News for hackers. Stuff that matters.

holtalanm

then you're hitting the db on every request just to do auth.

if you _had_ to do that, I would put the counter into something like redis instead.

watched the whole thing. was very informative. Actually havent used RSA in any capacity in years (AES is a lot easier to use), but always viewed RSA as a battle-tested encryption method/alg. I suppose with anything there are ways to misuse it, and RSA appears to be really easy to misuse.
> 1. Massively increases server strain and bandwidth usage

A short-lived JWT that fits into an HTTP Header is not going to _massively_ increase your bandwidth usage. At most, you will end up with a single refresh request every few minutes as each short-lived JWT expires.

> 2. Has problems with users less reliable connections (they'll be randomly logged out all the time)

Usually if your request failed due to a bad connection, the client wouldn't be designed to automatically log out the user. That would be just terrible UX.

> 3. Makes "Remember Me" style features impossible (unless you use a server-side store for that, which brings us back to it not being stateless)

Incorrect. A short-lived JWT tied to a refresh token allows for a remember-me style feature by checking account access when issuing a new JWT token.

that would be insanely illegal.
Yeah, if you need that kind of control over token access, then im not certain a jwt is the right tool for the job. For most use-cases a short-lived jwt is fine, as it expires in a matter of minutes, or even seconds, depending on configuration.
I can see that. I suppose when people say they need 'server-side session storage' I start thinking of app state, but in reality it could be as simple as storing a jwt refresh token that would be considered valid.
i have never seen anything anywhere advocating for moving away from RSA. i'm curious to see what their sources are for this claim.
> in reality you still need server side state for useful features like logging out

im curious about this. normally 'logging out' just involves deleting the secure http-only cookie where the jwt was stored. is there something I'm missing here?

well, good luck getting buy-in from the cli tool devs, then? the other option requires absolutely zero buy-in from homebrew, gatsby, dotnet, or any other cli.
are there documented cases of these cli tools abusing their telemetry? are they entirely used to pinpoint performance issues and bugs within the tools that implement this telemetry tracking?

if it is the former, i can see there being cause for concern. if it is the latter, this is just pure fear-mongering.

my question here is:

are we really concerned about console tools overreaching their telemetry? personally, I am not.

I would love to know why others think this is some kind of huge issue, without a bunch of 'what-if' scenarios.

I liked the Gatsby comment/suggestion a lot better: a tool for automatically setting the do-not-track env flags for all different dev tools.
Re:Virtual DOM is pure overhead (2018) on Tuesday June 29, 2021 @06:04PM (#27682367)
you don't have to clone it. cloning the object and putting it in Vuex will still result in it being reactive.

`Object.freeze` is what I used. This causes Vuex to not traverse the object for changes. in my case, the objects I was pushing into the Vuex state were essentially immutable once I pushed them in, so this did the ticket.

well, that, and only pushing partials of the entire state, so the object model didn't get too unwieldy. To get the total state, i just replayed the changes on top of the base state. base state was reset once the number of changes got to a certain size.

Re:Virtual DOM is pure overhead (2018) on Tuesday June 29, 2021 @10:09AM (#27675969)
> In my experience it has never, ever been the JS rendering layer which has caused unresponsiveness in an application.

Implemented a undo/redo stack on top of Vuex once that worked on some very large data structures.

Got unresponsiveness after only ~3 changes to the data. Purely due to how Vuex checks state for changes. No network, no database; purely in the frontend client.

Ended up needing to freeze the state as I pushed it into the Vuex store, so Vuex wouldn't check previously pushed state for changes.

My point is, there are multiple places where, if you are building an app of scale, you can run into client performance issues.

Re:JavaScript Is Weird on Monday June 28, 2021 @03:28PM (#27666625)
> The site is called "JavaScript Is Weird", not "Weird Javascript"

am i being punkd?

Re:JavaScript Is Weird on Monday June 28, 2021 @09:22AM (#27661617)
> Calling these things weird is fair enough but I can't help thinking this is code you'd never actually write outside of the context of a "Look how weird JS is!" post.

