minitech

5 ms·

1.
by minitech 6d ago
CPython has the unfortunate property that ints aren’t covered by hash randomization, and `hash(x) == x % ((1 << 61) - 1)` always.
2.
by minitech 10d ago
https://grapheneos.social/@GrapheneOS/117225731764489295 https://bsky.app/profile/grapheneos.org/post/3muupuvlfbs2v
3.
by minitech 16d ago
A Jekyll theme from the same person as this project, yes.
4.
by minitech 17d ago
Do you have a source for this practice? I couldn’t find any evidence of it with a search.
5.
by minitech 19d ago
> (3) it's provided in an environment variable (no better than before) Even if you take no measures beyond simply using a token that can be exchanged for secrets (and you can – invalidate it, authenticate it, etc.), you’re already d
6.
by minitech 19d ago
> "The environment" is not "environment variables" and not ".env files" Is there confusion because an extra “not” leaked in?
7.
by minitech 22d ago
“actually have ethical beliefs” here → not “virtue signalling”
8.
by minitech 24d ago
Combined with “do not mix declarations and code”, this could be a strict C89 compatibility thing (not that I think that these standards are a good idea either, even with that less arbitrary justification).
9.
by minitech 26d ago
Slop article generated to promote their game that they also posted yesterday.
10.
by minitech 27d ago
Slop article. Good for scam awareness I guess, but the main value of the analysis and advice is comedy. > read process.env directly, which in this app means MONGO_URI, JWT_SECRET, SENDGRID_API_KEY, CLOUDINARY_API_SECRET, PAYTM_MERCHANT_K
11.
by minitech 1mo ago
I’m not an expert in RustDesk, but I did take a quick look at the code, and it’s filled with massive red flags like [1], where it appears the general mechanism is SHA256(SHA256(password++salt)++challenge). I can’t even tell if the whole thi
12.
by minitech 1mo ago
Does your journal have cloud sync? That’s what broke on the device in the article.
13.
by minitech 2mo ago
Sometimes that's true, but sometimes (imo the superior approach) the touchscreen is independent from the cursor. I think touchscreen Chromebooks are like that, for example.
14.
by minitech 2mo ago
The `formaction` and `formmethod` attributes already exist. https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...
15.
by minitech 2mo ago
Correct, it’s a common misconception/sloppy wording.
16.
by minitech 3mo ago
Digitally rented content is rented. My music via Bandcamp/iTunes, my games from their developers’ websites/itch.io/GOG, and my ebooks are owned (for the purposes of the “owned”/“rented” distinction people are making here
17.
by minitech 3mo ago
Alternative what? Government?
18.
by minitech 3mo ago
> How is this different from struct in C#? A struct in C# has identity Since when? I’m pretty sure structs didn’t have identity last time I used C#, and that would be a very surprising thing to add.
19.
by minitech 4mo ago
and don’t open links like https://tinyurl.com/2s3twstw either, or any other page on the internet that’s able to redirect you to github.dev
20.
by minitech 4mo ago
This comment is confusing to me on so many levels. What’s with the tangent(?) about a math test your algebra teacher could have generated? Did you bring up an illiterate teacher (extreme outlier) as evidence that the general population ha
21.
by minitech 4mo ago
Not one window, but one application . Which is, yeah, about the worst of both worlds.
22.
by minitech 4mo ago
- CSP that allows cdn.jsdelivr.net/unpkg.com (which serve anything on npm, which anyone can publish to) indiscriminately is not effective (and I’m sure some cdnjs script in an Angular-style library executes arbitrary code in otherwise-
23.
by minitech 4mo ago
> in favor of some unlikely cloak and dagger interception scheme someone who definitely understands how crypto works, describing the most basic possible MITM
24.
by minitech 4mo ago
I know parameters don’t translate directly like that (and that linear and exponential aren’t the only types of growth) but a doubling as a go-to example of “not exponential growth” is pretty funny.
25.
by minitech 5mo ago
ASLR is (still[1]) not security by obscurity. [1] https://news.ycombinator.com/item?id=43408079
26.
by minitech 5mo ago
> Any TLS break delayed by more than 15 minutes would be worthless. It sounds like you’re talking about breaking TLS’s key exchange? Why would this not have the usual issue of being able to decrypt recorded traffic at any time in the fut
27.
by minitech 5mo ago
> Rather, an interactive window running under the user’s name has implied access to the user’s home folders, regardless of what’s been set under “Files & Folders” (which still applies for background/non-interactive processes). N
28.
by minitech 6mo ago
Npm and the other JavaScript package managers do generate and check lockfiles with hashes by default. This was a new release, not a republishing of an old version (which isn’t possible on the npm registry anyway).
29.
by minitech 6mo ago
Nobody is confused or disagrees about the `--hard` part. It was a minor tangent about contexts where these ASCII substitutions are established, like LaTeX (`` -> “, '' -> ”, -- -> –, --- -> —, etc.)
30.
by minitech 6mo ago
It’s about the top-level comment’s horror that ”--” was substituted with “an en dash, not even an em dash”. If you’re picking a substitution for “--”, en dash makes more sense. The comment you originally replied to had already agreed “tha

More ›