see this :) https://front-end.social/@html5test/116301798349200500 first response also contains link to how he built it

sehr cool! Glückwunsch! :)

2026-03-27T16:31:53Z

In reply to nevent1q…vwew
_________________________

sehr cool! Glückwunsch! :)

I am still very much grappling with a conclusion. But it's ...

2026-03-27T09:32:09Z

In reply to nevent1q…hjp9
_________________________

I am still very much grappling with a conclusion. But it's real. Linux appears to bee seeing the same https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_kernel/

codeberg seems cool but it doesn't really allow private repos

2026-03-27T09:28:56Z

In reply to nevent1q…5w7k
_________________________

codeberg seems cool but it doesn't really allow private repos

RE: https://chaos.social/@NikTheDusky/116296542412842528 Haha. A ...

2026-03-26T19:46:19Z

RE: https://chaos.social/@NikTheDusky/116296542412842528

Haha. A washing machine running wayland before all of my home computers… 😢🥲

quoting
note1tq9…5xjr

wayland washing machine

Looks like there’s s whole new meaning to "bugs are ...

2026-03-26T16:45:44Z

Looks like there’s s whole new meaning to "bugs are cheap"…

I like their aggressive timeline, but I'm not sure ...

2026-03-26T15:46:36Z

In reply to nevent1q…jsr5
_________________________

I like their aggressive timeline, but I'm not sure there's any specific argument or reason that explains why it should be expedited. Am I missing something?

Is there a shorter reference? Written words work better for me ...

2026-03-25T10:07:20Z

In reply to nevent1q…6lwg
_________________________

Is there a shorter reference? Written words work better for me than videos. Ironic, I know :)

In this household we don't say "The young people ...

2026-03-25T08:43:35Z

In this household we don't say "The young people don't work anymore", instead we say "surveillance capitalism, the ad industry and big tech have broken our attention span using mobile phones, notifications and social media FOMO" and I just think that's beautiful.

Had to explain to the kids (H is 10 and L is 8 year old) why work ...

2026-03-13T12:18:49Z

Had to explain to the kids (H is 10 and L is 8 year old) why work has been hectic the last couple of weeks (lots of security bugs). Couple of days later, L explained her granddad on the phone what a stack buffer overflow is. So proud :)

Composing Sanitizer configurations ...

2026-03-07T22:18:31Z

Composing Sanitizer configurations (https://frederikbraun.de/composable-sanitizers.html): The HTML Sanitizer API allows multiple ways to customize the default allow list and this blog post aims to describe a few variations and tricks we came up with while writing the specification.

New blog post: Perfect types with `setHTML()` - ...

2026-03-07T21:37:00Z

New blog post: Perfect types with `setHTML()` - https://frederikbraun.de/perfect-types-with-sethtml.html - TLDR: Use require-trusted-types-for 'script'; trusted-types 'none'; in your CSP and nothing besides setHTML() works, essentially removing all DOM-XSS risks....

hey, this is cool. Thanks for sharing

2026-03-06T14:33:14Z

In reply to nevent1q…nnn3
_________________________

hey, this is cool. Thanks for sharing

right. the guarantees of private mode are pretty much orthogonal ...

2026-02-26T15:38:46Z

In reply to nevent1q…tqt6
_________________________

right. the guarantees of private mode are pretty much orthogonal to the idea of persisting any kind of state :((

oh that sucks. When you go to the history menu, is "Restore ...

2026-02-26T14:11:09Z

In reply to nevent1q…9hph
_________________________

oh that sucks. When you go to the history menu, is "Restore previous session" greyed out or does it work?

I wrote a blog post 😊 If you replace all the innerHTML with ...

2026-02-24T13:07:15Z

I wrote a blog post 😊

If you replace all the innerHTML with setHTML, you will be free from XSS and other injection attacks. Goodbye innerHTML, Hello setHTML

https://hacks.mozilla.org/2026/02/goodbye-innerhtml-hello-sethtml-stronger-xss-protection-in-firefox-148/

Now that we have the infinite monkeys as software, could someone ...

2026-02-13T12:39:16Z

Now that we have the infinite monkeys as software, could someone let them know that we don't need someone to write the complete works of Shakespeare again? We have libraries for that.

Nostr event nevent1qqspv06uyrp98aksgcyhulfvx4rz4jmf8wgwh9jak9gfwgcpwh065lszyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvug564c9

2026-01-20T07:34:41Z

https://discernibleinc.com/blog/3-counterproductive-communication-patterns-holding-back-security-researchers - so simple, yet so good advice.

But then I discovered https://github.com/builtbybel/Winslop. A ...

