Amazon EC2 におけるセキュリティ(脆弱性)事例 - blog of morioka12
1. 始めに こんにちは、morioka12 です。 本稿では、Amazon EC2 上で動く Web アプリケーションの脆弱性によって脆弱性攻撃が可能だった実際の事例について紹介します。 1. 始めに 2. Amazon EC2 におけるセキュリティリスク Amazon EBS 被害があった公開事例 3. Amazon EC2 で起こりうる脆弱性攻撃 SSRF が可能な脆弱性 SSRF における回避方法 4. Amazon EC2 の脆弱な報告事例 画像読み込み機能に潜む SSRF を悪用した EC2 のクレデンシャルの不正入手が可能 SAML アプリケーションに潜む SSRF を悪用した EC2 のクレデンシャルの不正入手が可能 Webhook 機能に潜む SSRF を悪用した EC2 のクレデンシャルの不正入手が可能 Webhook 機能に潜む SSRF を悪用した EC2 のクレデ
WebKit Features in Safari 16.4
Mar 27, 2023 by Patrick Angle, Marcos Caceres, Razvan Caliman, Jon Davis, Brady Eidson, Timothy Hatcher, Ryosuke Niwa, and Jen Simmons ContentsWeb Push on iOS and iPadOSImprovements for Web AppsWeb ComponentsCSSHTMLJavaScript and WebAssemblyWeb APIImages, Video, and AudioWKWebViewDeveloper ToolingWeb InspectorSafari Web ExtensionsSafari Content BlockersNew Restrictions in Lockdown ModeMore Improve
=>htmz> a low power tool for html htmz is a minimalist HTML microframework for creating interactive and modular web user interfaces with the familiar simplicity of plain HTML. [GitHub] plain🍦 Use straight up HTML. No supersets. No hz- ng- hx- v- w- x-; no special attributes. No DSLs. No <custom-elements>. Just vanilla HTML. lightweight🪶 166 bytes in total. Zero dependencies. Zero JS bundles to l
How modern browsers work
Note: For those eager to dive deep into how browsers work, an excellent resource is Browser Engineering by Pavel Panchekha and Chris Harrelson (available at browser.engineering). Please do check it out. This article is an overview of how browsers work. Web developers often treat the browser as a black box that magically transforms HTML, CSS, and JavaScript into interactive web applications. In tru
Nic Jansma (@nicj) is a software developer at Akamai building high-performance websites, apps and open-source tools. Table of Contents The JS Self-Profiling API What is Sampled Profiling? Downsides to Sampled Profiling API Document Policy API Shape Sample Interval Buffer Who to Profile When to Profile Specific Operations User Interactions Page Load Overhead Anatomy of a Profile Beaconing Size Comp
WebKit Features in Safari 17.0
Sep 18, 2023 by Jen Simmons and the Safari / WebKit Team Today’s the day for Safari 17.0. It’s now available for iOS 17 and iPadOS 17. [Update September 26th] And now, Safari 17.0 is available for macOS Ventura, and macOS Monterey, and macOS Sonoma. Safari 17.0 is also available in the vision OS Simulator, where you can test your website by downloading the latest beta of Xcode 15, which supports t
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
WebKit Features in Safari 17.4
ContentsArchitectural improvementsWeb AppsForm elementsCSSWeb APIJavaScriptMediaSVGWebGLWeb AssemblyWeb InspectorChanges to SafariSafari ExtensionsWeb AuthenticationBug Fixes and moreUpdating to Safari 17.4Feedback Just like Safari 15.4 and Safari 16.4, this March’s release of Safari 17.4 is a significant one for web developers. We’re proud to announce another 46 features and 146 bug fixes. You ca
WebKit Features in Safari 18.0
ContentsNew in Safari 18Web apps for MacCSSSpatial WebHTMLJavaScriptWeb APICanvasManaged Media SourceWebRTCHTTPSWebGLWeb InspectorPasskeysSafari ExtensionsApple PayDeprecationsBug Fixes and moreUpdating to Safari 18.0Feedback Safari 18.0 is here. Along with iOS 18, iPadOS 18, macOS Sequoia and visionOS 2, today is the day another 53 web platform features, as well as 25 deprecations and 209 resolve
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
Posted on 2022-05-06 Last updated on 2024-03-13 These are some technical tips for publishing a blog. These have nothing to do with good content, just how to share that content. The recommendations are roughly in order of importance and have rationale for why they are that important. Formats People generally call feeds “RSS Feeds” but usually they aren’t specifically talking about RSS. RSS isn’t th
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
Jun 6, 2023 by Patrick Angle, Jean-Yves Avenard, Marcos Caceres, Ada Rose Cannon, Eric Carlson, Garrett Davidson, Jon Davis, Karl Dubost, Brady Eidson, Matthew Finkel, Simon Fraser, Brent Fulgham, Rachel Ginsberg, David Johnson, Anne van Kesteren, Mark Lam, Sihui Liu, Justin Michaud, Jer Noble, Tim Nguyen, Ben Nham, Richard Robinson, Michael Saboff, Alexey Shvaika, Jen Simmons, Sam Sneddon, Brando
