whymarrh

7 ms·

1.
by whymarrh 1y ago
You’re right, the math is slightly more complicated than rent v. mortgage payment. Ben Felix, a popular financial YouTuber, made many a video about the math: https://youtube.com/watch?v=j4H9LL7A-nQ https://youtub
2.
by whymarrh 2y ago
I don't think this is a useful comparison. This is Google's bug with Google's software vs. Project Zero's discoveries are (as I understand them) typically in software used by multiple people and thus there's a highe
3.
by whymarrh 3y ago
https://confs.tech/ has a decent crowd-sourced list
4.
by whymarrh 5y ago
Even if your Master Password is “hunter3”, 1Password, as an example, will mix in a locally generated Secret Key to increase the entropy [1] [1]: https://blog.1password.com/what-the-secret-key-does/
5.
by whymarrh 5y ago
GitHub Pages also doesn’t (yet) support custom headers and you can add them with Cf via Workers. So if you’re concerned about the results of securityheaders.io, for example, you can add those in.
6.
by whymarrh 5y ago
1Password's cloud offering architecture has a few important distinctions from other offerings. Namely the use of a password authenticated key exchange (PAKE) and a "Secret Key" that is never transmitted to 1Password servers.
7.
by whymarrh 5y ago
And what does this revocation accomplish? The app still has your unique address. This revocation is simply "don't log me in next time." You still need to use the app to delete any data, if that's even possible (highly-de
8.
by whymarrh 5y ago
> Web3 is by far the easiest way to provide auth to a web app right now Easiest by what measure? As I understand it, few browsers (read: only one or two) have built in wallets and outside of that the UX for this auth isn’t great. It’s ha
9.
by whymarrh 5y ago
Similarly, basically everyone using Ethereum just uses Infura nodes [1]. Web3 is no more decentralized than anything it purports to improve upon. [1]: https://infura.io/
10.
by whymarrh 5y ago
This is something that folks are working on via the `passwordrules` attribute https://github.com/whatwg/html/issues/3518 With that and a well-known endpoint for changing passwords (not quite the same thing a
11.
by whymarrh 5y ago
Small plug for LavaMoat ( https://github.com/LavaMoat/LavaMoat ) which includes tools to more granularly disable dependency lifecycle scripts via @lavamoat/allow-scripts.
12.
by whymarrh 5y ago
Yeah they’re similar feature-wise but the communities that exists on GitHub vs. GitLab aren’t remotely comparable.
13.
by whymarrh 5y ago
"If you like this you might also like" https://ferd.ca/awk-in-20-minutes.html I too am happy to see more Awk material in the world, once I learned a bit about it I started reaching for it more and more.
14.
by whymarrh 5y ago
The author linked to https://en.wikipedia.org/wiki/California_Unfair_Competition_... (I can't speak to its relevance)
15.
by whymarrh 5y ago
Even inside in the web world, this approach wouldn't quite work for features with even a modicum of state.
16.
Short summaries of recent results in empirical software engineering research(neverworkintheory.org)
2 points by whymarrh 5y ago|0 comments
17.
by whymarrh 5y ago
Yup, there's quite a few different configuration options available: https://docs.github.com/en/code-security/supply-chain-securi...
18.
by whymarrh 5y ago
There could be a simple explanation for this: Mozilla has its own browser stack whereas Edge is Chrome.
19.
by whymarrh 5y ago
> Let's be honest here. Curl to 98% of people is http/1 requests with some post params and maybe json body, with some custom headers. 100%, that's why we see so many smaller projects pop up (on GitHub and the like) that su
20.
by whymarrh 5y ago
> I was surprised that "Awk '!a[$0]++'" works too (on Mac at least). If I "ls Awk" in \usr\bin, it says Awk is there. If I "ls awk" it says awk is also there—but it seems they're the same file
21.
by whymarrh 6y ago
There are platforms that don't use PoW that are becoming quite popular. The NBA's Top Shot platform is built [on Flow]( https://www.onflow.org/primer ) which does not use PoW. I'm not making _any_ claim about t
22.
by whymarrh 6y ago
> This is the result of rendering everything to a <canvas> element. If the accessibility story isn't rock-solid, frankly this is a non-starter for a lot of applications. Web apps suck in a lot of ways but regular HTML has pret
23.
by whymarrh 6y ago
I don’t understand, so what? They’re doing their best and if users go somewhere else so be it. I’m sure if they could avoid the outage they would. They’re not losing profits or anything. They’re hosting a free service. When they get the ser
24.
by whymarrh 6y ago
I had similar issues with their macOS app using a pretty basic headphone+microphone setup (EarPods). I ended up leaving it off and not re-installing in on my latest setup. I've had a subscription from mid-2019, though I no longer use i
25.
by whymarrh 6y ago
Where does one find VPSs this cheap?
26.
by whymarrh 6y ago
And this is via Rosetta 2?
27.
by whymarrh 6y ago
I was just about to bring up mutation testing. I've had some pretty great success with PIT [1] when writing Java. Code coverage and mutation test coverage pair wonderfully together. [1]:https://pitest.org
28.
by whymarrh 6y ago
> where by they tell upstream what they are doing and if upstream wants to continue to be "Github compatible" well upstream better adopt it as well.... Do you have an example of this? This seems like it would be a hard sell as
29.
by whymarrh 6y ago
At their scale I do believe there’s a benefit to authenticating to see logs: a lot of people scrape GitHub for secrets. CI logs are at high risk for user error, errors where a user unintentionally marks something as non-secret when it sho
30.
by whymarrh 6y ago
Maybe this is a bit nitpicky, but Snowden himself does offer Signal to people [1] and is listed on the Signal homepage as "using Signal every day" [2]. [1]:https://twitter.com/Snowden/status/9862771592

More ›