That is the whole premise of the site, though. They even say that these examples aren't common syntax or patterns before you start.

Re:AWS BugBust on Friday June 25, 2021 @12:07PM (#27632559)
Most of the comments are completely dunking on Amazon for this, though.
Re:Hasura GraphQL Engine and SQL Server on Friday June 18, 2021 @02:42PM (#27553483)
best solution is to use int/long primary keys, with a uuid column that has a unique index. then the uuid can be used with public-facing apis.
Re:80% of orgs that paid the ransom were hit again on Friday June 18, 2021 @02:34PM (#27553405)
Doesnt this just mean that 80% of orgs that were hit with ransomware attacks just didn't bother to fix their infosec, and got hit again because they left the same holes open to be exploited?

Fool me once, shame on you. Fool me twice, shame on me.

almost like having competition drives innovation up and prices down.

too bad most ISPs have literal monopolies over entire regions of people.

Re:It's time for a data-first front end revolution on Monday May 24, 2021 @08:37AM (#27263618)
Might explain why Reason seemed to have fallen off the face of the earth for me. I wasn't really keeping heavy tabs on it, but was more waiting for its tooling to be more mature.

Will have to check it out again, I suppose.

Re:WebContainers: Run Node.js natively in the browser on Thursday May 20, 2021 @03:02PM (#27225606)
> I like where Skypack is headed and this seems like the opposite direction.

I did a quick google search because I had never heard of Skypack.

Skypack seems to be a far cry away from what WebContainers is claiming to do. Like, they're completely different products. I guess I don't understand why you're even comparing the two.

Re:WebContainers: Run Node.js natively in the browser on Thursday May 20, 2021 @02:58PM (#27225545)
I'm not sure what the complaint is here. Isn't it something like 90% of the browser market is chromium-based, now that edge is on the bandwagon?

Supporting chrome/chromium doesn't seem like a bad place to start with a prototype with that kind of potential adoption.

Re:It's time for a data-first front end revolution on Tuesday May 18, 2021 @01:56PM (#27198496)
Yeah, now that you mention it, yeah. Elm is the natural progression down the functional programming rabbit hole for the frontend. Either that, or ReasonML, which I haven't seen much news for recently.
Re:It's time for a data-first front end revolution on Tuesday May 18, 2021 @01:55PM (#27198471)
completely agree. every React app that I have ran across that used 'best practices' for React development has been an unmaintainable dumpster fire.
Re:It's time for a data-first front end revolution on Tuesday May 18, 2021 @01:52PM (#27198420)
https://xkcd.com/927/

seems relevant.

On a more on-topic note -- this data-oriented structure seemed to be at the core of the goals of Vue 3, to the point where you don't even need to use their Flux implementation, Vuex, anymore for 100% vue3 projects.

Re:CSS Houdini on Wednesday May 12, 2021 @02:05PM (#27133315)
> A new layout mode (like CSS Grid) isn't available yet? This allows someone to write a polyfill for it. That's neat!

this was my first thought, too. We have polyfills for js features that don't yet exist in a lot of browsers, but polyfills for css are either very complicated or just don't exist in some cases.

Re:AI Dungeon public disclosure vulnerability report on Thursday April 29, 2021 @10:01AM (#26981264)
This. Your resolvers should still do access control. No different than a REST api would.
Re:AI Dungeon public disclosure vulnerability report on Thursday April 29, 2021 @10:00AM (#26981251)
I honestly dont see any different between graphql and a REST api, in terms of what data is available where.

if you have data you don't want publicly available, just.....don't include it in the model, and make sure your server implementation doesn't return it.

It is possible I don't understand your comment, I suppose, but I really don't see what is so unique about graphql from a security standpoint.

where I live, having reliable transportation (i.e. owning a car) is pretty much a job requirement wherever you work.

a lot of people don't exactly understand just how _sprawling_ the US is.

Older »