CINXE.COM

<!DOCTYPE html> <html lang="en-US" class="no-js"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width"> <link rel="profile" href="https://gmpg.org/xfn/11"> <link rel="pingback" href="https://nacin.com/xmlrpc.php"> <script>(function(html){html.className = html.className.replace(/\bno-js\b/,'js')})(document.documentElement);</script> <title>Security is nuanced – Nacin</title> <meta name='robots' content='max-image-preview:large' /> <link rel="alternate" type="application/rss+xml" title="Nacin » Feed" href="https://nacin.com/feed/" /> <link rel="alternate" type="application/rss+xml" title="Nacin » Comments Feed" href="https://nacin.com/comments/feed/" /> <link rel="alternate" type="application/rss+xml" title="Nacin » Security is nuanced Comments Feed" href="https://nacin.com/2014/05/30/security-is-nuanced/feed/" /> <script> window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"wpemoji":"https:\/\/nacin.com\/wp-includes\/js\/wp-emoji.js?ver=6.6.3-alpha-59298","twemoji":"https:\/\/nacin.com\/wp-includes\/js\/twemoji.js?ver=6.6.3-alpha-59298"}}; /** * @output wp-includes/js/wp-emoji-loader.js */ /** * Emoji Settings as exported in PHP via _print_emoji_detection_script(). * @typedef WPEmojiSettings * @type {object} * @property {?object} source * @property {?string} source.concatemoji * @property {?string} source.twemoji * @property {?string} source.wpemoji * @property {?boolean} DOMReady * @property {?Function} readyCallback */ /** * Support tests. * @typedef SupportTests * @type {object} * @property {?boolean} flag * @property {?boolean} emoji */ /** * IIFE to detect emoji support and load Twemoji if needed. * * @param {Window} window * @param {Document} document * @param {WPEmojiSettings} settings */ ( function wpEmojiLoader( window, document, settings ) { if ( typeof Promise === 'undefined' ) { return; } var sessionStorageKey = 'wpEmojiSettingsSupports'; var tests = [ 'flag', 'emoji' ]; /** * Checks whether the browser supports offloading to a Worker. * * @since 6.3.0 * * @private * * @returns {boolean} */ function supportsWorkerOffloading() { return ( typeof Worker !== 'undefined' && typeof OffscreenCanvas !== 'undefined' && typeof URL !== 'undefined' && URL.createObjectURL && typeof Blob !== 'undefined' ); } /** * @typedef SessionSupportTests * @type {object} * @property {number} timestamp * @property {SupportTests} supportTests */ /** * Get support tests from session. * * @since 6.3.0 * * @private * * @returns {?SupportTests} Support tests, or null if not set or older than 1 week. */ function getSessionSupportTests() { try { /** @type {SessionSupportTests} */ var item = JSON.parse( sessionStorage.getItem( sessionStorageKey ) ); if ( typeof item === 'object' && typeof item.timestamp === 'number' && new Date().valueOf() < item.timestamp + 604800 && // Note: Number is a week in seconds. typeof item.supportTests === 'object' ) { return item.supportTests; } } catch ( e ) {} return null; } /** * Persist the supports in session storage. * * @since 6.3.0 * * @private * * @param {SupportTests} supportTests Support tests. */ function setSessionSupportTests( supportTests ) { try { /** @type {SessionSupportTests} */ var item = { supportTests: supportTests, timestamp: new Date().valueOf() }; sessionStorage.setItem( sessionStorageKey, JSON.stringify( item ) ); } catch ( e ) {} } /** * Checks if two sets of Emoji characters render the same visually. * * This function may be serialized to run in a Worker. Therefore, it cannot refer to variables from the containing * scope. Everything must be passed by parameters. * * @since 4.9.0 * * @private * * @param {CanvasRenderingContext2D} context 2D Context. * @param {string} set1 Set of Emoji to test. * @param {string} set2 Set of Emoji to test. * * @return {boolean} True if the two sets render the same. */ function emojiSetsRenderIdentically( context, set1, set2 ) { // Cleanup from previous test. context.clearRect( 0, 0, context.canvas.width, context.canvas.height ); context.fillText( set1, 0, 0 ); var rendered1 = new Uint32Array( context.getImageData( 0, 0, context.canvas.width, context.canvas.height ).data ); // Cleanup from previous test. context.clearRect( 0, 0, context.canvas.width, context.canvas.height ); context.fillText( set2, 0, 0 ); var rendered2 = new Uint32Array( context.getImageData( 0, 0, context.canvas.width, context.canvas.height ).data ); return rendered1.every( function ( rendered2Data, index ) { return rendered2Data === rendered2[ index ]; } ); } /** * Determines if the browser properly renders Emoji that Twemoji can supplement. * * This function may be serialized to run in a Worker. Therefore, it cannot refer to variables from the containing * scope. Everything must be passed by parameters. * * @since 4.2.0 * * @private * * @param {CanvasRenderingContext2D} context 2D Context. * @param {string} type Whether to test