Sharing an X11 Server Across Hosts with FamilyWild

3 hours ago

X11 connections fail when running apps in containers or over SSH because .Xauthority cookies are tied to a specific hostname.
The cookie's hostname must match the client's hostname; otherwise the client cannot offer the cookie.
Fix: rewrite the cookie's family to FamilyWild (0xffff) using xauth nlist and sed, making it match any hostname.
Unlike xhost+ which disables all access control, FamilyWild keeps the cookie secret while removing only the hostname constraint.
FamilyWild cookies are less specific; share only with needed environments and set permissions to 0600.

Cookie prefixes (__Host-, __Secure-) enforce browser restrictions to prevent attacks like cookie tossing or session fixation.
Browsers send cookies as raw bytes, and server parsing discrepancies can allow attackers to bypass prefix protections.
Using Unicode whitespace characters (e.g., U+2000) before a cookie name can trick the browser into accepting it as non-restricted, while servers like Django trim the whitespace and treat it as a prefixed cookie.

Mastodon serves different content (HTML, ActivityPub JSON, API JSON) for the same URL based on the Accept header, requiring careful cache key normalization.
The cache key must include a normalized variant of the Accept header to prevent serving the wrong content type to clients.
Key assumptions: AUTHORIZED_FETCH disabled, no signed URLs, federation uses HTTP Signatures (not Authorization header).

JWTs are commonly used for authentication but storing them in localStorage makes them vulnerable to XSS attacks, as any JavaScript on the page can read localStorage.
Using HTTP-only cookies with flags like Secure and SameSite=Lax prevents JavaScript from reading tokens, reducing the risk of token exfiltration during XSS attacks.
CSRF attacks are a risk with cookies, but can be mitigated using CSRF tokens, SameSite attributes, and checking request headers like Origin or Sec-Fetch-Site.

Zenovay's default cookieless tracking stores nothing on the device (no cookies, localStorage, IndexedDB), avoiding consent and deletion obligations.
Visitor identity is computed server-side using SHA256 of IP subnet (not full IP), user agent, and a daily salt that rotates at midnight UTC, ensuring privacy by expiration.
The daily salt rotation causes overcounting of unique visitors across multi-day ranges and inability to compute returning visitor rates, but within-day analytics (sessions, funnels, revenue) work normally.

Dickovers are modal panels or popovers that websites use to force unwanted interactions, often for cookie consent, violating user privacy and frustrating users.
Websites exploit GDPR and similar laws by repeatedly showing cookie-consent dialogs, despite the availability of Global Privacy Control (GPC) signals that browsers can send.
Companies falsely claim that they cannot store a 'don't spy' cookie under legitimate interest, but privacy laws actually allow such exceptions.

Cookie prefixes (__Host-, __Secure-) enforce browser restrictions to prevent attacks like cookie tossing or session fixation.
Browsers send cookies as raw bytes, and server parsing discrepancies can allow attackers to bypass prefix protections.
Using Unicode whitespace characters (e.g., U+2000) before a cookie name can trick the browser into accepting it as non-restricted, while servers like Django trim the whitespace and treat it as a prefixed cookie.

Mastodon serves different content (HTML, ActivityPub JSON, API JSON) for the same URL based on the Accept header, requiring careful cache key normalization.
The cache key must include a normalized variant of the Accept header to prevent serving the wrong content type to clients.
Key assumptions: AUTHORIZED_FETCH disabled, no signed URLs, federation uses HTTP Signatures (not Authorization header).

JWTs are commonly used for authentication but storing them in localStorage makes them vulnerable to XSS attacks, as any JavaScript on the page can read localStorage.
Using HTTP-only cookies with flags like Secure and SameSite=Lax prevents JavaScript from reading tokens, reducing the risk of token exfiltration during XSS attacks.
CSRF attacks are a risk with cookies, but can be mitigated using CSRF tokens, SameSite attributes, and checking request headers like Origin or Sec-Fetch-Site.

Zenovay's default cookieless tracking stores nothing on the device (no cookies, localStorage, IndexedDB), avoiding consent and deletion obligations.
Visitor identity is computed server-side using SHA256 of IP subnet (not full IP), user agent, and a daily salt that rotates at midnight UTC, ensuring privacy by expiration.
The daily salt rotation causes overcounting of unique visitors across multi-day ranges and inability to compute returning visitor rates, but within-day analytics (sessions, funnels, revenue) work normally.

Dickovers are modal panels or popovers that websites use to force unwanted interactions, often for cookie consent, violating user privacy and frustrating users.
Websites exploit GDPR and similar laws by repeatedly showing cookie-consent dialogs, despite the availability of Global Privacy Control (GPC) signals that browsers can send.
Companies falsely claim that they cannot store a 'don't spy' cookie under legitimate interest, but privacy laws actually allow such exceptions.

Hasty Briefsbeta