> Wails automatically makes your Go methods available to Javascript, so you can call them by name from your frontend! It even generates Typescript versions of the structs used by your Go methods, so you can pass the same data structures between Go and Javascript.
"Get a Product Job (May 2020 - May 2021)
This time the main objective was to learn something new by doing. I chose Ruby on Rails. It's a great framework to build websites quickly."
Choosing Roby on Rails in 2020 as a "new framework" for web development ... sheesh.
The provided staging build contains the Mozilla VPN WebSocket Controller, which exposes a WebSocket endpoint on localhost. No additional authentication is required to interact with this port, thus allowing any website to connect and interact with the VPN client. At the beginning of the audit, Mozilla assured that this WebSocket server is only part of the staging build. However, later it was revealed that Mozilla would like to reuse this connection for communication with a browser extension in the future. Thus, Cure53 decided to report this issue."
A classic one.
Also interesting:
"On Linux and macOS, a helper shell script is called by the privileged daemon which sets up WireGuard and network configurations. This script is extremely critical for security and should normally get most of the security attention. However, prior to the test, Mozilla has announced that it will be replaced soon and, as such, does not warrant substantial reviewing efforts. This - in Cure53’s opinion - is rather unfortunate in relation to its criticality. Cure53 therefore recommends that the upcoming changes get comprehensively reviewed in terms of security before they are shipped in production releases."