for support of "flag" or "emoji". * @param {Function} emojiSetsRenderIdentically Reference to emojiSetsRenderIdentically function, needed due to minification. * * @return {boolean} True if the browser can render emoji, false if it cannot. */ function browserSupportsEmoji( context, type, emojiSetsRenderIdentically ) { var isIdentical; switch ( type ) { case 'flag': /* * Test for Transgender flag compatibility. Added in Unicode 13. * * To test for support, we try to render it, and compare the rendering to how it would look if * the browser doesn't render it correctly (white flag emoji + transgender symbol). */ isIdentical = emojiSetsRenderIdentically( context, '\uD83C\uDFF3\uFE0F\u200D\u26A7\uFE0F', // as a zero-width joiner sequence '\uD83C\uDFF3\uFE0F\u200B\u26A7\uFE0F' // separated by a zero-width space ); if ( isIdentical ) { return false; } /* * Test for UN flag compatibility. This is the least supported of the letter locale flags, * so gives us an easy test for full support. * * To test for support, we try to render it, and compare the rendering to how it would look if * the browser doesn't render it correctly ([U] + [N]). */ isIdentical = emojiSetsRenderIdentically( context, '\uD83C\uDDFA\uD83C\uDDF3', // as the sequence of two code points '\uD83C\uDDFA\u200B\uD83C\uDDF3' // as the two code points separated by a zero-width space ); if ( isIdentical ) { return false; } /* * Test for English flag compatibility. England is a country in the United Kingdom, it * does not have a two letter locale code but rather a five letter sub-division code. * * To test for support, we try to render it, and compare the rendering to how it would look if * the browser doesn't render it correctly (black flag emoji + [G] + [B] + [E] + [N] + [G]). */ isIdentical = emojiSetsRenderIdentically( context, // as the flag sequence '\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62\uDB40\uDC65\uDB40\uDC6E\uDB40\uDC67\uDB40\uDC7F', // with each code point separated by a zero-width space '\uD83C\uDFF4\u200B\uDB40\uDC67\u200B\uDB40\uDC62\u200B\uDB40\uDC65\u200B\uDB40\uDC6E\u200B\uDB40\uDC67\u200B\uDB40\uDC7F' ); return ! isIdentical; case 'emoji': /* * Four and twenty blackbirds baked in a pie. * * To test for Emoji 15.0 support, try to render a new emoji: Blackbird. * * The Blackbird is a ZWJ sequence combining 🐦 Bird and ⬛ large black square., * * 0x1F426 (\uD83D\uDC26) == Bird * 0x200D == Zero-Width Joiner (ZWJ) that links the code points for the new emoji or * 0x200B == Zero-Width Space (ZWS) that is rendered for clients not supporting the new emoji. * 0x2B1B == Large Black Square * * When updating this test for future Emoji releases, ensure that individual emoji that make up the * sequence come from older emoji standards. */ isIdentical = emojiSetsRenderIdentically( context, '\uD83D\uDC26\u200D\u2B1B', // as the zero-width joiner sequence '\uD83D\uDC26\u200B\u2B1B' // separated by a zero-width space ); return ! isIdentical; } return false; } /** * Checks emoji support tests. * * This function may be serialized to run in a Worker. Therefore, it cannot refer to variables from the containing * scope. Everything must be passed by parameters. * * @since 6.3.0 * * @private * * @param {string[]} tests Tests. * @param {Function} browserSupportsEmoji Reference to browserSupportsEmoji function, needed due to minification. * @param {Function} emojiSetsRenderIdentically Reference to emojiSetsRenderIdentically function, needed due to minification. * * @return {SupportTests} Support tests. */ function testEmojiSupports( tests, browserSupportsEmoji, emojiSetsRenderIdentically ) { var canvas; if ( typeof WorkerGlobalScope !== 'undefined' && self instanceof WorkerGlobalScope ) { canvas = new OffscreenCanvas( 300, 150 ); // Dimensions are default for HTMLCanvasElement. } else { canvas = document.createElement( 'canvas' ); } var context = canvas.getContext( '2d', { willReadFrequently: true } ); /* * Chrome on OS X added native emoji rendering in M41. Unfortunately, * it doesn't work when the font is bolder than 500 weight. So, we * check for bold rendering support to avoid invisible emoji in Chrome. */ context.textBaseline = 'top'; context.font = '600 32px Arial'; var supports = {}; tests.forEach( function ( test ) { supports[ test ] = browserSupportsEmoji( context, test, emojiSetsRenderIdentically ); } ); return supports; } /** * Adds a script to the head of the document. * * @ignore * * @since 4.2.0 * * @param {string} src The url where the script is located. * * @return {void} */ function addScript( src ) { var script = document.createElement( 'script' ); script.src = src; script.defer = true; document.head.appendChild( script ); } settings.supports = { everything: true, everythingExceptFlag: true }; // Create a promise for DOMContentLoaded since the worker logic may finish after the event has fired. var domReadyPromise = new Promise( function ( resolve ) { document.addEventListener( 'DOMContentLoaded', resolve, { once: true } ); } ); // Obtain the emoji support from the browser, asynchronously when possible. new Promise( function ( resolve ) { var supportTests = getSessionSupportTests(); if ( supportTests ) { resolve( supportTests ); return; } if ( supportsWorkerOffloading() ) { try { // Note that the functions are being passed as arguments due to minification. var workerScript = 'postMessage(' + testEmojiSupports.toString() + '(' + [ JSON.stringify( tests ), browserSupportsEmoji.toString(), emojiSetsRenderIdentically.toString() ].join( ',' ) + '));'; var blob = new Blob( [ workerScript ], { type: 'text/javascript' } ); var worker = new Worker( URL.createObjectURL( blob ), { name: 'wpTestEmojiSupports' } ); worker.onmessage = function ( event ) { supportTests = event.data; setSessionSupportTests( supportTests ); worker.terminate(); resolve( supportTests ); }; return; } catch ( e ) {} } supportTests = testEmojiSupports( tests, browserSupportsEmoji, emojiSetsRenderIdentically ); setSessionSupportTests( supportTests ); resolve( supportTests ); } ) // Once the browser emoji support has been obtained from the session, finalize the settings. .then( function ( supportTests ) { /* * Tests the browser support for flag emojis and other emojis, and adjusts the * support settings accordingly. */ for ( var test in supportTests ) { settings.supports[ test ] = supportTests[ test ]; settings.supports.everything = settings.supports.everything && settings.supports[ test ]; if ( 'flag' !== test ) { settings.supports.everythingExceptFlag = settings.supports.everythingExceptFlag && settings.supports[ test ]; } } settings.supports.everythingExceptFlag = settings.supports.everythingExceptFlag && ! settings.supports.flag; // Sets DOMReady to false and assigns a ready function to settings. settings.DOMReady = false; settings.readyCallback = function () { settings.DOMReady = true; }; } ) .then( function () { return domReadyPromise; } ) .then( function () { // When the browser can not render everything we need to load a polyfill. if ( ! settings.supports.everything ) { settings.readyCallback(); var src = settings.source || {}; if ( src.concatemoji ) { addScript( src.concatemoji ); } else if ( src.wpemoji && src.twemoji ) { addScript( src.twemoji ); addScript( src.wpemoji ); } } } ); } )( window, document, window._wpemojiSettings ); </script> <style id='wp-emoji-styles-inline-css'> img.wp-smiley, img.emoji { display: inline !important; border: none !important; box-shadow: none !important; height: 1em !important; width: 1em !important; margin: 0 0.07em !important; vertical-align: -0.1em !important; background: none !important; padding: 0 !important; } </style> <link rel='stylesheet' id='wp-block-library-css' href='https://nacin.com/wp-includes/css/dist/block-library/style.css?ver=6.6.3-alpha-59298' media='all' /> <style id='wp-block-library-theme-inline-css'> .wp-block-audio :where(figcaption){ color:#555; font-size:13px; text-align:center; } .is-dark-theme .wp-block-audio :where(figcaption){ color:#ffffffa6; } .wp-block-audio{ margin:0 0 1em; } .wp-block-code{ border:1px solid #ccc; border-radius:4px; font-family:Menlo,Consolas,monaco,monospace; padding:.8em 1em; } .wp-block-embed :where(figcaption){ color:#555; font-size:13px; text-align:center; } .is-dark-theme .wp-block-embed :where(figcaption){ color:#ffffffa6; } .wp-block-embed{ margin:0 0 1em; } .blocks-gallery-caption{ color:#555; font-size:13px; text-align:center; } .is-dark-theme .blocks-gallery-caption{ color:#ffffffa6; } :root :where(.wp-block-image figcaption){ color:#555; font-size:13px; text-align:center; } .is-dark-theme :root :where(.wp-block-image figcaption){ color:#ffffffa6; } .wp-block-image{ margin:0 0 1em; } .wp-block-pullquote{ border-bottom:4px solid; border-top:4px solid; color:currentColor; margin-bottom:1.75em; } .wp-block-pullquote cite,.wp-block-pullquote footer,.wp-block-pullquote__citation{ color:currentColor; font-size:.8125em; font-style:normal; text-transform:uppercase; } .wp-block-quote{ border-left:.25em solid; margin:0 0 1.75em; padding-left:1em; } .wp-block-quote cite,.wp-block-quote footer{ color:currentColor; font-size:.8125em; font-style:normal; position:relative; } .wp-block-quote.has-text-align-right{ border-left:none; border-right:.25em solid; padding-left:0; padding-right:1em; } .wp-block-quote.has-text-align-center{ border:none; padding-left:0; } .wp-block-quote.is-large,.wp-block-quote.is-style-large,.wp-block-quote.is-style-plain{ border:none; } .wp-block-search .wp-block-search__label{ font-weight:700; } .wp-block-search__button{ border:1px solid #ccc; padding:.375em .625em; } :where(.wp-block-group.has-background){ padding:1.25em 2.375em; } .wp-block-separator.has-css-opacity{ opacity:.4; } .wp-block-separator{ border:none; border-bottom:2px