2026-01-17T09:48:33Z

In reply to nevent1q…v6vt
_________________________

But then I discovered https://github.com/builtbybel/Winslop. A tiny tool helped a lot in disabling all of that crap. Nice and simple and it gave me a feeling of control. Thank you Belim! :)

(Yes, this is a lesson in empathy wirh the user and pretty much accidentally a metaphor that somehow connects to my employer and their main product. No, I will not take any further questions.

P.S. I would prefer arkenfox as a config system over any kind fork)

2/2

Alas, while I wish I could just try bazzite, our family gaming ...

2026-01-17T09:45:15Z

Alas, while I wish I could just try bazzite, our family gaming computer has to stay on Windows for compatibility reasons..

I was feeling worse and worse with every update. Edge overriding Firefox, Copilot, Recall. Just imagine this hardcore security nerd in conflict between"always patch all family systems on day 1" and THIS. Gah.

A dot-release 147.0.1 should be available by now, fixing this ...

2026-01-16T19:26:25Z

In reply to nevent1q…s5av
_________________________

A dot-release 147.0.1 should be available by now, fixing this issue. :)

Hello internet, I am actively looking for speaking opportunities ...

2026-01-09T19:53:20Z

Hello internet, I am actively looking for speaking opportunities in central Europe (e.g., a train-ride from Berlin) to talk about Web security, XSS, `innerHTML` and the Sanitizer API. Ideally to an audience of web developers, framework engineers and the like :)

it's been a while but I liked https://ropemporium.com/ when I ...

2026-01-07T12:38:52Z

In reply to nevent1q…je0x
_________________________

it's been a while but I liked https://ropemporium.com/ when I got back in the game

Fwiw, we don't do CVSS for Firefox CVEs and someone is doing ...

2026-01-01T12:46:30Z

In reply to nevent1q…w2yh
_________________________

Fwiw, we don't do CVSS for Firefox CVEs and someone is doing nonsense-CVSS numbers for us. (People downstream look at the nonsense-CVSS and make decisions based on them, which saddens me. But I don't think we should play the cvss game)

Hey #39c3, Come see my lightning talk on a sage variant for ...

2025-12-27T08:44:54Z

Hey #39c3, Come see my lightning talk on a sage variant for `.innerHTML ` that is built right into the browser. https://events.ccc.de/congress/2025/hub/event/detail/lightning-talks-tag-2 on Day 2.

Do I know anyone working on freedesktop.org / mesa? A direct ...

2025-12-09T07:37:29Z

Do I know anyone working on freedesktop.org / mesa? A direct contact would be ideal :)

New blog post: Why the Sanitizer API is just `setHTML()` - ...

2025-12-07T21:14:39Z

New blog post: Why the Sanitizer API is just `setHTML()` - https://frederikbraun.de/why-sethtml.html

New blog post. Something off-topic to feed the search engine. A ...

2025-12-07T13:00:04Z

New blog post. Something off-topic to feed the search engine. A bug in Lego Star Wars: The Complete Saga (2007). https://frederikbraun.de/lego-star-wars-complete-saga-c3po-bug.html

Hello from Düsseldorf. I am at German OWASP day and you can ...

2025-11-26T08:18:11Z

Hello from Düsseldorf. I am at German OWASP day and you can follow along too. There’s a live stream on https://media.ccc.de/.
Full program at https://god.owasp.de/2025/

Talks are about all sorts of appsec things, from langsec over pdf to passkeys and so on. All talks will be recorded :)

Do I know someone who is (remotely) involved in running the `.hm` ...

2025-11-24T09:30:24Z

Do I know someone who is (remotely) involved in running the `.hm` domain registry?

spent 6 hours on a query last week. I am not sure it was correct.

2025-11-23T17:53:27Z

In reply to nevent1q…w38s
_________________________

spent 6 hours on a query last week. I am not sure it was correct.

I meant the 1990s IDE thing, like in Delphi, where you would just ...

2025-11-13T08:22:50Z

In reply to nevent1q…qzda
_________________________

I meant the 1990s IDE thing, like in Delphi, where you would just drag and drop interactive elements on canvas and when you hit build, you get an app. But you do you :)

When is someone finally building the rapid application ...

2025-11-13T07:56:29Z

When is someone finally building the rapid application development IDE for the web?

Has anyone EVER written a switch/case statement WITHOUT ...

2025-10-31T11:32:31Z

Has anyone EVER written a switch/case statement WITHOUT forgetting `break` in their first run?

Didn't somebody recently ask me what the Sanitizer API status ...

