maxwellg

My take on client-side hashing schemes is that they help with raising the floor -

  - they ensure that the backend application never sees your password in plaintext , and prevent the worst case scenario of a plaintext data dump
  - password hashing is CPU intensive by design, and pushing that work to the client means you can have them do the work and increase # of iterations far more aggressively 

but fundamentally still leaves users vulnerable compared to other approaches. For example, client-side hashed passwords can still be phished, and are not domain-bound like Passkeys are.

On the authentication front - JWTs would be a great fit here!

The developer's backend could issue a JWT, which is validated by the remoteStorage backend. Then, use the `sub` field as the user ID. JWTs are pretty ubiquitous in frontend applications, so many people would be able to reuse their existing auth setup.

IME Wildcard redirect URLs have become more common in recent years due to the rise of preview environments. If you're deploying a git branch to Vercel, and you now want to log in to <project-name>-git-<branch-name>-<scope-slug>.vercel.app, then you don't want to bother with configuring a different redirect URL for every branch name. Enter the wildcard.

Ideally wildcards are only used in dev/staging environments, but if the system allows for misconfiguration, the system will be misconfigured.

A good chunk of the AWS SDKs are codegen’d - it’s the only possible way to support the sheer volume of stuff they need.

It’s an old trick for pleasant-ish multi-line strings from before node/JavaScript had `backticks`. You can stringify the function and parse the string out of the embedded comment.

Ah, good to know. I immediately turned off the monkeypatching and didn't spend too much time playing around with it.

1Password's Passkey support feels very aggressively growth-hacky to me. They intercept calls to `window.credentials` and if you want to use 1Password along side other verifiers like Yubikey, you need to go into your settings and disable their passkeys offering entirely. It's similar to how they also intercept (and globally disable!) Google One Tap prompts in order to show their own OAuth prompt. I only use their Chrome extension so I'm not sure if the native app experience is significantly different.

Nice launch!

The SQL snippet shared [1] gives me the heebie jeebies. If any one of those where clauses contains user-generated data, that's ripe for a SQL injection vulnerability. `fmt.Sprintf` and SQL almost never belong together.

1 - https://blog.railway.app/_next/image?url=https%3A%2F%2Fres.c...

Column based database and Ancient Greek columns?

The React Native docs have a good writeup on how PKCE reduces vulnerabilities with deep linking & session hijacking - https://reactnative.dev/docs/security#authentication-and-dee...

PKCE also gives you nice assurances that the device finishing the flow is the same as the device that started it. Without PKCE, the classic client credentials flow risks login CSRF - https://support.detectify.com/support/solutions/articles/480... - which may or may not be an attack vector you care about.

Origin-bound codes & Web OTP codes [1] are interesting initiatives, but platform adoption has been poor. For example, it still isn't possible to use Web OTP in Chrome on MacOS from a Chrome Web app on iOS. The communication isn't there yet.

And for what it's worth - origin bound OTP codes aren't _strongly_ bound - there isn't anything physically stopping someone from typing that short 6 digit code into a phishing site. Compare with a Magic Link token - you're much less likely to take `https://example.com?token=some-long-uuid` and manually enter that code somewhere else.

[1]: https://wicg.github.io/web-otp/

There's a babel plugin for adding an Angular-style "display-if" to JSX - https://www.npmjs.com/package/babel-plugin-jsx-display-if

I've only seen it used in projects once or twice but it really does wonders for readability once the team becomes OK with the new-ish syntax

Check out https://stytch.com - we’re hybrid, but the SF and NYC offices have people in just about every day. I usually go in twice a week and it’s been great for in-person collaboration.

https://jobs.ashbyhq.com/stytch

AWS isn't a bullet to bite

Comment discovery is also horribly broken. So often, conversations _about_ a document contain information that don't necessarily _belong in_ the document, but still have value for future readers. Resolving comments makes it much harder to find them.

I'm moving out of my place at the end of July. Gonna do some short-term sublets for a few months, then move in with some friends coming up from South Bay. We've been checking Craigslist daily for weeks now and it's very exciting to see how prices have come down. We're at a point right now where we're holding out on getting a place since we expect prices to continue to drop.

At my school, generally you would enroll in ~3-5 classes per semester. One or two of those classes would be your "main focus" for the semester, and then you might try to fill a breadth or take something that interests you. You would have a week or two at the beginning before your schedule is fixed to move around classes. So you're not dropping out - you're swapping an Intro to Programming class for something you think you'd get more value out of. I've dropped classes ~45 minutes in to the first lecture because I just... didn't need to take it and wasn't enjoying the professor speak.

I took my intro to databases course on a $160 (sale) Acer C670 in 2015. Fantastic battery life, Crouton was a breeze to get working, and was my first introduction to doing work in a unix environment. The only problem was that the larger tests would take more than 2GB of ram, and start swapping out to disk - so suites that took my classmates 5 minutes to run took me closer to an hour. I got very careful at thinking over the code in my head before hitting run.

Wonderful little system for a broke CS student, and nothing but fond memories.

I suppose if my office gave out free cigarettes and the whole team grabbed one after lunch, I would have had a harder time quitting too. Caffeine is so ingrained into my work life that it's impossible to escape from.

Purely anecdotal, but for me it was the other way around. Last January, for my New Years Resolution, I kicked my pack-a-day-equivalent e-cigarette addiction. Three to four days of feeling anxious, some weird eating habits, a few headaches, but I still felt fairly productive. In February, I tried to quit coffee. Nonstop headaches for the week, complete inability to keep to a sleep cycle, and the worst irritability I've ever had. (I was at ~3 cups/day prior to quitting) Everyone is different - and some people do have quite terrible caffeine addictions.

I was thinking less around prefix matching and more around requesting enough data to where an observer couldn't tell what I was really interested in. If I requested 100 distinct locations in every state - 5000 total - you would know I was interested in the United States, but you would have a hard time determining where specifically.

If you request weather info for a large range of locations at once - the k-Anonymity that HAVE I BEEN PWNED uses - you could prevent this at the cost of increasing response size dramatically

https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

My 200 sq ft. microstudio has been absolute torture these last few weeks. I thought I was being smart and saving money - I'd pay much more now to be sheltered anywhere else. A house with a yard would be amazing.

The 166k benchmark is ridiculously snappy. Could you shave off a few more ms by inlining the JSON as a data block?

Non-production environments are useful for more than testing application code. Changing underlying infrastructure (Upgrading a database, networking shenanigans, messing around with ELB or Nginx settings) requires testing too. Having the same traffic / data shape in pre-prod is not as important.

Calling this a "glitch" is disingenuous. It (is/was) an open secret for my entire undergrad. There were plenty of professors who would encourage students on 8-hour appointments to work 20~30 hours/wk with no overtime pay. Professors control access to valuable research positions and grad school applications so if you wanted to have a career in academia there wasn't anything you could do about it.

> Thankfully some companies will give you a hiring bonus equal to your unvested RSUs though

I've never head of this before. Seems like 2-3 years of RSUs could easily be over $1 million for someone later in their career. A $1 million signing bonus would be insane.

Trader Joe's has a vanilla hemp protein powder I like (milk-based ones mess with my stomach). I couldn't imagine eating the seeds directly, but they go down very easy in a smoothie.

I'm not familiar with any fermentation process that operates on nuts, or any high-fat food source besides soybeans.

I've always ended up with on-sites on the shiny, clean, well-stocked sales floors. When I ask to see where the engineers sit, it's usually a pretty abrupt downgrade.

Is there any reason it isn't called mapFlat? FlatMap indicates to me that there's a flattening, then a mapping, not the other way around.