we are NSFW-friendly so here goes…
令人惊讶的是：一个主流AI媒体平台公开表示对NSFW(不适合工作场所)内容友好，这在传统科技媒体中相当罕见。这反映了AI社区对内容审查态度的转变，以及对更广泛AI应用场景的包容性增强。
32 Matching Annotations
- Last 7 days
-
www.latent.space www.latent.space
-
- Sep 2023
- Aug 2023
-
kit.svelte.dev kit.svelte.dev
-
```js // CSP svelte.config.js
/* @type {import('@sveltejs/kit').Config} / const config = { kit: { csp: { directives: { 'script-src': ['self'] }, reportOnly: { 'script-src': ['self'] } } } };
export default config; ```
-
-
developer.mozilla.org developer.mozilla.org
-
www.w3.org www.w3.org
- May 2023
-
Tags
- wikipedia:en=Clickjacking
- http:header=x-frame-options
- wikipedia:en=Cross-site_request_forgery
- http:header=x-content-type-options
- csp
- sri
- hsts
- http:header=content-security-policy
- http:header=strict-transport-security
- wikipedia:en=Session_hijacking
- security
- wikipedia:en=Data_breach
- http
- wikipedia:en=Man-in-the-middle_attack
- http:header=referrer-policy
Annotators
URL
-
- Dec 2022
- Aug 2022
-
www.theverge.com www.theverge.com
-
Roth, E. (2021, October 30). Facebook puts tighter restrictions on vaccine misinformation targeted at children. The Verge. https://www.theverge.com/2021/10/30/22754046/facebook-tighter-restrictions-vaccine-misinformation-children
-
- Dec 2021
-
www.ft.com www.ft.com
-
Espinoza, J. (2021, November 28). Vestager urges European legislators to push through rules to regulate Big Tech. Financial Times. https://www.ft.com/content/1880d0fb-0651-47ed-a8f4-6cde0f729859
-
- Jul 2021
-
today.law.harvard.edu today.law.harvard.edu
-
Schmitt, C. E., November 7, & 2020. (n.d.). ‘Be the Twitter that you want to see in the world’. Harvard Law Today. Retrieved 1 March 2021, from https://today.law.harvard.edu/be-the-twitter-that-you-want-to-see-in-the-world/
-
- Feb 2021
-
medium.com medium.com
-
I have a Content Security Policy!Oh, do you now.And did somebody tell you that this would prevent malicious code from sending data off to some dastardly domain? I hate to be the bearer of bad news, but the following four lines of code will glide right through even the strictest content security policy.
-
- Jan 2021
-
atomiks.github.io atomiks.github.ioThemes1
-
The CSS automatically gets injected into <head> with the CDN (tippy-bundle). With CSP enabled, you may need to separately link dist/tippy.css and use dist/tippy.umd.min.js instead.
-
- Nov 2020
-
github.com github.com
-
If your Svelte components contain <style> tags, by default the compiler will add JavaScript that injects those styles into the page when the component is rendered. That's not ideal, because it adds weight to your JavaScript, prevents styles from being fetched in parallel with your code, and can even cause CSP violations. A better option is to extract the CSS into a separate file. Using the emitCss option as shown below would cause a virtual CSS file to be emitted for each Svelte component. The resulting file is then imported by the component, thus following the standard Webpack compilation flow.
-
- Sep 2020
-
stackoverflow.com stackoverflow.com
-
I edited the post twice to remove the broken link /react-js-the-king-of-universal-apps/ (with the edit-comments clearly mentioning that it is a broken link), but the peers have rejected the edit both the times. Can someone guide me what's wrong in editing an answer and removing a broken link?
-
- Jul 2020
-
osf.io osf.io
-
Weed, M. (2020). Models and methods to analyse the interaction of evidence and policy in the first 100 days of the UK government’s response to COVID-19 (v1.1). https://doi.org/10.31235/osf.io/f73u4
-
-
blogs.harvard.edu blogs.harvard.edu
-
Staff, C. (2020, July 8). 230-esque Language in the USMCA: What Does It Mean for the US and Canada? Cyberlaw Clinic. https://blogs.harvard.edu/cyberlawclinic/2020/07/08/230-esque-language-in-the-usmca/
-
- May 2020
-
csp.withgoogle.com csp.withgoogle.com
-
However, it's possible to enforce both a whitelist and nonces with 'strict-dynamic' by setting two policies:
-
-
www.w3.org www.w3.org
-
sadness.js will not load, however, as document.write() produces script elements which are "parser-inserted".
Tags
Annotators
URL
-
-
developer.chrome.com developer.chrome.comjudell1
-
If a user clicks on that button, the onclick script will not execute. This is because the script did not immediately execute and code not interpreted until the click event occurs is not considered part of the content script, so the CSP of the page (not of the extension) restricts its behavior. And since that CSP does not specify unsafe-inline, the inline event handler is blocked.
-
-
www.iubenda.com www.iubenda.com
-
-
Remember that nonces must be regenerated for every page request and they must be unguessable.
-
- Apr 2020
-
www.troyhunt.com www.troyhunt.com
-
trim off a bunch of excessive headers such as the content security policy HIBP uses (that's of no use to a lone API endpoint).
-
- Nov 2019
-
csp.withgoogle.com csp.withgoogle.com
-
Why can't I keep using script whitelists in CSP? The traditional approach of whitelisting domains from which scripts can be loaded is based on the assumption that all responses coming from a trusted domain are safe, and can be executed as scripts. However, this assumption does not hold for modern applications; some common, benign patterns such exposing JSONP interfaces and hosting copies of the AngularJS library allow attackers to escape the confines of CSP.
Tags
Annotators
URL
-
-
stackoverflow.com stackoverflow.com
-
However, a broader problem is that your script-src whitelist includes domains that host Javascript which can be used by an attacker who finds a markup injection bug in your application to bypass your CSP. For example, https://cdnjs.cloudflare.com hosts Angular (https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.7.2/angular.min.js) which can be used by an attacker to convert an HTML injection into arbitrary script execution (here is a paper about this).
-
- Sep 2019
-
github.com github.com
-
github.com github.com
-
developers.google.com developers.google.com
-
csp.withgoogle.com csp.withgoogle.com
- Feb 2016
-
github.com github.com
-
In Firefox, one can disable Content Security Policy by changing security.csp.enable to false in about:config
Websites using Content Security Policy can be annoted with hypothes.is in Firefox by switching (in about:config ) security.csp.enable to false
-
-
www.nytimes.com www.nytimes.com
-
Twitter said violent threats and the promotion of terrorism had long been against its terms of service.
-