kevincox

35 ms·

601.
by kevincox 2y ago
I know. Everyone is different and there is nothing wrong with that. I don't think RSS-to-email is for everyone. And I definitely don't have (most) feeds going to my inbox. That would be far too much. The vast majority of my feeds
602.
by kevincox 2y ago
I've been using RSS-to-email since forever. I now run my own RSS-to-email service. I filter (almost all) of them into folders that don't notify and then they are there ready to read across all of my devices that are logged into my
603.
by kevincox 2y ago
> When you regain consciousness you'll be perfectly fine, but won't for the life of you be able to recall your device passwords or keys You can't use your password as input to the mud puddle test.
604.
by kevincox 2y ago
> If you could only gain access with your password, you could consider your data safe. You can't assume the negation. If you can get access without your password then you have proven that law enforcement or the hosting company can t
605.
by kevincox 2y ago
> The premise of your article ... it's simply not true for single-origin sites But it is. Even if you consider your site single-origin "simple requests" including form posts are allowed by default on some browsers. This re
606.
by kevincox 2y ago
I agree with those points but I don't think they mean that we shouldn't be promoting that header as a common solution. > Server bound to an inaccessible network interface This is a niche use case. Most sites don't have thi
607.
by kevincox 2y ago
Even with CORS, DNS rebinding may be a concern here. I think HTTPS may prevent that as the cert wouldn't contain the original site but in this setup where you want "no other security" it would probably work.
608.
by kevincox 2y ago
How can the browser know not to send the credential before it gets the response that contains the Access-Control-Allow-Origin header? This is the crux of the issue. For many types of request (notably with `Content-Type: application/jso
609.
by kevincox 2y ago
100%, this is one of the reasons that I want promote `Access-Control-Allow-Origin: *`. It allows client site RSS and link previews without needing a useless (and potentially privacy-harming) CORS proxy.
610.
by kevincox 2y ago
Yeah, I had a section on this but decided to cut it because I felt the other protections mostly obsoleted the need to talk about this. > pretty much everything requires a non-simple request in order to invoke an action Except for POST re
611.
by kevincox 2y ago
Sorry, you are completely correct. I'll update the article.
612.
by kevincox 2y ago
> SameSite=Lax is now the default on browsers Note on all major browsers unfortunately: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se... A real shame, because it would be a pretty
613.
by kevincox 2y ago
This is a good point, I tried to research `SameSite=Lax` but most of the docs don't actually mention how it applies to form posts. But the actual RFC does specify that it only applies to top-level "safe" methods. So form POST
614.
by kevincox 2y ago
You'd probably have to ask someone who worked in the phone industry at the time. I suspect that long-distance calls were legitimately quite expensive to provide at some point in the past, and the industry was happy to keep charging ext
615.
by kevincox 2y ago
HTTP/3 is QUIC. So you can tunnel whatever you want over a connection that is not reliably distinguishable from HTTPS. (You can do heuristics based on packet sizes and timings)
616.
by kevincox 2y ago
This is the same in Canada. It isn't possible to distinguish landlines from cell phones by looking at the number. All numbers issued in an area have the same area code. The North American numberig plan looks like +1-AAA-BBB-CCCC Where
617.
by kevincox 2y ago
It is protected by if the request uses JSON or similar. The point is still that this is the target problem that it is trying to address. > Why not use a canonical example that is protected against by default? I think demonstrating how fu
618.
by kevincox 2y ago
CORS is basically a backwards compatible hack to "fix" the bug that cookies are sent on third party requests by default. The canonical issue that CORS solves is: 1. I log into my bank. 2. I load an untrusted site. 3. That site doe
619.
by kevincox 2y ago
I run a paid RSS-to-Email service and I have customers who subscribe to get kill-the-newsletter RSS feeds delivered to them via email. At some point I just have to assume that people have motives and not worry about it. (In the case of news
620.
by kevincox 2y ago
I tried adding my website ( https://kevincox.ca ) and just got a broken image on the sidebar. Tried another site and nothing changed. I don't see any way to manage these feeds either. Maybe it lacks feed discovery? But it sho
621.
by kevincox 2y ago
I have something similar. I was added to the Google domain of some open source project, given an email address. But I can't log in because Google is demanding a phone number. I guess I could probably talk to the admin and get it reset,
622.
by kevincox 2y ago
How would you securely implement this scheme with SSS?
623.
by kevincox 2y ago
I don't think it fails to address that in a way that matters. The fact is that the default is still 1024. If you have bumped the side at build time it dynamically allocate them then you are more than welcome to bump the soft limit to t
624.
by kevincox 2y ago
> 1024 as the file limits https://0pointer.net/blog/file-descriptor-limits.html is a good overview of the unfortunate reason why this is and how it should be handled.
625.
by kevincox 2y ago
There is always nuance. I think if you work on a team for some product, it would be good to be a user of that product. Especially if you are at a high level driving product decisions. I think if you don't work on a specific product it
626.
by kevincox 2y ago
That sounds awful. Some of my favourite thing about the web are the semantics. This like links that have common shortcuts across all sites (like open in new tab) and a rich contect menu (send to another device, archive at archive.org). I ha
627.
by kevincox 2y ago
Swift is pretty next level compared to Rust. Rust does seem like a fairly constant level of slow and linearly slows down as the project gets larger. Swift tends to have huge degradations on seemingly innocent changes that make the type infe
628.
by kevincox 2y ago
I think they are referring to this section: https://chevyray.dev/blog/creating-175-fonts/#automatic-kern... In this case they are not using async but Rayon which provides some easy primitives for splitting tasks i
629.
by kevincox 2y ago
IPv6 solves this as you are strongly recommend to use a random component at the top of the internal reserved space. So the chance of a collision is quite low.
630.
by kevincox 2y ago
Yes, but then you are putting more information into the publically logged certificate. So it is a tradeoff between scope of certificate and data leak. I guess you can use a pattern like {human name}.{random}.internal but then you lose memor

More ›