The hottest Web Security Substack posts right now

And their main takeaways
Category
Top Technology Topics

What’s up Python? Astral's new type checker, McGugan's new tool and Django new CSRF protection

Bite code! • 1467 implied HN points • 30 Dec 25
🕹 Technology Web Security
  1. ty is a very fast new type checker and LSP that gives instant editor features like go-to-definition, completions, and automatic imports, though its type checking is still beta and misses some cases.
  2. Django is moving toward modern CSRF protection using Sec-Fetch-Site/Origin headers so apps can avoid embedding CSRF tokens in forms, making CSRF handling more transparent and reducing token errors over time.
  3. toad is a new terminal AI chat UI that works with many LLM providers and offers code highlighting, editable history, and command completion to give a smooth, developer-friendly chat experience.

Vegetarians, spam, spite programming, and drug names

DYNOMIGHT INTERNET NEWSLETTER • 640 implied HN points • 08 Jan 26
🕹 Technology Web Security
  1. Reported percentages of vegetarians by country can be wildly inconsistent, so surprising rankings often reflect different surveys and measurement challenges rather than true differences.
  2. A domain can end up on anti-spam blocklists even without sending email or hosting malware, and the removal/verification process can be opaque and hard for individuals to navigate.
  3. Generic drug names are built from meaningful prefixes and suffixes that hint at drug class and mechanism (e.g. -ib for inhibitors, -vir for antivirals), yet there’s no single, easy-to-use comprehensive reference or visualization for the full naming system.

Microsoft Sentinel SOC 101: How to Detect and Mitigate Cross-Site Scripting (XSS) Attacks with Microsoft Sentinel

Rod’s Blog • 59 implied HN points • 21 Sep 23
🕹 Technology Web Security
  1. XSS attacks can be classified into three main types: Stored XSS, Reflected XSS, and DOM-based XSS, each with unique methods of execution and potential risks.
  2. To effectively detect and mitigate XSS attacks, it's crucial to understand common attack vectors like input fields, URL parameters, cookies, HTTP headers, and third-party scripts.
  3. A combination of Azure Web Application Firewall (WAF) and Microsoft Sentinel offers robust protection against XSS attacks, providing tools for detection, investigation, and response.

Let's Talk About Malicious Browser Extensions: Part 2

!important • 43 implied HN points • 13 Feb 25
🕹 Technology Web Security
  1. Malicious browser extensions can steal sensitive information like passwords and cookies. This puts users at risk of losing their accounts and personal data.
  2. In workplaces, these risks are even more serious because a breach can affect the whole organization and its customers. It's crucial for businesses to be aware of these dangers.
  3. Many security professionals need better training and tools to recognize the risks of browser extensions and to protect their systems effectively.

Entrust mis-issues a certificate, Refuses To Follow CA/B Rules

Musings about WebPKI and Public Trust • 8 HN points • 15 Mar 24
🕹 Technology Web Security
  1. Certificate Authorities can face incidents like misissuance or non-issuance, with misissuances often caused by human error or software bugs.
  2. Baselining Requirements set by the CA/B forum provide rules for dealing with certificate misissuances, including the timeline for revocation.
  3. Entrust's recent incident highlights a misissuance dilemma, where they continued misissuing certificates and refused to follow the proper revocation process, impacting thousands of Extended Validation certificates.
Get a weekly roundup of the best Substack posts, by hacker news affinity:

The .zip domains are a good idea

Cybersect • 19 implied HN points • 12 May 23
🕹 Technology Web Security
  1. Google offering .zip domains sparked outrage in the cybersec community.
  2. Intolerance for security issues can lead to positive changes in cybersecurity practices.
  3. Challenging the status quo in cybersecurity can drive improvements over time.

Watch your ass - Adobe Flash zero-day attack in the wild

Thái | Hacker | Kỹ sư tin tặc • 0 implied HN points • 28 May 08
🕹 Technology Web Security
  1. There is a new Adobe Flash zero-day attack happening, exploiting a vulnerability that is being injected into third-party websites to redirect users to malware-laden servers.
  2. Consider using NoScript with Mozilla Firefox to block potentially vulnerable plugins like Flash, Java, Silverlight, and QuickTime, preventing exploitation of security vulnerabilities.
  3. A whitelist-based pre-emptive script blocking approach can be more effective in preventing security issues than traditional methods.

Cập nhật TetCon Saigon 2015: Hai bài đầu tiên

Thái | Hacker | Kỹ sư tin tặc • 0 implied HN points • 15 Dec 14
🕹 Technology Web Security
  1. TetCon Saigon 2015 aims to provide attendees with practical experiences and the latest research insights
  2. One talk at TetCon Saigon 2015 will discuss the Rosetta Flash attack technique that found vulnerabilities in major websites
  3. Another talk will highlight the importance of correctly implementing TLS, showing that spending more money does not always equate to better security measures

Chương trình chính thức của TetCon Saigon 2015

Thái | Hacker | Kỹ sư tin tặc • 0 implied HN points • 03 Jan 15
🕹 Technology Web Security
  1. The TetCon Saigon 2015 event featured topics on web security, Bitcoin, and software vulnerabilities.
  2. Speakers discussed innovative projects and tools related to anonymous messaging, cryptocurrency, and reverse engineering.
  3. The event catered to a variety of interests, from earning money through security loopholes to analyzing malware targeting activists.