Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Form hijacking is where an attacker exploits an HTML injection vulnerability by utilizing the formaction attribute or injecting their own form, thereby bypassing CSP. This is possible because the form-action directive was added in CSP v2 and is not covered by default-src. This post lists options to fix this and presents an overview of different scans in Burp Suite related to CSPs.
This post looks at statistical trends of vulnerabilities in the GitHub Advisory Database. The most common CWE associated with vulnerabilities was cross-site scripting. Maven was the ecosystem associated with the greatest number of vulnerabilities.
Sponsored
Security compliance can be complicated, especially when you’re
has everything you need to understand the process and get your SOC 2 report. Includes a free ebook, evidence collection spreadsheet [10], customizable policy templates, and an audit readiness checklist.
Secutils.dev is a versatile yet simple toolbox for security-minded engineers.
Ostorlab is a security scanning framework built for modularity, scalability, and simplicity.
Under New Management is a Chrome extension that periodically checks whether your extensions have changed owners.
The US charged ex-Google engineer Linwei Ding with stealing trade secrets related to AI and tensor processing units, including chip designs, GPU details, and cluster management software. Ding allegedly stole the data with the intent of using it at AI firms he was associated with in China. If convicted, he faces up to 10 years in prison per count.
Cybersecurity professionals are increasingly tempted to earn extra income on the dark web by offering offensive cybercrime services like phishing, crypto theft, and malicious coding. This trend is driven by layoffs, stagnant salaries, and employers unwilling to raise compensation, pitting enterprises against insiders with intimate knowledge of their vulnerabilities.
This article describes an experience with adopting passkeys. When the experience works properly, passkeys feel seamless and futuristic. There are still issues with websites adopting passkey support and interoperability between devices.
The CISA has laid out key actions for securing open source software.
TikTok sent a push notification that included a mechanism to search for representatives to its users to urge representatives to vote against an initiative to force ByteDance to divest from TikTok or face a ban.
Sponsored
Fortune 50 companies like AWS, Google, and Nvidia and fast growing startups like Vercel and Secureframe work with TLDR to reach our audience of over 4 million tech-savvy decision makers with highly customized campaigns (like this one!). We help manage your campaigns from end to end, ensuring that your performance marketing efforts hit your internal KPIs without breaking your budget. Learn more [4].
Congress wants to force TikTok to part with its Chinese parent company, ByteDance, amid concerns over national security. Despite strong bipartisan support in Congress and President Biden’s endorsement, the fate of the Protecting Americans from Foreign Adversary Controlled Applications Act remains uncertain. TikTok pushed back with a mass in-app message to US users last Thursday morning, complete with a button for calling their representatives. If the bill does become law, Apple’s App Store and Google Play will not be able to legally distribute the app in the US.
Gen Z is reshaping the customer journey. They’re departing from the linear funnel to embrace a continuous loop of inspiration, exploration, community, and loyalty. Gen Z is no longer trusting first-touch discovery executed directly by brands. Brands need to rely more on creators for discovery and ensure their top-of-funnel marketing is less sales and more engagement.
Rather than sponsoring the pricey conferences, the 42 Agency rented limousine buses to shuttle conference attendees and drove trucks with billboards. This post contains 3 guerilla tactics to use at your next conference.
This interview with MrBeast's thumbnail creator, Chucky Appleby, discusses tactics for increasing and maximizing performance on YouTube. It emphasizes the significance of trust, consistency, visual clarity, and testing to be successful.
Cracking retention enables businesses to drastically increase customer LTV and reduce customer acquisition costs. Keeping a customer costs on average 5x less than acquiring a new one, while a 5% increase in customer retention can increase company revenue by 25% to 95%. The first step to improving is to properly define the metric for your business. This article goes into detail on how to define the right retention metric, retention benchmarks, and 10 best practices to increase retention.
MyMind is an AI-powered tool designed to organize all of your notes, bookmarks, inspiration, and images in one place. The tool automatically understands what a new saved item is and remembers the important details. It offers text recognition in images, focus mode for writing and note-taking, and auto-sorted collections. Plans start at $5.99 per month.
