Cross-site scripting

basic? Sorry, can you clarify what a basic is? Least privilege.

Is it least privilege or is it system hardening, XSS, like before we flow?

Those things, right? I mean, I have an AI agent on my computer.

Have you locked down that agent? You're just talking about your agent.

They were early adopters of that.

I would point to that mid-2010s as a great way to, cool, most of XSS is gone.

Can we do, have we done enough of that? Are there more things that, before we even talk about Volns and CVEs, we can just say, that threat modeling a little bit, well, what's the worst could happen or what could go wrong? Let's design around that.

Is that something that you think can be viable or needs just, I'm trying to say how to make that conversation actually have impact? Because that was the word that I think is what I'm looking for here.

They were early adopters of that.

I would point to that mid-2010s as a great way to, cool, most of XSS is gone.

Can we do, have we done enough of that? Are there more things that, before we even talk about VOLNs and CVEs, we can just say, that threat modeling a little bit, well, what's the worst could happen or what could go wrong? Let's design around that.

Is that something that you think can be viable or needs just, I'm trying to say how to make that conversation actually have impact? Because that was the word that I think is what I'm looking for here.

and run them and see our product being pushed more and more in that direction where, you know, as people move away from like hardcore programming, writing their own code to like actually just deploying apps easily, that core to user is just increasing and increasing.

very interesting angle on the competitive part of it that you really are like, start in a world where not even long ago, but we were writing these complex scripts to be able to do XSS parsing of what's on a page after a fetch.

Playwright comes along and then makes that a little bit better and a little nicer and more deterministic until the, you know, whatever your local credit union changes the shape of their webpage and then everything breaks.

And this is maybe like a sweet spot for these non-deterministic calls where you give it a goal and it can go and do things that are useful for you and still give you presumably a typed output or an output that's predictable in one way or the other.

They were early adopters of that.

I would point to that mid-2010s as a great way to, cool, most of XSS is gone.

Can we do, have we done enough of that? Are there more things that, before we even talk about Volns and CVEs, we can just say, that threat modeling a little bit, well, what's the worst could happen or what could go wrong? Let's design around that.

Is that something that you think can be viable or needs just, I'm trying to say how to make that conversation actually have impact? Because that was the word that I think is what I'm looking for here.

The most serious is a flaw in the update process that could allow remote code execution during the window in which an update is applied.

The rest are mostly stored XSS, via manipulated block markup, in the customizer's selective refresh, in the categories, playlist, image, and comment pagination blocks, in personal data erasure requests, and in manipulated usernames, plus several in the interactivity API, along with a stored denial of service in that same API.

Also fixed.

Customizer change set drafts could be viewed without authentication, and notes could be read by users with privileges but without access to edit the post.