Most places I worked at cared very little for quality code, there was much more pressure on shipping fast even if it meant incurring technical debt, crap performance for end users, or developers leaving due to legacy code accumulation that nobody understood anymore.
I'm glad there is a tool that let's these companies have even shittier code shipped even faster. The faster they burn down the better.
There should be parental controls that disallows installing apps, so there is no hidden browsers. Google and apple has an entire walled garden infra setup that they are using for control and hoovering up all the user data, the same infra can be uses for this.
This, and more - device makers and those upstream of the parents need to make "child safe" phones .. and probably (uh, oh) make them that way by default so that tech savvy types can disengage restrictions (and have that restrictions lifted state glaringly obvious for non tech savvy parents).
The raison d'etre for my above framed question was to highlight that non tech parents can not be expected to IT-child-safe phones and then monitor risks w/out assistance from vendors.
That's basically what this law is, but it's not saying there has to be a wholly separate phone model, but it's saying every phone (or desktop or laptop or tablet or ...) must have a child safe mode.
The takeaway is that everyone makes security hard. Everyone does this anti-pattern of having these other domains that defeat all their own security recommendations.
GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on.
Your bank will send you “legitimate” surveys or communication from some third party domain like qualtropics.com.
Once upon a time, RuneScape ran a promotion where World of Warcraft players could join a special world with double XP (experience points) or something by clicking this promotion link.
RuneScape has an in-game dungeon designed to teach players about account security. One of the questions is whether you should click on a link that promises double XP...
It's also not worth posting "I tried didn't work" because nobody knows what you tried. There is zero information in it, and it's a waste of bits that just pollutes the discussion.
It seems like that, but it's not. When trying to figure out a problem, even that tiny bit of information is worthwhile. If nobody else has posted it, it's the first indication that it doesn't work.
If others have posted, it's an indication that it's a wider-spread problem than you knew.
I'd still rather have more information, and I look down on people who only post something that useless. But it does have information I've used to figure problems out.
My first thought was that they have several people who seem like they'll expect very serious compensation but no actual product, then I noticed they already seem to have a whole bunch of VC backers. I'm not gonna lie, I'm a little jealous of people who can make a flashy vaporware pitch deck and ride the VC gravy train.
Differences in parsing between two systems can allow data to sneak through. For example you might put a space before the header name. The reverse proxy might treat it as a header name starting with a space, so not matching the one it wants to remove, and not removed, while the origin server trims the space.
This is a ubiquitous security concern, like IDOR and memory safety. Every time you have a separate validation step for anything, you have the possibility of a parser differential vulnerability.
If you don't know it yet, look up "HTTP request smuggling" - pretty interesting.
