mhils

12 ms·

91.
by mhils 5y ago
This is included in https://github.com/eu-digital-green-certificates/dgc-partici... , in that context as an example it does make some sense.
92.
by mhils 5y ago
The RKI estimates the contribution that the Corona-Warn-App makes to containment to be roughly as high as that of all health authorities together. [1] I'm surprised your brother has not received any notifications. My partner is a docto
93.
by mhils 5y ago
> In the next commit the PR author exfiltrates GitHub secrets by base64ing them and logging in the workflow run (or any other way). Environment secrets are not exposed to PRs, so this does not work. This really only concerns DoS.
94.
by mhils 5y ago
GitHub actually introduced "Environments" recently, which allow you to do what you are asking for. Lots of existing pipelines haven't migrated yet of course. https://docs.github.com/en/actions/refere
95.
by mhils 6y ago
Most (all?) major CI providers automatically censor secrets printed in the worker log, so this is not as much of a concern. :)
96.
by mhils 6y ago
This looks great! Very happy to see that kind of software built with mitmproxy. If there's anything we can do to make your downstream life easier, feel free to reach out anytime. :)
97.
by mhils 6y ago
The situation on Android is particularly unfortunate. The Android folks have decided that user-added CAs are not exposed to apps unless they explicitly opt in, so nothing works out-of-the box. I personally don't see the threat model t
98.
by mhils 6y ago
The ad-tech response to SRI is to provide script tags where the entrypoint script loads additional scripts, which you cannot pin. ¯\_(ツ)_/¯
99.
by mhils 6y ago
In practice, some CMPs used to share positive consent across websites, but did not share negative consent. So if they tricked you into accepting once, they keep it; if you refuse, they keep annoying you. My understanding is that watchdogs
100.
by mhils 6y ago
I don't know if uBlock Origin increases this further, but even without it it's ridiculous. We measured this just for fun in a paper last year [1]: > Compared to accepting cookies, opting out causes an additional 279 HTTP(S) re
101.
by mhils 6y ago
Related, Claus Wilke's Data Visualization book has a fantastic section on common pitfalls of color use: https://clauswilke.com/dataviz/color-basics.html https://clauswilke.com/dataviz/color-pi
102.
by mhils 6y ago
If you have this super powerful quantum computer, you can still front-run transactions.
103.
by mhils 6y ago
A bit of a late reply, but Python 3.7 is supported now! :)
104.
by mhils 6y ago
AFAIK you can register URL handlers for a specific domain (signal.tube), but not for a specific hash. And you don't want Signal to appear as an alternative browser on every link. Edit: On a second thought, I wonder if a custom scheme w
105.
by mhils 6y ago
What kind of JSON format would you be looking for? Is there some sort of standard I'm not aware of? Generally speaking it's quite easy to change the output format, one just needs to swap out the Jinja2 template. :)
106.
by mhils 6y ago
Definitely, I'd be happy to merge a PR! But nothing wrong with using pdocs. :)
107.
by mhils 6y ago
pdoc produces completely standalone HTML files with no dependencies and no JS. Even the collapsible navigation on small screen sizes is implemented in CSS only. Take a look yourself: https://pdoc.dev/docs/pdoc.html You
108.
by mhils 6y ago
pdocs is what a friendly fork looks like, happy to see it. :) I've sent an email to Timothy a few days ago, I'd be more than happy to eventually join forces. We also invited the pdoc3 author early on to collaborate under the only
109.
by mhils 6y ago
> is it possible to include a folder with md files in the output? Not yet, but integrating your API documentation into the rest of your website/docs is definitely something that I have on the radar. I'm not sure what this will
110.
by mhils 6y ago
Hi HN! Some of you may remember @BurntSushi's pdoc tool, a lightweight alternative to Sphinx. We're a bit in an unfortunate situation with a hostile work assuming our name [1], but I figured that we shouldn't give in and cont
111.
Show HN: Pdoc, a lightweight Python API documentation generator(pdoc.dev)
45 points by mhils 6y ago|18 comments
112.
Mitmproxy: A New Proxy Core, Sans I/O(mitmproxy.org)
6 points by mhils 6y ago|0 comments
113.
by mhils 6y ago
Sorry, but this sounds a bit terrifying. All your traffic is going through Bubble's servers where it is TLS-intercepted and accessible as plaintext. Compared to a browser extension like uBlock, you don't see what is happening on B
114.
by mhils 6y ago
Correct me if I'm wrong, but a CNAME "redirect" on the DNS level does not change the page origin. `fonts.gstatic.com` will only get the cookies set for `fonts.gstatic.com`, even if it is CNAMEd to a different domain.
115.
by mhils 6y ago
Great to see us on HN, even if we don't have our 5.3 blogpost up yet :) This release continues our attempts to become a bit more friendly to new users. Our docs now include a beginners guide created by our GSoC student this summer, whi
116.
by mhils 6y ago
You can view TCP contents in the mitmproxy UI since a few months (thanks to some excellent community contributions). Minimal example: mitmproxy --mode reverse:http://example.com --tcp-hosts example.com curl http://
117.
by mhils 6y ago
It is not unlikely that the phishing site is hosted on a hacked server that still serves legitimate websites (which you would also take down in the process). So there could be a legitimate complainant.
118.
by mhils 6y ago
Zoom is the Windows of conferencing apps: It is the most popular one, so researchers actually look at it and say it's shit, but the alternatives aren't much better [1]. [1] Just one example: https://github.com/jits
119.
by mhils 7y ago
To add to the list: We've had a lot of fun playing https://www.geoguessr.com/ , both cooperatively and competitively.
120.
by mhils 7y ago
It would be fantastic if policymakers could enforce traffic transparency for mobile apps. I would love to just take my phone and see what is being transmitted, but of course Android doesn't trust user-added Certificate Authoritites for

More ›