2,549 karma · joined June 8, 2016
You don't need a nonce at all in this case.
The purposes of nonces is to make non-idempotent requests into idempotent ones.
"Write 'lol' in sheet 1, row 5, column B" is already idempotent.
You absolutely can. The idempotency nonce must be generated by the client who is responsible for firing potential retries. And a random UUIDv4 is a perfectly fine nonce.
If the client _doesn't_ generate a nonce, it doesn't matter what the server side does, they cannot tell from the request data if it's supposed to be a retry or a new request with the same data. A hash such as a UUIDv5 is more performant but not logically any better than comparing the raw data of the two requests. If you use that UUIDv5 as your primary key for insert/update, it's little more than a natural key, with all its well-known drawbacks.
All that you gain by transmitting the hash, is that the attacker will need to modify the client's request to inject the stolen hash.
If the client (website or app) runs on the attacker's own devices, this is trivial. I suppose it is a valid obstacle if we are talking about an ATM or similar locked-down client.
Save a passkey in Bitwarden, then export your vault as JSON. You'll see a nice plain text JSON block with your passkey that you can print, or backup, or import into whatever replaces Bitwarden.
So if you get sent to goog1e.com, your password manager won't prompt you to enter your Google passwords. Though of course, you could still manually paste it in if you got somehow convinced that it's a legit site.
It is not Mullvad's political position. It is the political position of one of its co-founders, using his own money. The other co-founder openly disagrees with that position.
Personally, I feel _much_ better about relying on a company whose two co-CEOs have diametrically opposed political stance, than I would about a company with a singular one.
ZKPs allow you to be the relay between Chase and Pornhub, and you know exactly which data is shared between the two. Chase would obviously have no idea whether you used the certificate for Pornhub or anything else; and Pornhub will know that their request was validated by _a_ trusted ID provider, but not necessarily which particular one out of a group (issuer-hidden ZKPs).
Because a malicious human will gladly copy/paste LLM text and sign it with his "I, a human, definitely wrote this academic paper" key?
Ironically, the main friction point were not old-fashioned tools (which `from ssv` usually handled nicely) but the 'new generation' of core CLI tools like eza or fzf. They have really nice visualizations, but they do not output structured data as a middle step, so all the colours and lines only play havoc with nu's parsing.
Since I need to "ls" a lot more often than I need to do data manipulation, the tools won and I went back to zsh. Still keep nu around for the occasional config/data file wrangling though.
You can also "firewall" AA via something like TrackerControl, this would let you block connections to eg. Google Analytics servers without denying network access altogether (which would likely cause AA to stop working). I've only used AA with short-term rentals so I didn't spend too much time exploring these options.
Android 16+ offers a built-in integrated Linux VM that can be enabled from Developer Mode, and if this[0] third-party site is accurate, "Android on laptop" will have it enabled by default.
So it should not be too different from working on a Windows laptop with WSL2, or on an OSTree distro where you use distroboxes to work with non-sandboxed programs.
(fwiw, I would still refuse to have one of these for personal use because Google is a shameless data robber. Unless someone were to de-google Aluminium like LineageOS and GrapheneOS did for Android, but that would probably take years.)
Well, that's only true if you also observe what Japanese customers are buying and do your best to mimic their habits.
You could go into any Italian supermarket and fill your cart with weißwurst, avocados, and Camembert cheese - and they're all right there in the meat, fruit, and dairy areas respectively, not in an 'ethnic' corner - but it would be hardly a good representation of what the locals typically eat.
Will they? I downloaded it for a test run, and there was no pressure to create a Zed account. I got the impression that it's something you'd do if you wanted to use their cloud AI services, and I can't really see why you'd want a third party involved instead of just bringing your own subscription to your favourite model.
French: C'est une citation de De Gaulle.
German: Das ist ein Zitat von Von Neumann.
Both correct, but one would probably add "Charles" or "John" between the two 'de' or 'von' just to break them up.
Having the forge control it half-defeats the point; the attackers who gained permission to push a malicious release, might well have also gained permission to mark it as "urgent security hotfix, install immediately 0 cooldown".
i.e. whatever they do to you if you wiped the phone via duress PIN, they would already do to you if you managed to smash the phone.
Important caveat: Tuta was required by a court to provide police with access to a customer's _unencrypted_ emails (ie regular SMTP mail). The police had also asked for a backdoor to Tuta's E2E emails, and that request was rejected by the courts.
But Gastown is MIT licensed, and Yegge is bragging about never having looked at the code at all.
Don't need to make PRs to benefit from the source being available. Running software whose source code has been under public eyeballs, and that I have compiled myself (or that a trusted third-party has compiled) is far more secure than running a binary blob that may or may not do what the developer's marketing page promises.
> If something like Bun (recently acquired by anthropic) becomes orphaned, we'd still have the git source code and a permissive license.
Closed-source apps have had source-code escrow clauses for a long time, exactly to avoid that problem. "If my company shuts down, you get all the source code and can do whatever you want with it."
Such clauses can, and should, be brought over to source-available licenses, where they would also be trivial since you don't even need a physical escrow.
The analogy, in this case, would be replacing NON-nutritious ingredients with water or air.
But the point is that, if you want to game on Linux, you probably want to perform exactly or almost exactly the same tweaks that Bazzite already does. So why bother doing them yourself?
It's not even a linux-from-scratch situation where you'd do it for the sake of learning. Googling "my controller doesn't work right", finding some discussion threads, and copy-pasting a bunch of fixes isn't particularly interesting.
One `rpm-ostree rebase` from Bazzite to a server-oriented flavour of Fedora Silverblue and it's been running and updating flawlessly since then.
Even if a whitelist is not available (the SO question involves a particular C++ preprocessor and may not apply to others), a hacky approach might be to comment out all the #defines in the codebase, uncomment the ones you want to get rid of, and then run the full preprocessor task on it. Ugly but probably doable for a one-time refactoring.
Is it possible to command the preprocessor to take the source files as input and print them out with that one particular macro expanded and no other changes?
Intuitively, it sounds like it should be possible, and then you'd end up with a code base with a bunch of repetition but one fewer too-clever abstraction - and refactoring to deal with repetition (if necessary!) is a far more approachable and well-understood problem.
(Kind of like how some fancy compiles-to-javascript languages have a literal 'mytool --escape' command that will turn the entire code base into a plain, non-minified javascript in case you ever want to stop using them.)