hdhzy

25 ms·

211.
by hdhzy 9y ago
Well I'm disappointed that "1. You should know the core language" does not include reading the actual language spec! Especially that this is apparently aimed at serious developers. ES 5.1 spec is actually quite simple and c
212.
by hdhzy 9y ago
Thanks but I'm looking for something simple like returning plain text in 200 HTTP response using only built-in API. Completely minimal example. Using framework for me now would be like learning JavaScript by writing SPA in React.
213.
by hdhzy 9y ago
Are there any simple projects like HTTP server in F# for CoreCLR somewhere? With a Dockerfile if possible. Last time I tried to build something like that for PoC the amount of struggles I had with various versions of CoreCLR was overwhelmin
214.
by hdhzy 9y ago
Wow, great idea! I think Web Authentication will slowly make U2F obsolete, in a sense that U2F will become one of many authentication methods, others could also be implemented. Checking WebAuth specs one can see references to Android attest
215.
by hdhzy 9y ago
Well you can have client certificate on hardware. Some hardware even has attestation built in [0] so you can be sure that the private key is non exportable. PIV based smartcards do not require external drivers on most modern OSes. [0]: htt
216.
by hdhzy 9y ago
Client certificates are best from security perspective but lack UX (this could be fixed) and are not designed with privacy in mind. U2F on the other hand generates unique pair of keys for each origin. By default.
217.
by hdhzy 9y ago
It's interesting that it's 2017 and this question still gets asked. Go having static types but no generics is the worst of two worlds: both dynamic languages and compiled languages with genetics have basic functional constructs li
218.
by hdhzy 9y ago
I can't find details on dispute resolution. Are they using multisig escrow transactions like Silk Road?
219.
by hdhzy 9y ago
Well "supports" is a very broad term given that yubikey supports multiple applets (OpenPGP, PIV, U2F, static passwords etc.). Do you mean this: > YubiKey challenge-response support for strengthening your database encryption key
220.
by hdhzy 9y ago
People see improvement even after taking placebo. I haven't read the paper yet but on first glance it looks like an observational study. I know it's cliche but correlation does not imply causation and observations are just that, d
221.
by hdhzy 9y ago
Just like children's IQ and foot size are strongly correlated the answer in their and in your case can be just attributed to age (you said "I've been working from home for a number of years"). Not saying that's the
222.
by hdhzy 9y ago
There is also QtPass (GUI around pass), and various browser extensions (e.g. BrowserPass). Of course one has to set it up, it's not an integrated solution. But GPG provides interesting features like storing encryption keys on hardware
223.
by hdhzy 9y ago
Funny because AMP was exactly the reason why I switched to DuckDuckGo (although https://encrypted.google.com is also a viable option). One more thing to remember - Firefox for Android has AdBlock extensions (e.g uBlock). My pers
224.
by hdhzy 9y ago
While I admire the article I remember when "minimal JavaScript dev environment" meant just a notepad app and a web browser...
225.
by hdhzy 9y ago
Just old Internet Explorers. Given Google's scale it's worth the work but not something the rest of us need to bother ourselves with.
226.
by hdhzy 9y ago
> Java`s generics have had issues due to use site variance Use site variance can be really powerful when you're dealing with invariant data structures like Lists. You can then treat them like covariant or contravariant depending on
227.
by hdhzy 9y ago
So... Just like checked exceptions in Java?
228.
by hdhzy 9y ago
Oh yes, exactly, JWT has a stronger ecosystem. Sometimes I feel like they are aimed at different problems, JWT to replace opaque tokens with stateless ones (but if you want instant revocation it becomes a problem) and Macaroons for delegate
229.
by hdhzy 9y ago
Not scary at all. Check out this article on Background Sync [0]. It's not supported everywhere yet but the fallback to sync when the page is open is good enough. Of course you can also do sync on push events (they have broader support)
230.
by hdhzy 9y ago
Client certificates don't work in http2. If you use due diligence and store them in secure hardware then they could be a lot more secure than bearer tokens (cannot be exported) but I guess most people would just store a PKCS#12 file on
231.
by hdhzy 9y ago
> make sure "noop" is not allowed Security by blacklisting is a bad idea. You don't need to look far - it's JWT libraries that could be fooled into accepting public key as a symmetric key [0] so even if you fix the no
232.
by hdhzy 9y ago
> - No built in mechanism to support key rotation (like JWT header kid). You'll need to roll your own. That's not true. Macaroons have identifier field. See the Readme doc in libmacaroons [0]. Direct quote: > The public port
233.
by hdhzy 9y ago
Exactly. I've written something like that but instead of messaging it was an issue tracker meets wiki. Completely offline with SW and IndexedDB with background sync when there was a connection. Works very well on the airplane :)
234.
by hdhzy 9y ago
AppCache looks like a poor hack if you want offline site that is more complex than just a static blog post. There are numerous edge cases that you can easily handle in SW's JavaScript vs AppCache's limited declarative language. Fo
235.
by hdhzy 9y ago
Wow, very cool. I wonder if elliptic curve certificates and intermediaries via certbot are also in the pipeline. P-256 can be issued via manual CSR and EC intermediaries are scheduled "before September" according to https:/&
236.
by hdhzy 9y ago
See here: https://developer.mozilla.org/en-US/docs/Web/API/Navigator/s... The "protocol" is just a deferred HTTP POST request that does not block page unload. Please use this as it is wide
237.
by hdhzy 9y ago
Google Authenticator, the one that you download from Play Store, is not open source: > These apps are not on the app stores, and their code has diverged from what's in the app stores, so patches here won't necessarily show up i
238.
by hdhzy 9y ago
Only for the same origin they were installed on. So a generic solution like this one wouldn't really work as a service worker.
239.
by hdhzy 9y ago
NEO has open source OpenPGP applet (in contrast of 4) but if you read the link carefully they provide rather strong points why it doesn't matter and closed hardware can even be more secure.
240.
by hdhzy 9y ago
The thing is that resource should have ideally one URI and selecting representation should be done through content negotiation (e.g. Accept header). Of course having an option to use file extensions makes debugging easier in a browser.

More ›