- Mar 2023
-
blog.cmpxchg8b.com blog.cmpxchg8b.com
-
I believe that SMS 2FA is wholly ineffective, and advocating for it is harmful.
Would this also appyl to OTP by e-mail??
-
Unique Passwords and U2F are not perfect, but they are good. Unique Passwords reduce the impact of phishing, but can’t eliminate it. U2F doesn’t prevent malware, but does prevent phishing.
-
This argument only works if what you’re defending is good. As I’ve already explained, SMS-2FA is not good.
-
Don’t let the perfect be the enemy of the good. Seat belts aren’t perfect either, do you argue we shouldn’t wear them? Etc, etc. This argument only works if what you’re defending is good. As I’ve already explained, SMS-2FA is not good.
-
If you also want to eliminate phishing, you have two excellent options. You can either educate your users on how to use a password manager, or deploy U2F, FIDO2, WebAuthn, etc. This can be done with hardware tokens or a smartphone.
-
You are currently allowing your users to choose their own password, and many of them are using the same password they use on other services. There is no other possible way your users are vulnerable to credential stuffing.
-
If you use a third party password manager, you might not realize that modern browsers have password management built in with a beautiful UX. Frankly, it’s harder to not use it.
-
If you’re a security conscious user... You don’t need SMS-2FA. You can use unique passwords, this makes you immune to credential stuffing and reduces the impact of phishing. If you use the password manager built in to modern browsers, it can effectively eliminate phishing as well.
not needed: password manager: 3rd-party
-
We have a finite pool of good will with which we can advocate for the implementation of new security technologies. If we spend all that good will on irritating attackers, then by the time we’re ready to actually implement a solution, developers are not going to be interested.
-
t’s important to emphasise that if you don’t reuse passwords, you are literally immune to credential stuffing.
Tags
- passwords: don't reuse passwords
- good point
- security: phishing
- password manager: 3rd-party
- passwords: use unique passwords
- WebAuthn
- not good enough reason/rationale/explanation
- security: credential stuffing
- interesting point
- authentication
- finite supply
- not good
- good enough
- OTP by SMS
- interesting way of thinking about it
- password manager: built into browser
- ineffective
- not needed
- weak argument
Annotators
URL
-
-
dictionary.cambridge.org dictionary.cambridge.org
-
build something in/into something phrasal verb with build verb
-
-
www.reddit.com www.reddit.com
-
You can also find the combination verb+in+to, but in that case you're usually dealing with a phrasal verb consisting of a verb and the particle "in", which happens to be followed by the preposition "to".They wouldn't give in to our demands.
-
"Built in to" appears when you use the phrasal verb "build in" followed by an infinitive, but that is not what you are trying to do in your sentence.There's an electronic switch built in to stop all data transfers.
-
-
www.chompchomp.com www.chompchomp.com
-
The house, of course, is not doing the agreeing; Cooper is! Because of the distance between Cooper and the participle phrase that describes him, the comma is necessary.
-
A present participle phrase will always act as an adjective while a gerund phrase will always behave as a noun.
-
-
-
english.stackexchange.com english.stackexchange.com
-
So in your example, you would not use a hyphen: "You can use the types [that are] built in to the library."
-
How can this be called an adjective? The postmodifier here is a participle phrase, 'built into the library'.
-
take off, should also be counted as a (multi-word) verb.
-
Using a hyphen is the wrongest thing to do here.
-
-
stackoverflow.com stackoverflow.com
-
Unfortunately all SMS/voice gateway are owned by paid services, thus there is no such thing as open-source, that I can recommend.
-
Fortunately, we found RingCaptcha (https://ringcaptcha.com), which has a the 'starter plan' that offers free 500 OTP monthly. Just a small plug for them for providing freemium service; they are highly reliable because they are integrated with all major global, and regional providers, e.g., Twilio, Nexmo, Infobip, MessageBird, etc., and send your OTP through the best provider/route based on country/phone carrier, and can auto fallback to alternative paths. This means you just need to integrate with RingCaptcha, without the headache of deciding which SMS/voice OTP provider has best combination of price and reliability, which is a real headache when you are sending OTP world-wide.
-
-
apps.apple.com apps.apple.com
-
the issues I've always had with it: No support. As in, no one in Google's support organization has any clue about what this app does. No support group discussions as far as I can tell ("Smart Lock" is too generic to really find anything). That's not surprising, because while I've figured out how it works/what it does in my use case, there's really no clear documentation on it - like what it even does, really.
-
No support group discussions as far as I can tell ("Smart Lock" is too generic to really find anything).
too generic
-
-
www.arengu.com www.arengu.com
-
like the one in the picture.
.
-
-
-
stackoverflow.com stackoverflow.com
-
{{#discriminator.mappedModels}} {{#-first}} {{#vendorExtensions.x-useDeduction}} @JsonTypeInfo(use = JsonTypeInfo.Id.DEDUCTION) {{/vendorExtensions.x-useDeduction}} {{^vendorExtensions.x-useDeduction}}
-
-
www.quora.com www.quora.com
-
Most platforms that require OTP verification for ensuring security are targeted at the mobile phone only. But some payment gaterways send OTP to email address also simultaneously to doubly ensure that you get the OTP and that you have requested the OTP. There could be some delay in SMS or email reaching you. Many OTPs are time restricted - you have to use them quickly.
