Bram Esposito

Tag: security

  • The Public Suffix List

    While researching security and how it’s done on github.io as an example, I ran into the Public Suffix List today. It’s actually fascinating to skim through the list itself.

    It’s wild that such a low-tech approach is the solution to a security feature in browsers. Even more so when you realize that it takes some time to update the PSL in your browser. For example, chatgpt.site was added to the list on June 9th but is not yet in the list for Google Chrome (blob: 5eabc92d51226369bf800473de55787951809886) . And cookies are still set for the top-level domain in my version (148.0.7778.181):

    Screenshot of the cookies on subdomains of chatgpt.site, showing top level cookies being set and accepted by Chrome.

    Firefox also accepts these cookies, even though their version of the list is more recent and they should have an auto update mechanism in place.

    Daniel Stenberg, creator of curl, describes the PSL as follows:

    If you ask me, this is one of the ugliest parts of cookie functionality.

    Daniel Stenberg, creator of curl

    I am inclined to agree with that.

  • Incredible insecure Wi-Fi repeater

    Fascinating to watch Low Level “hack” into this Wi-Fi repeater from Temu. It looks like they removed it, but it’s still available from bol.com, amazon, ali express, etc

    It’s so easy to put an insecure product on the market these days, but here even the basic precautions were not taken. Crazy.