Hedja

HTTPS ensures the data isn't tampered during transport, but it doesn't ensure the integrity of the data itself. That's why there's things like Subresource Integrity (which doesn't apply to top-level resources like HTML).

However, there's no way to ensure the files we download are created by who they say they are. A domain for example can change hands and existing links say on HN can be loaded with unexpected, potentially malicious, content. Same for hacked servers.

IMO we need some form standard page signing to enforce actual integrity of information, not just transport. I made a proof-of-concept Web Extension to show how that might be possible using PGP [1]. Of course PGP has its own issues but it's just an experiment.

[1] https://webverify.jahed.dev/

It's just a vectorised image of Yukimura from Samurai Warriors[1]. This image to be specific[2]. Don't think there was a designer, just a developer making a logo using a character they like (or maybe it was random image search). Pretty common in open source.

[1] https://koei.fandom.com/wiki/Yukimura_Sanada

[2] https://static.wikia.nocookie.net/dynastywarriors/images/9/9...

You can do this with GitHub Projects (the Trello-like interface). For my personal projects, I use GitHub Issues as a dumping ground for ideas, which automatically go into a "Triage" (inbox) column, which I go through and assign labels and priorities every week or month depending on the project.

The downside with GitHub projects is that you can't automate based on labels so the issues need to be organised into columns manually if you have more than the simple one board with To-Do/In-Progress/Done columns setup. Though search and filters slightly helps with that.

> lodash should just be incorporated into vanilla javascript, as part of its standard library

That's already happening. More and more of lodash/underscore/etc's functions are being introduced to Array/Object/String APIs.

https://github.com/you-dont-need/You-Dont-Need-Lodash-Unders...

In most browsers, you can go into settings and default it to block without asking.

This is what happens all across the web, regardless of software. Raiding. IRC raids, forum raids, etc. Sometimes it's for fun, sometimes it's more malicious. Most software has ways to mitigate it. Temporarily closing new registrations, invite only registrations, throttling, IP bans, etc. Just like DDoS attacks, there is no true solution to this since that's how the public web and internet works.

I have a single major problem with all of their new layouts. They place content at extreme ends of the screen, completely stretched out like a rubber band with No Man's Land in the middle. In this case, the top half is stretched and the bottom half is centred. Completely inconsistent and tiring for your eyes darting around corners of the screen.

Example: https://twitter.com/JahedDEV/status/1275532988772683776

I don't know why they think it's good design, it would be nice to know. All of their previews for it squash the window so it looks perfect, like their mockups I assume. Similarly, I have to have a dedicated, half-width window just for GitHub to workaround this.

Since people are showing interest in GitHub Sponsors, I just wanted to mention: The types of services listed in the article likely falls under VAT in specific regions which can be a pain to calculate. That's one of the reasons I'm sticking with Patreon; they handle tax and chargebacks so the fee isn't a big deal. GitHub Sponsors explicitly says the tax is all on you. They don't mention chargebacks in their docs so it's hard to say, if they're processing the payment on their end, I'd guess they handle it.

https://help.github.com/en/github/supporting-the-open-source...

The strange thing for me is, when I switched to custom first-party analytics, I stopped getting referrer spam altogether. I assume then that spammers explicitly optimise for GA tracking and ignore everything else. Which makes sense since a lot of them are targeting audiences that care about SEO and GA has a uniform tracking URL that they can flood without the cost of rendering webpages. The reason GA can't filter them out is because they're constantly working around each other.

My blog does this. Not because I want to hide it. Since RSS is a standard, I expect anyone wanting to add my blog to their RSS would just use the current URL and the reader will grab the alt meta tag. I have multiple feeds, one for each tag, so if a reader uses a blog post URL they'll be given a choice on what tag to subscribe to (or everything). Having separate RSS links on the page for this would add clutter.

Before, Firefox used to show the RSS icon but they killed it. It really should be a browser-level thing, it's no different from favicons, rather than requiring users to hunt down a link somewhere on the page.

You can. Projects in VSCode are called "Workspaces".

Every time I install an extension, I first "Disable" it, which is global. Then I switch to the workspace that needs it and choose "Enable (Workspace)". That way you only have the extensions you need per project.

This article has 50MB of GIFs to download. Be careful if you're metered.

Do you have a scenario where it doesn't work? I use it all the time on Firefox for Android, works every time.

You can still use the desktop site by using the 'Request Desktop Site' on your phone's browser (at least on most browsers). If you're logged in to GitHub, you can enable 'Opt out of mobile pages' in your account settings, though it sounds like you want to use both.

Their blog is hosted on Wordpress.com which seems to be using Let's Encrypt to generate one certificate for multiple different, unrelated custom domain names.

Maybe you encountered a bug where it served the wrong cert for a different batch of custom domains.

To assume certain conditions that are not explicitly laid out without even talking to the person providing you the service is literally entitlement. It seems like you've made assumptions that turned out wrong. I've fallen for it too in the past. Not everyone thinks the same thing so people's assumptions are always different. The key thing is, when your assumptions don't turn out true, to learn from it.

