| 00:51 | <MikeSmith> | annevk: https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 |
| 00:52 | <MikeSmith> | > I also found that, instead of making a regular AJAX request, this page instead loads an image from the Zoom web server that is locally running. The different dimensions of the image dictate the error/status code of the server. |
| 00:53 | <MikeSmith> | > One question I asked is, why is this web server returning this data encoded in the dimensions of an image file? The reason is, it’s done to bypass Cross-Origin Resource Sharing (CORS). |
| 00:56 | <MikeSmith> | see see https://fosterelli.co/developers-dont-understand-cors |
| 00:57 | <MikeSmith> | *see also |
| 00:58 | <MikeSmith> | > Anecdotally, lots of developers I’ve talked with don’t understand well how CORS works. There’s also very a generous quantity of examples from questions on Stack Overflow. Unfortunately, these are often paired with pages that recommend very insecure defaults like this one in express which would make your application vulnerable if copied verbatim. |
| 00:59 | <MikeSmith> | > I’ve seen CORS confusion from both experienced and new developers. Is the CORS API too complex and confusing, or do we only need better developer education around issues like CORS and CSP? I’m not sure, but the current approach definitely doesn’t seem like it’s working. |
| 04:29 | <annevk> | Yeah, I don’t have great ideas around CORS, though we should lock down localhost more |
| 04:37 | <MikeSmith> | annevk: what is a bit shocking about that Zoom thing is the degree to which their engineers seemed to really not have any clue how things worked |
| 04:39 | <annevk> | I don’t understand why they used an image and not JSONP |
| 04:40 | <annevk> | I’m also surprised a browser would limit CORS, but not other things |
| 04:40 | <annevk> | Ooh, is it because of mixed content? |
| 04:41 | <annevk> | That actually seems plausible |
| 04:43 | <annevk> | I get the feeling they know the engineering well, but the ethics and ramifications of violating “platform law” not so much |
| 04:43 | <annevk> | Hopefully better now, as I doubt Mozilla will stop using them |
| 04:44 | <MikeSmith> | OK |
| 05:32 | <cybai> | does anyone work on ServiceWorker repo around 👀? I'd like to help to update the default value of optional dictionary for the SW repo but I will get compile error from my patch. I wonder I used correct syntax 🤔 or did I do something wrong? https://github.com/w3c/ServiceWorker/pull/1448 |
| 05:32 | <cybai> | thanks |
| 06:01 | <annevk> | cybai: that’s great, thanks |
| 06:02 | <annevk> | cybai: we need to wait for Bikeshed updates and then rerun |
| 06:02 | <cybai> | annevk: ohh! I also thought about that! thanks for confirmation :D |
| 06:03 | cybai | will keep an eye on the bikeshed issue |
| 15:32 | <dtapuska> | annevk: The changes seem good on 4664.. Thanks! |
| 15:35 | <Domenic> | annevk: is the "allow sidechannel attacks" check flipped in 4734? |
| 15:35 | <Domenic> | it throws if "allow sidechannel attacks" is true. |
| 15:36 | <annevk> | Domenic: for ImageBitmap it is, as we don't want tainted data to be attacked |
| 15:37 | <Domenic> | Right, urgh, this is confusing... I need to re-page in how tainted bitmaps work, I guess. |
| 15:37 | <Domenic> | (Notably though, it's not clear that they work very well... https://github.com/whatwg/html/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+tainted ) |
| 15:38 | <annevk> | Domenic: also, I just realized that this might be more complicated |
| 15:39 | <annevk> | Domenic: since we do allow CORP-annotated opaque responses to enter the process |
| 15:40 | <annevk> | This check would affect those too |
| 15:41 | <annevk> | It's still secure and I'm not sure we want something much more complicated for what is a corner case, but also needs some more thought |
| 15:45 | <Domenic> | Hmm we didn't manage to fix https://github.com/whatwg/html/issues/2455 still, darn |
| 15:49 | <annevk> | Filed https://github.com/whatwg/html/issues/4767 on "more thought" |