1,370 reputation
618
bio website robwu.nl
location The Netherlands
age 21
visits member for 2 years, 3 months
seen yesterday

I'm a CS student who likes web-related technologies, in particular browser extensions. I'm the creator of Lyrics Here by Rob W and several Stack apps.

I'm quite active on Stack Overflow, the Chromium project, PDF.js, and occasionally put something on Github.

Contact: rob@robwu.nl


Apr
8
awarded  Yearling
Apr
1
comment Cannot turn off XSS filter in Chrome
Try --disable-xss-auditor instead.
Mar
26
comment Unexpected/unwanted/unknown participant joined WebRTC session
@joelmaranhao The room name is not a part of the SDP. For a dissection of a typical SDP as used in WebRTC, see e.g. webrtchacks.com/sdp-anatomy. The room name is something application-specific, you have to find and read the source code of the server if you want to get the exact answer. Bottom line is that whenever you send something to a server, it is out of your control, and the server is free to do whatever it want with it, including passing the data (SDP) to other subscribers of the websocket channel.
Mar
26
comment Unexpected/unwanted/unknown participant joined WebRTC session
@joelmaranhao You are not being hacked. You are deliberately (unknowingly?) sending your SDP to signaling.simplewebrtc.com, which in turn sends the SDP to other peers. Since these peers now have your SDP, they know how to set up a connection with your browser and exchange data.
Mar
26
answered Unexpected/unwanted/unknown participant joined WebRTC session
Mar
24
comment Is using “HTTPS everywhere” extension secure?
By switching from http to https, the communication (transport) is encrypted. What's misleading about that?
Mar
17
awarded  Good Answer
Mar
13
comment Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?
@Ajedi32 The webRequest API can only block requests. It cannot be used to selectively disable inline scripts. I have proposed a patch for Chromium which allows extension developers to get more control over whether to execute a specific script, but it was not well-received.
Mar
13
comment Why would Chrome not display a padlock icon at all on an SSL site?
@BrettCaswell Ah, I see where your confusion comes from. I assumed that you simply misspelled the word (that word is commonly misspelled), but you just misread. My answer, source and all documents that we've been referring to use "deprecate", not "depreciate". Sha-1 certificates are not loosing value (=depreciated), but they are being phased out (=deprecated).
Mar
13
comment Why would Chrome not display a padlock icon at all on an SSL site?
@BrettCaswell And before you continue nitpicking: "to deprecate" is defined as "to criticize or express disapproval of (someone or something)" (source: Merriam-Webster). Something that is "in the process of deprecating" is "deprecated".
Mar
13
comment Why would Chrome not display a padlock icon at all on an SSL site?
@BrettCaswell You're citing an old (2012) version of the document. The current version (1.2.3) states (section 9.4.2) "Effective 16 January 2015, CAs SHOULD NOT issue Subscriber Certificates utilizing the SHA-1 algorithm with an Expiry Date greater than 1 January 2017 because Application Software Providers are in the process of deprecating and/or removing the SHA-1 algorithm from their software, and they have communicated that CAs and Subscribers using such certificates do so at their own risk." So, sha-1 certs are certainly deprecated.
Mar
13
comment Why would Chrome not display a padlock icon at all on an SSL site?
@BrettCaswell "it is, however, not depreciated or obselete as of yet." - wrong, sha1 has already been deprecated since 2011 (see third paragraph of the linked source). And the exact appearance of the non-padlock is indeed version-specific, but the absence of a green padlock is version-independent (i.e. starting from Chrome 39, sha1 certificates are not shown as fully trustworthy any more).
Mar
13
comment Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?
@Ajedi32 contentSettings.javascript applies to whole tabs only, it cannot be used to selectively disable JavaScript on domains in a (sub)frames.
Mar
13
comment Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?
@Ajedi32 The part about NoScript is still true. The Chrome APIs are simply not powerful enough to offer all features from Firefox's NoScript.
Mar
13
awarded  Mortarboard
Mar
13
awarded  Enlightened
Mar
13
awarded  Nice Answer
Mar
13
answered Why would Chrome not display a padlock icon at all on an SSL site?
Mar
6
comment Why do major sites(Facebook, Google, etc) still send passwords unhashed?
Note: Key derivation and hashing is available in crypto.subtle, which is a part of the standard Web Crypto API and implemented in native code in browsers, so the speed argument is not that strong. Even if only implemented in JavaScript, the relative cost could be comparable to a busy web server. The cost cannot be too high, otherwise attempting to log in could be an easy way to commit DOS to a server (for desktop computers, maybe not for old phones).
Feb
24
comment What methods are websites using to prevent direct access to media?
An average Joe can still take someone else's program that downloads the media. How are you viewing the ones that develop these programs, in the context of your question?