<a href="..." ping="https://example.com/pingreporter">Example link</a>
The download attribute allows for the downloaded filename to be specified to be something different than the name in the url.
This is available only on the
A tag when an
href attribute is already specified and works similarly to setting the header as:
Content-Disposition: attachment; filename="filename.pdf"
NOTE: this is not currently available in IE, Edge(prior to 13) or IOS Safari.
Silverlight was a browser extension that was backed by Microsoft’s .NET product on many platforms, it provided media capabilities similar to Macromedia/Adobe Flash. Similar to Flash, it has had it’s own share of security problems over the years.
Introduced in 2007 and currently in a deprecated state. Once supported on Windows XP (IE6) to Windows 10 (IE11), MacOS and Ubuntu. Now only supported in MSIE. Edge never provided support. Modern versions of Chrome, Firefox, Safari, and Opera no longer support.
HTML Markup example:
<object data="data:application/x-silverlight-2," type="application/x-silverlight-2" width="100%" height="100%">
<param name="source" value="MySilverLightControl.xap"/>
I recently crossed paths with a customer that was still using Windows XP and experiencing problems with a website. This led me to evaluate their options for continuing to use this once very common, but now unsupported operating system.
After 12 years, support for Windows XP ended April 8, 2014. Microsoft will no longer provide security updates or technical support.
The most recent version of Internet Explorer in Windows XP was IE 8.0.6001.18702
Even Apple, Google and Mozilla Firefox have ceased to maintain browsers for this operating system, dropping support for Windows XP and Vista at the same time.
Firefox 52.9.0 ESR
An additional problem with use of IE8 on Windows XP is that it only supports up to TLS1.0 which is currently being replaced by TLS1.2 in many web applications.
This practice is now obsolete, and often problematic as there are very few of those browsers in use today – primarily only for testing of legacy functionality.
Example of old approach
// some script
NOTE: for XHTML or XML documents, the use of a CDATA style comment is still required.
If you have already started using HSTS to force users to your HTTPS website, the use of ‘preload’ is another simple addition as it only requires the addition of the keyword to the header.
Once done, you can either wait for your site to be identified (which can take a long time, or forever for less popular websites) or ideally, submit your hostname to be added to the lists preloaded in many modern browsers. The advantage here is that your users will never make a single request to your HTTP website and will automatically be directed to HTTPS.
An HTTP Header example:
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Apache2 configuration example:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
While having history available with the simple use of the up arrow is a convenience feature common to most linux builds it can come with some risk. One such risk is when you have inadvertently typed a password instead of a command, or had to pipe credentials into a command.
Thankfully, you can clear the entire history with a variety of methods, the most common are below but others are available in the references.
history -c && history -w
cat /dev/null > ~/.bash_history && history -c && exit
I often have to install different languages/locales on Windows 7 to perform testing in different languages, unfortuately adding all of them into a single installation can take a lot of space, particularly when using a virtual machine.
Using the usual method to ‘remove installed software’ will remove updates, but leaves the languages in place, to completely remove them you must open a command prompt and execute the following:
Select the languages you wish to remove, and click continue… it will take a while, but the languages will be removed one at a time.
A relatively new HTTP Header that is supported by most modern browsers (except MSIE) is the “Referrer-Policy” header. There have been previous attempts to implement similar protections through use of the ‘rel’ (or ‘rev’) attributes on links to external websites. The latest approach takes a different approach and prevents leaking of internal URLs, and in some cases parameters, to external websites. This is important from a security perspective as you might maintain some sensitive information in your page urls, that would otherwise be inadvertently shared with an external website.
Clearly, you’ll need to determine your own level of security based upon your needs. Example: ‘no-referrer’ would be the most strict and would prevent the browser from sending the ‘Referer'(sic) header even to your own websites pages.
Example header values:
Implementation can be accomplished in many ways, the most simple being and addition to your HTTP server configuration similar to the one shown below for Apache 2.x:
Header always set Referrer-Policy strict-origin