8 ms·

I think what we will (need) to see in coming time is more security awareness wrt. development tooling and setup. Management at a former employer quite rightly

I think what we will (need) to see in coming time is more security awareness wrt. development tooling and setup. Management at a former employer quite rightly freaked out when they realised that their devs on a certain subcontinent were routinely pasting their code into external web-based prettifiers to format it nicely...

thinkharderdev 5y ago
Ha. I bet if you were so inclined you could harvest a gold mine of sensitive information by having a public website which did: 1. JSON prettifying 2. JWT decoding/verification (bonus for "paste your signing key and we will generate JWTs for you too!") 3. PEM <-> DER conversion
- cddotdotslash 5y ago
  The amount of valid JWTs that jwt.io could have harvested by this point is incredible to even consider.
- nerdponx 5y ago
  As per my sibling comment - we need easier/better CLI and/or offline GUI tools for simple stuff like this.
  - thinkharderdev 5y ago
    Yeah, I use bloop personally which is great for this stuff.
    - nerdponx 5y ago
      I've never heard of it. Is there a webpage or source repo?
      - thinkharderdev 5y ago
        Sorry, it's boop not bloop. Source is at https://github.com/IvanMathy/Boop https://github.com/IvanMathy/Boop
nerdponx 5y ago
In my experience, relying on "prettifier" websites is directly a result of the lack of canonical, well-supported CLI tools for prettifying most programming and markup languages. It's such a weird glaring gap in dev tooling. I'd love to see "standard" prettifiers for HTML, CSS, JSON, YAML, and TOML. The required libraries exist and the problem isn't terribly hard if you aren't picky about corner cases. I'm sure countless programmers have written such tools already. Where is the disconnect?
- goatinaboat 5y ago
  In my experience, relying on "prettifier" websites is directly a result of the lack of canonical, well-supported CLI tools for prettifying most programming and markup languages. It's such a weird glaring gap in dev tooling. There's a CLI linter for pretty much every language I've used, but how would you prettify a valid YAML file? Any reformatting will change it semantically.
  - sundbry 5y ago
    You just parse and reserialize it. The trick is handling comments.
    - dathinab 5y ago
      Don't underestimate YAML and not fully compliant YAML parsers(1) and sterilizer's with everything but nice results. (1): Which can be necessary to prevent accidental problems like NO defaulting to false not "NO" and similar. I personally strongly recommend against anything where string quotes are optional for human written/edited serialization formats (and comments are a must have).

thinkharderdev 5y ago

Ha. I bet if you were so inclined you could harvest a gold mine of sensitive information by having a public website which did: 1. JSON prettifying 2. JWT decoding/verification (bonus for "paste your signing key and we will generate JWTs for you too!") 3. PEM <-> DER conversion

cddotdotslash 5y ago
The amount of valid JWTs that jwt.io could have harvested by this point is incredible to even consider.
nerdponx 5y ago
As per my sibling comment - we need easier/better CLI and/or offline GUI tools for simple stuff like this.
- thinkharderdev 5y ago
  Yeah, I use bloop personally which is great for this stuff.
  - nerdponx 5y ago
    I've never heard of it. Is there a webpage or source repo?
    - thinkharderdev 5y ago
      Sorry, it's boop not bloop. Source is at https://github.com/IvanMathy/Boop https://github.com/IvanMathy/Boop

nerdponx 5y ago

In my experience, relying on "prettifier" websites is directly a result of the lack of canonical, well-supported CLI tools for prettifying most programming and markup languages. It's such a weird glaring gap in dev tooling. I'd love to see "standard" prettifiers for HTML, CSS, JSON, YAML, and TOML. The required libraries exist and the problem isn't terribly hard if you aren't picky about corner cases. I'm sure countless programmers have written such tools already. Where is the disconnect?

goatinaboat 5y ago
In my experience, relying on "prettifier" websites is directly a result of the lack of canonical, well-supported CLI tools for prettifying most programming and markup languages. It's such a weird glaring gap in dev tooling. There's a CLI linter for pretty much every language I've used, but how would you prettify a valid YAML file? Any reformatting will change it semantically.
- sundbry 5y ago
  You just parse and reserialize it. The trick is handling comments.
  - dathinab 5y ago
    Don't underestimate YAML and not fully compliant YAML parsers(1) and sterilizer's with everything but nice results. (1): Which can be necessary to prevent accidental problems like NO defaulting to false not "NO" and similar. I personally strongly recommend against anything where string quotes are optional for human written/edited serialization formats (and comments are a must have).