tshadwell

13 ms·

1. 61.▲
   by tshadwell 12y ago

   "low level" CSS? It's a sad day when a collection of CSS classes is referred to as "low level". Lower level than bootstrap, I assume?
2. 62.▲
   by tshadwell 12y ago

   byzanz was created for this purpose.
3. 63.▲
   by tshadwell 12y ago

   Honestly, there should have been a loop there. The author introduced un-necessary complexity and a bug appeared. Not that Javascript is a great language.
4. 64.▲
   by tshadwell 12y ago

   A nice product, but it should be noted that every additional authorization method you add to your product is a very high value and often mis-implemented weak point!
5. 65.▲
   by tshadwell 12y ago

   Isn't this a misleading title? The article is essentially the author forgetting to set GOMAXPROCS, not really a lack of parallelism in Go.
6. 66.▲
   by tshadwell 12y ago

   It's very nice, but the Javascript is 475KB mainly because it's written in poorly compiled Go; something like this could be written in 100x less vanilla Javascript. What implementation of compile-to-javascript Go is this? They sho
7. 67.▲
   by tshadwell 12y ago

   You can do this /without/ a link tag in Firefox by using a link header. Syntax is: Link:<[filename]>;rel=stylesheet It's fun to use: Link:<.>;rel=stylesheet and detect the Accept: text/css header to serve a c
8. 68.▲
   by tshadwell 12y ago

   I was looking into who this was funded by, and Synthace who are listed in the footer have this page: http://www.synthace.com/investors/ Amusingly, the link for their main sponsor's website goes to: "file:&#x2
9. 69.▲
   by tshadwell 12y ago

   Pivotal paragraph: "We have found out that an Attacker can obtain the CSRF Auth which can be valid for ALL users, by intercepting the POST request from a page that provide an Auth Token before the Logging-in process, check this page f
10. 70.▲
    by tshadwell 12y ago

    I was amazed when I was watching BBC News and this came on. I remember Google dorking webcams when I was 12 and the BBC were playing it up like some prodigal hacker had tapped into the matrix to produce these webcams or something.
11. 71.▲
    by tshadwell 12y ago

    This would be great if the primary demographic for Minecraft didn't become almost entirely children.
12. 72.▲
    by tshadwell 12y ago

    It mystifies me especially that the logout URL for the login call is chained a number of times. logoutUrl: ' https://foobar.withgoogle.com/_ah/logout?continue=https://ww...
13. 73.▲
    by tshadwell 12y ago

    I noticed the logo loads slowly and it actually loads a huge x1024 image https://mdn.mozillademos.org/files/9069/firefox-dev-ed_logo-...
14. 74.▲
    by tshadwell 12y ago

    The important point to me is "some web services", which translates to 'some web servers', but which? Through a cursory browse I can't find one. Correction: this seems to rely almost entirely on the content-type snif
15. 75.▲
    by tshadwell 12y ago

    "bees have tiny brains and are very smart". Smart in what sense, exactly?
16. 76.▲
    by tshadwell 12y ago

    Though the alert may look nice, the actual JS behind it is hugely wanting for several reasons: - 690 LOC to produce an alert dialog - Heavy use of Javascript for what CSS is designed for: https://github.com/t4t5/sweeta
17. 77.▲
    by tshadwell 12y ago

    Usually I work to prevent problems rather than create them but hey I could be the antagonist in someone's novel. I doubt that's not the only exploit in the library either. I could go through it with a finer toothed comb if you wan
18. 78.▲
    by tshadwell 12y ago

    I edited my original post to include a working XSS exploit.
19. 79.▲
    by tshadwell 12y ago

    I realise that, but unless every piece of information in the JSON is dealt with caution (which I doubt from experience) it could be possible to put together an attack. Well, I should probably verify that myself.
20. 80.▲
    by tshadwell 12y ago

    I've not looked in detail, but I'm not so sure about the security of generating windows via URL parameters. I feel like there's an XSS in that for sure. Edit: there is https://golden-layout.com/?gl-window=%7B%
21. 81.▲
    by tshadwell 12y ago

    if you're that determined to shoot yourself in the foot you might as well rebind valueOf
22. 82.▲
    by tshadwell 12y ago

    As far as I am aware, the standard implementation of a URL shortening algorithm is to convert the number to a higher base, not to generate a random string. This has the advantages of greater loading speed, and smaller storage size. Here is
23. 83.▲
    by tshadwell 12y ago

    By the way, `typeof X === 'undefined'` doesn't need to be used for variable names that exist such as arguments, you can use X == undefined without opportunity for failure.
24. 84.▲
    by tshadwell 12y ago

    Ah, yes that's great!
25. 85.▲
    by tshadwell 12y ago

    As usual, the event listeners shown are just jQuery making the binding. It would be really great if it actually stepped back through the stack to see what initially called jQuery's bind. I can't think of any general solution to th
26. 86.▲
    by tshadwell 12y ago

    https://en.wikipedia.org/wiki/Plant_intelligence#Plant_intel... There is a Wikipedia article on this which may provide some wider information.
27. 87.▲
    by tshadwell 12y ago

    I've been using a pattern like this for my more complex initialisations: s, i := make([]T, 0, 6), 0 s = append(s, 1, 2, 3) //[1 2 3] fmt.Println(s[i:]) i += 3 s = append(s, 4, 5, 6) //[4 5 6] fmt.Println(s[i:]) i +=
28. 88.▲
    by tshadwell 12y ago

    https://en.wikipedia.org/wiki/Culture-bound_syndrome Many of these are also just as interesting
29. 89.▲
    by tshadwell 12y ago

    And when you colour in the picture always use a pen of 100% opacity or the colour can be removed from the image to reveal the data underneath!
30. 90.▲
    by tshadwell 12y ago

    Perhaps another reason to use a fixed time string equality function