bgc

I wonder how well Cloudflare et al defend against the class of “nobody could still possibly be using this” vulnerabilities.

Well-written, I appreciated the absence of the kind of over-excited writing you often see in these kinds of posts.

At least with the second app (admittedly judging by that UI) this is a classic case of some team that has only every built apps that sit behind the firewall being made to “move to cloud,” without any understanding of what it means that their code is exposed to the internet.

I’ve seen a lot of orgs “solve” this not by fixing their code but by using Direct Connect to keep everything within the corporate network boundary; since after all compromised VPN credentials are another team’s problem!

This is not a Google-wide thing… this is from Google’s Context-Aware Access product, which is configurable in Google Workspace environments. OP should direct their ire at their corporate IT or infosec team.

Another fun Zendesk “feature,” that, to my knowledge, has never been fixed is if you CC it on a thread with any other email address that auto-replies, it will get stuck in a loop and ping-pong emails back and forth until the mailbox fills up.

> does there exist a well-defined secure subset of CSS such that we don't have to worry about weird vulnerabilities?

I don’t know the answer, but if it is “no,” would it be feasible to add a few more user settings ala topcolor to achieve a more basic version of this?