solid; margin-left:auto; margin-right:auto; } .wp-block-separator.has-alpha-channel-opacity{ opacity:1; } .wp-block-separator:not(.is-style-wide):not(.is-style-dots){ width:100px; } .wp-block-separator.has-background:not(.is-style-dots){ border-bottom:none; height:1px; } .wp-block-separator.has-background:not(.is-style-wide):not(.is-style-dots){ height:2px; } .wp-block-table{ margin:0 0 1em; } .wp-block-table td,.wp-block-table th{ word-break:normal; } .wp-block-table :where(figcaption){ color:#555; font-size:13px; text-align:center; } .is-dark-theme .wp-block-table :where(figcaption){ color:#ffffffa6; } .wp-block-video :where(figcaption){ color:#555; font-size:13px; text-align:center; } .is-dark-theme .wp-block-video :where(figcaption){ color:#ffffffa6; } .wp-block-video{ margin:0 0 1em; } :root :where(.wp-block-template-part.has-background){ margin-bottom:0; margin-top:0; padding:1.25em 2.375em; } </style> <style id='classic-theme-styles-inline-css'> /** * These rules are needed for backwards compatibility. * They should match the button element rules in the base theme.json file. */ .wp-block-button__link { color: #ffffff; background-color: #32373c; border-radius: 9999px; /* 100% causes an oval, but any explicit but really high value retains the pill shape. */ /* This needs a low specificity so it won't override the rules from the button element if defined in theme.json. */ box-shadow: none; text-decoration: none; /* The extra 2px are added to size solids the same as the outline versions.*/ padding: calc(0.667em + 2px) calc(1.333em + 2px); font-size: 1.125em; } .wp-block-file__button { background: #32373c; color: #ffffff; text-decoration: none; } </style> <style id='global-styles-inline-css'> :root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #fff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--color--dark-gray: #111;--wp--preset--color--light-gray: #f1f1f1;--wp--preset--color--yellow: #f4ca16;--wp--preset--color--dark-brown: #352712;--wp--preset--color--medium-pink: #e53b51;--wp--preset--color--light-pink: #ffe5d1;--wp--preset--color--dark-purple: #2e2256;--wp--preset--color--purple: #674970;--wp--preset--color--blue-gray: #22313f;--wp--preset--color--bright-blue: #55c3dc;--wp--preset--color--light-blue: #e9f2f9;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--gradient--dark-gray-gradient-gradient: linear-gradient(90deg, rgba(17,17,17,1) 0%, rgba(42,42,42,1) 100%);--wp--preset--gradient--light-gray-gradient: linear-gradient(90deg, rgba(241,241,241,1) 0%, rgba(215,215,215,1) 100%);--wp--preset--gradient--white-gradient: linear-gradient(90deg, rgba(255,255,255,1) 0%, rgba(230,230,230,1) 100%);--wp--preset--gradient--yellow-gradient: linear-gradient(90deg, rgba(244,202,22,1) 0%, rgba(205,168,10,1) 100%);--wp--preset--gradient--dark-brown-gradient: linear-gradient(90deg, rgba(53,39,18,1) 0%, rgba(91,67,31,1) 100%);--wp--preset--gradient--medium-pink-gradient: linear-gradient(90deg, rgba(229,59,81,1) 0%, rgba(209,28,51,1) 100%);--wp--preset--gradient--light-pink-gradient: linear-gradient(90deg, rgba(255,229,209,1) 0%, rgba(255,200,158,1) 100%);--wp--preset--gradient--dark-purple-gradient: linear-gradient(90deg, rgba(46,34,86,1) 0%, rgba(66,48,123,1) 100%);--wp--preset--gradient--purple-gradient: linear-gradient(90deg, rgba(103,73,112,1) 0%, rgba(131,93,143,1) 100%);--wp--preset--gradient--blue-gray-gradient: linear-gradient(90deg, rgba(34,49,63,1) 0%, rgba(52,75,96,1) 100%);--wp--preset--gradient--bright-blue-gradient: linear-gradient(90deg, rgba(85,195,220,1) 0%, rgba(43,180,211,1) 100%);--wp--preset--gradient--light-blue-gradient: linear-gradient(90deg, rgba(233,242,249,1) 0%, rgba(193,218,238,1) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;} :where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;} :where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;} :root :where(.wp-block-pullquote){font-size: 1.5em;line-height: 1.6;} </style> <link rel='stylesheet' id='twentyfifteen-fonts-css' href='https://nacin.com/wp-content/themes/twentyfifteen/assets/fonts/noto-sans-plus-noto-serif-plus-inconsolata.css?ver=20230328' media='all' /> <link rel='stylesheet' id='genericons-css' href='https://nacin.com/wp-content/plugins/jetpack/_inc/genericons/genericons/genericons.css?ver=3.1' media='all' /> <link rel='stylesheet' id='twentyfifteen-style-css' href='https://nacin.com/wp-content/themes/twentyfifteen/style.css?v=20140829&ver=20240716' media='all' /> <link rel='stylesheet' id='twentyfifteen-block-style-css' href='https://nacin.com/wp-content/themes/twentyfifteen/css/blocks.css?ver=20240609' media='all' /> <script src="https://nacin.com/wp-includes/js/jquery/jquery.js?ver=3.7.1" id="jquery-core-js"></script> <script src="https://nacin.com/wp-includes/js/jquery/jquery-migrate.js?ver=3.4.1" id="jquery-migrate-js"></script> <script id="twentyfifteen-script-js-extra"> var