ship - Dave's Blog


Windows.Web.UI.Interop.WebViewControl localhost access

2018 Jul 25, 5:34

If you're developing with the new Windows.Web.UI.Interop.WebViewControl you may have noticed you cannot navigate to localhost HTTP servers. This is because the WebViewControl's WebView process is a UWP process. All UWP processes by default cannot use the loopback adapter as a security precaution. For development purposes you can allow localhost access using the checknetisolation command line tool on the WebViewControl's package just as you can for any other UWP app. The command should be the following:

checknetisolation loopbackexempt -a -n=Microsoft.Win32WebViewHost_cw5n1h2txyewy

As a warning checknetisolation is not good on errors. If you attempt to add a package but get its package family name wrong, checknetisolation just says OK:

C:\Users\davris>checknetisolation LoopbackExempt -a -n=Microsoft.BingWeather_4.21.2492.0_x86__8wekyb3d8bbwe
And if you then list the result of the add with the bad name you'll see the following:
[1] -----------------------------------------------------------------
Name: AppContainer NOT FOUND
SID: S-1-15-...

There's also a UI tool for modifying loopback exemption for packages available on GitHub and also one available with Fiddler.

As an additional note, I mentioned above you can try this for development. Do not do this in shipping products as this turns off the security protection for any consumer of the WebViewControl.

PermalinkCommentschecknetisolation loopback security uwp webview win32webview

Tweet from David Risney

2016 Nov 4, 4:05
WinMDGraph graphs relationships between WinRT APIs . My initial version is up.

Retweet of justinkan

2016 Jan 3, 8:57
This seems like the way car ownership declines …

Retweet of codepo8

2015 Aug 18, 1:31
Oh god, @b3ta, yes!!! Spaceship Troopers!

Tweet from David_Risney

2015 Jul 23, 12:34
Amazon doesn't say how it determines friendship because that exposes work around or because we would be creeped out? …

Retweet of wilshipley

2015 Jun 26, 5:47
Summary of Scalia’s dissent. #stolenjokes

Tweet from David_Risney

2015 Mar 30, 10:52
Or from GitHub's POV, how else can you use this XSS? Example: Open a new window with info on howto subvert particular censorship. What else?

jacobrossi: shipping Project Spartan to Windows XP might treat a symptom, but doesn't fix the problem. People need an up to date OS too!

2015 Jan 27, 2:33
Jacob Rossi @jacobrossi :
@domenic shipping Project Spartan to Windows XP might treat a symptom, but doesn't fix the problem. People need an up to date OS too!

URI Design and Ownership - IETF Draft

2014 May 21, 2:06

URI Design & Ownership - On the issues with and alternatives to requiring well known filenames and extensions in URIs. You must love the draft’s URI.

PermalinkCommentstechnical uri

laughingsquid: The Ultimate Spaceship Face-off, Interactive...

2013 May 22, 3:10


The Ultimate Spaceship Face-off, Interactive Guide For Comparing the Speeds of Famed Sci-Fi Ships

PermalinkCommentssci-fi scifi tardis doctor-who star-trek star-wars nerd

The best cosplay of all time (by RayLiehm) Awesome car...

2012 Nov 14, 5:16

The best cosplay of all time (by RayLiehm)

Awesome car dealership wavy tube thingy costume.

PermalinkCommentshumor costume wavy video

When they went to the Moon, they received the same per diem...

2012 Aug 28, 4:38

When they went to the Moon, they received the same per diem compensation as they would have for being away from base in Bakersfield: eight dollars a day, before various deductions (like for accommodation, because the government was providing the bed in the spaceship).


Apollo 11’s Astronauts Received an $8 Per Diem for the Mission to the Moon

The astronauts of Apollo 11: Intrepid explorers. Inspirational heroes. Government employees.

Read more. [Image: Reuters]

PermalinkCommentshumor space nasa moon government

A New HTTP Status Code for Legally-restricted Resources

2012 Jun 11, 2:00

451 Unavailable for Legal Reasons: The 451 status code is optional; clients cannot rely upon its use. It is imaginable that certain legal authorities may wish to avoid transparency, and not only forbid access to certain resources, but also disclosure that the restriction exists.

That was fast.