Netflix Japan - Watch TV Shows Online, Watch Movies Online
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
# Finally releasing 90s.dev I’ve mentioned this a bunch on HN and I’ve been working on it nonstop since about February. So I’m pretty excited to finally make it public. # tl;dr What it is in relation to other gamedev apps: Game dev Meta gamedev * you are here What it is: An API for making games, game engines, and game maker components An API that wraps web technology up in an “operating system” me
ウィンター・オン・ファイヤー: ウクライナ、自由への闘いを観る | Netflix (ネットフリックス) 公式サイト
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
Jun 10, 2024 by Jen Simmons, Jon Davis, Karl Dubost, Anne van Kesteren, Marcos Cáceres, Ada Rose Canon, Tim Nguyen, Sanjana Aithal, Pascoe, and Garrett Davidson ContentsWebXRCSSWeb apps for MacSafari ExtensionsSpatial mediaHTMLMediaWebRTCPasskeysHTTPSJavaScriptWeb APICanvasWebGLWeb InspectorWKWebViewApple PayDeprecationsBug Fixes and moreHelp us Beta TestFeedback The last year has been a great one
The User Activation API
As a web developer, you’ve probably noticed that certain APIs only work if an end-user clicks or taps on an HTML element. For example, if you try to run the following code in Safari’s Web Inspector, it will result in an error: await navigator.share({ text: "hi" }); NotAllowedError: The request is not allowed by the user agent or the platform in the current context, possibly because the user denied
When you first see WordPress Playground, it seems like an ordinary site–maybe except for the colorful background. It's anything but. What you're actually looking at is an entire WordPress tech stack, including PHP and a database, running directly in your browser. In this post, Adam Zieliński (lead of WordPress Playground) and Thomas Nattestad (Product Manager for V8) explore: How WordPress Playgro
WebKit Features in Safari 18.4
Mar 31, 2025 by Jen Simmons, Saron Yitbarek, Jon Davis, Razvan Caliman, Karl Dubost, Brady Eidson, Elika Etemad, Youenn Fablet, Matthew Finkel, Simon Fraser, Timothy Hatcher, David Johnson, Anne van Kesteren, Daniel Liu, Keith Miller, Rupin Mittal, Tim Nguyen, Pascoe, Abrar Rahman Protyasha, Richard Robinson, Lily Spiniolas, Brandon Stewart, John Wilander and Luming Yin ContentsDeclarative Web Pus
Making a Chess Engine in Zig
I had the honor of speaking at Systems Distributed at the end of June. Since it was hosted by TigerBeetle who is one of the largest zig users, a lot of the zig community was there. After talking to some of them, Zig seemed more interesting for me to try out. Around the same time my youtube algorithm got me hooked on chess content. I’m not a good chess player by any means, but it started giving me
25th May 2025 Anthropic publish most of the system prompts for their chat models as part of their release notes. They recently shared the new prompts for both Claude Opus 4 and Claude Sonnet 4. I enjoyed digging through the prompts, since they act as a sort of unofficial manual for how best to use these tools. Here are my highlights, including a dive into the leaked tool prompts that Anthropic did
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
書いた記事をEPUBで電子書籍化しました｜note
今まで「不動産 x IT」として書いてきたことをまとめて、電子書籍（EPUB）にして見よう、と思い立ちました。 単にやったことがないからやってみよう、というだけだったりします。「そこに山があるから登るんだ」、みたいな。 基本は「不動産情報デジタル標準化の覚書」をベースに、その中で「詳しくはこっちで書きました」みたいに追記して個別の記事に分散していた内容など関連する記事をすべて本文に取り込み、それを一つのEPUBで電子書籍化、みたいな感じです。（EPUB化の手順はここに書きました） 「不動産情報デジタル化の作法」と題し、直接は関連しない記事も「付録」にて全部入りにしています。全部で約15万文字。だいたい新書とかと同じぐらいでしょうか。なかなか大変でありました。 ソフトウェア開発的に言うと、これ、元プロジェクトからフォークして派生させて新たな奴を作るパターンですね。上手くやらないとあとあと変更
Err... thanks for the technical explanation. But what does this actually mean in real life? Which setting should you use? Does it even matter? And if it does, why don't those clever browser engineers just set it to the best setting? Well recently I ranted on Twitter about this (as I am often want to do!) in a long thread that really should have been a blog post. So here is that blog post. Some mis
WebKit Features for Safari 26.2
Safari 26.2 is a big release. Packed with 62 new features, this release aims to make your life as a web developer easier by replacing long-standing frustrations with elegant solutions. You’ll find simpler ways to create common UI patterns with just a few lines of HTML or CSS, and no JavaScript — like auto-growing text fields with CSS field-sizing, and buttons that open/close dialogs and popovers w