screenReaderText = {"expand":"<span class=\"screen-reader-text\">expand child menu<\/span>","collapse":"<span class=\"screen-reader-text\">collapse child menu<\/span>"}; </script> <script src="https://nacin.com/wp-content/themes/twentyfifteen/js/functions.js?ver=20221101" id="twentyfifteen-script-js" defer data-wp-strategy="defer"></script> <link rel="https://api.w.org/" href="https://nacin.com/wp-json/" /><link rel="alternate" title="JSON" type="application/json" href="https://nacin.com/wp-json/wp/v2/posts/4235" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://nacin.com/xmlrpc.php?rsd" /> <meta name="generator" content="WordPress 6.6.3-alpha-59298" /> <link rel="canonical" href="https://nacin.com/2014/05/30/security-is-nuanced/" /> <link rel='shortlink' href='https://nacin.com/?p=4235' /> <link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://nacin.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fnacin.com%2F2014%2F05%2F30%2Fsecurity-is-nuanced%2F" /> <link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://nacin.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fnacin.com%2F2014%2F05%2F30%2Fsecurity-is-nuanced%2F&format=xml" /> <link rel="shortcut icon" href="/favicon.ico?2" />  <meta property="og:type" content="article" /> <meta property="og:title" content="Security is nuanced" /> <meta property="og:url" content="https://nacin.com/2014/05/30/security-is-nuanced/" /> <meta property="og:description" content="As a software vendor, there are many reasons to prefer responsible disclosure of security issues. But the most important reason is also less obvious: vulnerability reports need to be correct. I&#82…" /> <meta property="article:published_time" content="2014-05-30T18:44:41+00:00" /> <meta property="article:modified_time" content="2014-05-30T18:44:58+00:00" /> <meta property="og:site_name" content="Nacin" /> <meta property="og:image" content="https://s0.wp.com/i/blank.jpg" /> <meta property="og:locale" content="en_US" /> <meta name="twitter:text:title" content="Security is nuanced" /> <meta name="twitter:card" content="summary" />  <style type="text/css" id="syntaxhighlighteranchor"></style> </head> <body class="post-template-default single single-post postid-4235 single-format-standard wp-embed-responsive"> <div id="page" class="hfeed site"> <a class="skip-link screen-reader-text" href="#content"> Skip to content </a> <div id="sidebar" class="sidebar"> <header id="masthead" class="site-header"> <div class="site-branding"> <p class="site-title"><a href="https://nacin.com/" rel="home">Nacin</a></p> <p class="site-description">WordPress Lead Developer</p> <button class="secondary-toggle">Menu and widgets</button> </div> </header> <div id="secondary" class="secondary"> <nav id="social-navigation" class="social-navigation"> </nav> <div id="widget-area" class="widget-area" role="complementary"> <aside id="text-3" class="widget widget_text"><h2 class="widget-title">About Me</h2> <div class="textwidget"><p><img src="https://secure.gravatar.com/avatar/01cfe9feaafb068590891bbd1f6a7f5a?size=75" style="float:right; margin:0 0 7px 7px" /> Hi, I'm Andrew Nacin, a Lead Developer of WordPress, living in Washington, D.C., and previously working for the <a href="https://www.usds.gov/">U.S. Digital Service</a> at the White House. <a href="/about/">More...</a></p> </div> </aside><aside id="text-6" class="widget widget_text"><h2 class="widget-title">Find Me</h2> <div class="textwidget"><ul> <li><a href="http://twitter.com/nacin">@nacin on Twitter</a></li> <li><a href="http://profiles.wordpress.org/nacin">on WordPress.org</a></li> </ul></div> </aside> </div> </div> </div> <div id="content" class="site-content"> <div id="primary" class="content-area"> <main id="main" class="site-main"> <article id="post-4235" class="post-4235 post type-post status-publish format-standard hentry tag-security tag-wordpress"> <header class="entry-header"> <h1 class="entry-title">Security is nuanced</h1> </header> <div class="entry-content"> <p>As a software vendor, there are many reasons to prefer responsible disclosure of security issues. But the most important reason is also less obvious: vulnerability reports need to be <em>correct</em>.</p> <p>I’ve seen countless “full disclosure” reports that are wrong and invalid. Most of these could have been prevented by privately disclosing it to the vendor and allowing them the opportunity to respond.</p> <p>Everyone sees WordPress in the headlines, over and over again, but no one ever notices the “this report is invalid” response. We’ve prevented countless invalid reports from being published simply because they were disclosed to us first. This is better for the software’s users, who are otherwise left to scramble every time they see a report. They are not an expert, and often, neither is the reporter.