In the case of open source, it's worth asking the maintainer what the terms are if you're unsure. The LICENSE always says that authors and contributors are not liable for any outcome, either as an ALL CAPS paragraph or a clearly defined section.

Everything is provided as-is so you can't expect anything. It's on you to pick up after them if you still need the project.

That's pretty much the case for any remote content. Proxy and rewrite the response. But that added step is usually enough, especially for something as complicated as a Browser MMO.

Also, web servers should have rate limits set which would make proxying less viable, even for IP ranges.

You can avoid loading your site in an iframe using headers.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

You are still supporting Discord by using it and Discord still needs non-paying members. Without those members, Discord won't be as popular and the paying members wouldn't stick around.

By all means, you are still providing value to the service and they need you as much as their paying customers. However, a lot of companies lose sight of this logic once they go big.

It's worth mentioning that indiehackers.com is a JavaScript-only website and doesn't work with JS turned off. Google's spider can execute JS, while others do not. This is why indiehackers.com doesn't show up, not because of the search engines themselves.

I have a similar issue with a side project of mine. JS-only websites solve this with server-side rendering or static generation.

What do you base that on? Lego has plenty of small individual sets that get played with by kids, broken apart, bits go missing and eventually they get binned.

That's an interesting contradiction to the rest of their docs. Their docs in other place repeatedly state using periods "." will cause issues. https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestri...

e.g.

> The name of the bucket used for Amazon S3 Transfer Acceleration must be DNS-compliant and must not contain periods (".").

and as you mentioned

> When you use virtual hosted–style buckets with Secure Sockets Layer (SSL), the SSL wildcard certificate only matches buckets that don't contain periods. To work around this, use HTTP or write your own certificate verification logic. We recommend that you do not use periods (".") in bucket names when using virtual hosted–style buckets.

AWS Docs have always been a mess of inconsistencies so this isn't a big surprise. I dealt with similar naming issues when setting up third-party CDNs since ideally Edges would cache using a HTTPS connection to Origin. IIRC the fix was to use path-style, but now with the deprecation it'd need a full migration.

Wonder how CloudFront works around it. Maybe it special cases it and uses the S3 protocol instead of HTTP/S.

Every time I see articles about time management with side projects, it reminds me of this Onion article:

"Find The Thing You're Most Passionate About, Then Do It On Nights And Weekends For The Rest Of Your Life"

https://www.theonion.com/find-the-thing-youre-most-passionat...

It makes me think "AppVeyor". https://en.wikipedia.org/wiki/AppVeyor

Looks like it's a placeholder. https://github.com/intika/Librefox/issues/20

No need to scrape it, they have an RSS feed. https://status.github.com/messages.rss

Author here.

Yes, my conclusion's a bit blunt. I guess the broader takeaway is to not generate log lines in your business logic but instead to use a common API for events so that changing outputs (e.g. to syslog or some other standard) is straight forward, as shown in the example code with the concept of "reporters".

You can also pipe the output from JSON to syslog if format is the main concern and not performance. Like pino-syslog[1] shows.

[1] https://github.com/pinojs/pino-syslog

I have similar issues, but only on low FOVs, framerates and motion blur. A lot of console games have a ridiculously low FOV that fails to match reality when you turn the camera; causing nausea. But on PC playing on 90+ at 60FPS+ with no motion blur is fine. For me the sweet spot is around 110 FOV.

Net neutrality is still a problem outside the USA. For example, a lot of network providers provide "Unlimited Streaming" where they pick popular music and video streaming providers and allow you to use them without using up your data allowance.

Example: http://www.three.co.uk/go-binge

I would argue that Beaker is providing a better UX for the web while solving the centralised nature of it. Its API allows websites to provide interfaces for creating and modifying websites tailored for specific audiences, owned by the user.

So you can have your own RSS subscriptions in a Dat, a feed reader in another Dat, click a button on a website to subscribe to it and add it to your Dat. The Feed reader can keep track of what you've read and store it in its own Dat or a different Dat (if you want client/data separation). Your mobile phone can sync to your Dat(s) so you have Desktop/Mobile sync all in a single place.

I've not tried this, but I don't see why it wouldn't work.

I think most websites can be generated statically. But yes, it does mean a lot of the existing patterns used on the current web needs to be redesigned for it. Again, this is all very new so there's a lot that needs to be worked out.

I can give an example of non-static data (though what is static vs dynamic can be a grey area):

SPAs work great with Beaker/Dat since users can download the app and use it offline. The data can be any Dat archive. So for a social network, each user can have their own Dat archives of images and posts. The root site can hold an index of each user and download individual files from their Dat and display them using client-side routing. In this scenario, each user has their own database as a Dat which is indexed by a parent Dat website.

Demo, a Twitter clone: https://github.com/beakerbrowser/fritter

Also, at the end of the day, they are still websites. So you can still use a central HTTP server to:

- Serve your data directly

- Provide an API to edit your Dat archive instead of distributing it into multiple user-owned archives.

It also means you don't need to migrate a website to a completely different paradigm in one big bang.