treve

32 ms·

421.
by treve 5y ago
They mention in the video that they could ask a person to make the changes with Photoshop, but the reason they give is: "Then it would be that artist's work, not Rembrandt". That statement rubs me the wrong way a bit though,
422.
by treve 5y ago
I'm trying to figure out what your point is. Is it a criticism of the article? Are you sharing with us that you are clever? I'm trying to give it a generous interpretation, but I'm having a hard time. So it's not complic
423.
by treve 5y ago
Would love to compare this to a HTTP/2 version!
424.
by treve 5y ago
We also don't know if the shortened urls are random.
425.
by treve 5y ago
It's pretty weird hearing anyone talk about CGI parameters these days, so perhaps that should also tell you something?
426.
by treve 5y ago
The same way you would build any login system for a browser application.
427.
by treve 5y ago
Or even better: allow me to paste the url in a browser and get a meaningful result.
428.
by treve 5y ago
In the Netherlands apparently this is a thing since the 60's: https://nl.wikipedia.org/wiki/Cultureel_Jongeren_Paspoort
429.
by treve 5y ago
I'm a novice at security, but shouldn't the correct fix be to force the user to revoke the keys?
430.
by treve 5y ago
I just watched this video yesterday, and wow so surprised that they all tile! Not a math person at all (aside from a casual interest), but there was something about this that just made me intuit that it wouldn't always work. I also lov
431.
by treve 5y ago
> I did... I made a decision tree. It's really that easy I think we are past an intellectually honest discussion. Disappointing. Good luck with everything.
432.
by treve 5y ago
I've provided data in my article of many instances where people got JWT wrong, including an example from Auth0. I wouldn't call myself a security researcher, but many who are have also said this. Your comment that it's '
433.
by treve 5y ago
If the simple thing is sufficient, don't do the complex thing. You say that JWT is the right answer for most scenarios, I think that's not true. Aside from revoking, there's risk in complexity and I did my best in providing e
434.
by treve 5y ago
This implies you would also need to know if the user ID exists before you use it, which means a look up. (because it might be 'regenerated' and no longer valid). If you take that one step further and just introduce disposable user
435.
by treve 5y ago
Yeah, I got this comment elsewhere too. I decided to not edit, because I think current standards at least strongly discourage session id's in urls, and this functionality is basically obsolete. Sessions requiring cookies felt like a re
436.
by treve 5y ago
The first one is hyperlinked, unless you count the title.
437.
JWT should not be your default for sessions(evertpot.com)
3 points by treve 5y ago|0 comments
438.
by treve 5y ago
This is a good thing. Businesses that rely on paying people salaries that keep them under the poverty line have no right to exist. Your business is exploitative and doesn't deserve to survive.
439.
by treve 6y ago
For a potential security breach at this level, if access was possible, and no records exists if it happened, you operate under the assumption there was a breach.
440.
Which type of novelty-seeking web developer are you?(baldurbjarnason.com)
1 points by treve 6y ago|0 comments
441.
by treve 6y ago
> And the example is, instead of a chron job just running a process once a month or on some other schedule, it runs more frequently but checks if the change has already been made. As a property, I think it's even nicer if a script c
442.
by treve 6y ago
Another open source alternative: https://github.com/minimalchat/client
443.
by treve 6y ago
Honestly, it hasn't been. Probably helps that I run Linux, but would probably do the same on Mac. Managing that extra virtualization layer has always been more pain than just relying on services that are just always there.
444.
by treve 6y ago
In my case, I run all services locally without docker. apt-get seems to work just fine.
445.
by treve 6y ago
You mean things like Linux, LibreOffice, Any browser? The things that they are copying are themselves also copies of earlier products. Airtable can be traced back to MS Access, DBase and I'm sure there's even older examples.
446.
by treve 6y ago
Owning your domain has the same advantage for element than it would for, for example email. If your company has their own domain for email, but hosts at Gmail, Google can one day decide to kick you off their platform. But, because you have
447.
by treve 6y ago
Yes, but Chrome is still google. If the left hand suggests using this Google product means privacy and trust, but the right hand still exploits you, I do think there's an issue. They can twist the words to be technically accurate, but
448.
by treve 6y ago
We are heavy into REST and HATEOAS. This, coupled with React SPAs has worked really well for us. The HATEOAS client we use/build has an cache/event system that will emit to subscribers (via react hooks) when a resource is stale, a
449.
by treve 6y ago
The issue with this thread is that it seems like an argument, but different people just have different sensibilities. Get the machine that suits _you_. Unless you want to run Apple OS because then you're not given choice.
450.
by treve 6y ago
The page addresses that there are other alternatives/supersets. I think the most common one that has decent adoption is JSON5. I would like to see why the author chose to do yet another format, vs adopt JSON5.

More ›