unscaled

28 ms·

241.
by unscaled 2y ago
I'm happy that it works for you, but you've just been lucky. Statistically speaking, JWT attacks are far more common in the wild than attacks against stateful tokens or other token formats (such as PASETO). The author of this essa
242.
by unscaled 2y ago
> Sharing the session across multiple services is its own distributed systems problem with numerous security implications to be aware of and bearer tokens might be a good alternative. JWT makes it possible to distribute the same access t
243.
by unscaled 2y ago
Here's the thing: neither Google, nor Facebook is using JWT for their access or refresh tokens. The only place they use JWT, as far as I know, is for the ID Token in their Open ID Connect Flow, since this is a mandatory (and terribly m
244.
by unscaled 2y ago
PCI compliance is never a non-issue. Even if you're using a third party provider that handles both credit card entry and processing, you need to comply with some subset of the PCI/DSS requirements. In the case of terminal.shop i
245.
by unscaled 3y ago
These would be 290 yen ($1.90) 790 yen ($5.20) in Japan respectively. I still don't think an RFID will eat that much into their profit margin, but Uniqlo is in the unique position of having stricter control over their supply chain. All
246.
by unscaled 3y ago
Uniqlo checkout experience is really how self-checkout should be look like, but unfortunately relies on controlling the manufacturing of all products to implement efficiently. The closest thing I've seen in a convenience store, was a f
247.
by unscaled 3y ago
If my memory serves me right, when I last visited the US right before COVID (SF) I wanted to see an Amazon Go convenience store but it closed down at 16:00 or 17:00. That was quite unacceptable for a convenience store and it was then I got
248.
by unscaled 3y ago
I've also don't remember seeing them in Europe when flying as a child during the 1990s. Yes, there were shared CRTs every 10-15 rows or so, but the earphones were your run-of-the-mill electric earphones, usually with a two prong c
249.
by unscaled 3y ago
And before that FORTRAN, COBOL and Assembly.
250.
by unscaled 3y ago
Borland did keep supporting Pascal in addition to C++ then, no? They introduced Object Pascal with Turbo Pascal 5.5 IIRC, and later kept extending that with Delphi. As far as I know, their strategy was playing both Pascal and C++ up through
251.
by unscaled 3y ago
Very true, and Go (or bash for that matter) are proofs that language limitations do not mandate complexity. Complexity is mandated by perceived need and culture. You can easily see how complexity would play out in Go by looking at Kubernete
252.
by unscaled 3y ago
From looking at what the Go team had to say about Go in its earliest days, Go had very little to do with Java, and they weren't very concerned with fixing Java's issues. The "Bloated Abstractions" issue in Java is more o
253.
by unscaled 3y ago
The Go standard library is probably being too opinionated here, but it's in line with the general worse-is-better philosophy behind Go: simplicity of implementation is more important than correctness of interface. In this case, the int
254.
by unscaled 3y ago
NuGet was only released in 2010, so I wasn't really referring to it. I was referring to Maven (the build tool part, not the Maven/Ivy dependency management part, which was quite a breeze) the build system and MSBuild. Both of whic
255.
by unscaled 3y ago
> In 2009 most Google web servers (by unique codebase I mean, not replica count) were written in Java. A few of the oldest web servers were written in C++ like web search and Maps. C++ still dominated infrastructure servers like BigTable
256.
by unscaled 3y ago
Thank you! I really appreciate it, since it did take a while writing this ;)
257.
by unscaled 3y ago
I thin you wanted to say that headers are not case sensitive according to the HTTP spec, but some clients and servers do treat header names as case-sensitive in practice. What Go does here is kinda moot nowadays, since HTTP/2.0 and H
258.
by unscaled 3y ago
To be fair, Go pointers do not allow pointer arithmetic and unsafe casting. They are really not much different than Java's references. The main issue is null. And you can't even say Rob Pike is not deeply familiar with Tony Hoare,
259.
by unscaled 3y ago
It's not a lot of work, you can just let the IDE spew it off for you and feel like a certified J2EE programmer circa 2003 who lets the IDE write everything for them. But yeah, writing code is not the problem. Reading the code is. I
260.
by unscaled 3y ago
More precisely because "they" are Rob Pike, and Rob Pike doesn't seem to think error handling in Go is horrible. Other members of the Go Team (Robert Griesemer, Russ Cox) trialed out several solutions for this problem, but th
261.
by unscaled 3y ago
Back when Java had green threads (the late 1990s), there was no such thing as "multi-core machines". Some top-of-the-line servers had SMP (i.e. two or more physical processors running together on the same bus and sharing the sam
262.
by unscaled 3y ago
I'm not sure what you were meaning by "it". The main domain the original team behind Go were aiming at was clearly network software, especially servers. But there was no consensus whether kernel could be a goal one day. Rob P
263.
by unscaled 3y ago
It's not at "an accident" and Go didn't "somehow" fail to replace C++ at its systems programming domain. The reason why go failed to replace C and C++ is not a mystery to anyone: Mandatory GC and a rather heavy
264.
by unscaled 3y ago
> Testing third-party code is often well within the purview of first-party integration testing. Yes, integration tests do tend to cover integration with third party libraries and even entire products (such as databases). But even in inte
265.
by unscaled 3y ago
If you're worried about DDoS (and also timing attacks, if you've got a B-Tree index), you can just append an HMAC to your random session ID. I've even seen a few cases of Stateful JWTs, where the JWT contained a session ID an
266.
by unscaled 3y ago
I believe YAML has serious issues and I would not be using it as a configuration format. But I think a lot of the criticism around YAML misses the mark. YAML is not excessively overused as configuration language. It is not dominant like XML
267.
by unscaled 3y ago
Stripping indentation for embedded text is probably the nicest feature YAML has. In TOML you either just forget about indenting multi-line strings (which makes them less readable) or you have to remember to putting a backslash at the end of
268.
by unscaled 3y ago
I'm not criticizing having attributes-vs-child-elements. The problem with XML is not that it exists or that it is a particularly badly designed markup language. The problem is that XML is ill-suited for configuration files.
269.
by unscaled 3y ago
The problem is that XML doesn't even map that well even to objects and classes, even with annotation. And XSD is quite a heavyweight format with terrible UX. I'm pretty much consistently on the strict/type-safe side of the &q
270.
by unscaled 3y ago
> I then built a UI system that works with the XML and generates cofig docs with ease. I lost you there. Not that I'm criticizing you since I've gone the same route and built a complex UI tool to manage said config (complete wi

More ›