Build Strong Defenses By Participating In Standards!
summary
Standards work described here names concrete fixes, implementations and outcomes: Shadow Realms is at stage 2.7 with browser patches behind flags and aims to isolate plugin code synchronously by allowing only primitives across a boundary; locking down Object.prototype stopped a proxy-based same‑origin leak, Firefox ships that change without site breakage and that enabled proxies to land. trusted types already ships in Chrome and is being formalized with Safari/Firefox implementations underway. Supply‑chain spec Cyclone DX 1.6 is now an Ecma standard.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:33Anyone can shape standards
- 3:39JavaScript standards development
- 5:20OWASP Top 10 with Shadow Realms
- 10:22Same-origin policy in JavaScript
- 19:41Trusted Types for injection prevention
- 27:32Cyclone DX supply chain security
- 33:34Contributing to secure standards
related talks
47mD2T2 - Defense-in-Depth Techniques for Modern Web Apps
11mWhat your browser can teach you about software security
18mWeb Developer Security: Best Practices & Beyond
58mPractical Secure Development and Operations with JavaScript in 2020
16mFrom security as opt-in to security by default
59mProactively defending your business
19mWeb Platform Security
59mThe Final Frontier: Security APIs in Modern Browsers