-
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
9 changed files
with
111 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| --- | ||
| tags: | ||
| - productivity | ||
| --- | ||
| ::: info | ||
| 主にAPI経由でChatGPTなどを使う際に検討されるクライアントツールを挙げると思います。 | ||
| これらは利用したことがないものを多く含みます。 | ||
| ::: | ||
|
|
||
| 1. BoltAI | ||
| 2. [Msty](https://msty.app/) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| --- | ||
| tags: | ||
| - security | ||
| --- | ||
| ## 概要 | ||
| > **コンテンツ セキュリティ ポリシー**( [CSP ) は、クロスサイト スクリプティング (](https://developer.mozilla.org/en-US/docs/Glossary/CSP) [XSS](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting) ) やデータ インジェクション攻撃などの特定の種類の攻撃を検出して軽減するのに役立つ追加のセキュリティ レイヤーです。 | ||
| > | ||
| > [Content Security Policy (CSP) - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) | ||
| HTTPの`Content-Security-Policy`レスポンスヘッダーに設定することで、信頼できるコンテンツやスクリプトのみを実行します。違反しているリソースの読み込みや実行は拒否されます。 | ||
| [[XSS]]対策がメインになります。 | ||
|
|
||
| ## 設定概要 | ||
| ### Fetch directives | ||
| 特定のリソース種別を読み込む事ができる場所を制御する。 | ||
| ### Document directives | ||
| ポリシーが適用sareru文書とworkerのプロパティを管理 | ||
| ### Navigation directives | ||
| `form-action`など、ユーザーが移動・送信できる場所を制御。 | ||
| ### Reporting directives | ||
| CSP違反のReportの制御。 | ||
|
|
||
| ## 対応基準 | ||
| [[XSS]]対策が主になるため、ユーザー入力内容が表示・実行されるようなサービスでは特に対応を検討するべきです。 | ||
|
|
||
| ## 参考 | ||
| - [ゼロから学ぶCSP（Content Security Policy）入門](https://liginc.co.jp/blog/tech/639126) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| --- | ||
| tags: | ||
| - security | ||
| --- | ||
| 想定されるリスク | ||
| 1. DNSスプーフィング | ||
| - 暗号化される前のDNSクエリの改ざん | ||
| - 偽サイトへの誘導リスク | ||
| 2. [SSLストリッピング](https://bluegoat.jp/blog/hsts-ssl-stripping/) | ||
| - HTTPS接続を強制的にHTTPへダウングレードする | ||
| - 見かけ上は通信しているため、前段で攻撃者が介在していると検知できない | ||
| - HSTS[^HSTS]によって対策 | ||
| 1. [Man-in-the-middle (MITM) 攻撃](https://www.f5.com/ja_jp/glossary/man-in-the-middle-attack-mitm) | ||
| - 偽のアクセスポイントを設置し、通信の傍受 | ||
| - 証明書の警告無視が危険 | ||
| 2. パケットスッフィング | ||
| > [スニッフィングとは](https://wa3.i-3-i.info/word12624.html) | ||
|
|
||
| [^HSTS]: HTTP Strict Transport Security: 一度通信したブラウザとサーバー間でサーバーがブラウザに対してセキュリティヘッダーを付与。有効期間内でhttpsで接続する旨があり、次回以降は自動的にhttps接続をする。<br> https://securityheaders.com/ にてヘッダーの確認ができる。もしくはNetwork Tab | ||
|
|
||
| 関連: [[Content Security Policy (CSP)]] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| --- | ||
| tags: | ||
| - seed | ||
| - styling | ||
| - css | ||
| --- | ||
| https://unocss.dev/guide/why |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| --- | ||
| tags: | ||
| - seed | ||
| - paas | ||
| --- | ||
|
|
||
| [Supabase vs Firebase](https://supabase.com/alternatives/supabase-vs-firebase) | ||
| - SupabaseはFirebaseの代替品 | ||
| - ドキュメントベースではなくPostgreSQLベース | ||
| - Pros | ||
| - オープンソースなのでロックインされない | ||
| - SQLでクエリ実行 | ||
| - 大規模活用できる実績 | ||
| - 一般的なシステムであるトランザクションんワークロードに最適なDB | ||
| - エコシステム：Postgres拡張とプラグイン | ||
| - SupabaseはFirebaseのファンであるからこそ同等のものを用意している | ||
| - 自動生成API | ||
| - リアルタイム: Streaming可能 | ||
| - Auth | ||
| - Functions: JavaScript/TypeScript Function | ||
| - Storage: Image, Video, PDF | ||
| - その他の違い | ||
| - Pricing | ||
| - FirebaseはRead/Write/Deleteに料金発生 | ||
| - 初期では予測できないことがある | ||
| - Supabaseは保存データ量に依存 | ||
| - **APIリクエストと認証ユーザーの数は無制限を確保** | ||
| - Performance | ||
| - FirebaseよりReadで最大4倍、Writeは3.1倍 | ||
| - 移行ツールもある |