joshpeek

6 ms·

1.
by joshpeek 9y ago
We’re concerned about this as well at GitHub. We don’t link directly to the Google Analytics script, which could be updated at anytime. Instead we host our own script version that’s locked down with CSP and SRI. We still allow XHRs to the G
2.
by joshpeek 11y ago
Hey, I'm one of the devs for this new PR stuff. This flow is something we're hoping to improve as well. Force push support is pretty second class right now, any previous commits and discussion basically gets lost. It sucks. So we
3.
by joshpeek 12y ago
Ha, I guess someone started this awhile ago. https://github.com/judofyr/duktape.rb I opened a PR update it to 1.0.
4.
by joshpeek 12y ago
If someone publishes a ruby-duktap c extension, I'll definitely get that supported in ExecJS.
5.
by joshpeek 12y ago
It seems like Langley and Gibson both agree that OCSP Must-Staple would resolve all this. "If we want a scalable solution to the revocation problem then it's probably going to come in the form of short-lived certificates or someth
6.
by joshpeek 13y ago
This looks so great. I just looked at the current print.css styles today on a README and they look really awful comparatively. There might be some JS hacks that could be done on github.com itself to render a more stylized view when ⌘+P is p
7.
by joshpeek 13y ago
Private markdown files should be accessible from a tokenized raw.github.com link. So it'd be neat if https://gitprint.com/josh/secret/master/REAMDE.md?token=123 worked.
8.
by joshpeek 13y ago
"both" referring to selector-set and jquery patch. Its wishful thinking that browsers could expose a similar api as selector set that they already use for matching css rules.
9.
by joshpeek 13y ago
You can still export the data from GitHub Analytics into Google Analytics. That'd give you more info then what you get from a bad image hack.
10.
by joshpeek 13y ago
Most the issues under "bower is a mess" are being discussed in the https://github.com/bower/bower.json-spec repo. I have a number of proposals to improve the "main" directive and other require paths
11.
by joshpeek 13y ago
This doesn't replace Sprockets at all, but integrates with it. It replaces bower "installer" with a pure ruby dependency. Sprocket still handles the runtime operation.
12.
by joshpeek 13y ago
It should require "sudo" privileges now.
13.
by joshpeek 13y ago
If your site is a simple static blog or whatever, there probably is no XSS vector. So you probably don't need CSP.
14.
by joshpeek 14y ago
> my hope for Rails 5 is it's the one that embraces fat-client JS apps Pretty sure DHH would say not a chance.
15.
by joshpeek 15y ago
The quickest way to drop it in vendor/assets. Anything there will override any gems. so `//= require jquery` will just find your local copy instead. Shouldn't have to change any requires. curl http://code.jquery.com/jquery-1.7.js > ve
16.
by joshpeek 15y ago
Had this exact same issue. xpdf isn't on the new cedar stack. Not ideal, but you can package up a rubygem that can compile itself. https://github.com/josh/ruby-xpdf
17.
by joshpeek 15y ago
pow isn't written in ruby, but javascript. So it might be installable from npm soon. If you `git clone git://github.com/37signals/pow.git`, you can install it from source with `npm install -g` (requires npm 1.0)
18.
by joshpeek 16y ago
Hack: Change CFBundleVersion to 2.0 in /Applications/Dropbox.app/Contents/Info.plist
19.
by joshpeek 16y ago
I've done this w/ my mustache implementation. Its compiled on the server side and sent down as a pure JS function. https://github.com/josh/mustache-trimmer
20.
by joshpeek 16y ago
Theres some duplication between the server side (Ruby) and client side (JS) models.
21.
by joshpeek 16y ago
CoffeeScript has been a joy. Because most of the code runs in the browser, we were able to use the WebKit debugger. I never had any trouble matching up the compiled JS with the original CS source.
22.
by joshpeek 16y ago
All the eco templates are compiled and shipped along with the JS files. The server backend only sends JSON to the app. Its much smaller and faster to render, plus its cacheable on the client side. Its a huge win over RJS templates.