</p> <p>There’s another angle here, though: sometimes, the vulnerability report is correct, but <em>incomplete</em>. This too can send everyone scrambling, starting with the vendor who was not given the opportunity to straighten things out.</p> <p>When responsible disclosure works, it works really well. I offer <a href="http://jetpack.me/2014/04/10/jetpack-security-update/">Jetpack’s recent vulnerability</a> as a recent case study. While this was discovered internally at Automattic, the effect is the same: they were able to quickly and thoroughly investigate the issues and follow through with a plan of action. During their investigation they learned the problem was far more severe than they originally identified, and that their initial proposed fix was incomplete.</p> <p>There will always be individuals who want everything to be fully disclosed, and there are some great arguments for that. I’m not trying to sway you one way or the other. But if you’re trying to do the right thing — you’re doing full disclosure in the interest of users, possibly even providing a patch or steps to mitigate — working with the vendor is a good way to ensure you haven’t missed anything.</p> <p>I’m not sure how many times now I’ve responded to a mailing list saying, “well, this isn’t a vulnerability,” or “your proposed patch is incomplete,” or “your patch makes it worse.” Or when I don’t respond to the mailing list because my thought is <em>T</em><em>his is worse than the reporter realizes.</em></p> <p>Security is nuanced.</p> <p>Last week, a security researcher disclosed some issues with WordPress. They stated that WordPress issues a cookie in plain HTTP that identifies the user. Correct. They also stated that this cookie does not expire when the user logs out. Also correct.</p> <p>She went on to state that the cookie has a lifetime of 3 years, that it can be used to mess with the account’s two-factor authentication settings, and change their email and other settings. She followed that up with “have notified them and waited 24hrs for response, none yet. guessing it’s a wontfix for now, since their SSL support is patchy.”</p> <p>Yes, absolutely, SSL support in WordPress is patchy. (Coincidentally, fixing all of this was already slated for the next major release.) While you can force SSL for the dashboard, we don’t have the concept of forcing SSL for the front-end of the site. So, that “logged in” cookie is issued over plain HTTP. It’s trivial in a plugin to force that cookie to be secure, but of course most users aren’t going to do that. Of course, most users also aren’t using SSL (sadly).</p> <p>WordPress also doesn’t have any concept of session management. The user is authenticated and a cookie is issued, but there’s no way for it to be automatically invalidated upon logout (without you changing your password). Changing this is a major architectural change we’ve been planning for some time. But this is also why cookies are designed with a limited expiration: just 48 hours, or 14 days if you click “Remember me.”</p> <p>But the report was that it didn’t expire for three years, right? This is where it gets a bit weird. I’d love it if “Remember me” remembered you for 30, 90, or even 365 days, but WordPress will wait to make any changes until cookies can be invalidated. Some time ago, though, WordPress.com configured this cookie to last for three years.</p> <p>Normally, this wouldn’t be that bad. You see, the “logged in” cookie is <em>relatively</em> harmless. It allows presentational things like the toolbar, edit links in your theme, and such. But you can’t use it to manage your account, change your email, or do anything particularly crazy. In fact, WordPress issues a separate, secure “auth” cookie used for the “wp-admin” dashboard. It’s like Amazon knowing who you are after six months of not being on the site, but asking you to log in when you start to check out.</p> <p>On WordPress.com, however, a lot of settings can be managed outside of the dashboard, on their “new dashboard,” at wordpress.com/settings/. As you might have guessed by now, they were not requiring the “auth” cookie on this page, only the “logged in” cookie. That is the true critical vulnerability here. A number of decisions came together to make a latent issue a very real one. The issue wasn’t reported like this because the reporter isn’t familiar with the intricacies of user authentication internals in WordPress, nor should anyone expect them to. Rather, an assumption was made it was a design decision that would probably just be a “wontfix” due to “patchy” SSL support.</p> <p>The disclosure was well-intentioned, but because it happened within just 24 hours, Automattic wasn’t able to react quickly enough to identify the actual issue and request that it not be disclosed until they got a fix in place.