2 points by refp in lobste.rs · 24m ago · lobsters
> It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this paper [Gareth Heyes] going to show you how to break out of trust boundaries, exfiltrate tokens, compromise 3rd party websites and even steal passwords.
1 points by readevalprint in lobste.rs · 1h ago · lobsters
Tsampi BFT is a leaderless Byzantine fault-tolerant state-replication protocol with one Vote round per Proposed Block and exact-lineage finality in as few as two later Blocks. Its dual-linked Vote chain records both Block-lineage causality and each Validator's endorsement order. Earlier Votes are neither revoked nor reassigned; every successor must prove that it targets a strictly better proposal.
A strict supermajority has more than two thirds of the Stake in the Validator set used for a Block. Q1 is the strict-supermajority Vote pass that sets QuorumBlock. Q2 is the later, independently deduplicated strict-supermajority Vote pass that sets CoveredBlock. Q2 starts empty after Q1 closes. A Validator counted in Q1 may count in Q2 only through a different, later Vote carried by a later descendant Block.
Proposal admission is parameterized independently of finality. Under an unchanged Validator set and an endorsement threshold of at least two thirds, genesis reaches QuorumBlock in Block 2 and CoveredBlock in Block 3; the steady-state pipeline keeps a one-Block lag between them. Proposal admission may use a lower threshold, but every accepted Block must advance the lineage toward strict-supermajority finality.