manager/security things for Firefox. love my family, my bike and reading books. You can also find me on Mastodon as @freddy@security.plumbing, which I consider my primary account. Homepage: https://frederikbraun.de/https://bsky.app/profile/freddyb.bsky.socialhttps://bsky.app/profile/freddyb.bsky.social/post/3mn57xjr6k72xThe S in interoperability (https://frederikbraun.de/the-s-in-interoperability.html): A blog post about standards, their proliferation and the issues that arive over time.31 May 2026 11:12 +0200at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mn57xjr6k72xhttps://bsky.app/profile/freddyb.bsky.social/post/3mn57xjr6k72xThe S in interoperability (https://frederikbraun.de/the-s-in-interoperability.html): A blog post about standards, their proliferation and the issues that arive over time.31 May 2026 11:12 +0200at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mn57xjr6k72xhttps://bsky.app/profile/freddyb.bsky.social/post/3mkax5sr2522lNew Blog post: "Multiple things can be true at the same time" - https://frederikbraun.de/feels-and-llms.html Dear reader, I am sure you have read a lot of blog posts about AI in the past weeks or months. This is my post.…24 Apr 2026 16:30 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mkax5sr2522lhttps://bsky.app/profile/freddyb.bsky.social/post/3mjzpobfxbc27https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/21 Apr 2026 19:27 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mjzpobfxbc27https://bsky.app/profile/freddyb.bsky.social/post/3mgiubdwgk22oOK, ok. I'll stop blogging for today. I promise.07 Mar 2026 22:19 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mgiubdwgk22ohttps://bsky.app/profile/freddyb.bsky.social/post/3mgiuafy76m2hComposing Sanitizer configurations (https://frederikbraun.de/composable-sanitizers.html): The HTML Sanitizer API allows multiple ways to customize the default allow list and this blog post aims to describe a few variations and tricks we came up with while writing the specification.07 Mar 2026 23:18 +0100at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mgiuafy76m2hhttps://bsky.app/profile/freddyb.bsky.social/post/3mgirw5tvc72iNew blog post: Perfect types with `setHTML()` - https://frederikbraun.de/perfect-types-with-sethtml.html - TLDR: Use require-trusted-types-for 'script'; trusted-types 'none'; in your CSP and nothing besides setHTML() works, essentially removing all DOM-XSS risks....07 Mar 2026 22:36 +0100at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mgirw5tvc72ihttps://bsky.app/profile/freddyb.bsky.social/post/3mg3pek3ujc2yI was invited to join the @shoptalkshow.com podcast and talk about my favorite topic. The HTML Sanitizer API and `setHTML()`. Give it a spin in your favorite podcast player :) shoptalkshow.com/704/ https://shoptalkshow.com/704/02 Mar 2026 16:46 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mg3pek3ujc2yhttps://bsky.app/profile/freddyb.bsky.social/post/3mfmnlmwyoc2vwe did a thing! Congrats to the team for getting this out. [contains quote post or other embedded content]24 Feb 2026 17:04 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mfmnlmwyoc2vhttps://bsky.app/profile/freddyb.bsky.social/post/3mcmefqilrc2othis is your regular reminder that centralized, single-ownership social media is doomed17 Jan 2026 10:05 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3mcmefqilrc2ohttps://bsky.app/profile/freddyb.bsky.social/post/3maywlsuj6c2sHey #39c3. Come see my lightning talk on a safe variant for `.innerHTML ` that is built right into the browser. Tomorrow (day 2), at approximately 12:25 - https://events.ccc.de/congress/2025/hub/event/detail/lightning-talks-tag-227 Dec 2025 23:12 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3maywlsuj6c2shttps://bsky.app/profile/freddyb.bsky.social/post/3maywjlxhsc2sHey #39c3, chat me up if you want to talk about web security, browser security. I will be one of the tall dudes with a Firefox hoodie :)27 Dec 2025 23:10 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3maywjlxhsc2shttps://bsky.app/profile/freddyb.bsky.social/post/3m7t3tre7oc2olol, bsky wanting everyone's my birthday. Follow me on mastodon, you cowards.12 Dec 2025 22:04 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3m7t3tre7oc2ohttps://bsky.app/profile/freddyb.bsky.social/post/3m7ggpdzbkh2fNew blog post: Why the Sanitizer API is just `setHTML()` - https://frederikbraun.de/why-sethtml.html07 Dec 2025 22:14 +0100at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3m7ggpdzbkh2fhttps://bsky.app/profile/freddyb.bsky.social/post/3m7fl2xa45y2fNew blog post. Something off-topic to feed the search engine. A bug in Lego Star Wars: The Complete Saga (2007). https://frederikbraun.de/lego-star-wars-complete-saga-c3po-bug.html 07 Dec 2025 14:00 +0100at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3m7fl2xa45y2fhttps://bsky.app/profile/freddyb.bsky.social/post/3lsxoiukfvk2nWe just opened the Call-for-Papers for the German OWASP Day 2025. The event will be held November 25th-26th in Düsseldorf. god.owasp.de/2025/cfp.html We're looking for all sorts of presentations about web security and beyond for an audience of builders, breakers and defenders. https://god.owasp.de/2025/cfp.html02 Jul 2025 07:21 +0000at://did:plc:irliyjsfhe6vxcn776u5uvh7/app.bsky.feed.post/3lsxoiukfvk2n