Sjoerd Langkemper

I came to the same conclusion. Many string comparison implementations don't actually compare one character at a time. In one case strcmp seemed to compare eight characters at a time, so you would need to guess eight characters correctly to get a time difference. Glibc memcmp can compare 32 bytes at a time. In C# the timing of string compare depends on whether it does Unicode normalization or not. Even then, the difference is less than a nanosecond per compared character. It is not as straightforward that every string comparison between sensitive data and user input is at risk of timing attacks. https://www.sjoerdlangkemper.nl/2024/05/29/string-comparison-timing-at…

This one surprised me: https://www.sjoerdlangkemper.nl/2024/06/26/htmx-content-security-polic… <div hx-disable> <%= raw(user_content) %> </div> So, I get that `raw` prevents htmx from being used. I get that `<script>` still works. But I find it scary that if `user_content` is `</div><div>...` that is actually injected, as raw HTML. I would expect that the `<%= raw(user_content) %> only has access to contents of the div it is in itself, and nothing more. But instead I understand that the HTML is injected as text (?) and then re-parsed (?).

JVM 8 isn't an implementation, it's a specification. Assuming you mean oracles implementation, it's likely that it is. https://www.sjoerdlangkemper.nl/2016/05/22/should-passwords-be-cleared… http://www.daemonology.net/blog/2014-09-04-how-to-zero-a-buffer.html https://man.openbsd.org/explicit_bzero.3

> just like they failed to implement per-site cookies To be fair there has been an ugly solution to this recently, the `__Host-` cookie prefix: https://www.sjoerdlangkemper.nl/2017/02/09/cookie-prefixes/

Everything else aside (where does one put the sleep?) probably stuff like https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/

> Several months ago, I built a project using USB host mode on a Raspberry Pi Pico, which uses a USB numpad to pass messages to an MQTT server. This uses the Rp2040's USB host mode https://gitlab.com/baiyibai/pico-w-usb-host-mqtt-numpad Maybe I read the README a little to quickly, but you seem to be using standard WiFi for communication. As stated in other comments in this thread, this solution already exists. USB through Ethernet extension are well established and you can already connect this to a WiFi extender. What I was thinking was to achieve this with a simple radio connection that do not need configuration or even a WiFi network to function. Just plug it in and it works. Here's a sketch of the high level concept I had in mind: https://ibb.co/VD2d9XM Is your point that once you can do that with Wi-Fi it is trivial to do it with any type of radio connection? > From my limited understanding, it should be possible to pass these USB messages from HID client to HID host and vice-versa. Someone did this here using Etherkey and an ATmega32u4: https://www.sjoerdlangkemper.nl/2022/11/16/running-etherkey-on-arduino… > it seems the TinyUSB library doesn't provide the full bitmask resolution necessary If my understanding is correct, Arduino already provides low level USB controls: https://shorturl.at/joSWZ. All in all, it seems to me that there is an opportunity here but unfortunately this requires skills in electronic, radio and USB protocol that I do not…

From their links: This feature adds a set of restrictions upon the names which may be used for cookies with specific properties. These restrictions enable user agents to smuggle cookie state to the server within the confines of the existing "Cookie" request header syntax, and limits the ways in which cookies may be abused. In a nutshell: `__Secure-` cookies have to have the `Secure` flag, and `__Host-` cookies have to have `Path=/`, can't have `Domain`, and might require `Secure` (depending on the setter). From: https://www.sjoerdlangkemper.nl/2017/02/09/cookie-prefixes/ Cookie prefixes make it possible to flag your cookies to have different behavior, in a backward compatible way. It uses a dirty trick to put a flag in the name of the cookie. When a cookie name starts with this flag, it triggers additional browser policy on the cookie in supporting browsers. The __Secure- prefix makes a cookie accessible from HTTPS sites only. A HTTP site can not read or update a cookie if the name starts with __Secure-. This protects against the attack we earlier described, where an attacker uses a forged insecure site to overwrite a secure cookie.

A few more links that I collected recently on the topic https://github.com/golang/go/issues/73626 https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF#def… https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Se… https://web.dev/articles/fetch-metadata https://appliedgo.net/spotlight/csrf-dont-mess-with-my-site/ And some older ones that focused on Origin header rather than sec-fetch-* https://www.sjoerdlangkemper.nl/2019/02/27/prevent-csrf-with-the-origi… https://www.brandur.org/fragments/origin https://srungta.github.io/blog/start-right/ui-nonce