2025-10-28T08:49:07Z

Didn't somebody recently ask me what the Sanitizer API status is? Well anyway, it's in Firefox Nightly for testing now.

TLDR:
```diff
- foo.innerHTML = DOMPurify.sanitize(untrusted);
+ foo.setHTML(untrusted);
```

Download on https://nightly.mozilla.org

1900s: Computers allow me to do things. Early 2000s: Computers do ...

2025-09-16T10:22:29Z

1900s: Computers allow me to do things.
Early 2000s: Computers do things for me.
Now: Computers do things to me.

thanks. Surprisingly long to leave it unpatched?

2025-07-29T19:43:58Z

In reply to nevent1q…x24d
_________________________

thanks. Surprisingly long to leave it unpatched?

I was thinking of ...

2025-07-14T11:40:05Z

In reply to nevent1q…v63k
_________________________

I was thinking of https://gitlab.gnome.org/GNOME/libxslt/-/issues/139#note_2421963 in particular.

(I did see the presentation, I was there :))

Did I read https://gitlab.gnome.org/GNOME/libxslt/-/issues/139 ...

2025-07-14T10:38:59Z

In reply to nevent1q…d0ck
_________________________

Did I read https://gitlab.gnome.org/GNOME/libxslt/-/issues/139 correctly that they disclosed this even though some affected browser vendor (cough cough) is still affected? Feeling bad for them.

"Belgium is unsafe for CVD" - ...

2025-07-08T08:54:31Z

"Belgium is unsafe for CVD" - https://floort.net/posts/belgium-unsafe-for-cvd/ by Floor (npub1sjf…h6tr)

Do you want full disclosure, Belgium?
This is how you get full disclosure.

(cf. https://mastodon.social/@floort/114806039846236450)

Nostr event nevent1qqs0dpg6q9hyz9kjukw04a263dc00pd8flayjtugfwdl80rc7qgn30szyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvug8ueas

2025-07-05T08:58:49Z

Fediverse. Gnome or KDE?

The fact that these apps can launch local web servers to collude ...

2025-06-05T08:23:38Z

In reply to nevent1q…hcdt
_________________________

The fact that these apps can launch local web servers to collude with tracking scripts and completely de-anonymize the users is wild. It's appalling. But here is what's not new:

Native apps from huge advertising companies (née "social" networks) are nothing but a slot machine where you pay with your data.

Get off these apps. Remove them now. Best yet, get off these addictive shit sites. And if you can't, visit them in at truly privacy preserving browser. 2/3.

Great research by folks from IMDEA Networks, Radboud University, ...

2025-06-05T08:23:38Z

Great research by folks from IMDEA Networks, Radboud University, Digital Security Group & iHub, and COSIC, KU Leuven on the "localmess" disclosure (https://localmess.github.io/).

We have always known that native mobile apps will maximize the data collection and use whatever the operating system gives them as long as it doesn't cause a prompt (and often times even if it causes a prompt). 1/3

Tired: Naming your conference rooms after regions and actual ...

2025-05-08T12:37:55Z

Tired: Naming your conference rooms after regions and actual places. "I am in Spadina", "I am in Burgundy"

Wired: Giving your conference rooms fictional names: "I am in Mordor", "I am in agony"

I am writing the approximately third blog post referencing ...

2025-04-23T13:21:16Z

I am writing the approximately third blog post referencing "The Science of Insecurity" from Meredith L. Patterson and Sergey Bratus at the 28c3.
At this point, I consider it necessary education for security people out there (and I really do not say these things lightly).
https://www.youtube.com/watch?v=3kEfedtQVOY

New blog post: With Carrots & Sticks - Can the browser handle ...

2025-04-10T08:43:08Z

New blog post: With Carrots & Sticks - Can the browser handle web security? https://frederikbraun.de/madweb-keynote-2025.html - This is the blog version of my keynote from MADWeb 2025 earlier this year. It's about how web security could become the browser's responsibility.

Nostr notes by Frederik Braun �

yeah, we will see how things go. Due to *gestures wildly* recent ...

Nostr event nevent1qqsft3shvygexgzwzn43yjethngpvj25l7dh74ge0m092m7lnhu5gfszyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvumjk8w2

You can just click the bugs and see the attachments? :)

You'll see attachments in some of the bugs. We asked the LLM ...

When we said that we found and fixed hundreds of bugs in Firefox ...

Nostr event nevent1qqsq6sst4v8h2net43vje59hfxz62r6vdaplv94g7yqxj8zatj0mauczyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvuy8d5lw

did the vibes take you? :P

The SSD storage thing is a bit concerning from a pricing ...

What Mythos access got us. Now public. ...

