hirsin

30 ms·

331.
by hirsin 7y ago
Note that this is the draft, and 6265bis-03 expired in October. While it's presumed that this proposal will be accepted and become the new standard, a single commit does not make the standard.
332.
by hirsin 7y ago
Just a nit on this point - "Quick note on Microsoft's implementation: their first shot at it was buggy and caused the "None" policy to omit the SameSite cookie attribute altogether" This isn't a bug, just unfor
333.
by hirsin 7y ago
It helps to be in the same place as the other person(s) and time bomb the agreement. For us, it's: Roughly similar salaries at Microsoft/Amazon Same age Significantly overlapping friend groups (which increases house utilization an
334.
by hirsin 7y ago
Precisely. This sketch always comes to mind https://youtu.be/hNoS2BU6bbQ You're under no obligation to accept names that are hard (as in painful) for you (except if you're the police, I suppose. Ironically)
335.
by hirsin 7y ago
Sample size a couple dozen only, but IBU on the menu has also been helpful to non-IPA drinkers I know, so they can avoid things they don't enjoy. It's also trended locally (Ballard) towards golf - see Reuben's releasing a zer
336.
by hirsin 7y ago
+1. Most of the support cases I get (meaning they've escalated through 2 to 3 layers of support engineering) are XY Problems (1). The customers are smart, and typically their issue is knowing too much about one aspect of the thing the
337.
by hirsin 7y ago
Sample size 2, but same here.
338.
by hirsin 7y ago
A lane, maybe, some of the time. And don't underestimate the impact of pick up/drop off. Uber was supposed to bring the same change, but not it just takes twice as long to get through Capitol Hill because it's crowded with ub
339.
by hirsin 7y ago
Eh, I understand it. They want to put some name in the identity control in the header. Putting the full name in is guaranteed to go wrong. We might start asking for a nickname for that purpose.
340.
by hirsin 7y ago
Note that the logged in API is not supported in Chrom(e|ium). That WI be a big deal when finished because it will help with user privacy without breaking things.
341.
by hirsin 7y ago
They broke most federated auth scenarios with ITP, so there needs to be a way for auth to flow between websites in a way that allows users to consent and control it. The logged in API basically takes your auth state (to a first estimate) ou
342.
by hirsin 7y ago
Which is great until the client asks for a friendly name (given name) identifier. GitHub uses name, we use first/last name. So we just shove the GitHub name in the first name spot and ask people to organize what looks right. Our partne
343.
by hirsin 7y ago
If you force a check at the start, refresh token seems fine. That's much preferable than popping ux every hour or whenever the access token expires.
344.
by hirsin 7y ago
Facebook does this when you sign into an app you've previously authorized, in native application flows. Microsoft just added this recently as well. We do recommend it to other IDPs. This is only enforced for public clients though that
345.
by hirsin 7y ago
Is it possible you have cause and effect reversed? I received this as "learning to code well can also teach good communication skills"
346.
by hirsin 7y ago
Passwords can be used from anywhere. Keys cannot. That is the attack this blocks.
347.
by hirsin 7y ago
Or based on what the politicians elected by those states say and then vote for. "Vote the most against"...
348.
by hirsin 7y ago
You still found a bug - the error claimed it was a bug, but it wasn't! The point of technical error messages, imo, is to tell the developer what they did wrong to get into this state. They can't be allowed to be wrong, otherwise d
349.
by hirsin 7y ago
Yup, although calling it black magic isn't far off from the truth. It's why I stick with oauth and let my coworker handle SAML. (They do SAML both directions, which is how we added it to AAD and Windows). It's a bit of a roug
350.
by hirsin 7y ago
Google supports SAML federation: https://support.google.com/a/answer/60224?hl=en
351.
by hirsin 7y ago
If you have cookies that need to be read in a 3p context (federated auth for instance), you must UA sniff in order to figure out if setting samesite=none is going to break your cookies, do nothing, or be required for your cookies - just acr
352.
by hirsin 7y ago
On top of preventing CSRF, it forces labeling of cross site cookies, commonly used for tracking. There's an option in the latest builds to remove all 3p cookies (and add a site allow list)
353.
by hirsin 7y ago
They (will) add the samesite decorators.
354.
by hirsin 7y ago
Not mentioned in the article, but critical for debugging and testing - Chrome has added a 2 minute grace period, where cookies set in that time period are still allowed on non-get requests even without a samesite policy. This is considered
355.
by hirsin 7y ago
Usually it means you can't actually drink that much, so, watch what you wish for.
356.
by hirsin 7y ago
You've led a fortunate life, if you've never had a phone utterly and completely destroyed or lost. Having the SIM ruined is a rough time. I believe t-mobile has a nice requirement of being able to mark you number as "show up
357.
by hirsin 7y ago
What are the implications of only buying Wheaties for breakfast? That doesn't scream wealth to me, but I also don't eat breakfast cereals, so have a blind spot.
358.
by hirsin 7y ago
Give or take 2 of the 5 largest OIDC providers. This change broke form_post in OIDC, so every app using it (low 5 digit count) needs to update and redeploy.
359.
by hirsin 7y ago
That is not how specs work.
360.
by hirsin 7y ago
Nah. You have a blind spot because I'm guessing you're not responsible for a developer ecosystem, otherwise you'd not spout off with absolutes, especially when you're just wrong. These "hypothetical idiots", in

More ›