griffinmb

This is not the same company. The OP Tiny Corp accused them of Trademark infringement on Twitter, due to exactly this kind of misconception.

Agreed that there’s no way to do this meaningfully and securely.

Looking forward to the archeological audits of LLM-developed apps x years from now that are a total mystery to the product owners…

Yeah, it doesn’t fix the issue at all. Rough to have a security product demo be fundamentally insecure.

I created/maintained a popular project for years[^1], and recently passed ownership to someone else. It's been great seeing issues resolve, PRs merge, etc, after languishing for a while :)

[^1]: https://github.com/nccgroup/sobelow

The point is that with a powerful Effects system, devs calling the logger would have to account for the network call in their own code. Someone might have wondered why that was needed and gotten this addressed before it was ever widespread.

Effects can definitely help, but a strong type system allows you to encode security concerns for compile time feedback as well.

See https://gmb.is/refinement-types.html for a non-Haskell example.

Given that he's now un-retweeted it, it looks like even amasad agreed it wasn't a good look.

Based on your retweet[1], you still seem to be publicly punching down.

[1]: https://twitter.com/pnegahdar/status/1402018604233732098?s=2...

You probably know this, but correcting for anyone reading. C is generally considered statically but *weakly* typed.

It’s versioned, which is an improvement on “agility”

Yep, that’s the way!

This class of bug (CSRF bypass via route confusion) is probably more common in Phoenix apps. I’ve found a handful of apps vulnerable to this issue with Sobelow.

People create (for example) a get ‘/profile’ and a post ‘/profile’, and the action intended to correspond with post requests really just pattern matches against params.

I’ve also seen at least one app implement this properly, matching against the HTTP method as you described.

Sure, the "passive" was what I was calling out as incorrect. And as you noted, a compromised trusted CA affects all domains. Which is another thing this article gets explicitly wrong.

> If DigiCert’s Key Management System is compromised, all of their SSL certificates will have to be revoked and re-issued. But if one of the other CAs is compromised, it would not affect Medium’s site.

This is a horribly misinformed article, and is incorrect about the most fundamental arguments it is making. E.g. Among many other issues, it implies that a compromised CA would allow passive MitM.

Agreed that you don't gain anything if you're using 1Password. But users may be required to set up MFA to access something like GitHub organizations, in which case having it available in 1Password is convenient.

The docs don't seem to disagree with me.

> Besides, you shouldn't need to plug it that way to pair it either.

Agreed. And glad that's not necessary for the latest generation.

> You missed charging the Apple Pencil on the ipad pro.

You plug the Pencil into the iPad to pair it. It comes with an adapter that you use to charge it with a regular cable.