Hacker News new | past | comments | ask | show | jobs | submit login

The "SameSite" cookie parameter is only supported in Chrome, but you can vote for it in other browsers' issue trackers.

Firefox has an open bug https://bugzilla.mozilla.org/show_bug.cgi?id=795346

Microsoft does, too https://wpdev.uservoice.com/forums/257854-microsoft-edge-dev...

And so does WebKit https://bugs.webkit.org/show_bug.cgi?id=159464 WebKit allows voting, too, by filing duplicate issues in Apple's private "radar" issue tracker.

Which is to say, the WebKit bug is already filed in Radar as rdar://problem/27196358

Apple has said publicly that if you want to "vote" for a given Radar issue, you should file duplicates for that Radar. (I find that weird, but that's the way they do it.) To do that, go here: https://bugreport.apple.com/

You can copy and paste the data from OpenRadar, a community tool where people share Radar issues that they want people to be able to search for and/or duplicate. https://openradar.appspot.com/radar?id=4963174633701376

Be sure to mention in the bug description that you're filing a duplicate of rdar://problem/27196358.

EDIT: And while you're in there voting for browser security features, consider voting for Subresource Integrity on Apple WebKit and Microsoft Edge.

https://openradar.appspot.com/radar?id=4980317458792448

https://wpdev.uservoice.com/forums/257854-microsoft-edge-dev...




> Apple has said publicly that if you want to "vote" for a given Radar issue, you should file duplicates for that Radar. (I find that weird, but that's the way they do it.)

Given that Radar is a private store with a public write-only channel (bug report submissions), the only way it could work for non-Apple-employees to vote for something is to request that they describe it again themselves and then merge all the duplicates on the Apple-private side.

Not saying that Radar being private is not itself kind of weird, but the submission policy necessarily follows from that.


Radar sucks yes, but thats why open radar got created, to help out coordinating exactly this kind of thing.

https://openradar.appspot.com/page/1


Seems like "The Cross-Site Request Forgery killer" might be a better title. It sounds like I can probably stop using anti-csrf tokens 8-10 years from now. I still support IE8.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: