hostmonster-Host Unlimited Domains on 1 Account   coolhandle offering reliable webhosting since 2001
Unlimited Hosting Space - FREE Site Builder   Smart Website Solutions for Your Small Business=

Web Development Reading List #171: Leaks, SHA-1 Collision, And Brotli

Web Development Reading List #171: Leaks, SHA-1 Collision, And Brotli

Phew, what a week! Due to an HTML-parsing bug, Cloudflare experienced a major data leak, and the first practical collision for SHA-1 was revealed as well. We should take these events as an occasion to reconsider if a centralized front-end load balancer that modifies your traffic is a good idea after all. And it’s definitely time to upgrade your TLS-certificate if you still serve SHA-1, too. Here’s what else happened this week.

News Link

General Link

Tools Workflows Link

  • Joseph Zimmerman introduces us to Webpack6. What I really like about this article is that it’s not another article sharing pre-built sets of configurations but that it explains every detail step-by-step.
  • Oh shit, git!7 Don’t be afraid of git anymore thanks to this emergency guide that helps you solve the most common problems with the versioning system.
Oh shit, git!8
Something went wrong in Git, but you don’t know how to get yourself out of the mess? “Oh shit, git!9” has got your back.

Security Link

  • Mitigating Cross-Site Request Forgery attacks has never been easy. Luckily, it seems that we now got a proper solution for it: Same-Site Cookies10. The only thing you need to do to make it work is adding SameSite to your existing Set-Cookie header. Of course, you should know how same-site cookies differ from “normal” cookies, but for most sites this should be easy to implement.
  • A joint-venture of five journalists researched how the private security industry works and what price we as citizens pay for our security11.

Privacy Link

  • It’s not your computer that is the most vulnerable device, it’s your smartphone. In fact, for a small amount of money, everyone can easily buy spyware12 that works on most Android phones. For iOS, things look a bit better unless the device is jailbroken. But this doesn’t necessarily mean that spyware doesn’t exist for that system as well.

Web Performance Link

Brotli support14
With support for Chrome, Firefox, Opera and the Android browser, Brotli does a better job at compressing resources15 than its predecessor Gzip.

JavaScript Link

Going Beyond… Link

AirInk19
Turn something ugly into something beautiful: A team at the MIT Media Lab developed artist’s ink made from air pollution. (Image credit20)

And with that, I’ll close for this week. If you like what I write each week, please support me with a donation21 or share this resource with other people. You can learn more about the costs of the project here22. It’s available via email, RSS and online.

— Anselm

Footnotes Link

  1. 1 https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
  2. 2 https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
  3. 3 https://webkit.org/blog/7423/release-notes-for-safari-technology-preview-24/
  4. 4 https://blog.mozilla.org/security/2017/02/23/the-end-of-sha-1-on-the-public-web/
  5. 5 https://ana-balica.github.io/2017/02/21/code-review-checklist/
  6. 6 https://www.smashingmagazine.com/2017/02/a-detailed-introduction-to-webpack/
  7. 7 http://ohshitgit.com/
  8. 8 http://ohshitgit.com/
  9. 9 http://ohshitgit.com/
  10. 10 https://scotthelme.co.uk/csrf-is-dead/
  11. 11 https://thecorrespondent.com/10221/security-for-sale-the-price-we-pay-to-protect-europeans
  12. 12 https://motherboard.vice.com/en_us/article/i-tracked-myself-with-dollar170-smartphone-spyware-that-anyone-can-buy
  13. 13 https://www.voorhoede.nl/en/blog/static-site-implosion-with-brotli-and-gzip/
  14. 14 https://www.voorhoede.nl/en/blog/static-site-implosion-with-brotli-and-gzip/
  15. 15 https://www.voorhoede.nl/en/blog/static-site-implosion-with-brotli-and-gzip/
  16. 16 https://medium.com/@matuzo/writing-javascript-with-accessibility-in-mind-a1f6a5f467b9
  17. 17 https://www.kickstarter.com/projects/1295587226/air-ink-the-worlds-first-ink-made-out-of-air-pollu
  18. 18 http://transit.iee.ucsb.edu/research/computing/projects
  19. 19 https://www.kickstarter.com/projects/1295587226/air-ink-the-worlds-first-ink-made-out-of-air-pollu
  20. 20 https://www.kickstarter.com/projects/1295587226/air-ink-the-worlds-first-ink-made-out-of-air-pollu
  21. 21 https://wdrl.info/donate
  22. 22 https://wdrl.info/costs/

↑ Back to top

Tweet itShare on Facebook

Article source: https://www.smashingmagazine.com/2017/02/web-development-reading-list-171/

Tags:


Submit a Review




If you want a picture to show with your review, go get a Gravatar.

1&1 has shared hosting and dedicated hosting solutions for every budget and free domains with all hosting packages!  StartLogic - Affordable hosting: Free setup/domain, unlimited emails, PHP, mySQL, CGI, FrontPage. As low as $3.95/month
Cloud ecommerce platform delivers more traffic, higher conversion and unmatched performance

© Copyright 2008 Tyconia International, Inc. All Rights Reserved.