cheald

92 ms·

961.
by cheald 12y ago
Everything described in the article is covered by Varnish. You can hash on Vary headers, on individual cookie values, on the sum of the digits in the user's IP address if you want. ESI lets you provide partial caching of pages as the a
962.
by cheald 12y ago
Off the top of my head: sub vcl_recv { set req.http.X-Custom-Cookie-Value = regsub(req.http.cookie, ".*;|^)YOUR_COOKIE_NAME=([^;]+)(;.*|$)", "\2"); } Then you can just: sub vcl_hash { set r
963.
by cheald 12y ago
Varnish also supports plugins for extreme flexibility. For example, I wrote a plugin for our Varnish install which performs HMAC validation of a specific signed cookie and then sets a header which is used downstream in the caching rules. Va
964.
by cheald 12y ago
This sort of crap is exactly why I use Uber whenever possible. There's plenty negative to be said of Uber, but at least the drivers aren't attempting to constantly scam me. I'm absolutely done with putting up with taxi bull
965.
by cheald 12y ago
Authorization of a null permission is effectively the same as authentication, though. I think the GP's point was that authz implies authn, even if the set of permissioned authz'd for is empty.
966.
by cheald 12y ago
This is a great point. The article bemoaned Project Zero's rigid deadline as unreasonable, but I think you have it right - a known and standard deadline doesn't leave anyone surprised.
967.
by cheald 12y ago
Metasploit does the same thing, and we've managed to not have the internet implode yet. Yours is the standard argument against any form of disclosure. I'm not discounting it, because no disclosure has its merits, but responsible
968.
by cheald 12y ago
This is a big issue in enterprise deployments. Consider, for example, the Sony hack - this is the kind of issue that allows a savvy low-level employee to wreak havoc on their employer, because once you can get root on a machine inside a c
969.
by cheald 12y ago
This story is surprisingly hostile to Google. A 90-day window after which the bug is published is about as responsible as responsible disclosure gets. The headline really rubs me the wrong way, as though Google raced to publish this vulnera
970.
by cheald 12y ago
This is somewhat off topic, but since you mention wanting to try JRuby, I'll give you my spiel. :) I'm a recent JRuby convert (I've only started using it heavily in the last year), but I can't say enough good about it. I
971.
by cheald 12y ago
1. JRuby's definitely built for concurrency, though I suspect you're kind of leaning towards Node with this comment. It's certainly true that Ruby doesn't comprehensively do reactor-pattern stuff as well as Node, but thr
972.
by cheald 12y ago
Every time I've tried to use it, it's either been unstable (segfaults are fun) or orders of magnitude slower than MRI. It's a promising project, but as far as "no GIL, true concurrency, mature GC" implementations go
973.
by cheald 12y ago
Heroku doesn't require any Github account - that's the beauty of git :) That said, I'd still argue that you should practice defense-in-depth; plan for "this is how I'll limit damage when someone gets ahold of these
974.
by cheald 12y ago
I like that better - I think I'll start using it. I usually end up staging the stuff I want to commit and reverting the stuff I don't, but that offers better flexibility. Thanks!
975.
by cheald 12y ago
Whoops. I missed that. Glad the author was able to dodge that bullet!
976.
by cheald 12y ago
There are a few lessons here: 1. Use IAM roles. AWS keys should only have access to the specific functionality they need. Best practice is to never use your root credentials for anything ; always use IAM users and use unique keys for eac
977.
by cheald 12y ago
You just cited two competing companies and then said they could become "a monopoly". That's not how monopolies work.
978.
by cheald 12y ago
Ads mean iframes, which mean tons of separate DOMs, which are heavy and expensive. You also have to consider that images are decompressed for display; that 474x350 image in the lead spot on the Techcrunch homepage is 474 * 359 * 4 = 663,600
979.
by cheald 12y ago
This isn't a direct response to your points, but thank you for this! I'm a self-taught bassist, and I come from a very musical family, but I have no theory training at all. I love the form you've given to the things that I&#x
980.
by cheald 12y ago
You might be surprised. New languages can teach you quite a lot more than simply a new syntax - there are concepts that will be present and visible in a new language or stdlib that you might not have encountered before, and constant exposur
981.
by cheald 12y ago
Vanguard enabled proper 2FA a little while ago. It's SMS-based, which is a pity, but it's better than Schwab's abortion of a system.
982.
by cheald 12y ago
Interesting. Thank you!
983.
by cheald 12y ago
Use TokuMX (I don't have a stake in TokuMX, I'm just a happy customer). It's mostly a drop-in for Mongo 2.6 (though converting data is a downtime operation). To your point specifically, we're running aggregation stuff on
984.
by cheald 12y ago
I only have anecdotal data to add, but I've been using zinc lozenges for years for when I start to get sick (or my kids are exhibiting symptoms), and it really does dramatically shorten the cold and reduce the severity of the symptoms.
985.
by cheald 12y ago
I think the comparison to InnoDB is apt; many of the same shortcomings/features are there, as well. MyISAM/mongodb both have table/collection locking, no transactions, make no ACID guarantees. WiredTiger/InnoDB by contra
986.
by cheald 12y ago
In fairness, we get like 20cm of rainfall per year . :)
987.
by cheald 12y ago
I'm no bitcoin apologist, but off the top of my head: 1. Due to Bitcoin's cash-esque nature, you don't hand over your account keys when you make a transaction. Every time I hand my credit card to a 16-year-old waiter I'm
988.
TorqueBox 4 Alpha1 Released(torquebox.org)
1 points by cheald 12y ago|0 comments
989.
by cheald 12y ago
It's much easier to not pay taxes on cash income than on credit card income. Also, cabbies don't pocket the income, the medallion owner pockets the income. If that happens to be the cabbie, great, but frequently, cabbies simply le
990.
by cheald 12y ago
I think the article is less poking fun at the non-technological nature of the government solutions, but at their ineffectiveness, when a proven solution with widely deployed infrastructure to support it already exists in the marketplace. If

More ›