maxwellg

4 ms·

1.
by maxwellg 8d ago
We can have both. The resources aren't coming from the same bucket. Public transportation must be built by the local government, and is subject to that local government's ability to execute. In contrast, Self driving cars are larg
2.
by maxwellg 25d ago
No - this is built on top of SPIFFE/WIMSE work to enable cross-domain usage where the target domain speaks OAuth instead. You wouldn't expect, say, Slack's APIs to accept SPIFFE SVIDs from your internal deployment. This provi
3.
by maxwellg 26d ago
It is viable. Think of workload identity federation as the mechanism for the client to get an bearer token initially, and DPoP as the mechanism for the client to present the access token to a resource server. Each DPoP proof is entirely sel
4.
by maxwellg 3mo ago
> There are lighter weight options that do basic stuff like transaction management and binding result sets to object properties that are much less of a PITA than ORMs. Query builders like these are my personal favorite from a productivit
5.
by maxwellg 3mo ago
> If the client wants to detect custom API gateways, it can say so plainly. It can send an explicit telemetry field with documentation. It can make the policy visible. It can put the behavior in release notes. This seems like a very naiv
6.
by maxwellg 3mo ago
Huge congrats to the folks behind this at Okta, A\, Microsoft, Figma, Linear, etc... For the MCP nay-sayers - don't worry there's something here for you too :) This is powered by a new token format called an ID-JAG - https:/
7.
by maxwellg 3mo ago
In regular OAuth, end users consent to share their data with applications individually. This makes sense for consumer usecases, where the end users own their data. But it doesn't make sense for many business usecases, where the busines
8.
by maxwellg 3mo ago
Pre-GenAI I wrote a new interview question for a role on our team. As far as I know, the question was never made public. The interview required implementing a pretty basic CSS-in-JS utility in vanilla javascript. We instructed the candidate
9.
by maxwellg 6mo ago
Wouldn't a browser that doesn't execute JS also not execute the browser fingerprinting code in the first place?
10.
by maxwellg 6mo ago
Is your agent harness dropping the entire MCP server tool description output directly into the context window? Is your agent harness always addig MCP servers to the context even when they are not being used? MCP is a wire format protocol be
11.
by maxwellg 7mo ago
Mikey might have a profit incentive at play, but let's be abundantly clear - the drivers he is catching are frequently flagrantly breaking the law and endangering both themselves and the people around them. I have a very hard time feel
12.
by maxwellg 9mo ago
> The only issue it solves is if you want to bring your own tools to an existing chatbot. That's a phenomenally important problem to solve for Anthropic, OpenAI, Google, and anyone else who wants to build generalized chatbots or ass
13.
by maxwellg 10mo ago
I've also had drivers do 50+ in residential areas, run red lights, play on their phones, cut off pedestrians in crosswalks, and once even park in a handicap spot at a gas station to buy cigs with me left in the back seat. If I was guar
14.
by maxwellg 11mo ago
The initial remote MCP specification was pretty painful, but the June spec and the upcoming November spec are much more workable - MCP auth is (mostly) just OAuth now. MCP Clients are OAuth clients and can be granted access tokens and manag
15.
Show HN: ChatGPT Tamagochi Pet Using Apps SDK(chatagotchi.app)
1 points by maxwellg 11mo ago|0 comments
16.
by maxwellg 1y ago
Ironic that DHH is politically active enough that it affects his day to day activities and public perception of his company - kind of the exact opposite of his own policy he expects his employees to abide by.
17.
by maxwellg 1y ago
I’ve bought several of the WAOAW sleep masks as well. They’re great for the price point - I have a nasty habit of forgetting them in hotel beds though. I tend to go through one every few years or so. My wife enjoys hers as well. Has anyone
18.
by maxwellg 1y ago
The innocuous https://grants.github.com/apply URL goes to a completely different site. Sneaky sneaky.
19.
by maxwellg 1y ago
I should caveat this by saying this is certainly not 9/9/6, yeesh. Weekdays are fuzzy but never 12 hour days. Do you count going to a meetup after hours as work? A dinner with a prospect? Early coffee with a coworker? Saturdays or
20.
by maxwellg 1y ago
Of course we are! This year has been the most exciting (and fun!) of my career in the Bay. There is so much to do and so much going on. Things that were impossible a year ago suddenly feel imminent. Nobody is forcing (or really even asking)
21.
by maxwellg 1y ago
Cloudflare is only the first to market with a solution. If this proposal catches on every WAF vendor under the sun will have it implemented before the next sales cycle. Enforcement of this standard will be commoditized down to nothing.
22.
by maxwellg 1y ago
It cracks me up to no end how the dev tools are much better MCP clients than the web chatbots. Claude Code is so _so_ much better at MCP than Claude Web, which has issues with managing DCR client state, is comparatively terrible at surfacin
23.
by maxwellg 1y ago
I would also recommend the OAuth 2.1 IETF draft as a precursor to the BCP: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-... Although it isn't a published RFC yet, it intends to replace several
24.
by maxwellg 1y ago
Refresh tokens are only really required if a client is accessing an API on behalf of a user. The refresh token tracks the specific user grant, and there needs to be one refresh token per user of the client. If a client is accessing an API o
25.
by maxwellg 1y ago
Many "softer" forms of SSO have trickled down too. Google + Microsoft OAuth are ubiquitous today without any upchage. OAuth from a Google Workspace account managed by an IT admin has many of the same security guarantees as SAML or
26.
by maxwellg 1y ago
For extra security, an intermediary can set Content Security Policy (CSP) headers that instruct browsers to only connect to certain domains. CSP headers aren't a total solution, but they're a good tool in the toolkit for redundanc
27.
by maxwellg 1y ago
SSO chaining is super common in large corporate environments. Different orgs might have their own SSO IDP, acquisitions often bring their own, etc. Once a provider is in use, it is quite difficult to tear out later while keeping everyone in
28.
by maxwellg 1y ago
This is conceptually extremely similar to the Web Push API: https://web.dev/articles/push-notifications-web-push-protoco... You'd need something at the browser/UA level to unsubscribe or to make the subscript
29.
by maxwellg 1y ago
I dream of a low-milage early 2000s Taco with aftermarket Carplay
30.
by maxwellg 1y ago
Installing a dependency for myself is just and a little harder the first time. Asking every developer who will ever consume my service over CURL to install a dependency is absolutely an ongoing burden.

More ›