TheDong

44 ms·

781.
by TheDong 2y ago
Not listening on port 80, such that the user gets a connection refused, would result in the client not sending the api key over the wire at all. I personally think listening, accepting that user mistakes can expose API keys to MITMs, and re
782.
by TheDong 2y ago
It's nice to check if you're about to extract a 1MB tarball into 2TBs of data before actually running out of disk space. Most tar programs do prevent extracting tarballs containing absolute paths (like '/etc/passwd&
783.
by TheDong 2y ago
I suspect he's wrong because he's disabled some of KeepassXC's most important security features. One of the largest security threats to users is phishing websites, getting an email and clicking a link, and then typing your ac
784.
by TheDong 2y ago
Unfortunately, most of these companies have share-holders, and thus the directors of the company have a legal fiduciary duty to the shareholders: https://en.wikipedia.org/wiki/Business_judgment_rule If the directors in
785.
by TheDong 2y ago
That "hack" uses reptyr to attach to the existing pty, which requires ptrace permissions. The same "hack" can be done against sudo if you ptrace attach to the shell that started sudo. This isn't a new issue. It&#x27
786.
by TheDong 3y ago
I didn't propose any solution or claim Shift-JIS fixes this. It doesn't really since a single Shift-JIS document can only encode the japanese variant, not both. However, a unicode codepoint which acted as a "language hint&quo
787.
by TheDong 3y ago
The parent said "displayed correctly", not "encoded". For example, if I want to talk about the fairly rare japanese name '刃一' (jinichi), there's a chance your computer displays it correctly, but there&#x27
788.
by TheDong 3y ago
what3words has a proprietary implementation and has sent fairly silly legal threats: https://news.ycombinator.com/item?id=27020810 I'll happily boycott that for-profit company which is masquerading as a public utility,
789.
by TheDong 3y ago
If you look around, you'll see the sponsors page: https://curl.se/sponsors.html Some sponsorship is through opencollective, which includes transparent information about donations: https://opencollective.com&
790.
by TheDong 3y ago
What a soulless perspective. Most people are not fully free to quit, having rent to pay, a work visa to maintain, or other circumstances. Most software jobs are not paying their workers a salary for them to become soulless robots. They are
791.
by TheDong 3y ago
While it's true that ffmpeg's license doesn't require you to release the source code of your application, ffmpeg is GPL, and so it's in good form to also make your application open source. You can still charge for it jus
792.
by TheDong 3y ago
You can see them writing the ssh public keys that are entered into the settings page _somewhere_ in ruby, and you can then kinda guess :)
793.
by TheDong 3y ago
It's pretty easy to check something kinda close to GitHub's source code to see, if you want. Just buy a copy of GitHub Enterprise, deobfuscate the files (it's a fun challenge to deobfuscate them, and not all that hard), and l
794.
by TheDong 3y ago
The other disadvantage to the customer who gets that extra 0.5% is that they know they're profiting off the misery of those worse off than them, that they enjoy rewards while those with low credit scores, struggling to feed their famil
795.
by TheDong 3y ago
The alternative to credit cards that charge 2-3% fees shouldn't be cash, but rather debit cards with close to zero fees. Cash handling isn't free, but a digital transfer that doesn't have rewards is obviously cheaper than a c
796.
by TheDong 3y ago
That's idiomatic go. See https://go.dev/blog/generate and '//go:generate stringer -type=Pill' See also '//go:embed', which also turns a variable into a magic type via an ad-
797.
by TheDong 3y ago
Sure, pointers are nullable types, but they also are necessary for mutability, so you're forced to use them for non-nullable things too. You'll notice the go stdlib uses pointers for things which absolutely should not be nullable
798.
by TheDong 3y ago
If other people buy into this idea, then every site will begin proxying third-party javascript. If the only way to get trackers on the average person is to serve it from the same first-party domain, or to bundle it in with the giant 'a
799.
by TheDong 3y ago
The extension ecosystem of browsers is pretty important though, and that is tied to the rendering engine. On Android, I can install firefox-for-android and run ublock origin to no longer see ads on websites. On iOS, that's not possible
800.
by TheDong 3y ago
I think what AT&T is saying is that it wasn't taken from AT&T servers. Rather, AT&T gave the data to some third-party data-processor (i.e. to some ad company), and that company then lost it. ... Honestly, that shouldn'
801.
by TheDong 3y ago
If you're able to predict with high confidence how this effects the yen/usd rate, then you can make a huge amount of money on fx arbitrage. We don't really know how this will play out, and people's guesses for how it wil
802.
by TheDong 3y ago
The main value of the race detector is enabling it for tests (go test -race), and then writing sufficiently exhaustive unit tests to cover all code paths. I do think most gophers, instead of tests, use a combination of prayer and automatica
803.
by TheDong 3y ago
> And this works behind NAT? Sure, UDP NAT only knows the 4-tuple (say {wggwd.fly.io, 12345, clientIP, 23456}). Any UDP packet, whether it's a new "initiator" udp packet, or a response to the outgoing initiation message, w
804.
by TheDong 3y ago
> no it is not illegal All of these are wrong. The answer to each of those is "It may or may not be legal depending on various factors including whether it is intentionally creating a monopolistic anti-competitive environment".
805.
by TheDong 3y ago
It still has the 7 day limit for apps, so if you go on a vacation your apps stop working, or if you stop running the sideloadly software in your home network they also do. It also doesn't have a linux version, so it's unusable for
806.
by TheDong 3y ago
The source for this figure: https://www.sec.gov/Archives/edgar/data/1713445/000162828024... CEO pay for 2023: 341,346 (cash salary) + 98,332,716 (stock) + 93,776,049 (options) + 792,000 (cash bonus) It&#
807.
by TheDong 3y ago
These things are multifaceted. Someone might want to be able to video-call with their grandma who only knows how to use facetime, while also wanting to be able to compile and run open-source apps from source on the device they paid money fo
808.
by TheDong 3y ago
The definition of short phrases is not some intuitive prescriptive "the components mean this", but rather it is what we have collectively agreed on the meaning to be. Open Source and Free Software are widely collectively agreed up
809.
by TheDong 3y ago
No such license can exist, if it did it wouldn't be open source. Open Source, as defined by the Free Software Foundation or Open Source Initiative, requires the right to create a modified version of a piece of software and sell it. It
810.
by TheDong 3y ago
I don't think the choice is "surveillance vs privacy", but rather "free-with-ads" vs "paid-with-privacy" People choose to watch youtube with ads rather than pay for youtube premium without ads. People buy

More ›