EtienneK

You can’t downvote submissions on HN.

Yes, this was my first thought too. This car is for people to make YouTube videos with.

That’s not a dark pattern. That’s one of the core reasons to use Cloudflare.

My prediction is that the EU will eventually bring in legislation that will force platform providers to provide pluggable APIs so that you can use whatever LLM you want.

And this is why I am extremely bullish on Apple.

You ok bro?

Passkeys are better passwords. They need a TPM.

That’s when you install Keycloak.

Carl Zeiss only has a €2.2B market cap. What stops someone from just buying all these world class vendors?

In time for Windows 12 that reportedly will require an NPU: https://tech4gamers.com/windows-12-reportedly-relasing-2026-...

Yes, exactly my first thought as well. Fantastic show!

I assume it was an "ask me anything" type of event.

Maybe because war is terrible and no one wants it? Especially if it means protecting private companies’ revenues.

This is crazy talk. The single player campaign is considered as one of the best in FPS games ever.

Titanfall 2 is a masterpiece. You have no idea what you are talking about.

Nothing in that clip indicates he was driving recklessly. They even end it by saying the cause is still unknown.

Interesting. I always thought Apple would be the ones to acquire Warner Bros. Seemed like a good fit.

The day we stop making noise is the day they will pass this.

Yup, same here (Europe). Opened up HN to confirm. Thanks :)

> Most people understand these two things to be, collectively, the "provider" side of OAuth

Citation needed. As another commenter already noted, the term "Provider" is rarely used in OAuth itself. When it is mentioned, it's typically in the context of OpenID Connect, where it refers specifically to the Authorization Server - not the Resource Server.

> the service provider, who is providing an API that requires authorization

That’s actually the Resource Server.

I understand that the current MCP spec [1] merges the Authorization Server and Resource Server roles, similar to what your library does. However, there are strong reasons to keep these roles separate [2].

In fact, the MCP spec authors acknowledge this [3], and the latest draft [4] makes implementing an Authorization Server optional for MCP services.

That’s why I’m being particular about clearly naming the roles your library supports in the OAuth flow. Going forward, MCP servers will always act as OAuth Resource Servers, but will only optionally act as Authorization Servers. Your library should make that distinction explicit.

[1]: https://modelcontextprotocol.io/specification/2025-03-26/bas...

[2]: https://aaronparecki.com/2025/04/03/15/oauth-for-model-conte...

[3]: https://github.com/modelcontextprotocol/modelcontextprotocol...

[4]: https://modelcontextprotocol.io/specification/draft/basic/au...

> This is a TypeScript library that implements the provider side of the OAuth 2.1 protocol with PKCE support.

What is the "provider" side? OAuth 2.1 has no definition of a "provider". Is this for Clients? Resource Servers? Authorization Server?

Quickly skimming the rest of the README it seems this is for creating a mix of a Client and a Resource Server, but I could be mistaken.

> To emphasize, this is not "vibe coded". Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs

Experience with the RFCs but have not been able to correctly name it.

Agreed. This was also the first thing I searched for when clicking on the article. 60Hz screens should not be a thing in 2025.

Reddit is at its worse when it tries to suggest posts from subreddits I don’t follow.

When things like this pop up, I always think back to Joel Spolsky's review of the Nokia E71 and how he compared it to the iPhone 3G: https://www.joelonsoftware.com/2008/08/22/a-review-of-the-no...

The E71 was arguably Nokia's best phone ever; and it was indeed better than the iPhone 3G. But Nokia just couldn't keep up the momentum.

It’s phishing resistant; thus making it more secure than all other current popular MFA methods.

Ah, the iPad Pro: One of the most compact and powerful computing devices of all time. But trying to use even a small fraction of that power requires workarounds like this.

I bought into the idea of the iPad Pro as a coding device 4 years ago; only to have been left very disappointed. And it seems nothing has really changed (although the M series iPads do at least support full screen external monitors now - mine still has black bars).

I won't consider an iPad Pro until I can actually use it as a development laptop replacement. I still see use for the non-pro iPads in my life; but not the Pro.

As opposed to what else?

Please elaborate.