hparadiz

10 ms·

241.
by hparadiz 4mo ago
I don't have a Windows install anymore and won't set it up just for one game. Furthermore Epic Games has a history of acquiring studios and them crippling Linux support on games that were already purchased. I have a long list of g
242.
by hparadiz 4mo ago
I think you are probably an outlier if you've never rented a movie in the 90s and shouldn't generally be used as a good example of how life was. It's frankly absurd that you would even bring it up as a virtue.
243.
by hparadiz 4mo ago
Everything you just said is readily available now. You can use a FOSS OS on a mobile device with an offline mapping program. They were available before Google Maps was even a thing on Android 1.x. I know because I used to download them and
244.
by hparadiz 4mo ago
Can you imagine sitting around waiting for a phone call these days? At home? With a landline? Lol. Or going to the video store to drop $20 (with inflation today: $48) on three movies that you had to actually return by driving. The romantic
245.
by hparadiz 4mo ago
Oh man I can tell you're young. Those directions weren't always right. You couldn't just pull out your phone and find the nearest hospital if something happened during your trip. Or call 911 and have them find you by GPS. And
246.
by hparadiz 4mo ago
People just forget the before times. No one wants to go back to printing out driving directions or emailing photos. We take all these things for granted now but I am 100 certain the technology we have now has saved hundreds of millions of l
247.
by hparadiz 4mo ago
They also buy studios and then kill Linux support when it was already working just fine. From the horses mouth itself: https://x.com/timsweeneyepic/status/964284402741149698?lang=... He straight up makes fun of Li
248.
by hparadiz 4mo ago
Does it support Linux?
249.
by hparadiz 4mo ago
As long as Epic Games is anti Linux I will never use any Epic Games product. Count on it.
250.
by hparadiz 4mo ago
This is actually really funny because I recently had this problem having to authenticate an internal repo with an OIDC but the script had to run so early in the bootstrap processes that the python google sdk is not yet installed so I had to
251.
by hparadiz 4mo ago
The US first got magnetic strip readers in 1970 so we just have a ton of infrastructure using them. Since most people drive pickpocketing and things of that nature are much less of an issue for us. Typical use has someone using the card for
252.
by hparadiz 4mo ago
Stealing the numbers. Could've been someone taking a photo of the card out of sight. I honestly don't track my card that well when I'm out cause it's easy to have a transaction voided if it's legit not me. Then agai
253.
by hparadiz 4mo ago
We're talking about just in time tokens that disappear after use. There's nothing you can do to defeat that on a rooted device. That's the whole point of the entire tech. That's why yubikeys are even a thing.
254.
by hparadiz 4mo ago
I prefer saml 2.0 for jit provisioning.
255.
by hparadiz 4mo ago
We have chips but magnetic strips are still on most credit cards and payments are still accepted that way in many older payments gateways. From what I read on the topic the cost of lost business if this was disabled is greater than eating t
256.
by hparadiz 4mo ago
It's wild how basic math goes poof as soon as someone has an agenda to push in internet comment threads.
257.
by hparadiz 4mo ago
pictured > man plows field by hand
258.
by hparadiz 4mo ago
Even worse than both of those scenarios. If you don't check the signature anyone can simply write whatever they want in the payload string. The signature is always generated by combining the payload with a private key. Then the receive
259.
by hparadiz 4mo ago
> Commercially, this makes sense. Does it though? The people in this thread are like "just use a card". Well I've done that for years and had my card skimmed, lost, and stolen over the years. The cost wasn't trivial e
260.
by hparadiz 4mo ago
I think you can use a JWT just fine to introduce a new user into a system but once authenticated just set a classic session cookie with an expiration. I get when you can't for like an API and sure that's where JWTs are best. But a
261.
by hparadiz 4mo ago
It's infuriating that they won't do this for non Google Android. It's in the best interest of both the bank and the card owner. Credential theft risk goes down to basically zero when backed by a fingerprint authenticated virt
262.
by hparadiz 4mo ago
I didn't downvote you. You're absolutely right. Implementation of anything is work.
263.
by hparadiz 4mo ago
You should not be using them for user contexts at all. The cookie should be the session token and the sessions should be stored on the server side where you can simply delete them and the user's login becomes invalid. Using JWTs for th
264.
by hparadiz 4mo ago
The cost of the stateless token is basically the CPU usage for signing the message and checking the signature with the public key on the client. Example: Google Compute Instance asks metadata server for OIDC token (which is a JWT). The meta
265.
by hparadiz 4mo ago
HN is full of people who don't actually fully understand the subject matter speaking confidentiality. And lots of arguing even when they are clearly wrong.
266.
by hparadiz 4mo ago
You should do some basic optimizations. Fixed length table and indexes on the unique string for fast lookups. I also like to do a rolling delete for old sessions after 30 days unless mobile session that is logged in. Those get to live forev
267.
by hparadiz 4mo ago
If you don't understand conceptually how to verify a signature with a public key the very first thing you should do is get that working and then work from there. It's completely unacceptable to ship without this.
268.
by hparadiz 4mo ago
I remember before FB was a thing and sharing photos with your friends was a huge pain in the ass. We had dozens of different websites in this days from MySpace to some weird ones that you've never heard of before. They all did the same
269.
by hparadiz 4mo ago
Not checking the signature on every single JWT is the same as storing a password in plain text.
270.
by hparadiz 4mo ago
You can make a JWT invalid after 30 seconds or even 1 second. You should set an aud (audience) when creating the JWT. Otherwise the signature is crypto-graphically sound. Validate every single JWT every single time with a short lifetime. OI

More ›