smagin
Falsehoods programmers believe about addresses (2013)
Re:Falsehoods programmers believe about addresses (2013)
on Friday March 13, 2026 @07:39AM (#47363086)
in light of zipcodefirst site
Re:Ask HN: Could you share your personal website here?
on Thursday January 15, 2026 @10:18AM (#46633696)
https://smagin.fyi/
That's my blog. I have opinions on software, make a couple of apps and patch other people programs when I like them enough.
People here liked https://smagin.fyi/posts/cross-site-requests/ this post the most.
The Science of Word Recognition
Re:Keyboard with Turntable Dials
on Monday October 06, 2025 @07:39AM (#45490278)
This feels like April 1st joke made in October. Like the Enter dial in particular.
Keyboard with Turntable Dials
Re:Passkeys and Modern Authentication
on Wednesday September 03, 2025 @03:29AM (#45113172)
Like the take that we need to authentificate more often nowadays. AWS makes it extreme — it resets login each 12 hours I reckon, and each time I need to click like 10 times, touch the fingerprint button 3 times (fill email, fill password, passkey), and I fail to imagine how it's not a security theater.
Re:
on Monday September 01, 2025 @06:21AM (#45091382)
Thanks for the information hierarchy / conceptual boundaries distinction, makes sense. I didn't know the latter term but tried to describe it in the last section of the post, nice to have a name now.
There are apps and sites that manage to keep the number of cards at min, one is selfridges (not an ad, was just open in another tab), another is firefox settings. MacOS Finder does a good job at grouping things with spacing, and macos generally. iOS seems to put everything on cards, at least nowadays.
Re:
on Monday September 01, 2025 @05:55AM (#45091228)
yup, that's a good part of the page to stand out, when I've seen all the landing page can show and now it nudges me to try the app out
Re:
on Monday September 01, 2025 @05:49AM (#45091182)
hm, I sort of agree with the train of thoughts but not with the conclusion. Maybe it's "is my blue your blue" situation. I talked to people while working on this post and some said e.g. grid with cards is way easier to them to scan through than grid without cards; other people feel the opposite and complain about too many things on the page that are not content. I'm in the latter category, but wondering if I could make an experiment, or if anyone made it already.
Thanks for getting me thinking this way.
Re:
on Monday September 01, 2025 @04:01AM (#45090590)
author here (not super educated either). That's part of the idea — when cards are removed it becomes obvious that tags become the most noticeable part while not being the most (or any) important one. When you look at the cards you see cards and _something_ inside them.
So maybe if this post was in less flame-provoking tone I'd suggest trying to add cards back and see if it makes it better. It might, on landings there is a good chance it will.
Re:How we made JSON.stringify more than twice as fast
on Tuesday August 05, 2025 @04:36AM (#44795667)
Unrelated but I have the easiest design improvement for your website: change <html> background color to #4285f4 (same as in topbar) so it looks like a sheet of paper on a blue base
Re:Ordinary life improvements 2018-2025
on Sunday May 25, 2025 @12:48PM (#44089032)
Gwern wrote a post about his everyday improvements in 2018, I thought I'd write a follow-up.
Ordinary life improvements 2018-2025
I Need Your Help to Improve Money Formatting on the Internet
Re:Why do we have both CSRF protection and CORS?
on Tuesday March 04, 2025 @03:44AM (#43252061)
oh god you're right https://stackoverflow.com/a/57206146/1685746 yeah sure what can go wrong, let's listen to fetch and modify requests in a service worker.
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @02:00PM (#43245385)
I asked that in the post but nobody answered still, let's try here.
Why are CSRF tokens rotated? OWASP says it's somehow more secure but I don't really see why.
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @01:47PM (#43245253)
not even you don't need to, you shouldn't. Sessions shouldn't be accessible to js at all
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @12:11PM (#43244087)
mitm means you can control users network, doesn't it?
Another question, does this work with https?
And the third one, if this was the thing some dishonest governments or vpn providers would do this already. Would be cool to read on that (genuinely, not implying this never happened)
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @10:56AM (#43242956)
You shouldn't need your session token in JS, you can specify your fetch requests to include cookies, and you can setup CORS to allow that.
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @10:37AM (#43242750)
> How does server know the cookie is valid if it doesn't store it
depending on why you'are asking the question, * because it decrypts correctly * because it contains some user identifier
People don't usually store sessions in cookies because cookies can't be very big, and session do become big. So what people do instead they store cookies in databases, and put session identifiers into cookies.
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @07:20AM (#43241056)
Why would you need that?
Also, one thing I can speculate that phishing would become even easier if such things were allowed
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @07:10AM (#43240991)
This is my blog. I haven't posted all the articles from there to hackernews. I think some of them are not worth discussing because too old or too poorly written, but some are just not posted because I didn't think of it at the time. Thanks for the interest, I will re-read what I wrote and post some.
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @07:07AM (#43240967)
it is true. But again, writes are allowed, reads are not, you won't be able to see the reply. Which author of the question eventually realised https://stackoverflow.com/a/44122076/1685746
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @07:00AM (#43240922)
well it does make sense to assume that by default different origins belong to different people, and some of those people don't have to behave friendly to each other.
There is little server can do with that, because of the request-based model. The state that persists between requests lives in cookies, and it's browser job not to expose those cookies all around. Turning off single origin policy would be a terrible idea. For one, it makes CSRF work by not allowing cross-origin reads.
Re:Why do we have both CSRF protection and CORS?
on Monday March 03, 2025 @04:08AM (#43239852)
yup. You didn't imply it but just in case -- this token shouldn't be the same as session token. Session tokens should be `HttpOnly`, so that we don't even expose it to javascript
Re:Why do we have both CSRF protection and CORS?
on Sunday March 02, 2025 @05:58PM (#43236174)
oh hell yes. And oh yes iframes and postmessages, of course people would setup them incorrectly and even if they do some (probably not that important but still) data will leak if you're creative enough. Thanks for the link!
Re:Why do we have both CSRF protection and CORS?
on Sunday March 02, 2025 @05:44PM (#43236053)
"search this site in google" shouldn't even be a POST request, but yeah, when we'll have better defaults for cookies it should work nicer. And if you are a web developer, you should check your session cookie attributes and explicitly set them to SameSite=Lax HttpOnly unless your frameworks does that already and unless you know what you're doing
Re:Why do we have both CSRF protection and CORS?
on Sunday March 02, 2025 @05:36PM (#43235993)
you're right, you can initiate cross-site requests that _could be_ form submissions. It was even in the post but I thought I'd omit that bit for clarity. I should have decided otherwise.