The Curse of Cross-Origin Stylesheets - Web Security Research

In 2017 a cool bug was reported by a researcher, which lead me down a rabbit hole to a 2014 and even 2009 bug. This provides interesting insight into how web security research looks like.

-=[ 🔴 Stuff I use ]=-

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#SecurityResearch

[hugowoesthuis]

You should know that those 20 minutes feel like 5 minutes. Great job and keep em coming!

[leanobajio]

Reenactment of historic bug discussions, please!

[indycinema]

I cannot believe you've been making videos like this for years and I just found you. Insane.

[kkmetcom]

I was having insomnia and I slept listening to your bug stories, thanks, you're perfect in many ways, this now is one of them

[serkandevel]

2:15 *But let's keep this bug Chrome-private whilst we debate what can be done (and protect our customers first:)*
Chrome developers are very responsible

[DanielDogeanu]

I am totally in favor of a stricter syntax. Let developers to receive 1 gazillion warnings and errors! I don't know why HTML and CSS has such relaxed syntax in the first place. Even noobs can write proper syntax if you make them.

[noselund]

Took me way too long to realize that the intro animation is a buffer being overflowed.

[catlord]

when a software engineer talks about past:
...evolved historically ...
*2009*

[fluffy_tail]

"the internet is broken because cross-domain"
I'd say that this video proves that is broken because all the browser parsers are super lax to allow even the worst webdev do put out their garbage, which in turn allows more terrible devs to join the field successfully, thus perpetuating the cycle

[_iphoenix_]

Fantastic video, as always. I really like the way that you showed the connections between the bug reports.

[justanormalperson]

Good video, I really like watching these videos with popcorn.

[abbottabbott]

This was really interesting / informative to watch. I would perhaps come across some of this on the web on in trackers and it would all go right over my head, having you explain it I now actually understand what was going on. Thank you!

[GoodBalak]

I like how the fix in the end was a simple restriction to .css file type. Lol.

[imjustsomepersonontheinternet]

This stuff is freaking fascinating. Thank you.

[jwrm]

Thanks for the explanation. The bounty is great for beer money but not to live from. You would need to find 2 of these bugs a month and get the guaranteed payout to survive.

[damejelyas]

your video is like a music to my ears

[bandie]

"okay it's fixed by checking the content-type. case closed". and then they needed 3 years to ask the question: "what if there is no content-type header!? you know when our web browser happens to be a local file browser because «do one job, do it well» ... oh wait..."

[galqiwi]

Thanks you 4 yours videos, it's very interesting to learn something new in such close-to-life subjects.

[Rednesswahn]

Great stuff, I'd love to see more of this kind of stuff.

[the_rahn]

Very interesting and well explained, greetings from Spain!