Nostr event nevent1qqsfqajsxsgxe97df3d3tgn3wnx04ejqyey6ezl48ms0lfd38aw0egqzyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvuxlgqp5

ok cool, ich hab jetzt einen Meshcore Solarnode auf dem fünften ...

lots of people are being / were hit by LLM-slop bugs first and ...

they likely advertise specifically to your area because of the ...

This is to let you know that ...

Do I know someone who works on security for freedesktop.org ...

erinnert mich daran, wie ich das gleiche Softwareprojekt mehrfach ...

RE: https://glauca.space/@r/116434222890632831 @npub1dey…2ty4 ...

browsers have reacted and this kind of attack should no longer be ...

Ach, schade. Vielleicht klappt es beim nächsten. Ein Stoffteil ...

das nervt mich am meisten. man müsste irgendso eine art ...

Yeah, I have a take or two. What I like about David's idea is ...

Sales email started with a poem. I must have put a prompt ...

RE: https://infosec.exchange/@attackanddefense/116418875523198922 ...

+1 von mir. Würde such zum Telefon greifen

This will be like what AddressSanitizer did to fuzzing but ...

there was some early research that claimed a correcter / better ...

None of this is hype. Just look at the increasing length of the ...

oh, I had no idea Chrome had a guest mode. Firefox should steal ...

should be easy to do, too. Could just use a throwaway profile.

yep this is still largely subsidized by cheap inference and ...

RE: https://infosec.exchange/@metacurity/116397875382563012 Must ...

not really. Some bugs are truly hard to find with fuzzing and are ...

this is a good change. We adjusted the Firefox bug bounty policy ...

I got into a (mild) argument multiple times with our localizers ...

Will damit sagen: Es ist viel Hype und daher auch viel ...

ach und noch was: Ich wünscht es wäre anders :)

Deine Kritik ist nicht so ganz angebracht: 1) Zu Firefox: alle ...

looks so pretty, I can’t shake the feeling it was trained for ...

true, using a mozilla build with our updater will ensure this ...

I think your configuration might be borked. We do not force a ...

every browser, every library that does media parsing, ...

duuuuude, just enable session restore 😓

I got the neon pink "motherfucking devtools" sticker on ...

ist euch aufgefallen dass das Sommerloch-Tier dieses Jahr echt ...

her designs were amazing :)

guess if nobody disagrees, I will have to blog post. That’ll ...

not CSS-only as I originally thought. But still pretty cool. I ...

…progress still remains as an inventive to get it done as first ...

@npub1k8h…4fm8 are you still involved with lakectf? Were you ...

… and @npub1s05…tnkj had a good tutorial including tips on ...

my take: if you don’t need encryption (because you self host at ...

did you see https://alexandmanu.com/blog/immich-vs-ente-photos/?

this.

OH: "Mich würd das auch total verstören, wenn ich es nicht ...

@npub1xcc…khle Have you seen this? You must see this :) ...

sehr cool! Glückwunsch! :)

I am still very much grappling with a conclusion. But it's ...

codeberg seems cool but it doesn't really allow private repos

RE: https://chaos.social/@NikTheDusky/116296542412842528 Haha. A ...

Looks like there’s s whole new meaning to "bugs are ...

I like their aggressive timeline, but I'm not sure ...

Is there a shorter reference? Written words work better for me ...

In this household we don't say "The young people ...

Had to explain to the kids (H is 10 and L is 8 year old) why work ...

Composing Sanitizer configurations ...

New blog post: Perfect types with `setHTML()` - ...

hey, this is cool. Thanks for sharing

right. the guarantees of private mode are pretty much orthogonal ...

oh that sucks. When you go to the history menu, is "Restore ...

I wrote a blog post 😊 If you replace all the innerHTML with ...

Now that we have the infinite monkeys as software, could someone ...

Nostr event nevent1qqspv06uyrp98aksgcyhulfvx4rz4jmf8wgwh9jak9gfwgcpwh065lszyqksl098zqfafzqk7k33cwtcq4tzfk8aap87et97h0m9j5jdnsgvug564c9

But then I discovered https://github.com/builtbybel/Winslop. A ...

Alas, while I wish I could just try bazzite, our family gaming ...

A dot-release 147.0.1 should be available by now, fixing this ...

Hello internet, I am actively looking for speaking opportunities ...

it's been a while but I liked https://ropemporium.com/ when I ...

Fwiw, we don't do CVSS for Firefox CVEs and someone is doing ...

Hey #39c3, Come see my lightning talk on a sage variant for ...

yeah, we will see how things go. Due to gestures wildly recent ...