hdhzy

37 ms·

331.
by hdhzy 9y ago
Are there any plans for Node.js to handle WebAssembly? This way we could get native libraries compiled directly to wasm avoiding problems with linking native libraries to current version of node, etc. Of course not all libraries could be co
332.
by hdhzy 9y ago
Cont refers to the continuation monad. For details see http://www.haskellforall.com/2012/12/the-continuation-monad....
333.
by hdhzy 9y ago
See also "don't use for evil" clause in JSON library by Douglas Crockford and a special exemption for IBM: "I give permission for IBM, its customers, partners, and minions, to use JSLint for evil." [0]. [0]: http:
334.
by hdhzy 9y ago
You say that the standard is bad and that indirectly caused bugs in JWT implementations but looking at Macaroons examples there are still some corner cases where a programmer can make mistakes. For example this piece of code (fragment taken
335.
by hdhzy 9y ago
Wow, what an interesting idea it looks like macaroons resemble HS256 JWTs (no asymmetric Crypto) with claims encoded as strings (except key-value pairs of JWT) that are interpreted by the verifier (you can build more complex claims like log
336.
by hdhzy 9y ago
IIRC that's almost exactly what Linus said about git: that it's rather a toolbox for creating SCM rather than SCM itself [0]. [0]: http://www.youtube.com/watch?v=4XpnKHJAok8
337.
by hdhzy 9y ago
Usually people using the acronym daily process it as a single concept not even consciously thinking it's a compound term. Look at yourself: you used "Cobol" instead of "common business-oriented language" [0]. [0]:
338.
by hdhzy 9y ago
Could you elaborate on the "stealing your cookies" part? Cookies are sent only to the origin that set them and (except XSS attacks) are not revealed to anyone else. So who exactly is stealing them?
339.
by hdhzy 9y ago
Roslyn is basically a compiler API for .NET. Take a look at this walkthrough [0] to see how to implement custom diagnostics and quick fixes that operate on AST level. [0]: https://social.technet.microsoft.com/wiki/conte
340.
by hdhzy 9y ago
Sounds good but I suspect it will meet the same fate as XHTML 2: designed to be clean and perfect but in reality it would take to much effort to implement and maintain. From your professional experience you can probably tell people would ra
341.
by hdhzy 9y ago
If the site accepts httpsb it can as well support the Origin header [0] and the problem is solved. [0]: https://wiki.mozilla.org/Security/Origin
342.
by hdhzy 9y ago
JS can't (that protects against stealing the token) but the server still receives it even when the request originates from foreign domain. That's the gist of CSRF [0]. [0]: https://en.wikipedia.org/wiki/Cross-
343.
by hdhzy 9y ago
Web Assembly is specifically designed not to replace JavaScript [0]. [0]: http://webassembly.org/docs/faq/#is-webassembly-trying-to-re...
344.
by hdhzy 9y ago
Note that these protections are only needed because Google supports every imaginable browser version even outdated ones. You most certainly do not need to do the same. Array and object globals cannot be overridden now (since 2007) for liter
345.
by hdhzy 9y ago
Well I never left because someone "sucked" (didn't have X, Y, Z or didn't do A, B or C) and the feedback was generally actionable sometimes even with references to literature and research. But if people have problem with
346.
by hdhzy 9y ago
Good idea. I personally had given feedback every time I left a company and the reaction was always either no improvement to slight adversity. So naturally I stopped giving feedback. Maybe instead of simple feedback it would be worth to just
347.
by hdhzy 9y ago
Excellent summary. U2F was designed to protect login where you don't need more context except the site you're logging into and that's protected as part of the protocol. Abusing it for other purposes (tx confirmation) as you s
348.
by hdhzy 9y ago
No, or yes if you replace shared passwords with EC assymentic crypto with added protections (test of user presence, taking origin into consideration - signature for Google.com cannot be used on fake-google.com, attestation - you can check r
349.
by hdhzy 9y ago
> so long as you can convince your phone company that you are you you're fine. Well I think the problem starts when someone else convinces your phone company that they are you. As we've seen several times now it becomes easier
350.
by hdhzy 9y ago
> his brain and body was recorded in exact detail and replicated. I'm not a physicist but as far as I remember it's not a matter of a advanced technology but rather a quantum limitation or the world (you cannot copy an object w
351.
by hdhzy 9y ago
Note that one time codes do not protect against phishing the same way U2F does (U2F is always bound to secure origin).
352.
by hdhzy 9y ago
This looks very good indeed but the lack of initial data model very severely limits the production usability of this tool. You can't use "document" and "window" ... It's the same problem TypeScript have/ha
353.
by hdhzy 9y ago
I suspect they understand how password managers work and either ask you for access or take your hardware and fiddle with it off-screen (Evil Maid attack? [0]). Otherwise if they don't like you they just send you back home and that&#x27
354.
by hdhzy 9y ago
What if you give them your password but the account is protected by 2FA and you don't have it with you? (being shipped with FedEx in the mean time...)
355.
by hdhzy 9y ago
I'm looking forward to initial reviews. It looks absolutely fantastic but being heavily burned by Dell XPS 13 (9350) I'll rather wait a little bit...
356.
by hdhzy 9y ago
Try Firefox for Android.
357.
by hdhzy 9y ago
The only thing I saw was "your browser is not supported, try Google Chrome". It's not exactly "new experience" - I still remember "this site works best in browser X" and "under construction" bann
358.
by hdhzy 9y ago
Good point. It's a defensive behavior and in a low trust culture one would be more concerned about choosing something good enough rather than risk experimenting with a new but unproven tool.
359.
by hdhzy 9y ago
I've got exactly the same experience: it takes weeks to do a minor adjustment to task flow due to administration overhead but people still say it's super configurable. What difference does this power make if you cannot exercise it
360.
by hdhzy 9y ago
tptacek's VPN probably uses PIV applet instead of GPG one and you can't switch them easily (requires stopping and starting agents). If you stay in GPG+U2F land then you don't have these problems.

More ›