K0nserv

36 ms·

451.
by K0nserv 7y ago
From the reporting I've read, primarily by RiskIQ, in both the Ticketmaster and BA case it was not the origin servers that were compromised in which case SRI would have been effective in so far that it would have required the attackers
452.
by K0nserv 7y ago
That's a different, but related concern. Yes deep dependency graphs have a big trust problem, but at the very least in that case you can use CSP and SRI to verify the integrity after the asset has been built. A compromised node module
453.
by K0nserv 7y ago
In this specific case the attackers seems to have compromised a CMS which for some reason was used to serve javascript libraries. It’s likely that they did not compromise the origin itself, only the CMS. Thus using SRI on the origin would h
454.
by K0nserv 7y ago
> At the time, BA said hackers had carried out a "sophisticated, malicious criminal attack" on its website. Compromising a single JS resource that was being carelessly loaded on a payment page doesn’t qualify as sophisticated i
455.
by K0nserv 7y ago
> Firefox has way better privacy controls than Chrome, however, their track record on security is abysmal. In fact, a 0-day was just found last week targeting Coinbase employees. All complex codebases, especially web browsers, will suffe
456.
by K0nserv 7y ago
> Keung Suk-man, one of the parents among the protesters, denounced the opposition camp for calling for a strike by schools and teachers to oppose the extradition amendments. Such blatant incitement went against the school's princip
457.
by K0nserv 7y ago
It is perfectly OK to only code at work, but you need to ensure you are learning and developing at work. Almost all programming related fields are still growing and changing rapidly. To stay relevant you need to invest in learning and self
458.
by K0nserv 7y ago
Images are not comparable to WASM and especially not to JS. This is described in "Making WebAssembly even faster: Firefox’s new streaming and tiering compile", but the TL;DR is that network is less so the bottleneck than parsing a
459.
by K0nserv 7y ago
Doh. My bad for being a dummy. 165kb is still fairly big for a minimal example, much smaller than 1.17MB though, compared to React for example. Are there ways to analyze what contributes to the size for WASM compiled projects? I guess wasm-
460.
by K0nserv 7y ago
Sauron looks really great and I for one am super excited about the future of Rust + WASM for web apps(with Backend). However I am a bit concerned that even the minimal example is 1.17MB of WASM which seems really high since Rust compiled to
461.
by K0nserv 7y ago
It's based on Yew itself and since Yew is React/Elm like, but this is more Elm inspired I assume it compares like Elm vs React.
462.
by K0nserv 8y ago
You do, that's the crux of the matter. Apple can happily claim that 30% is the overhead cost of providing the subscriptions service, that's within their right. Looking past how ridiculously high 30% is the fact that they are so ho
463.
How to hack half of all websites(hugotunius.se)
2 points by K0nserv 8y ago|0 comments
464.
by K0nserv 8y ago
You still have to pick a default region/language unless you want to force the user to make a selection before they get anywhere which is a mess UX-wise
465.
by K0nserv 8y ago
I use a VPN for all traffic, using an exit server in Finland. I don't speak a word of finnish. I have chatted with people who work on internationalization about IP based detection. The explanation I've always heard is that `Accept
466.
by K0nserv 8y ago
Progressive disclosure can be made to work with password managers, notably Apple's Apple ID login page[0] does this while still allowing the password manager to fill both username and passwords in one action. 0: https://appl
467.
by K0nserv 8y ago
Agreed. Most of my solutions[0] use something simple like input .lines() .map(|s| s.trim()) .filter(|l| l.len() > 0) .map(CustomType::from) .collect::<Vec<_>>(); or for grid-like puzzels inp
468.
by K0nserv 8y ago
I stopped drinking regular milk actively more than a year ago. At work we have soy milk which is good enough, but Oatly is definitely the gold standard milk replacmenet for me. Unfortunately I am finding that in Edinburgh cafés and other es
469.
by K0nserv 8y ago
> To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to t
470.
by K0nserv 8y ago
Doesn't GDPR require explicit cosent[0] for collection of sensitive private information? This is what many website has implemented as popups with "I accept" or "Manage Settings" options. I don't remember going
471.
by K0nserv 8y ago
I use Apple Pay with both my debit cards. This is in the UK.
472.
by K0nserv 8y ago
I found Deliveroo sending highly detailed location information to a marketing company(Braze) yesterday[0]. I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enoug
473.
by K0nserv 8y ago
I've never liked git aliases, at least not for things I do frequently.
474.
by K0nserv 8y ago
All of my various git alises. I especially like `goops` which is very useful if you just pushed some code and realised you missed something. https://github.com/k0nserv/dotfiles/blob/7721559be40bba09cd8...
475.
by K0nserv 8y ago
http://gov.uk and other UK government websites that has had involvement from GDS(Government Digital Services) are some of the best websites I've seen. They are lightweight, to the point, accessible and still look good. If t
476.
by K0nserv 8y ago
The other article[0] linked in this one is well worth a read. I had never heard about Uyghurs or China's treatment of them before I read the reddit thread yesterday about phone spyware. It's pretty appalling and what more how the
477.
by K0nserv 8y ago
No it's not since this is a error on the client's side it should be a 4xx code, probably not 418 though.
478.
GDPR Hall of Shame(gdprhallofshame.com)
210 points by K0nserv 8y ago|183 comments
479.
by K0nserv 9y ago
No but if an app uses a Facebook login flow with the native Facebook SDK any third party analytics that the app developer has integrated should be able to do the same thing, at least in the case of Objective-C where powerful runtime meta pr
480.
by K0nserv 9y ago
It's been really exiciting to follow all the awesome work that Mozilla and the Rust team are doing in this area. I'm looking forward to this bright new Rust WASM future for sure!

More ›