News for hackers. Stuff that matters.

serious_habit

Re:Train burglaries in LA on Friday January 14, 2022 @04:27PM (#29940681)
Outrageous behavior is being glorified because it drives clicks.

So many of these Alex Jones wannabe 'anti-maskers invade a store protesters', schoolboard meeting ravers get publicized because they get people fired up and drive clicks and ad revenue.

It's normalizing that the way to handle disagreement is to act out.

I'm sorry to say that this onslaught of terrible behavior isn't because people are tired of lockdowns, it's because it's great for driving ad traffic & getting $ from voters.

Re:Don’t try to sanitize input, escape output (2020) on Thursday January 13, 2022 @11:52AM (#29923066)
If I'm reviewing code and someone is implementing escaping that's an immediate, massive, red flag. It's SO HARD to get right and there are many MANY libraries for doing it correctly. The scary thing is how many bugs still make it into these libraries.

Strongly prefer using an established library and see designs such as https://web.dev/trusted-types.

Re:Don’t try to sanitize input, escape output (2020) on Thursday January 13, 2022 @11:35AM (#29922753)
Even better- never sanitize your data.

You should only use templating systems which safely handle user data. Don't use innerHTML assignments, don't concatenate user data into SQL queries. Use existing, validated libraries for generating HTML and SQL.

Re:CSVCHAIN - NFTs backed by CSV technology on Monday January 10, 2022 @03:54PM (#29882244)
Are NFTs a joke?