</p> <p>I’m just trying to set the record straight on what happened, since I keep seeing confused tweets, blog posts, comments, and Facebook chatter. (Favorite Facebook comment, after I posted a brief explanation: “Did we just open all those nesting doll layers to discover the belly was empty?”) This situation probably could have been handled better by everyone involved, but that’s not really the point. The primary issue is now handled, and other issues are also being addressed. I don’t think this requires post-mortem blog posts with a side of FUD. I’m not looking for a debate on full disclosure versus responsible disclosure. And I certainly don’t think anyone should be questioning the researcher, who has spent years dedicating herself to making the Internet more secure.</p> <p>In this case, WordPress.com the service was able to react quickly to mitigate this issue for all of its users. Of course, with software, holes can’t be closed so easily, and in this case, the situation was probably exacerbated by confusing WordPress.com the service with WordPress the software. That confusion is easy to understand, especially since some of these issues have roots in the core software.</p> <address>Security is nuanced.</address> <p><em>I’ve not linked to any previous posts because I don’t want this to be a criticism of any researcher or writer, but if you’re looking for background: <a href="https://zyan.scripts.mit.edu/blog/wordpress-fail/">1</a> <a href="http://arstechnica.com/security/2014/05/unsafe-cookies-leave-wordpress-accounts-open-to-hijacking-2-factor-bypass/">2</a> <a href="http://wptavern.com/wordpress-com-security-vulnerability-stirs-debate-over-responsible-disclosure">3</a>. Also, related work for WordPress 4.0 is happening <a href="https://core.trac.wordpress.org/query?milestone=4.0&component=Security">here</a>.</em></p> </div> <div class="author-info"> <h2 class="author-heading">Published by</h2> <div class="author-avatar"> <img alt='' src='https://secure.gravatar.com/avatar/01cfe9feaafb068590891bbd1f6a7f5a?s=56&d=mm&r=g' srcset='https://secure.gravatar.com/avatar/01cfe9feaafb068590891bbd1f6a7f5a?s=112&d=mm&r=g 2x' class='avatar avatar-56 photo' height='56' width='56' decoding='async'/> </div> <div class="author-description"> <h3 class="author-title">Andrew Nacin</h3> <p class="author-bio"> Lead developer of WordPress, living in Washington, D.C. <a href="http://twitter.com/nacin">Follow me on Twitter</a>. <a class="author-link" href="https://nacin.com/author/nacin/" rel="author"> View all posts by Andrew Nacin </a> </p> </div> </div> <footer class="entry-footer"> <span class="posted-on"><span class="screen-reader-text">Posted on </span><a href="https://nacin.com/2014/05/30/security-is-nuanced/" rel="bookmark"><time class="entry-date published" datetime="2014-05-30T14:44:41-04:00">May 30, 2014</time><time class="updated" datetime="2014-05-30T14:44:58-04:00">May 30, 2014</time></a></span><span class="byline"><span class="author vcard"><span class="screen-reader-text">Author </span><a class="url fn n" href="https://nacin.com/author/nacin/">Andrew Nacin</a></span></span><span class="tags-links"><span class="screen-reader-text">Tags </span><a href="https://nacin.com/tag/security/" rel="tag">security</a>, <a href="https://nacin.com/tag/wordpress/" rel="tag">WordPress</a></span> </footer> </article> <div id="comments" class="comments-area"> <h2 class="comments-title"> 5 thoughts on “Security is nuanced” </h2> <ol class="comment-list"> <li id="comment-340500" class="comment even thread-even depth-1"> <article id="div-comment-340500" class="comment-body"> <footer class="comment-meta"> <div class="comment-author vcard"> <img alt='' src='https://secure.gravatar.com/avatar/8a41fbdec727d043c6f7512e3687e249?s=56&d=mm&r=g' srcset='https://secure.gravatar.com/avatar/8a41fbdec727d043c6f7512e3687e249?s=112&d=mm&r=g 2x' class='avatar avatar-56 photo' height='56' width='56' decoding='async'/> <b class="fn"><a href="http://Sucuri.net" class="url" rel="ugc external nofollow">Tony Perez</a></b> <span class="says">says:</span> </div> <div class="comment-metadata"> <a href="https://nacin.com/2014/05/30/security-is-nuanced/#comment-340500"><time datetime="2014-05-30T16:22:47-04:00">May 30, 2014 at 4:22 pm</time></a> </div> </footer> <div class="comment-content"> <p>Your post is perfect, on point!</p> </div> </article> </li> <li id="comment-340507" class="comment odd alt thread-odd thread-alt depth-1"> <article id="div-comment-340507" class="comment-body"> <footer class="comment-meta"> <div class="comment-author vcard"> <img alt='' src='https://secure.gravatar.com/avatar/6e8cca95f0491b36499ba25f0e0440d7?s=56&d=mm&r=g' srcset='https://secure.gravatar.com/avatar/6e8cca95f0491b36499ba25f0e0440d7?s=112&d=mm&r=g 2x' class='avatar avatar-56 photo' height='56' width='56' decoding='async'/> <b class="fn">William P. Davis</b> <span class="says">says:</span> </div> <div class="comment-metadata"> <a href="https://nacin.com/2014/05/30/security-is-nuanced/#comment-340507"><time datetime="2014-05-30T17:33:50-04:00">May 30, 2014 at 5:33 pm</time></a> </div> </footer> <div class="comment-content"> <p>Nacin, Can you share a bit about what specific functions WP.com was misusing that allowed this vulnerability? There are many other sites that have sensitive info on the frontend. Also, what of her claim to be able to read private posts?