Back in 2015, Google introduced SPDY as a method of improving TCP connections. HTTP/3 now improves upon that by removing the blocking of TCP with the use of UDP (QUIC).
Firefox: currently disabled by default in version 85, to enable use about:config and set network.http.http3.enabled = true
IOS Safari 14+: currently disabled by default, but can be enabled under Settings > Safari > Advanced > Experimental Features > HTTP/3
Chrome/Chromium: current versions 88+ are currently implementing by default.
Chromium Edge: as new versions are based upon Chromium, support should follow Chrome.
MSIE: was never and will never be implemented.
This was very long overdue for a variety of reasons. While Flash became almost ubiquitous on the web under Macromedia before being acquired by Adobe, it was also full of .
Apple never offered Flash on it’s mobile devices and helped to drive developers to make use of modern HTML5 to accomplish many of the same effects.
Flash “cookies” were buried deep within the application and were not easily removed by users making them very useful for tracking users.
|End of Life Announced
||July 25, 2017
|End of support
||December 31, 2020
||January 12, 2021
<a href="..." ping="https://example.com/pingreporter">Example link</a>
The download attribute allows for the downloaded filename to be specified to be something different than the name in the url.
This is available only on the
A tag when an
href attribute is already specified and works similarly to setting the header as:
Content-Disposition: attachment; filename="filename.pdf"
NOTE: this is not currently available in IE, Edge(prior to 13) or IOS Safari.
Silverlight was a browser extension that was backed by Microsoft’s .NET product on many platforms, it provided media capabilities similar to Macromedia/Adobe Flash. Similar to Flash, it has had it’s own share of security problems over the years.
Introduced in 2007 and currently in a deprecated state. Once supported on Windows XP (IE6) to Windows 10 (IE11), MacOS and Ubuntu. Now only supported in MSIE. Edge never provided support. Modern versions of Chrome, Firefox, Safari, and Opera no longer support.
HTML Markup example:
<object data="data:application/x-silverlight-2," type="application/x-silverlight-2" width="100%" height="100%">
<param name="source" value="MySilverLightControl.xap"/>
I recently crossed paths with a customer that was still using Windows XP and experiencing problems with a website. This led me to evaluate their options for continuing to use this once very common, but now unsupported operating system.
After 12 years, support for Windows XP ended April 8, 2014. Microsoft will no longer provide security updates or technical support.
The most recent version of Internet Explorer in Windows XP was IE 8.0.6001.18702
Even Apple, Google and Mozilla Firefox have ceased to maintain browsers for this operating system, dropping support for Windows XP and Vista at the same time.
Firefox 52.9.0 ESR
An additional problem with use of IE8 on Windows XP is that it only supports up to TLS1.0 which is currently being replaced by TLS1.2 in many web applications.
A few months ago, Cloudflare revealed their public DNS server, and I’ve been pleased so far. In addition to performance, Cloudflare claims to be investing heavily in security of DNS. The top competitors in this field already being Cisco’s OpenDNS and Google. As these are all global players, they will (in most cases) have better speed and reliability than those of your local ISP.
Changing these for your entire network generally involves the administrative features/config of your gateway, modem or router. If you are familiar with this, the change should take just a minute or two.
If you are looking for some content filtering at the DNS level, OpenDNS still presents the easiest option for home users and also provides logs.
Google Public DNS:
This practice is now obsolete, and often problematic as there are very few of those browsers in use today – primarily only for testing of legacy functionality.
Example of old approach
// some script
NOTE: for XHTML or XML documents, the use of a CDATA style comment is still required.
If you have already started using HSTS to force users to your HTTPS website, the use of ‘preload’ is another simple addition as it only requires the addition of the keyword to the header.
Once done, you can either wait for your site to be identified (which can take a long time, or forever for less popular websites) or ideally, submit your hostname to be added to the lists preloaded in many modern browsers. The advantage here is that your users will never make a single request to your HTTP website and will automatically be directed to HTTPS.
An HTTP Header example:
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Apache2 configuration example:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"