unscaled

5 ms·

1.
by unscaled 6d ago
OP already answered that one: They used a closed list of 3 vendors in prioritized order, and got 429ed out of two of them, while the third one stopped serving the mode. This is less of a problem if you're running an agent locally and r
2.
by unscaled 9d ago
I think the article is a bit weak when it's making this point, because it's not about Unix pipelines. It's about POSIX shell utilities being too bare-bones. But Unix pipelines are not simple too. They have a couple of nitty-g
3.
by unscaled 27d ago
You can mix Japanese and Chinese with modern document authoring standards or with HTML, but the fact is that most people are too lazy to do that. It's a pet peeve of mine when a document gets displayed with a Japanese font but then fal
4.
by unscaled 27d ago
I don't know how much the USTR campaign against TRON affected the success of BTRON, but I feel like we should be careful about this explanation. This is a classic example of American exceptionalism, but it seems like the USTR mandate j
5.
by unscaled 27d ago
In highly distributed microservice architecture, there's almost never a single upstream. In some cases you may have a couple of customer-facing entry-points (a global API gateway, and a couple of BFFs), but these are not the only paths
6.
by unscaled 27d ago
> To handle this correctly you need your RPC framework to accurately communicate retryable vs non-retryable failures to clients. Even this is not enough, since you cannot always reliably know whether service B is dead or suffers an inter
7.
by unscaled 27d ago
I think the "happy path" might be a slightly wrong classification in GP, since the post is in reply to a retry-storm issue and explicitly talks about retry storms and thundering herds. I've seen many cases where engineers opt
8.
by unscaled 1mo ago
That's my take. The arguments for Go over Rust used to be: - Better concurrency story - Native cross-compilation of static binaries (great for CLIs) - Easier to learn, easier to teach - Opinionated: You don't have to enforce a sin
9.
by unscaled 1mo ago
I don't think it was true even in 2023. This sounds like tackling the problems of C++ in the early 2000s. 1. Casey Muratori also that DRY shouldn't doesn't have to result in non-performant code. 2. Smaller functions, function
10.
by unscaled 2mo ago
For this testing to be really effective at stopping "dangerous and misaligned" models from leaking out, you need a mechanism for banning failed models that prevent them from being released in the first place, not just prevent US c
11.
by unscaled 2mo ago
The law is airtight. Acceptance must be informed and freely given (this includes forcing through dark patterns and annoying banners that force you not to read), and withdrawal should be as simple as acceptance. GDPR article 7 and its variou
12.
by unscaled 2mo ago
Despite this being called a "cookie banner", this is not _just_ about cookie. When you click "Accept all" you are giving your consent to any form of tracking and information sharing mentioned in the details. The site you
13.
by unscaled 2mo ago
It doesn't even have to be something as bare-bones as pass. You can have a full-fledged password manager that is open-source and local-first. KeepassXC (and the OG Keepass) were always OSS and local-first. The original version of Keepa
14.
by unscaled 2mo ago
"supposed" is doing a lot of heavy-lifting here. According to who? The FIDO2 or Webauthn standards? Or in a perfect world? FIDO 1.0 started as two different standards: UAF and U2F. U2F was for USB keys used as second factors (so a
15.
by unscaled 2mo ago
Passkeys is basically a brand name for "discoverable credentials" (a Webauthn term). They do a little more than that technically, but in practice their purpose is what you said. Replace passwords. Or more accurately usernames and
16.
by unscaled 2mo ago
The FIDO set of standards (UAF, U2F which predated passwords and passkeys) haven't even started as enterprise standards. There are multiple origins for what became FIDO, but the main ones I know are: 1. PayPal was looking for a physica
17.
by unscaled 3mo ago
For what? For just authenticating a client application to a server without getting access to any user data? By all means. You usually don't need the client credentials in OAuth 2.0 if you don't want to use it. But if you want acce
18.
by unscaled 3mo ago
PKCE, OAuth 2.0 for Native Apps and the Device Code flow are a thing. In practice all of these clients work so well with OAuth 2.0, that the implicit and resource owner password credential grants have been removed from OAuth 2.1 and are the
19.
by unscaled 3mo ago
I wish I was young. Did I explicitly said TLS __1.3__ or did I not? A lot of effort was put into making TLS 1.3 a stronger, less agile and more misuse-resistant standard than its previous iterations. And that effort worked.
20.
by unscaled 3mo ago
True. But XSS stealing your token (which is always possible with localStorage) is still worse than XSS using your token. It's the principle of least privilege all over again.
21.
by unscaled 3mo ago
The main reason I don't like the id token is that I've seen way too many instances of the ID token being used as a trusted identity assertion sent across multiple services or to third parties. This is very dangerous, since ID toke
22.
by unscaled 3mo ago
The OP was talking about sessions (which include session cookies and API tokens). I'd argue these use cases are far more common for the average programmer than tokens and signatures that are used for federation, but I'll bite the
23.
by unscaled 3mo ago
PASETO and TLS 1.3 were also written by humans. TLS libraries (which are several orders of magnitude more complicated than JWT libraries) are also written by humans. If you passionately care about security and misuse-resistance you CAN writ
24.
by unscaled 3mo ago
If memory serves me right, cookies were designed by Netscape in 1994 before JavaScript was even a thing. They were released in an early beta of Netscape (0.9 something), while Javascript was only added in Netscape 2.0. SSL 2.0 was only adde
25.
by unscaled 3mo ago
Wow, Fortune 500 companies are using an insecure technology, get hacked and exploited by cryptominers and PII burglars and then just patch their vulnerabilities and call it a day? This never happened before! /sarcasm Just because a cer
26.
by unscaled 3mo ago
A non-exhuastive list of CVEs from this year alone: CVE-2026-28802, CVE-2026-29000, CVE-2026-1529, CVE-2026-22817/8, CVE-2026-34950, CVE-2026-23993, CVE-2026-32597. Most of them are the same classic alg=none, signature verification byp
27.
by unscaled 3mo ago
JWT libraries had poor defaults because the spec was poorly designed. Of course JWT can be implemented securely. Even XMLDSig can be implemented securely. But if the spec is not designed with security and misuse-resistance as a tier 1 prior
28.
by unscaled 3mo ago
I think both you and GP are somewhat misrepresenting the OP is saying. OP's argument is three-fold: 1. JWTs are not a good fit for a session token (although there are several RFCs that are trying to shoe-horn JWTs into this use). >
29.
by unscaled 3mo ago
Ok, I think I misunderstood you. Lightweight policing, not policy. I guess this happens in the US, but in most countries cops wouldn't stop you for a traffic violation with a gun in their hand. In some countries (e.g. the UK) the polic
30.
by unscaled 3mo ago
That's interesting. I didn't know any other country in East Asia that showed this level of restrictive policy that sets up a cascade of problematic tooling and technologies. Japanese Internet was pretty bad in the 2010s, but this

More ›