cphoover

46 ms·

1. 271.▲
   by cphoover 5y ago

   > Because as the package owner I _do_ have that context. I understand there may be significant issues with this approach though! But what if one of your contributors slips in a merge that uses the vulnerable code path of your dependenc
2. 272.▲
   by cphoover 5y ago

   So currently the algorithm is... check (dev)Dependencies and descendent/transient dependencies to see if they exist in a security advisory database if they do, highlight and surface them to the user. What are alternatives? A way to ign
3. 273.▲
   by cphoover 5y ago

   All it does is look to see if either your direct dependencies or descendant dependencies exist in the advisory database.... It seems like a simple algorithm that works pretty well. Perhaps ignoring certain dependencies makes sense, via an i
4. 274.▲
   by cphoover 5y ago

   Vulnerabilities are just code paths that can behave in unexpected ways and be abused.... I'm not sure the author's point, that development configuration could not hide malicious code? Why not? All NPM does is scan to the dependenc
5. 275.▲
   by cphoover 5y ago

   Someone on the reddit thread asked about adversarial ML approaches to introduce either poor performing or vulnerable code into the suggestion. Could be a good vector for exposing tons of applications to attack from malicious actors.
6. 276.▲
   by cphoover 5y ago

   I don't think AI generated spam is going to help your relationships... Sorry dude
7. 277.▲
   by cphoover 5y ago

   I'm so glad someone wrote this article... It summarizes my frustrations with the website over the last few years.
8. 278.▲
   by cphoover 5y ago

   This reads as redis marketing content push, probably coinciding with their upcoming IPO.
9. 279.▲
   by cphoover 5y ago

   The difference tho is maintaining a list of user ids you dont accept, a "blackist" (likely very small and each record expires as the token expires). This can be kept in-memory Vs doing a network request to your DB and searching a
10. 280.▲
    by cphoover 5y ago

    It doesn't have to be a DB tho it could be a server in-memory list that gets updated via pubsub or some other means. This is a hell of a lot faster than doing a network call to a DB and because revocation lists should be small by defi
11. 281.▲
    by cphoover 5y ago

    I don't get why you couldn't have a panic bit set the same way you maintain an in memory revocation leak... Also I don't get how this is any different than "what if a DB password" leaks? What if someone steals a dev
12. 282.▲
    by cphoover 5y ago

    M
13. 283.▲
    by cphoover 5y ago

    One of the nice things about Repl.it was being able to spontaneously try out or demo code in front of a coworker or friend... Forcing signup/login introduces friction that makes the tool less useful
14. 284.▲
    by cphoover 5y ago

    If your validation function works for 99.99% of your user's email addresses and it's a big unnecessary lift to get that other .01% your logic is not wrong.
15. 285.▲
    by cphoover 5y ago

    I love zoho's suite of free tools. When I first got started in web development business 10+ years ago, I used their invoicing tool, and thought it was perfect for a freelancer like I was at the time.
16. 286.▲
    by cphoover 6y ago

    Hmmmm they definitely have a phone number, I remember when I worked at a startup a few years ago I had many phone conversations with them regarding a bug in their mobile chat SDK. Perhaps we had a support contract tho...
17. 287.▲
    by cphoover 6y ago

    Yea but then it's not "crypto" duh. /s
18. 288.▲
    by cphoover 6y ago

    I'm curious about the raspberry pi pc build kit for kids. I think that's a great way to get kids introduced to technology and hardware, do they make dedicated kits for young kids?
19. 289.▲
    by cphoover 6y ago

    Ryan Dahl left the leadership of the Node.js pretty early in its development. A lot of people can be considered "the creator" of Node.js to be fair.
20. 290.▲
    by cphoover 6y ago

    brilliant tongue in cheek.
21. 291.▲
    by cphoover 6y ago

    It's impressive someone was able to do this... I also do not see the advantage.
22. 292.▲
    by cphoover 6y ago

    BTW you should finish your project. You built the parser already!
23. 293.▲
    by cphoover 6y ago

    Thanks
24. 294.▲
    by cphoover 6y ago

    Interesting... What framework did you use to write your parser? I've been curious about tinkering with some exploratory language design myself.
25. 295.▲
    by cphoover 6y ago

    I agree that where strict typing exists it should have the ability to get out of the way as is with languages that support type inference. Personally I've never found type mismatches to be particularly a large problem, as you can still
26. 296.▲
    by cphoover 6y ago

    If there is a practical reason you aren't using a uniform format for time I would consider this a case where compile-time type validation make sense... but for most applications I work on I would argue this is not a concern.
27. 297.▲
    by cphoover 6y ago

    One of the reasons I like weak type systems or duck typing as is with vanilla JS is because I don't have cognitive overload... I don't have to think about abstractions as types I only need to think how to solve the problem in fron
28. 298.▲
    by cphoover 6y ago

    would love if this had repl.it integration so I could teach any language Instead of just a few frontend frameworks and vanilla JS. Great idea!
29. 299.▲
    by cphoover 6y ago

    What is to prevent duplication or deletion of the private key though?
30. 300.▲
    by cphoover 6y ago

    Why not tell their customer to maintain ac to dc converters rather than maintain a totally separate grid? Seems like that would be way more costly?