Category: Security and Privacy

Firefox Profilemaker

TheSmithy

https://ffprofile.com/

This tool will help you to create a Firefox profile with the defaults you like.

You select which features you want to enable and disable and in the end you get a download link for a zip-file with your profile template. You can for example disable some functions, which send data to Mozilla and Google, or disable several annoying Firefox functions like Mozilla Hello or the Pocket integration.

Each Setting has a short explanation and for the non obvious settings links to resources describing the feature and the possible problems with it.

WP-CLI secure all – Single-command WordPress security!

TheSmithy
HomePage

https://hackthewp.com/

NEW feature in >wp-cli to secure any WordPress instance in just 60 seconds.

One command to rule them all 🤘

80% of the attacks to WordPress instances could be mitigated by simply applying common security best practices [1].

wp secure all exactly does that for you. Via wp secure all common best practices are applied proactively, and you are ready to go.

What’s covered by secure all?

The security vulnerabilities identified in 2012 [2] are still the security vulnerabilities of today [1].

wp secure all made it its mission to fix this grievance and make security the defacto standard.

By executing wp secure all security best practices such as:

Fix permissions

Set the correct permissions of all files & directories in your WordPress installation.

Set security headers

We add HSTS (Strict-Transport-Security), X-XSS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.

Disable file editor

Prevents hackers from using file editor on your WordPress Dashboard.

Prevent PHP execution on sensitive locations

To extend security, you can block direct access to PHP files in plugins, themes, wp-includes and uploads.

Block access to sensitive stuff

Prevent hackers from accessing sensitive files and directories.

And many more …

See the README for an overview of all features.

Read More

DOMPurify

TheSmithy

https://github.com/cure53/DOMPurify

also: interesting discussion about XSS attacks (confusing even DOMPurify at times):

https://news.ycombinator.com/item?id=24703230

DOMPurify sanitizes HTML and prevents XSS attacks. You can feed DOMPurify with string full of dirty HTML and it will return a string (unless configured otherwise) with clean HTML. DOMPurify will strip out everything that contains dangerous HTML and thereby prevent XSS attacks and other nastiness. It’s also damn bloody fast. We use the technologies the browser provides and turn them into an XSS filter. The faster your browser, the faster DOMPurify will be.

How do I use it?

It’s easy. Just include DOMPurify on your website.

Using the unminified development version

<script type="text/javascript" src="src/purify.js"></script>
Read More

Temporary Containers – a FireFox addon

TheSmithy

https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search
Open tabs, websites, and links in automatically managed disposable containers. Containers isolate data websites store (cookies, storage, and more) from each other, enhancing your privacy and security while you browse.

Tip: bind CTRL + click to open a link in temporary container in Settings > Isolation >Global: set Ctrl/Cmd+Left Mouse to ‘Different from Tab domain (& subdomains)’

OBS Studio: Open-source software for video recording and live streaming

TheSmithy

OBS Studio: Open-source software for video recording and live streaming

From the HN Thread

  • There are a lot of tutorials around learning OBS. One of the best ones that I’ve come across is EposVox’s OBS Studo Master Class 2018. It helps you figure out what you want to learn and covers a large swath of the various OBS functionalities. EposVox’s OBS Studio Master Class 2018 YouTube Playlist: https://www.youtube.com/playlist?list=PLzo7l8HTJNK-IKzM_zDic…
Read More

The most important technology critic in the world was tired of knowledge based on clicks. So he built an antidote

TheSmithy

Evgeny Morozov was a critic of Big Tech long before it became fashionable. Then he built The Syllabus, an online system that breaks the laws of the attention economy. At a time when misinformation about Covid-19 can spread faster than the virus itself, his system is even more important. I was with him when he first shared it with the world.

https://thecorrespondent.com/369/the-most-important-technology-critic-in-the-world-was-tired-of-knowledge-based-on-clicks-so-he-built-an-antidote/789698745-92d7c0ee?pk_campaign=daily

DRM’s dead canary

TheSmithy

DRM’s Dead Canary: How We Just Lost the Web, What We Learned from It, and What We Need to Do Next

EFF (Electronic Frontier Foundation) explains what EME (Encrypted Media Extensions) is and how it is gonna fuck up our future.

EFF has been fighting against DRM and the laws behind it for a decade and a half, intervening in the US Broadcast Flag, the UN Broadcasting Treaty, the European DVB CPCM standard, the W3C EME standard and many other skirmishes, battles and even wars over the years. With that long history behind us, there are two things we want you to know about DRM:

1. Everybody on the inside secretly knows that DRM technology is irrelevant, but DRM law is everything; and

2. The reason companies want DRM has nothing to do with copyright.

https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next