n2d4

20 ms·

271.
by n2d4 2y ago
Or someone "just" finding a fault in the cryptographic algorithms used in Bitcoin. Or whoever created the puzzles leaking their information.
272.
by n2d4 2y ago
For those curious, the reason why a public key lets you find a private key more efficiently is Pollard's rho algorithm: https://en.wikipedia.org/wiki/Pollard%27s_rho_algorithm_for_...
273.
by n2d4 2y ago
"X is a superset of some subset of Y" is a weak statement. This is not about semantics, it's about grammar. While it's fair to say that JSON "usually" is valid YAML, it's still good to be strict about it,
274.
by n2d4 2y ago
YAML 1.2.2 is also not a JSON superset, as keys are required to be unique: > The content of a mapping node is an unordered set of key/value node pairs, with the restriction that each of the keys is unique https://yaml.org
275.
by n2d4 2y ago
YAML 1.2.2 still isn't a superset of JSON, because it requires all keys to be unique: > The content of a mapping node is an unordered set of key/value node pairs, with the restriction that each of the keys is unique
276.
by n2d4 2y ago
> The example 1e2 clearly matches this regex, so his YAML parser is broken. 1e2 does not match this regex. 1e+2 or 1e-2 would, though.
277.
by n2d4 2y ago
Venture debt. Though, unless you have no other options, I wouldn't do it; angel investors are better in almost every way, and they can't forcefully liquidate your company when they feel like you've been underperforming.
278.
by n2d4 2y ago
It's really not just a marketing gimmick — it's the sole reason why we are building Stack Auth, instead of going for one of the existing proprietary managed auth solutions. Trust me, we wouldn't spend time building this if we
279.
by n2d4 2y ago
Regular people may not but password managers do. Maybe not everyone, but at least security-conscious people would grow suspicious when their password manager doesn't autofill credentials on a page, and wouldn't immediately jump to
280.
by n2d4 2y ago
Stack Auth is trying to solve exactly this — open-source, developer-friendly, and reasonably priced managed auth. That way, you don't have to worry about OAuth but still aren't locked into a specific vendor. The downside is that w
281.
by n2d4 2y ago
We gotta start somewhere, and Next.js is popular right now — we're working on some cool non-Next stuff though (eg. auth proxies that can provide user info to any server, which we can hopefully launch within the next weeks). Regardless,
282.
by n2d4 2y ago
Thanks for the catch, fixed it now!
283.
OAuth from First Principles(stack-auth.com)
490 points by n2d4 2y ago|104 comments
284.
by n2d4 2y ago
Not true — also, why would YC alums be less likely to upvote a post about Pavel Durov getting arrested?
285.
by n2d4 2y ago
Flame war detector. If a thread has too many comments (compared with upvotes), it gets downranked
286.
by n2d4 2y ago
Sounds great! Yep, I think Stack would be a good fit. We don't proxy APIs, instead we just give you the access token and refresh it automatically so you can pass it alongside your requests to the original endpoints. If you want to prox
287.
by n2d4 2y ago
Quoting from another comment chain: > Supertokens, Ory: Developer-friendliness and integrations, mostly (both of these target enterprise customers). Also, Supertokens is open-core. I'd say we're to Supertokens/Ory what Cle
288.
by n2d4 2y ago
Some people much smarter than me have written excellent articles about this topic: https://www.michalspacek.com/upgrading-existing-password-has...
289.
by n2d4 2y ago
You're right. Thanks, fixed!
290.
by n2d4 2y ago
Not right now, but we're working on a native Postgres extension as part of our Supabase integration — which would let you do that.
291.
by n2d4 2y ago
Understood. Thanks for clarifying :)
292.
by n2d4 2y ago
Sorry about that! Can you send me an email with your package.json to konsti(at)stack-auth.com? Would love to try reproducing this.
293.
by n2d4 2y ago
Check for cookies. If they exist, we can continue like normal. If not, require user interaction (none of the spam filters we tested click buttons, but from what I could gather, one of them — Outlook — moves the mouse).
294.
by n2d4 2y ago
To quote myself from another comment chain: > Both Zai and I care a lot about FOSS — we also believe that open-source business models work, and that most proprietary devtools will slowly but surely be replaced by open-source alternatives
295.
by n2d4 2y ago
We added a security policy: https://github.com/stack-auth/stack/blob/dev/.github/SECURIT... If it helps you, we delegate the most vulnerable parts of the application, such as OAuth, to lower-level f
296.
by n2d4 2y ago
First, incorporating Stack into your project is really easy if you use Next.js — literally just a single command: npx @stackframe/init-stack@latest If you use our managed hosting, we'll deal with deployment, backup, ... f
297.
by n2d4 2y ago
This is actually exactly what I've been working on right now — currently doing E2E tests. Should be done by this weekend! (And available on any plan.)
298.
by n2d4 2y ago
You must encrypt and salt passwords and retrieve them without being susceptible to timing attacks. PKCE. 2FA/TOTP as well.
299.
by n2d4 2y ago
Keycloak is a pain to set up, and its configuration tends to get quite messy — besides, we try to cover integrations into the entire stack (frontend to the database). I keep repeating this comparison throughout this thread, but Stack is to
300.
by n2d4 2y ago
Logto's focus is on enterprises, while ours is on the developer experience for startups and side projects. I've used this line in a few comments on this thread already but I'd say that Stack is to Logto what Clerk is to Auth0

More ›