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
Over the last couple of years, we’ve seen significant growth of the e18e community and a rise in performance focused contributions because of it. A large part of this is the “cleanup” initiative, where the community has been pruning packages which are redundant, outdated, or unmaintained. One of the most common topics that comes up as part of this is “dependency bloat” - the idea that npm dependen
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
WebKit Features in Safari 18.2
Dec 9, 2024 by Jen Simmons, Ada Rose Canon, David Degazio, Yoel Hawa, Etienne Segonzac, and John Wilander ContentsCSSSpatial videos and photosWebXRGenmojiMediaHTMLWebAssemblyWeb APIJavaScriptSecurity and PrivacyWeb InspectorWebDriverWKWebViewBug Fixes and moreUpdating to Safari 18.2Feedback Today marks the arrival of Safari 18.2. With it, WebKit adds 61 new features and 111 resolved issues. Highli
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
Building A Dynamic Header With Intersection Observer — Smashing Magazine
Have you ever needed to build a UI where some component on the page needs to respond to elements as they’re scrolled to a certain threshold within the viewport — or perhaps in and out of the viewport itself? In JavaScript, attaching an event listener to constantly fire a callback on scroll can be performance-intensive, and if used unwisely, can make for a sluggish user experience. But there is a b
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
Join a VS Code Dev Days event near you to learn about AI-assisted development in VS Code. Update 1.57.1: The update addresses these issues. The Workspace Trust feature addresses CVE-2021-34529. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the May 2021 release of Visual Studio Code. There are a number of updates in this version that we ho
A Tour of WebAuthn
This book was distributed at the FIDO Authenticate conference in 2024. Its intended format was as a PDF, which you can find here. The following is the contents of the PDF converted to HTML. 1: Introduction Passwords are rubbish. If you’re reading this book then hopefully you’re already on board with this idea, but let’s recap anyway. The typical practice with passwords is to remember a few differe
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
Performance-Optimized Video Embeds with Zero JavaScript – Frontend Masters Blog
Every embedded video comes with a real cost to page load performance. Each player loads extra resources, whether the user ever hits play or not, as Chris Coyier noted in his blog post on “YouTube Embeds are Bananas Heavy and it’s Fixable”. The approach of using <lite-youtube> in that article works well when the video appears further down on the page and loads outside of the initial viewport. If th
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
ギレルモ・デル・トロの驚異の部屋を観る | Netflix (ネットフリックス) 公式サイト
'); doc.close(); } if (!doc) throw Error('base not supported'); var baseTag = doc.createElement('base'); baseTag.href = base; doc.getElementsByTagName('head')[0].appendChild(baseTag); var anchor = doc.createElement('a'); anchor.href = url; return anchor.href; } finally { if (iframe) iframe.parentNode.removeChild(iframe); } }()); } // An inner object implementing URLUtils (either a native URL // ob
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
htmz - a low power tool for html
JS Self-Profiling API In Practice
大奥を観る | Netflix (ネットフリックス) 公式サイト
Top 10 Movies on Netflix Right Now - Netflix Tudum
RSS Feed Best Practises - Kevin Cox
ドント・ルック・アップを観る | Netflix (ネットフリックス) 公式サイト
News from WWDC23: WebKit Features in Safari 17 beta
90s.dev
News from WWDC24: WebKit in Safari 18 beta
Build in-browser WordPress experiences with WordPress Playground and WebAssembly | Articles | web.dev
Highlights from the Claude 4 system prompt
ザ・プレイリストを観る | Netflix (ネットフリックス) 公式サイト
What does the image decoding attribute actually do?
浅草キッドを観る | Netflix (ネットフリックス) 公式サイト
The Three Pillars of JavaScript Bloat
THE DAYS | Netflix (ネットフリックス) 公式サイト
Netflix Tudum - Go behind the streams
イカゲームを観る | Netflix (ネットフリックス) 公式サイト
アーケイン | Netflix (ネットフリックス) 公式サイト
May 2021 (version 1.57)
陰謀論のオシゴト | Netflix (ネットフリックス) 公式サイト
イベリン: 彼が生きた証を観る | Netflix (ネットフリックス) 公式サイト