minitech

62 ms·

391.
by minitech 7y ago
> Community maintained software with short dependency lists doesn’t have this problem. That’s just not true. One of the first things mentioned in the post is vulnerabilities. An image viewer shouldn’t be able to put your SSH keys at risk
392.
by minitech 7y ago
This seems like a very verbose retread. What I was saying is if you are currently using a named function: function foo(bar) { // … } you don’t lose the name by making it an arrow function: const foo = bar =>
393.
by minitech 7y ago
They can’t be named in the same standalone way that non-arrow function expressions can, but they do acquire names in some positions that get used in stack traces and profiles. > ({ literalProperty: () => {} }).literalProperty.name
394.
by minitech 7y ago
I don’t think it’s a mistake. I think it’s a sensible design choice (after strict mode disconnected it from the actual misfeature that is primitive wrappers). There are arguments to be made that it’s confusing coming from other languages gi
395.
by minitech 7y ago
> Simply knowing about normal function parameters and lexical binding like in Python is not enough: There is an invisible a VM interpreter thread somewhere that you have to know about, which has a "this" property, and the only
396.
by minitech 7y ago
Do you mean you wouldn’t have named it “this”? Because if `this` weren’t set by the means of calling in ES5 and earlier, it would have no point at all.
397.
by minitech 7y ago
Very little of that article is applicable. The website is served over HTTPS, the browser has a crypto API now. The encryption in this project decreases the impact of any future compromise of the server (if a share link is never visited post
398.
by minitech 7y ago
A strong master password is what makes brute-forcing impractical.
399.
by minitech 7y ago
function loginAction(evt) { evt.preventDefault(); const password = inputPasswordEl.current.value; props.db.getAllUsers() .then(querySnapshot => { const users = []; querySnapshot.forEach(function (do
400.
by minitech 7y ago
https://github.com/lesspass/lesspass/blob/e134350f2b17b63a3a... : salt = ( password_profile["site"] + password_profile["login"] + hex(password_profile["co
401.
by minitech 7y ago
> If an attacker gets that password, they now have the opportunity to brute for the master_password value. So don’t use a brute-forceable master password…
402.
by minitech 7y ago
> from seeds partially known to the attacker That’s heavily misleading, like complaining encryption is performed using a key partially known to the attacker because a nonce/IV is involved. The site name and username are there to der
403.
by minitech 7y ago
> And the fact that your passwords are deterministic means that somebody who has one of your passwords can learn the master from it and pwn you everywhere. Don’t use a trivial master password then… if you only need to remember one passwo
404.
by minitech 7y ago
My first assumption on seeing Date.now() throw would be that it’s implementing an older standard. new Date().getTime() would be the ES3 equivalent.
405.
by minitech 7y ago
> Mozilla never actually caring about user features: https://bugzilla.mozilla.org/show_bug.cgi?id=1520119 (a link to a fixed bug)
406.
by minitech 7y ago
> doesn't that mean that one can also willingly make a SHA1 hash that matches with the prefix of an existing SHA256 hash? No, the “prefix of an existing SHA256 hash” stops being relevant at that point – that’s just a full preimage a
407.
by minitech 7y ago
Brushing is mainly supposed to mechanically take the bacteria off of your teeth, like washing your hands, not kill them chemically. The fluoride exists to help keep enamel intact.
408.
by minitech 7y ago
Same-origin policy prevents that specific attack, although the same idea exists if you’re not protected from DNS rebinding on localhost, and `--bind 127.0.0.1` (or some other way to block the port) is necessary – but the Pythons’ built-in H
409.
by minitech 7y ago
As a fan of Python, I agree that it’s a problem, and probably one of Python’s worst design decisions. It doesn’t achieve anything over sentinels, and results in lots of potential for hidden bugs (especially in the case of __getattr__, and b
410.
by minitech 7y ago
SameSite=None isn’t progressive enhancement.
411.
by minitech 7y ago
Triaging issues, sure. Progressive enhancement? If you’re parsing User-Agent to implement that, you’re doing it wrong. (Feature detection is the correct approach, when necessary.)
412.
by minitech 7y ago
I’m not really familiar with ptrace, but does this if regs.Orig_rax == 0 { mean it only intercepts the read syscall? Seems like any security someone was hoping to provide with this could be bypassed entirely by accident (e.g. a scrip
413.
by minitech 7y ago
Sure it does, that’s just how locals work (in bash and similar). Try printing it after `main` with and then without `local`.
414.
by minitech 7y ago
> turning it into another bug bounty eye-roller like ClickJacking When did clickjacking get mitigated by default by browsers? As far as I know it’s still up to websites to prevent framing explicitly.
415.
by minitech 7y ago
Given a correct function that converts a JSON-representable value to embed-safe JSON, you can use it on the JSON to get your JSON.parse performance: const inlineJSON = data => JSON.stringify(data) .replace(/\u2028&#x2F
416.
by minitech 7y ago
It was moved to April: https://pyfound.blogspot.com/2019/12/python-2-sunset.html https://www.python.org/psf/press-release/pr20191220/
417.
by minitech 7y ago
> * Properly serialize your JSON strings. That's what we use: https://gist.github.com/eliseumds/6192135660267e2c64180a8a9c... . That doesn’t look like “properly”. The double escaping is overcomplicated and no sa
418.
by minitech 7y ago
Some common reasons include transferring less (data/bandwidth limitations) and reducing attack surface (fonts have historically been involved in a surprising number of vulnerabilities).
419.
by minitech 7y ago
Run `npm ls` without `npm dedupe` and notice "deduped".
420.
by minitech 7y ago
> What's poorly designed about each dependency recursively installing its own dependencies even if some of them are shared? Something npm doesn’t do, so not a great example. Simple apps having dependencies with lots of files is also

More ›