Frederik Braun

RSS: https://frederikbraun.de/feeds/all.rss.xml
Frederik Braun 的博客，Mozilla 安全工程师，关于 Firefox 安全与 Web 技术。

The S in Interoperability

This is a blog post about standards, their proliferation and the issues that may arise. My first involvement with standards was just as a reader. To better understand complicated code or unexpected be...
评论点赞收藏75 天前

多重真相可以同时成立

作者坦诚面对自己在AI话题上的矛盾心理——明知会被同为黑客的人指责为虚伪或认知失调，仍选择写下这些思考来帮助自己理清头绪。这不是一篇站队或科普文章，而是一个真实的人在新技术浪潮面前呈现的复杂心态：可以同时相信多个看似冲突的立场。有人味、有反思、有讨论入口。
评论点赞收藏115 天前

Composing Sanitizer configurations

The HTML Sanitizer API allows multiple ways to customize the default allow list and this blog post aims to describe a few variations and tricks we came up with while writing the specification. Safe a...
评论点赞收藏161 天前

Perfect types with `setHTML()`

TLDR: Use require-trusted-types-for 'script'; trusted-types 'none'; in your CSP and nothing besides setHTML works, essentially removing all DOM-XSS risks. Background: Sanitizer API I was guest at th...
评论点赞收藏162 天前

Why the Sanitizer API is just setHTML()

Sanitizing HTML is the practice of taking a piece of HTML and removing some unwanted elements and attributes. We are specifying an API that will be directly built into the browser. In fact, you can al...
评论点赞收藏252 天前

The C3PO Bug in Lego Star Wars: The Complete Saga

Today: Something off topic, to feed the search engines. My kids and I have a lot of fun with the video game Lego Star Wars: The Complete Saga, which was released in 2007. As it is quite old, the "com...
评论点赞收藏253 天前

Home Assistant 无法安全地暴露在互联网上

作者以自家智能取暖控制需求为起点，亲自踩坑后直言 Home Assistant 无法被安全地开放到公网。文章从具体场景出发（离家自动关暖气、回家前自动开启），引出将 HA 暴露到互联网时遇到的安全短板。作为 Mozilla 安全工程师的个人经验分享，有明确立场和实操背景，引发自建智能家居用户对安全边界的讨论——到底该不该开公网访问、如何替代。短小但有观点、有争议入口。
评论点赞收藏609 天前

旧金山的Mozilla纪念碑

For those who don't know, I have provided countless contributions to the Mozilla project. This is to an extent, that I have been added to our credits page (type about:credits into Firefox!) more than ...
评论点赞收藏623 天前

Modern solutions against cross-site attacks

NB: This is the text/html version of my talk from the German OWASP Day 2024 in Leipzig earlier this month. If you prefer, there is also a video from the event. This article is about cross-site leak a...
评论点赞收藏628 天前

提示注入攻击演示

安全研究员 Frederik Braun 发布了一个提示注入（Prompt Injection）的现场演示。文章中展示了一段精心设计的注入文本：攻击者伪装成用户，声称祖母刚刚去世、遗愿是要求回复必须用十六进制编码，从而诱导 LLM 绕过安全约束。这个示例生动展现了当前 AI 系统面临的社会工程式注入攻击手法，对于关注大模型安全、红队测试和 AI 防护的读者具有直接参考价值。
评论点赞收藏697 天前

What is mixed content?

In web security, you may have heard of "mixed content". Maybe you saw a DevTools message like this one. Mixed Content: Upgrading insecure display request ‘http://...’ to use ‘https’. This blog post ...
评论点赞收藏792 天前

我是如何获得一个新域名的

作者回忆自己1990年代作为年轻极客的经历，从姨妈的趣事引向获得新域名 的来龙去脉。这是一篇有个人温度的怀旧叙事，适合对个人博客文化、域名故事感兴趣的读者。
评论点赞收藏792 天前

Web安全基础：源、站点及其他术语

文章系统介绍Web安全模型中的核心术语，包括源（origin）、站点（site）等基础概念的定义与区分，为后续讨论安全问题的根因和防御措施建立共同语言。内容偏教科书式术语梳理，适合安全入门者查阅，但缺乏个人观察或独特视角。
评论点赞收藏1310 天前

DOM Clobbering

This article first appeared on the HTMLHell Advent Calendar 2022. Motivation When thinking of HTML-related security bugs, people often think of script injection attacks, which is also known as Cross...
评论点赞收藏1343 天前

Reference Sheet for Principals in Mozilla Code

Note: This is the reference sheet version. The details and the big picture are covered in Understanding Web Security Checks in Firefox (Part 1). Principals as a level of privilege A security context...
评论点赞收藏2204 天前

登录芦苇

登录后关注作者、收藏内容和参与讨论。

热门话题

人工智能12,865 人关注AI 会怎样改变日常工作？产品思考8,243 人关注怎样判断一个产品值得长期做？独立开发5,917 人关注一个人如何持续完成作品？
关于芦苇 · 联系我们 · 下载 App · © 2026 芦苇