richm44

If that same tool is unable to spot LD_PRELOAD in use then I'd suggest getting a new one. :-)

Time for me to dust off CVE-2010-3170 again? :-)

Odd - I also have 16.93 on Mac and I don't get the checkbox (unless I just can't find it I guess).

As the article explains, that's not been implemented on Mac yet.

Downloading things from the AIA fields would mean triggering HTTP/HTTPS requests to an untrusted URL from a certificate you haven't verified - not a good idea. What firefox does is cache intermediates that it has seen elsewhere, the windows TLS stack can fetch additional certs from windows update on-demand (and actually starts with only a small bundle of trusted roots). There is no good solution for incomplete chains other than getting the sites fixed (or using a provider like cloudflare that solves it for them).

1. A SYN will receive a SYN-ACK or a RST 2. A host from my machine is the same as from your machine 3. An IP from my machine is the same as from your machine

It was also possible in earlier browsers by using hidden frames. User interaction or a timer would trigger, then you load the frame (which contained dynamically generated js) and then call the javascript you'd just loaded.

You can't get perfection, but you can do things like ask for them to document the controls they implement and to evidence that they have operated them appropriately via an audit like SOC2.