RoastMyOpsecBlog
OPSEC signal for public sites and apps — what changed, what still leaks, and what to scan first. Ten guides per page.
Page 7 of 7
News · Mar 27, 2022
Attribution Reporting vs Topics API for marketing sites is two Privacy Sandbox ads channels. Topics lets participating sites observe coarse interest topics the browser computed. Attribution Reporting (ARA) lets an…
Read guide →News · Mar 19, 2022
assetlinks.json vs apple-app-site-association is Android App Links versus Apple Universal Links, both published under /.well-known/. Google looks at https://example.com/.well-known/assetlinks.json. Apple looks at…
Read guide →News · Mar 2, 2022
AMP vs Signed HTTP Exchanges for public pages is two ways a third party might serve a copy of your HTML. AMP is a constrained HTML dialect historically cached on a Google origin (cdn.ampproject.org and cousins) — extra…
Read guide →News · Feb 21, 2022
Alt-Svc vs origin IP exposure on CDNs is a performance header versus a bypass map. Alt-Svc (RFC 7838) tells supporting browsers they may use another protocol or host for this origin — commonly h3=":443" for HTTP/3 on…
Read guide →News · Feb 13, 2022
AI crawlers vs search crawlers in robots.txt for public sites is a User-agent grouping decision: keep Googlebot and other search crawlers on the policy you want for search, and add separate groups for named AI crawlers…
Read guide →News · Feb 4, 2022
ads.txt vs app-ads.txt on public marketing origins is two IAB Tech Lab files that list who may sell your ad inventory. ads.txt lives at https://example.com/ads.txt for the website. app-ads.txt lives on the developer…
Read guide →News · Jan 18, 2022
Access-Control-Max-Age vs CORS preflight caching is how long a browser may skip repeating an OPTIONS check, not whether the API is safe. Access-Control-Max-Age is a seconds budget on a successful preflight. A large…
Read guide →