Reddit’s new “Reddit Pro” analytics and data insights suite is designed to help brands make the most of the app and tap into the value of Reddit’s highly active niche communities. The new Pro features include post scheduling and drafts, post performance analytics, and AI-powered industry trends and engagement insights. The tool is currently available on a first-come, first-served basis - brands must sign up to use it.
This report from TikTok provides insights into how women use the platform and discusses how to integrate these insights into effective marketing strategies. It focuses on user sentiment, ad effectiveness, and creativity. The report also explores themes such as women's storytelling across generations, the platform's impact on self-discovery, and changing definitions of authenticity.
Most branded communities fail because they feel forced and overly promotional. However, Sticker Mule's recently launched community is already generating high user engagement, targeted reach, valuable data, and organic brand advocacy. The new community is a social network called Stimulus, where brands can get attention by giving away gifts, and users win them by simply interacting on the platform. To replicate this new community model, create incentives that give users a reason to return, partner with other brands to boost content supply, and host the community on your own platform to maintain control and retain data.
Recent changes by Apple and Google have undermined the reliability of email open and click data, impacting the effectiveness of email marketing campaigns. Apple's Mail Privacy Protection feature and Google Workspace's link-scanning process have distorted open and click rates, making them unreliable indicators of engagement. To mitigate this issue, email service providers could adopt technological solutions like substituting images for tracking pixels, while marketers are encouraged to rely on UTM campaign query strings for more accurate measurements.
This article reflects on the similarities between great marketing machines and Costco. It highlights the importance of multiple small factors working together rather than a single magic solution. Successful marketing operations require understanding and optimizing various interconnected elements, similar to how Costco optimizes its operations.
Failure to comply with these Meta guidelines may result in higher costs or ad rejection, with potential long-term repercussions for ad accounts or websites.
Sam Altman predicts that in 5 years' time, AI will be able to do 95% of what marketers use agencies, strategists, and creative professionals do today.
Pinterest offers tips for creating inclusive content, including integrating diversity into all stages of campaign development, diversifying visuals, and using inclusive language.
This blog explores the concept of using `infinity` within CSS, specifically in the `calc()` function, to achieve unique effects like ensuring an element has the highest `z-index`, creating extremely large elements, and dealing with browser inconsistencies. `infinity` is essentially shorthand for the largest possible value in a particular situation. This value can and will change between browsers, operating systems, and CSS properties. It can be used to create some pill shapes, hide content for screen readers, and make CSS animations.
Coroutines are functions that can be suspended and resumed while potentially passing data between suspension points. They are useful for implementing various patterns involving cooperation between different tasks or functions, such as asynchronous flows. This article demonstrates how to use coroutines to build a very flexible and simple abstraction for UI components, enabling you to split behavior and view into reusable bits, maintain internal state, and consolidate component lifecycles within a single location.
Astro is a static site generator that offers a robust development experience with TypeScript integration and built-in i18n/l10n support. Its static site generation conflicted with this developer's need for server-side locale negotiation, so they integrated a Rust web server (axum) to serve the Astro website, allowing for custom locale negotiation logic while still using Astro's advantages.
Databases often focus excessively on benchmark performance, overlooking the fact that a subjectively better user experience is often more important. The rate at which a database improves, ease of use, and how it integrates into existing workflows are all factors that can be more important when choosing a database over just raw performance. Focusing on a streamlined user experience that empowers quick analysis can sometimes offer a better edge than single-metric performance gains.
To write effective documentation, carefully choose what to document, focusing on common questions, poorly understood concepts, and information crucial for informed decisions. Understand your audience's knowledge level, tailor your language, and structure the documentation for easy navigation. Write with the future in mind by explaining the "why" behind decisions, linking to current information, and encouraging a culture of shared documentation ownership.
To make the most of a side project, start with a problem you face yourself and clearly outline goals. After that, iterate continuously and take in feedback from users honestly. The success of a side project doesn’t have to be defined solely by the money earned, but rather based on what is learned.
