jonstaab

17 ms·

181.
by jonstaab 7y ago
Yes, that's definitely a big part of it. Test it all with curl or your language's http client, then put it in the browser and it breaks? Must be the client's fault! Which it sorta is. But only because it's a client that
182.
by jonstaab 7y ago
I guess that's what I meant; XSS would give them the user's session implicitly on my domain, regardless of CORS. CORS prevents them from using that from another domain, which is valuable, but moot if you already have a breach.
183.
by jonstaab 7y ago
The single-value constraint seems like a feature rather than a bug; if you included your full list of whitelisted domains every time, not only would your HTTP header size be unnecessarily heavy, but you'd be leaking private details abo
184.
by jonstaab 7y ago
CORS is really pretty simple, it's getting the threat model that is tricky. Some docs on Allow-Origin here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac... and a more complete w
185.
by jonstaab 7y ago
I'm not familiar with Blazor or WebAPI, but if you're not expecting requests from client-side javascript specifically, you can just use `Access-Control-Allow-Origin: null`, since non-browser clients don't respect CORS anyway.
186.
by jonstaab 7y ago
Totally agree. Something about CORS and the resources out there makes newcomers think that it's something the client has to do differently. I thought this when first doing cross-origin stuff, and thought it was just me until my dad (pr
187.
by jonstaab 7y ago
Correct, the check is server-side. Nothing the client can do about it.
188.
by jonstaab 7y ago
I have to admit I was thinking primarily of my company's use case, which is serving brick-and-mortar. This is a pretty different picture from card-not-present transactions, but if you're a low-risk business from the point of view
189.
by jonstaab 7y ago
Yeah, depends on your business, but for us Stripe is only necessary for new customers or for folks to update their billing information once in a blue moon. I definitely envy anyone getting multiple new customers per minute. Our application
190.
by jonstaab 7y ago
Sadly, I am Android-only. Is there any difference in functionality, or it a pure clone (edit: or, is Numi the clone? Sound like Soulver has been around a while)?
191.
by jonstaab 7y ago
Seconded (though I'm tentatively switching to dc[0], reverse polish notation ftw), can anyone who has used both Numi and Soulver point out the differences between the two? They look super similar to me. [0] https://www.compu
192.
Running Queries from Kakoune(dev.to)
2 points by jonstaab 7y ago|0 comments
193.
Using Kakoune as a Query Browser(dev.to)
3 points by jonstaab 7y ago|0 comments
194.
by jonstaab 7y ago
Stoked about jsonpath! The current collection of json(b) functions are a huge pain to use. If you want to do something as trivial as filtering a json array, you have to select jsonb_array_elements in a subquery, do a filter, and then roll t
195.
by jonstaab 8y ago
The definitions are frustratingly vague. "Any customer data excluding sensitive personal data", which doesn't exclude stuff that isn't relevant to them, or things that don't fit in the API. Also, it states that apps
196.
by jonstaab 8y ago
I had been working on an integration between our product and Shopify via an app for just about a week when their updated ToU came out. It is a pain in the butt. I side with MailChimp here, that customer data isn't ours to share with Sh
197.
by jonstaab 8y ago
Unfortunately, I'm in the same boat, having only fiddled briefly with some of the newer web APIs, rather than architecting an app around service workers. My impression comes from folks like Joreteg who do the work, and from the increas
198.
by jonstaab 8y ago
Henrik Joreteg ( https://twitter.com/HenrikJoreteg ) makes some pretty good arguments for PWAs. I've not had the chance to work on one, but when you start looking at mobile devices in particular, they do seem to be a goo
199.
by jonstaab 8y ago
Agree that an offline-first PWA is the way to go. Not _no_ javascript, just _as little as possible_. However, I've also not seen such a good example before of how doable this is, so thanks to the author for the show-and-tell. The label
200.
The Mother’s Smile: Integrative Beauty(theopolisinstitute.com)
1 points by jonstaab 8y ago|0 comments
201.
by jonstaab 8y ago
I've been using Kakoune for about a year, after a year of vim, after several years of Sublime. It has its warts, but it's way above and beyond anything I've used before. Whenever I use another editor I feel freakishly slow no
202.
Show HN: Quick Program for Helping to Memorize Large Chunks of Text(memorize.surge.sh)
1 points by jonstaab 8y ago|0 comments
203.
by jonstaab 8y ago
Hey there, I'm the guy that wrote this — I just wanted to point out that the really neat thing about this (in my opinion) is that you can gather around a single screen (located at "/canvas"), and control the bugs from ph
204.
Show HN: Bedug, a programming game for 3 year olds(bedug.herokuapp.com)
1 points by jonstaab 8y ago|1 comments
205.
by jonstaab 8y ago
Empire is an amazing game! I grew up playing it with my dad. So many good memories, and I think it stands the test of time; I still play sometimes. Never thought I'd run into its author on HN!
206.
by jonstaab 8y ago
Thanks for the article! I've often heard that null is bad, but haven't ever seen such a thorough, readable explanation. Just so I can think it fully through for myself, it seems that the problems with null are: 1. Its semantics ar
207.
by jonstaab 8y ago
Sounds like you might want to move on. I've been at kinda crappy startups for 4 years now, not being paid much and working hard. But like, Idaho hard. 55ish max hours a week. And I've stuck to it because I have so much agency. I l
208.
by jonstaab 8y ago
Just don't type while (true) {} or you have to throw everything away.
209.
by jonstaab 8y ago
The quote is from Herodotus Book 9 Chapter 122, "Soft lands breed soft men", by Cyrus the Persian. Reference: http://www.perseus.tufts.edu/hopper/text?doc=Perseus:text:19...
210.
by jonstaab 8y ago
I was a little disappointed not to read anything about conscientious objectors, having just read Wendell Berry's 1987 article "Why I am NOT going to buy a computer" [0]. Idealistic as he is, Berry's work appeals very str

More ›