zaphar

45 ms·

601.
by zaphar 4y ago
JWTs have been in the news a lot for trivial vulnerabilities and among security/cryptography professionals is widely regarded as a problematic standard. I would argue just as you seem to be that the surface area for ways to get them
602.
by zaphar 4y ago
generating a sufficiently random session id is not difficult. Using JWT doesn't substantially make this easier for you and operationally you are going to have to invest in significant key management infrastructure. If you don't ne
603.
by zaphar 4y ago
If you do this you get 0 value from using a JWT over a regular session id. It's simpler and likely less work to just not use a JWT in that case.
604.
by zaphar 4y ago
JWT is a token, often stored as a cookie. This is both true and also misses the point. Session Cookies are ususally stateful. In other words, the server validates the session by querying a service or database. JWTs however are sta
605.
by zaphar 4y ago
Emphasize written communication. Voice and Video are important but it's too easy to prioritize a Video Conference over written communication. The two mediums are complementary not fungible. If you needed a meeting you probable also nee
606.
by zaphar 4y ago
You can't maintain the same culture after going full remote. If that is your goal you will fail. Instead figure out what the right culture is as a remote shop and work to build up and maintain that.
607.
by zaphar 4y ago
Latex followed by markdown, depending on the use case.
608.
by zaphar 4y ago
Ours was literally bought with tax return money. We could never have afforded it otherwise.
609.
by zaphar 4y ago
My first computer was a Tandy 1000HX. Without it I would probably never have gotten into the career I have now. Nothing but fond memories of that thing.
610.
by zaphar 4y ago
This is sort of my point. Cloudflare is essentially invisible to the users unless they exhibit markers putting them in a suspicious category. Which is fine with me as a provider. Meanwhile the switching cost for me as a site provider is eff
611.
by zaphar 4y ago
I don't follow this at all. The open interconnection of the internet still works no matter what Cloudflare does. My users can still get to my site. When they no longer can because of Cloudflare I can easily drop them and/or switch
612.
by zaphar 4y ago
Tragedy of the commons applies to a community shared resource not a service like Cloudflare. Effective monopoly makes a little more sense but I guess I sort of object since there is literally nothing other than money preventing someone from
613.
by zaphar 4y ago
I actually have really enjoyed SiLE[0] as a replacement. The only caveat being that it has no where near the ecosystem that LaTeX has built up over the years. I do think that it is better under the hood than LaTeX though and much easier to
614.
by zaphar 4y ago
I find it problematic that we would consider it bad for a company or group to be highly effective. I for one would not want to create disincentives for a company to be effective at their value prop. It's not Cloudflare's fault tha
615.
by zaphar 4y ago
From here on out I will only be taking full remote jobs. For me the upsides far outweigh the downsides. * Not having to commute is huge for me. I get so much more time back that way. * Time flexibility is super important. * Focus time is
616.
by zaphar 4y ago
Why? it doesn't materially impact the articles point.
617.
by zaphar 4y ago
This is important. He is arguing specifically that when made explicit and opted into by the coder that UB can be useful. The issues that C and C++ have are that it's too easy for the developer to get opted in to UB by the compiler with
618.
by zaphar 4y ago
When Chrome came out it was unambiguously: * A safer browser. * A more performant browser. Which was more than enough for most of us to recommend everyone switch. Much the same was as when Firefox first came out it was unambiguously: * A sa
619.
by zaphar 4y ago
I should mention that this isn't the fault of dependency injection itself. It's the natural result of doing that dependency injection at runtime using reflection. A better way is to use code generation so that you can actually see
620.
by zaphar 4y ago
My complaint about spring is the same complaint I have about almost every runtime dependency injection framework. In the happy path everything just works. But when you get off that happy path which happens all the time in production for any
621.
by zaphar 4y ago
I'm excited about value types. I'm less than enthused by the spring ecosystem. It does help you start quicker than you would without it but while running it in production over time I think it has costs I'd rather not pay so I
622.
by zaphar 4y ago
I've seen it but: 1. I find the syntax pretty offputting. 2. Make is found everywhere so a drop in replacement is a useful feature.
623.
by zaphar 4y ago
We use all kinds of tools that require a database that is effectively hidden from us. (e.g. git). I don't think this is a significant blocker or problem.
624.
by zaphar 4y ago
yes
625.
by zaphar 4y ago
This is clever but truly content based change detection in make would seriously fix a bunch of issues. I'm sort of surprised it hasn't been done already.
626.
by zaphar 4y ago
You are speaking in extreme hypotheticals. I am unaware of any set of features that require a blockchain to satisfy them. Is there an as of yet unknown set of features that require a blockchain? I don't know but I'm unaware of any
627.
by zaphar 4y ago
Your second function does more work and covers more cases certainly but could also be written less confusingly to indicate the intent. If I encountered your second function in a code review I would at a minimum be asking you to add comments
628.
by zaphar 4y ago
By this reasoning the vast majority of lawyers drafting contracts are not acting in good faith because the vast majority of lawyers are drafting obtuse unreadable contracts. Which is perhaps the case but the current reality is that encounte
629.
by zaphar 4y ago
Except that I don't agree those features are only available on a Blockchain.
630.
by zaphar 4y ago
Blockchains are not the only way of achieving what you describe. It's just one mechanism. You seem to be conflating the "result" achieved with the "mechanism". If a game company wanted to provide the same properties

More ›