jub0bs

5 ms·

1.
by jub0bs 1y ago
"Stateless" does not seem as strong as "pure", and purity is what I'm after. What about an iterator that maintains no state but prints to the screen? You could describe it as a "stateless", but not as &quo
2.
by jub0bs 1y ago
Ok, that is annoying. I hope it gets fixed soon.
3.
by jub0bs 1y ago
Your post does show that iterators are somewhat of a leaky abstraction, but I'm not sure I would go as far as calling some of their infelicities "bugs". Whether those infelicities matter in practice is a moot point.
4.
by jub0bs 2y ago
Instead of recovering from what clearly is a bug, why not fix that bug instead?
5.
by jub0bs 2y ago
There are even panics that are intended as irrecoverable: https://cs.opensource.google/go/x/sync/+/refs/tags/v0.12.0:s...
6.
by jub0bs 2y ago
I don't think any reasonable member of the Go community would claim that any aspect of the language and its standard library is perfect. The many open issues on https://github.com/golang/go attest to that. One exa
7.
by jub0bs 2y ago
One data point showing that Pike's views can be and sometimes are controverted: https://www.youtube.com/watch?v=5uM6z7RnReE&t=18m
8.
by jub0bs 2y ago
> actually they always intended to have generics There was a time when generics were not even on the table. I'm pretty sure I remember an old talk by Rob Pike where he says that much. People can change their mind as they learn more
9.
by jub0bs 2y ago
You cannot use `Access-Control-Allow-Origin: *` indiscriminately, though. In some cases, it can be dangerous: https://security.stackexchange.com/questions/227779/concrete...
10.
Jub0bs/CORS: a better CORS middleware library for Go(jub0bs.com)
1 points by jub0bs 2y ago|1 comments
11.
by jub0bs 2y ago
I’ve just released jub0bs/cors, a new CORS middleware library for Go, perhaps the best one yet. It has some advantages over the more popular rs/cors library, including a simpler API, better documentation, extensive configuration v
12.
Useful functional-options tricks for better Go libraries [video](youtube.com)
2 points by jub0bs 3y ago|1 comments
13.
by jub0bs 3y ago
Functional options is a creational pattern that remains divisive in the Go community: loved by some, loathed by others. However, the pattern can tremendously improve a library’s API design. Throw in a few twists and unleash the full power o
14.
A smorgasbord of a bug chain: postMessage, JSONP, WAF bypass, XSS, CORS, CSRF(jub0bs.com)
1 points by jub0bs 3y ago|0 comments
15.
by jub0bs 4y ago
Thanks for the kind words!
16.
Fearless CORS: a design philosophy for CORS middleware libraries and a Go impl(jub0bs.com)
1 points by jub0bs 4y ago|1 comments
17.
by jub0bs 4y ago
In this post, I investigate why developers struggle with CORS and I derive Fearless CORS, a design philosophy for better CORS middleware libraries.
18.
Subdomain Takeover: Ignore This Vulnerability at Your Peril(honeybadger.io)
2 points by jub0bs 6y ago|0 comments
19.
by jub0bs 6y ago
I hoped the TL;DR item entitled "SameSite paints a target on your subdomains' back" would be enough to compel readers to get through the whole post... But I understand your criticism; the post is quite long... By the way, one
20.
by jub0bs 6y ago
Thanks. Yes, that's a good point. The difficulty for me in writing the post was not to spoil how origin and site intersect too early. ¯\_(ツ)_/¯
21.
by jub0bs 6y ago
AFAIK, there is no proposal to add a type of DNS record that would allow you to do that. And I don't think that this type of configuration should be done at the DNS level rather that at the HTTP one.
22.
by jub0bs 6y ago
You'll find an answer in https://web.dev/same-site-same-origin/ : [...] for domains such as .co.jp or .github.io, just using the TLD of .jp or .io is not granular enough to identify the "site". And there
23.
by jub0bs 6y ago
Apologies about that. There is a TL;DR and an estimated reading time at the top, though. You can also skip the addendum.
24.
by jub0bs 6y ago
You'd be surprised by how many organizations completely disregard the security of their non-essential subdomains. The point of my post is that one subdomain takeover (or some XSS or some HTML injection) on a different subdomain of the
25.
by jub0bs 6y ago
Hey! I don't usually hang out on Hacker News. Thanks for sharing the post here :)
26.
by jub0bs 6y ago
Sorry! I like the dark theme the way it is, I'm afraid. Have you tried the light one?