kevincox

31 ms·

571.
by kevincox 2y ago
Just email the link? The receiver has authenticated by getting the email.
572.
by kevincox 2y ago
So you at least need to pay with personal information before you even know about the cause you are paying to.
573.
by kevincox 2y ago
Definitely agree on the array. They were smart enough to use JSON for the patch format so that people didn't have to write custom parsers but then used a selector syntax that requires a custom parser (and serializer). It seems like an
574.
by kevincox 2y ago
This is me. I almost always try to sleep but am lucky to get 2h on a 20h flight.
575.
by kevincox 2y ago
Yeah, this is the recommendation that I usually give people who reach out to support. Feedburner tends to be on the whitelists to avoids this problem.
576.
by kevincox 2y ago
> In the end we had to use Cloudflare to rate limit the RSS endpoint. I think this is fine. You are solving a specific problem and still allowing some traffic. The problem with the Cloudflare default settings is that they block all req
577.
by kevincox 2y ago
I'll mail you as well but I think public discussion is helpful. Especially since I have seem similar responses to this over the years and it feels very disingenuous. The problem is very clear (Cloudflare serves 403 blocks to feed reade
578.
by kevincox 2y ago
I dislike advice of whitelisting specific readers by user-agent. Not only is this endless manual work that will only solve the problem for a subset of users but it also is easy to bypass by malicious actors. My recommendation would be to cr
579.
by kevincox 2y ago
I agree that tips are stupid. But they are technically different as you can pay the price without them and be fine. This is unlike "convenience fees" and tax which are required but not displayed in the advertised price. I defini
580.
by kevincox 2y ago
I agree with this. I think all tokens should expire. If you accidentally zip up an auth token in an application's config directory it is nice if it becomes inert after a while. If you extend the token it could live forever. For my appl
581.
by kevincox 2y ago
Reading the answer it seems that the easter egg accidentally also triggered if you pass the page to load via --path. This was then fixed later (and then even later the whole easter egg was removed).
582.
by kevincox 2y ago
The first answer explains that it was only supposed to trigger on error cases (no page specified) but due to an oversight also triggered if you specified a man page by the --path flag (rather than just the page name)
583.
by kevincox 2y ago
This is a great point and a huge feature provided by major social media platforms. They have built-in access control that is consistent across profiles. I haven't seen a compelling offering for providing this on a personal website, esp
584.
by kevincox 2y ago
> removing XUL Nah, XUL had to go. The other stuff wasn't really related. It was a more "if we are going to break most extensions we may as well use this time to push everything else we want". If anything XUL is a scapegoa
585.
.gitignore Is Inherently Sisyphean(rgbcu.be)
5 points by kevincox 2y ago|1 comments
586.
The sorry state of Java deserialization(marginalia.nu)
73 points by kevincox 2y ago|52 comments
587.
by kevincox 2y ago
For inserts yes, but for updates I've frequently seen cases where people just stuff the whole request into their ORM or document store. It is pretty easy to think "the owner can update the document" without realizing that the
588.
by kevincox 2y ago
If you run a node that forwards traffic to any node other than the one requested by the client then that node won't be able to decrypt the traffic. The client encrypts traffic to each node on its selected path in turn. If the traffic d
589.
by kevincox 2y ago
That's a good point. I meant to say proxies that don't alter the headers. These methods could easily be stripped if the proxy wants to ensure that it understands the response.
590.
by kevincox 2y ago
It is interesting that a proxy won't be able to see the complete response anymore. It will see the dictionary ID and hash but without a copy the server's response won't be fully intelligible to it.
591.
by kevincox 2y ago
And most importantly it is enough to debug and fix the system.
592.
by kevincox 2y ago
And now every website has an excuse to require a verified phone number... I guess it probably does raise the baseline, but at the cost of those who have good security practices.
593.
by kevincox 2y ago
I think the OP meant OTP. The general concept of one time passcodes, not TOTP as per RFC 6238
594.
by kevincox 2y ago
What is the reference size? It is hard to compare. For many applications the size of "assets" like images, localization data and other stuff will vastly outweight the code.
595.
by kevincox 2y ago
I really don't get it. > You get a copy of the entire works of your favorite authors Atom supports pagination. If it was a major issue people would support it. But the nice thing about RSS is that you don't need to download eve
596.
by kevincox 2y ago
But if you know the number picker is going to choose these numbers you can optimize your algorithm.
597.
by kevincox 2y ago
This was Podcast Addict.
598.
by kevincox 2y ago
I don't see it mentioned in the article. What type of tracking was Google doing here that was problematic?
599.
by kevincox 2y ago
Reminds me of a bug that I field for my podcatcher. It has an automatic playlist feature where it automatically queues up next episodes based on some simple rules. One of the rules is "alternate podcasts" to ensure that you rotate
600.
by kevincox 2y ago
IIUC the main difference is that third-party cookies are not blocked, but scoped to the top-level domain. So if you visit games.example which loads tracker.example it can set cookies. However these cookies are only used while you are on gam

More ›