Crash, Burn, Report

on YouTube ↗01h 02m

" summary

Explains how browsers send native JSON telemetry via the Reporting API to any off‑domain endpoint, using a Report-To header (JSON with max-age, endpoints, includeSubdomains) so cached policies let broken clients report DNS/TCP/TLS/HTTP failures; demonstrates Network Error Logging payload fields (type, age, samplingFraction, TLS.certificate_date_invalid) and sampling to avoid floods. Shows CSP and deprecation/intervention/crash reports, and how email protections (SPF DKIM + DMARC reports) route phishing to spam. Presents a working Report URI ingestion service.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 0:10Crash, Burn, Report
3. 9:35Report-To
4. 16:13NEL Header
5. 17:16NEL Reporting
6. 29:26Deprecation Report
7. 33:05Intervention Report
8. 35:07Crash Report
9. 35:56Browser Reporting Capabilities

" related talks

• 01h 00mCrash, Burn, ReportScott Helme · NDC Security Oslo 2019
• 59mCrash, Burn, ReportScott Helme · NDC London 2019
• 22mThe other side of webapp securityLuka Kladaric · WebCamp Zagreb 2018
• 01h 00mContent Security Policy: From newbie to advancedHalvor Sakshaug · NDC Security 2025
• 20mNetwork Error Logging: Client side measurement of end to end web service reliabilityIlya Grigorik, Douglas A. Creager, Lily Chen, Misha Efimov, Ben Jones, Harsha V. Madhyastha, Sam Burnett, Pavlos Papageorge, Brian Rogan, Charles Stahl, Julia Tuttle · NSDI 2020
• 01h 00mHack to the FutureTroy Hunt · NDC Sydney 2019
• 40mContent Security Policy to the RescueDheeraj Joshi · PHP UK Conference 2018
• 40mObservability for All!Carly Richmond · Berlin Buzzwords 2025