</p> </div> </article> </li> <li id="comment-340535" class="comment even thread-even depth-1 parent"> <article id="div-comment-340535" class="comment-body"> <footer class="comment-meta"> <div class="comment-author vcard"> <img alt='' src='https://secure.gravatar.com/avatar/2d355831d599d06f495dd868c89bb601?s=56&d=mm&r=g' srcset='https://secure.gravatar.com/avatar/2d355831d599d06f495dd868c89bb601?s=112&d=mm&r=g 2x' class='avatar avatar-56 photo' height='56' width='56' loading='lazy' decoding='async'/> <b class="fn"><a href="https://www.toddlahman.com" class="url" rel="ugc external nofollow">Todd Lahman</a></b> <span class="says">says:</span> </div> <div class="comment-metadata"> <a href="https://nacin.com/2014/05/30/security-is-nuanced/#comment-340535"><time datetime="2014-05-30T22:18:39-04:00">May 30, 2014 at 10:18 pm</time></a> </div> </footer> <div class="comment-content"> <p>Since WordPress.com uses Nginx and SPDY, why isn’t the whole site using the https?</p> </div> </article> <ol class="children"> <li id="comment-344300" class="comment byuser comment-author-nacin bypostauthor odd alt depth-2"> <article id="div-comment-344300" class="comment-body"> <footer class="comment-meta"> <div class="comment-author vcard"> <img alt='' src='https://secure.gravatar.com/avatar/01cfe9feaafb068590891bbd1f6a7f5a?s=56&d=mm&r=g' srcset='https://secure.gravatar.com/avatar/01cfe9feaafb068590891bbd1f6a7f5a?s=112&d=mm&r=g 2x' class='avatar avatar-56 photo' height='56' width='56' loading='lazy' decoding='async'/> <b class="fn"><a href="http://www.andrewnacin.com" class="url" rel="ugc external nofollow">Andrew Nacin</a></b> <span class="says">says:</span> </div> <div class="comment-metadata"> <a href="https://nacin.com/2014/05/30/security-is-nuanced/#comment-344300"><time datetime="2014-07-14T10:13:34-04:00">July 14, 2014 at 10:13 am</time></a> </div> </footer> <div class="comment-content"> <p>Easiest answer: This doesn’t work for mapped domains. But <a href="http://en.blog.wordpress.com/2014/06/05/reset-the-net/" rel="nofollow">they’re intending</a> to force-SSL *.wordpress.com by the end of the year.</p> </div> </article> </li> </ol> </li> <li id="comment-342406" class="comment even thread-odd thread-alt depth-1"> <article id="div-comment-342406" class="comment-body"> <footer class="comment-meta"> <div class="comment-author vcard"> <img alt='' src='https://secure.gravatar.com/avatar/c822828d07eb9ea433404cb27f84c4d6?s=56&d=mm&r=g' srcset='https://secure.gravatar.com/avatar/c822828d07eb9ea433404cb27f84c4d6?s=112&d=mm&r=g 2x' class='avatar avatar-56 photo' height='56' width='56' loading='lazy' decoding='async'/> <b class="fn"><a href="http://geek.ryanhellyer.net/" class="url" rel="ugc external nofollow">Ryan Hellyer</a></b> <span class="says">says:</span> </div> <div class="comment-metadata"> <a href="https://nacin.com/2014/05/30/security-is-nuanced/#comment-342406"><time datetime="2014-06-23T11:04:27-04:00">June 23, 2014 at 11:04 am</time></a> </div> </footer> <div class="comment-content"> <p>I didn’t realise WordPress.com had separate auth cookies. I assumed they were all jumbled into one super cookie. That does explain how they got away with doing things the way they had for so long. I always assumed that was a big security flaw they had chosen to ignore.</p> </div> </article> </li> </ol> <p class="no-comments">Comments are closed.</p> </div> <nav class="navigation post-navigation" aria-label="Posts"> <h2 class="screen-reader-text">Post navigation</h2> <div class="nav-links"><div class="nav-previous"><a href="https://nacin.com/2014/04/15/my-talk-proposals-for-open-source-bridge/" rel="prev"><span class="meta-nav" aria-hidden="true">Previous</span> <span class="screen-reader-text">Previous post:</span> <span class="post-title">My Talk Proposals for Open Source Bridge</span></a></div><div class="nav-next"><a href="https://nacin.com/2014/06/12/comcast/" rel="next"><span class="meta-nav" aria-hidden="true">Next</span> <span class="screen-reader-text">Next post:</span> <span class="post-title">You can call it congestion or throttling. I call it unacceptable.</span></a></div></div> </nav> </main> </div> </div> <footer id="colophon" class="site-footer"> <div class="site-info"> <a href="https://wordpress.org/" class="imprint"> Proudly powered by WordPress </a> </div> </footer> </div> <style id='core-block-supports-inline-css'> /** * Core styles: block-supports */ </style> </body> </html>