timruffles

I reported this a back in March 2016, and Google said it was not an issue.

Analysed whole attack here: https://gist.github.com/timruffles/5c76d2b61c88188e77f6

This was the response I got:

> The address bar remains one of the few trusted UI components of the browsers and is the only one that can be relied upon as to what origin are the users currently visiting. If the users pay no attention to the address bar, phishing and spoofing attack are - obviously - trivial. Unfortunately that's how the web works, and any fix that would to try to e.g. detect phishing pages based on their look would be easily bypassable in hundreds of ways. The data: URL part here is not that important as you could have a phishing on any http[s] page just as well.

Would you mind posting some links to find people in this community please? Forums etc?

Thanks!

If you still haven't given TypeScript a go as a Javascripter, now is a great time to do so.

Whether you end up adopting it or not, it's interesting to get the types out of your mind and into the code. The first time you feel the speed/confidence of refactoring with accurate 'Find usages', you'll decide if the undeniable overhead of types is worth it.

Could you ask the company to help out?

There's so much wrong with the above.

To pick a quick one: "query language which was designed to run on both single-machines and distributed infrastructure". Mongo has no fewer than THREE query syntaxes: standard, map-reduce[1], and the aggregate pipeline.

'homogeneous', lol.

[1] which even Mongo employees recommend people avoid like the plague https://www.linkedin.com/pulse/mongodb-frankenstein-monster-...

Really glad you're thinking about this, and making it explicit, buuuuut...

Why not dual-license, or look at the Fair Source license? The "donate please" button is just going to be ignored, like Sublime's donate nag screens.

Make it so at least big companies who have open-source policies will pay for a non-GPL license or support etc. You don't have to publish the history containing Apache 2, republish, and write all new code with AGPL-3.0.

Yes, mention the cool coding project! We're mostly average[1], most companies/jobs are average, and most employers should and do value our average accomplishments[2]! If you enthusiastically and knowledgeably describe a cool coding project you'll be winning vs most people I've interviewed.

If you're going for CTO of SpaceX, yes, you'll need some overwhelming accomplishments. If you're going for developer role 437 at SpaceX, less so :)

[1] when compared to peers, e.g the people going for the same jobs as you

[2] and will definitely prefer a nice 'average' person, to an obnoxious 'genius'

Brilliant news! It'd be fun to arrange pairing with boot camp attendees in London.

Just to say, D3 is entirely the 're-rendery "DOM as a pure function of state"' approach. `el.__data__` is just optimisation (if you're only using d3). You should be able to `setInterval(yourD3Code, 16)` if you're writing idiomatic d3.

Wha? Yes, D3 is definitely not a charting library - because it's a data-focused, thin wrapper over the DOM & SVG APIs. It's designed from the group up to "let you do something slightly different": that's the point. It's the low-level primitives you'd otherwise reinvent.

Your experience is totally different from everyone on every team I've used D3 with, and all the people I've taught D3. I can understand "D3 does too little", but "D3 does too much" is just weird.

Still the best game I've played - nothing matches the feeling of consequence your actions had.

I had a similar 'read about it and waited years to play' experience :) Started playing on Europa in the T2A time I think.

For next time: pay for google apps.

That's a sign someone has fundamentally misunderstood Angular and is hacking around their misunderstanding.

Great! This, plus the lack of libraries, put me off. Will take a new look!

I think I linked to the most balanced bit of that article :)

"We've seen many projects use this style in the last few years, and results so far have been positive, so much so that for many of our colleagues this is becoming the default style for building enterprise applications"

"Monolithic applications can be successful, but increasingly people are feeling frustrations with them "

Does this feel like backtracking to anyone else? Compare to Fowler's previous discussions [1].

Maybe it's just hard to write about a new, interesting thing without most people getting the impression you think it's the way (especially developers, who seem eager to declare any new tool the One True Way® and everything else 'legacy').

[1] http://martinfowler.com/articles/microservices.html#AreMicro...

Seriously? "modifies it without giving you the changes back, what has that deprived you of?"

Uh... it's depriving you of the changes? e.g the kind of changes a big, rich company can afford to pay people to do to free software.

I think it needs a foreword: "your problem likely is nowhere near needing a DSL, please don't write one just because it makes you look clever".

Signed: everyone who's ever used a DSL which could have been written better as a couple of dozen functions.

Automation/systemisation is how productivity & profitability grows. Everyone should be clear on this - and be ready to retrain, ideally before time!

So Google will be shutting down search then? Or perhaps: maybe some tasks like finding things are by definition 'pull', and others are better suited to 'push'?

The only information in this article: the author doesn't think things through.

A band that once burnt £1,000,000 in cash. http://en.wikipedia.org/wiki/K_Foundation_Burn_a_Million_Qui...

It was pretty well their entire earnings from the band.

Great to see PG trying counter Steve Jobs inspired asshole-dolatry. Certainly I think it accords with my experience: I've stuck around in jobs because of the people when better ones were available. Conversely, meanness in founders creates a mean atmosphere, and people will not be loyal.

Oh ok, we're agreed. You'll not be having digest loops per second though, that'd be quite a weird situation :)

Digest on mousemove wouldn't be a good idea - look at _.throttle etc. You shouldn't realistically need digest loops more than once per 100ms, as people can't perceive changes happening faster.

No idea what you mean when you say dirty checking is O(n^2) - each watcher is checked once per loop. With 100 watchers you get 100 checks, not 100 * 100...

I agree with a lot of what you say, but wonder if you're being rhetorical when you say Angular's popularity is baffling. Do you actually think that people pick tools by reviewing the CS literature and picking the one that best reflects the state of the art? :)

Angular is productive, people want to get things done; thus Angular is popular.

Nice looking app!

You're not doing promises right however :) `$http.get()` etc returns a promise, so you can do all transforms and logic via `.then()`. The only time you should ever use `$q.defer()` is when you're wrapping a non-promise API. The bluebird library has a nice write-up: https://github.com/petkaantonov/bluebird/wiki/Promise-anti-p...

If you've not read any of Greg Egan's books this is your lucky day - an incredible writer to discover! His books have an unusually high ideas/page ratio, and are very readable.

55k is average for Ruby in London now: http://www.itjobswatch.co.uk/default.aspx?page=1&sortby=0&or...

I'd say £70k+ for senior. Contract rates are £450+, so ~£100k a year.

Sounds like teams might pay a lot to have someone else do it :)

Two things:

- not feeling like an expert is a good sign - unless you were pushing yourself for 10k hours the rule doesn't apply. depends if you were doing stuff you're already familiar with?

I've built FP systems in a few languages, and I don't see them as a step change in ease of writing "good, modular" programs.

If you could tell me which aspect of FP you think does provide this big change, or link me to a discussion, I'd be very grateful!