Skip to content

Instantly share code, notes, and snippets.

JSON CSP

CSP is the de facto way to filter a sites exploitable surface areas. The current problem that needs some thought is being able to share your policy for others to be able to consume.

The easiest way for this to be made possible is to provide a JSON representation of CSP so that libraries can publish their polices. Tools can be then made available to merge policies together easily and ultimately then allow a smoother transition to a secure internet.

This may for example look like:

{
 "default-src": ["'self'", "domain.com"],
.overlay {
display: flex;
height: 100vh;
width: 100vw;
position: absolute;
top: 0;
left: 0;
background-color: rgba(0, 0, 0, 0.5);
justify-content: space-around;

Comparing the proposed loading order of <script type="module"> with the current script tag loading methods. Showing a comparison of HTML parsing, script loading and executing scripts.

  • Classic (<script>) loading blocks the parser to fetch the code and then blocks again execute the code then goes back to parsing the HTML.
  • Defer (<script defer>) will not block the parsing to trigger the fetch but it will happen at the same time, the execution of the script will happen after the parsing is complete.
  • Async (<script async>) will not block the parsing to trigger the fetch but it will block to execute the script, after that has happened it will continue the parsing.
  • Module (<script type="module">) will behave like defer in that it will fetch in parallel to parsing but also it's dependency tree is fetched at the same time in parallel. After the parsing has completed it will execute the scripts.
  • Async module (`
@jonathanKingston
jonathanKingston / pipeline-alternative.md
Last active December 16, 2015 20:53
Explanation of pipeline alternative
//three code here renderer...
document.getElementById('bg').appendChild(renderer.domElement);
Meteor.deps.Context.current.invalidate(); //this clears the above
@jonathanKingston
jonathanKingston / gist:2668583
Created May 12, 2012 19:55
Filters psudo code
Meteor.methods({
'sabotage'
});
Meteor.filters({
'checkIsABeastieBoy'
});
function checkIsABeastieBoy(args) {
@jonathanKingston
jonathanKingston / gist:2580242
Created May 2, 2012 20:36
server side tags to client side
tags = Tags.find();
_.each(function(tag){
Handlebars.something[tag.key] = tag.value;
})
@jonathanKingston
jonathanKingston / gist:2558822
Created April 30, 2012 14:33
find nearbythings
Meteor.setInterval(function() {
var allTheThings = Things.find({});
//Near will contain all the object _id's and this will be an array of all other objects nearby.
near = {}
allTheThings.forEach(function (thing) {
if (thing != undefined) {
near[thing._id] = [];
allTheThings.forEach(function (thing2) {
if(thing2.x >= thing.x-5 && thing2.x <= thing.x+5) {
if(thing2.y >= thing.y-5 && thing2.y <= thing.y+5) {
function post(args) {
//DO post here
}
function comment() {
//Do comment here
}
function checkUser(args) {
//Check args here to make sue is user
@jonathanKingston
jonathanKingston / gist:2501225
Created April 26, 2012 17:42
rendering of diff templates
Handlebars.registerHelper('content', function(something) {
if(something) {
Meteor.ui.chunk(function() {Template.hello({first: "Alyssa", last: "Hacker"});});
} else {
Meteor.ui.chunk(function() {Template.something_else({first: "silly", last: "bobby"});});
}
});