TanStack Store is a framework-agnostic type-safe store with reactive framework adapters. It supports React, Vue, Angular, and SolidJS. TanStack Store requires minimal setup and comes with granular APIs.
React Unforget is a compiler that analyzes React components and hooks to identify optimization opportunities and automatically inserts memoization code where it will have the most impact, reducing unnecessary re-renders and improving overall performance. It features intelligent memoization of components, hooks, and JSX elements, as well as the ability to optimize code execution even in the presence of early returns.
An onboarding library for building accessible, customizable, and persistent onboarding flows in React apps.
Google has published a whitepaper that outlines its "Secure by Design" approach, which advocates for the adoption of languages like Java, Go, and Rust to achieve high-assurance memory safety. Google has a massive C++ codebase. It will gradually adopt memory-safe languages for new code while seeking safety improvements for existing C++.
Amazon S3 is often thought of as a cloud-based file system, but it lacks important features of a traditional file system like partial overwrites. This mismatch in expectations has significant implications for software (especially databases) designed to work with filesystems as it makes them incompatible with S3. Despite this, S3 still is valuable due to its interface, high bandwidth, and low maintenance.
Git’s HEAD refers to your current location in the Git repository, indicated either by a branch name or a commit ID stored in the .git/HEAD file. HEAD can also be used as a command parameter ('git show HEAD') to reference the currently checked-out commit. Git often includes HEAD in its output (such as 'HEAD detached') to provide context about your working state within the repository.
An interactive visual site that demonstrates and compares how long certain operations (eg. L1 cache latency) take.
PlanetScale is prioritizing profitability to ensure long-term reliability and sustainability for its database services - it is removing its free tier on April 8.
To prevent context switching from affecting productivity, software engineers should block focus time on their calendars, prioritize tasks well, and take notes to minimize attention residue.
A selection of open source Next.js projects to contribute to. It can be helpful for learning how large-scale production web apps are structured.
OpenAI's chief technology officer Mira Murati questioned Sam Altman's management in front of the board last year before Altman was briefly ousted from the company. This move helped to propel the board's decision to force Altman out. Ilya Sutskever, a co-founder and chief scientist of OpenAI, expressed similar concerns. Both executives said that Altman sometimes created a toxic work environment by freezing out executives who did not support his decisions. WilmerHale, the law firm investigating the incident, is expected to release a report in the coming days that could shed more light on the board's decision.
Apple is planning to release a 20.3-inch MacBook with a foldable screen in 2027, according to Apple analyst Ming-Chi Kuo. It will have a screen measuring about 20 inches diagonally when fully expanded. The laptop is Apple's only foldable product with a clear development schedule. A foldable iPhone or iPad is not likely to come any time soon.
Novo Nordisk's new obesity treatment drug, amycretin, helped patients lose 13% of their body weight in just 12 weeks. The drug may be more effective than semaglutide. Amycretin targets GLP-1 and another hormone called amylin, both of which are believed to be linked to hunger and satiety. The drug still needs to go through much larger trials that will likely drag on for years before it will be publicly available. The results of the initial trials sent Novo Nordisk's stock rising as much as 8.3%.
Engineers from the University of New South Wales in Australia are working on a prototype solar panel implant for the retinas to restore sight. The implant converts light into electrical signals that can be directed to the optic nerve, enabling vision. Users may need to wear special glasses or goggles that amplify sunlight for the device to work. The device is still in a proof-of-concept stage - a lot more work still needs to be done before it is ready for human implantation.
Mercurial is a tool for creating and managing code changes used at Facebook. Facebook started out on Git, but it began hitting scaling limits in around 2012. Mercurial's developers were receptive to the idea of Facebook engineers contributing patches to scale it better while Git's developers were not. There were other alternatives, but all were quickly disqualified. Facebook adopted Mercurial not because it had better technology, but because the maintainers and codebase felt more open.
Grats makes building GraphQL servers as simple as writing functions. It leverages existing type annotations to automatically extract an executable GraphQL scheme from generic TypeScript resolver code. Grats makes the TypeScript implementation into a source of truth so developers don't have to worry about validating whether their implementations match their schemas.