hirsin

30 ms·

361.
by hirsin 7y ago
OK, fine - this will cost just my developer community alone 10-50 million dollars in rework. Maybe that's acceptable to the Chrome team, but I'm the one sending that mail to a hundred thousand developers, not them. So I weigh it d
362.
by hirsin 7y ago
Yup. This is a good change and should have been the default from the start. But it wasn't, so you need to play by the rules - standard first, let the framework developers at least implement this so it doesn't require header hacks,
363.
by hirsin 7y ago
No. They have a bug in their implementation of the spec, but Chrome is going off spec here, and dropping breaking changes into the ecosystem in a way that requires developers to UA sniff. The Safari bug is annoying today, but ultimately did
364.
by hirsin 7y ago
Has there ever been a breaking change approved by the IETF? I'm not familiar enough with their history to know of precedence. It seems like the spec/standard should be approved at least before we go about asking developers to incu
365.
by hirsin 7y ago
This is tricky - it's up to the site basically. For single site websites (hacker news, let's say) then yeah - samesite should be enabled to prevent this. For a large IDP like Google, Facebook, Microsoft, etc, you start to want* lo
366.
by hirsin 7y ago
Windows has for over a decade, I assume Linux does too.
367.
by hirsin 7y ago
It's rarely purely price/oz. Often it's mixed units - eg for granola bars or similar you'll see four different items listed at - Price/oz Price/lb Price/bar Price/unit (which might be bar or package o
368.
by hirsin 7y ago
Those OS features do largely exist (speech to text slightly less so) and are readily available for developers to interact with, often worked into the framework of choice already. Except Electron, where you get to reimplement everything.
369.
by hirsin 7y ago
Eh - I see diminishing returns around smaller public-ish transit (!) commutes. The difference between a 15 minute commute and a 45 minute commute wasn't significant for me. I can still pay bills, answer personal mail, read a book, and
370.
by hirsin 7y ago
https://pubs.usgs.gov/fs/fs-040-03/ 4th result on "landfill leak groundwater" and first solid looking, non biased answer. Yes, modern, but that's a scope on an already scoped excuse. Second, it&#x27
371.
by hirsin 7y ago
I would think a "Pre-auth" endpoint that can be called for user information is not what consumers want...
372.
by hirsin 7y ago
Ah, gotcha. That sounds like token introspection basically, which is a (budding?) standard, not really userinfo.
373.
by hirsin 7y ago
Eh? Got additional details on which OIDC providers aren't using a proper userinfo + AT? Not that that shouldn't include TLS... We don't do token introspection (basically what you're referring to) and instead use JWT&#x2F
374.
by hirsin 7y ago
The opposite likely occurred re: local businesses. People stayed home in Renton and spent money locally instead of spending it in Seattle.
375.
by hirsin 7y ago
Yes, hence my second statement and use of "space" in the first.
376.
by hirsin 7y ago
Surprisingly this is not true. A watt of energy can only produce a watt of heat, but can remove several watts of heat from a space. That said, we're much better setup to increase total entropy in the atmosphere than decrease it (via he
377.
by hirsin 7y ago
Is there any evidence that consumers are actually pushing for 5g? It's always seemed like it was a buzzword that various telcos and equipment vendors push to ensure spend and churn. The telcos likely get to push for subsidies ("ju
378.
by hirsin 7y ago
That was a design decision made because install to SD card causes apps to load slowly (to my understanding). It used to be possible but they killed it. Doesn't hurt that it helps speed up the upgrade cycle since users run out of on-boa
379.
by hirsin 7y ago
Auth systems don't key off of usernames... When we added FIDO support there's still a backing user store that records user x has FIDO y, with a recording of the public key. That's how the pairing works. You can see it today o
380.
by hirsin 7y ago
Pretty much this. I once tried adding a new ~3 MB binary, and it was rejected on effectively these grounds. Now consider that the team making these in/out decisions has a backlog of requests just like it for larger items...
381.
by hirsin 7y ago
Yeah, 1 percent is way too high is the concern. That will generate support calls and customer complaints. (plus, the same domains will always hit the problem, meaning those domains will specifically ask us to fix it - so... We send an extra
382.
by hirsin 7y ago
As others have mentioned, this isn't great for accessibility. And most password managers would be smart to ignore hidden password fields, since that's a decent attack vector for skimming.
383.
by hirsin 7y ago
Are you suggesting that the bloom filter be pushed with the login page? That's like 10 MB of data on every login request. It's almost certainly faster to just do the Ajax call. (Assuming you have around 2 million domains supported
384.
by hirsin 7y ago
Yes, it can. How do you think Auth works? You know what auth methods the user has. Otherwise you can't really validate their auth.
385.
by hirsin 7y ago
Ah, yes, figure out which ux the user needs before they tell you who they are. Please, let me know if your genie is for rent. Otherwise, see other comments for how the detection ux with a default password entry caused issues for us.
386.
by hirsin 7y ago
In Auth we call this a NASCAR, where there are so many buttons on the page that the user no longer knows which one they used to login last time. This leads to retention problems as users accidentally sign up for your app multiple times, end
387.
by hirsin 7y ago
Many corporate clients don't want you passing their users passwords through your backend, so full page navigation is required. You're also working with on-premises Auth servers that likely don't support whatever fancy front c
388.
by hirsin 7y ago
We (Microsoft) did that for a while. It doesn't work as well as the paginated flow. Users without a password get to the page and leave, claiming they don't have a password and are stuck, because they don't try to type in thei
389.
by hirsin 7y ago
No user will understand that. They will call their IT admin and ask for the password. Or won't type the password and think you should find it somewhere else. Or think it's I secure because anyone can sign into their account withou
390.
by hirsin 7y ago
It's not the point. Most "information theft" is people not realizing that they shouldn't share the information. If someone is dedicated enough to exfiltrate information they'll just take a picture of the screen. But

More ›