PermalinkCommentshttp internet web 451 law legal rfc ietf censorship technical

EFF White Paper Outlines How Businesses Can Avoid Assisting Repressive Regimes

2012 Apr 18, 6:24

A House subcommittee has passed the Global Online Freedom Act (GOFA), which would require disclosure from companies about their human rights practices and limit the export of technologies that “serve the primary purpose of” facilitating government surveillance or censorship to countries designated as “Internet-restricting.”

PermalinkCommentstechnical human-rights eff software government law surveillance

Star Trek: TNG Season 8 illustration has us longing for more [Star Trek]

2012 Mar 5, 3:17

Fictional plot summaries of TNG S8 episodes.    Like:

  • Q’s back: he’s wearing scuba gear and needs Picard’s help dumping his girlfriend. Barclay accidentally locks himself outside the ship.
  • Geordie and Data nurse a space bird back to health, and are sad when they have to release it. Picard is trapped in a turbolift with a baby.
  • Starfleet sends a cantankerous admiral to boss around Picard during delicate peace talks. Data seems to have mastered bragging.
  • Riker’s ex-girlfriend arrives and dies, leaving behind a pile of glowing dust and a mystery. Picard is trapped on a turbolift with a horse.
  • A planet of suspicious docents abduct Riker for their museum of amazing men. Geordi and Data are too excited to sleep at their sleepover.
  • Picard is trapped inside a sentient turbolift. A clip show highlights the most memorable “Picard is trapped on a turbolift” moments.
PermalinkCommentshumor twitter tng tv

URI Percent-Encoding Ignorance Level 1 - Purpose

2012 Feb 15, 4:00

As a professional URI aficionado I deal with various levels of ignorance on URI percent-encoding (aka URI encoding, or URL escaping).

Worse than the lame blog comments hating on percent-encoding is the shipping code which can do actual damage. In one very large project I won't name, I've fixed code that decodes all percent-encoded octets in a URI in order to get rid of pesky percents before calling ShellExecute. An unnamed developer with similar intent but clearly much craftier did the same thing in a loop until the string's length stopped changing. As it turns out percent-encoding serves a purpose and can't just be removed arbitrarily.

Percent-encoding exists so that one can represent data in a URI that would otherwise not be allowed or would be interpretted as a delimiter instead of data. For example, the space character (U+0020) is not allowed in a URI and so must be percent-encoded in order to appear in a URI:

  2. path/
In the above the first is a valid URI while the second is not valid since a space appears directly in the URI. Depending on the context and the code through which the wannabe URI is run one may get unexpected failure.

For an additional example, the question mark delimits the path from the query. If one wanted the question mark to appear as part of the path rather than delimit the path from the query, it must be percent-encoded:

In the second, the question mark appears plainly and so delimits the path "/foo" from the query "bar". And in the first, the querstion mark is percent-encoded and so the path is "/foo%3Fbar".
PermalinkCommentsencoding uri technical ietf percent-encoding

MPAA Boss: If The Chinese Censor The Internet, Why Can't The US? (

2011 Dec 10, 8:31


The MPAA is getting pretty desperate, it seems. MPAA boss Chris Dodd was out trying to defend censoring the internet this week by using China as an example of why censorship isn’t a problem. It’s kind of shocking, really.

“When the Chinese told Google that they had to block sites or they couldn’t do [business] in their country, they managed to figure out how to block sites.”

PermalinkCommentsmpaa technical censorship

Feds Mistakenly Shut Down Popular Blog For Over A Year (

2011 Dec 8, 10:57PermalinkCommentstechnical censorship government internet riaa copyright

Google Now Censors The Pirate Bay, isoHunt, 4Shared and More (

2011 Nov 24, 4:06PermalinkCommentstechnical google censorship

Iran blocks Tor; Tor releases same-day fix ...

2011 Sep 19, 12:53Counter intuitive argument for not making the larger fix: "Should we fix them all preemptively, meaning the next time they block us it will be through some more complex mechanism that's harder to figure out? Or should we leave things as they are, knowing there will be more blocking events but also knowing that we can solve them easily?"PermalinkCommentstor censorship government iran technical
Older Entries Creative Commons License Some rights reserved.