danscan

9 ms·

1.
by danscan 9d ago
The X3 stands out a bit more than the X4. The difference is small but mighty. I was at a restaurant in my small (not the forefront of tech) town, and had two people ask about it!
2.
by danscan 9d ago
I use [Crossink]( https://crossink.dev ) and I absolutely love it. Have it both the X4 Pro and the X3, and surprisingly (to me) I prefer the x3 for everything but reading in the dark
3.
by danscan 2mo ago
There is no right way :) SwiftUI is good, albeit not without issues, as long as you tolerate them. The same is true for any approach. My most recent app was built in SwiftUI because I have been using React Native in my professional work for
4.
by danscan 2mo ago
I think you may have meant to comment on another post :)
5.
by danscan 3mo ago
How does the directive bound what it applies to? I imagine they could be in compliance by renaming the model
6.
by danscan 4mo ago
I think this is saying it's: 1) A JS chromium browser automation API targeting Bun (uses Bun.* or "bun:*" apis) 2) Engineered to interact with webpages in a way that evades bot detection
7.
by danscan 4mo ago
> I've never even heard of Sacks until now Bless your soul
8.
by danscan 5mo ago
Axios, like Express, is something I'm shocked to see used in any modern codebase. I loved both in the 2010s. In JS/TS-land there are much simpler and better options these days. Depending on Axios suggests the devs don't know
9.
by danscan 7mo ago
TIL nobody can spell phyzix
10.
Show HN: GithubDownfall – Track GitHub incidents and downtime(githubdownfall.com)
4 points by danscan 7mo ago|0 comments
11.
by danscan 1y ago
It’s not about doing discovery _from_ personal apps, but the inverse: doing discovery _of_ personal apps. For example, an app that uses an AI chat API can discover and route requests to your preferred provider (ollama, etc)
12.
by danscan 1y ago
Fair that this post lacks background. I’d say I have the opposite of a narrow view of software one can write, having written everything from typical web/mobile apps to DBs, network protocols and VMs :) My initial explorations were focu
13.
Legitimizing Personal Software(selfref.com)
3 points by danscan 1y ago|4 comments
14.
by danscan 1y ago
Ah, and just the subtle crypto API to generate keys? Or are you not generating them on the client?
15.
by danscan 1y ago
Easy to imagine that haha. That’s part of the reason I’d lean on a standard like JOSE and make signing happen automatically for users who prefer to use an SDK
16.
by danscan 1y ago
Fair. I assume you mean asymmetric key cryptography and not JWKs in particular? JOSE is a pretty good library if you need the latter and you’re already working in JS
17.
by danscan 1y ago
IMO this is a tooling issue. You can make your SDK generate keys and even base64 encode them so they appear opaque to the uninitiated (like an API key)
18.
by danscan 1y ago
Valid
19.
by danscan 1y ago
Ah, yes I agree
20.
by danscan 1y ago
It's interesting to imagine taking the pubkey as identity concept to its full extents in situations like this, for example if you could create a cloud account, spin up resources, and authorize payment for them all programmatically with
21.
by danscan 1y ago
Not sure which way of constraint you're referring to, but WebAuthn credentials are bound to a domain via Relying Party ID. There's a proposal for cross-domain usage via Related Origins, but that scheme depends on the authority of
22.
by danscan 1y ago
Yeah, I am sort of a fan of Passkeys in principal, but they are domain bound (you can't use them across domains). I wish there were something built into browsers that offered a scheme where your pubkey = your identity, but in short the
23.
by danscan 1y ago
For sure. Would likely need to be combined with another mechanism like IP rate limits
24.
by danscan 1y ago
The key distinction I am getting at is: self-signed as in “signed with a self-issued key pair”, as opposed to using an API key/credential that has been issued to you
25.
by danscan 1y ago
The things that change are: 1. With self-signed JWTs, you could start consuming APIs with free tiers immediately, without first visiting a site and signing up. (I could see this pattern getting traction as it helps remove friction, especial
26.
by danscan 1y ago
Haven't heard of PASETO, but I'll check it out. I'd say JOSE is an implementation detail of what I'm advocating for, so very open to alternatives.
27.
by danscan 1y ago
Bummer. Not sure what I can do about that, but I assure you it is not pornography!
28.
by danscan 1y ago
In some apps, the client may be the signing authority (e.g. it owns the resource it's accessing). In that case, the client can possess the JWK keypair and do its own signing.
29.
by danscan 1y ago
(Author here) The JWT signer should be the authority setting claims, so if your server is the authority and the client is untrusted, the server can provide the client a pre-signed JWT with the claims it needs, and the client can send that a
30.
Self-Signed JWTs(selfref.com)
118 points by danscan 1y ago|83 comments

More ›