-
-
m.egwwritings.org m.egwwritings.org
-
It is a law of nature that our thoughts and feelings are encouraged and strengthened as we give them utterance. While words express thoughts, it is also true that thoughts follow words. If we would give more expression to our faith, rejoice more in the blessings that we know we have,—the great mercy and love of God,—we should have more faith and greater joy. No tongue can express, no finite mind can conceive, the blessing that results from appreciating the goodness and love of God. Even on earth we may have joy as a wellspring, never failing, because fed by the streams that flow from the throne of God.
Tags
Annotators
URL
-
-
datatracker.ietf.org datatracker.ietf.org
-
-
It is also used to migrate existing clients using direct authentication schemes such as HTTP Basic or Digest authentication to OAuth by converting the stored credentials to an access token.
-
-
github.com github.com
-
Double quotes for string literals - because pre-committing to whether you'll need interpolation in a string slows people down
Tags
Annotators
URL
-
-
datatracker.ietf.org datatracker.ietf.org
-
Another option would be to implement a delay scheme to avoid a brute force attack. After each failed attempt A, the authentication server would wait for an increased T*A number of seconds, e.g., say T = 5, then after 1 attempt, the server waits for 5 seconds, at the second failed attempt, it waits for 5*2 = 10 seconds, etc.
-
The reason for masking the most significant bit of P is to avoid confusion about signed vs. unsigned modulo computations. Different processors perform these operations differently, and masking out the signed bit removes all ambiguity.
-
The lack of interoperability among hardware and software technology vendors has been a limiting factor in the adoption of two-factor authentication technology. In particular, the absence of open specifications has led to solutions where hardware and software components are tightly coupled through proprietary technology, resulting in high-cost solutions, poor adoption, and limited innovation.
-
-
-
en.wikipedia.org en.wikipedia.org
-
www.networkworld.com www.networkworld.com
-
Protocols are, by their very nature, open. If you can't read the protocol specification then you can't very well implement it, can you?
-
As others pointed out, OATH's claims of "open source" have little meaning when compared to other authentication protocols such as SAML. When you include the entire Liberty Alliance specifications as well as the Web Services Initiative protocols and methods (as devised by Microsoft and IBM) there's nary a proprietary bit of code involved. Actually, there's no code involved at all. Protocols are, by their very nature, open. If you can't read the protocol specification then you can't very well implement it, can you?
-
-
en.wikipedia.org en.wikipedia.org
-
the output is 20 bytes, and so the last byte is byte 19 (0-origin).
-
It is suggested that verification be locked out after a small number of failed attempts or that each failed attempt attracts an additional (linearly increasing) delay.
-
-
en.wikipedia.org en.wikipedia.org
-
One-time passwords are generated on demand by a dedicated OATH OTP authenticator that encapsulates a secret that was previously shared with the verifier. Using the authenticator, the claimant generates an OTP using a cryptographic method. The verifier also generates an OTP using the same cryptographic method. If the two OTP values match, the verifier can conclude that the claimant possesses the shared secret.
-
-
www.mediawiki.org www.mediawiki.org
-
bitwarden.com bitwarden.com
-
We believe that being open source is one of the most important features of Bitwarden. Source code transparency is an absolute requirement for security solutions like Bitwarden.
Tags
Annotators
URL
-
-
www.pcmag.com www.pcmag.com
-
But getting codes by phone turns out not to be not very secure at all. A vulnerability in SMS messaging is that crooks can reroute text messages(Opens in a new window).
-
Unlike the other apps listed here, Authy requires your phone number when you first set it up. We're not fans of this requirement, since we’d rather have the app consider our phones to be anonymous pieces of hardware; and some have suggested that requiring a phone number opens the app up to SIM-card-swap fraud.
-
2FAS doesn't need your phone number or even require you to create an online account, so it's not susceptible to SIM-swapping fraud.
-
-
datatracker.ietf.org datatracker.ietf.org
-
The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.
-
-
The authors believe that a common and shared algorithm will facilitate adoption of two-factor authentication on the Internet by enabling interoperability across commercial and open-source implementations.
-
-
github.com github.com
-
More maintained alternative: https://github.com/tinfoil/devise-two-factor
Tags
Annotators
URL
-
-
developers.facebook.com developers.facebook.com
-
Businesses can send message templates to up to 250 unique customers in a rolling 24-hour period
-
-
forum.xda-developers.com forum.xda-developers.com
-
On my ZE620KL nothing worked, many tries, I waited a few days and it didn't work. Even changing the rom for an official Asus rom (without root) the app kept saying that the device is not safe. It only started to allow contactless payment after relocking the bootloader. I believe that in my case, gpay did not work by detecting the unlocked bootloader. Edit The device passed all tests, safenet, Google protect, basic, CTS (with root). but it still only worked after relocking the bootloader
.
-
-
kevinjmurphy.com kevinjmurphy.com
-
Our test raises an ActiveRecord::RecordNotFound exception. We know that Rails has special handling to return a 404 status code in this case. However, the request spec still raises the exception.
-
-
-
bugs.ruby-lang.org bugs.ruby-lang.org
-
Finding good names is quite difficult. Single words are also almost always better than combined names, even though one is a bit limited with single words alone. There are exceptions though. For example .each_with_index or .each_index are good names, IMO.
Tags
Annotators
URL
-
-
www.outlookmag.org www.outlookmag.org
Tags
Annotators
URL
-
-
learningtakesalifetime.home.blog learningtakesalifetime.home.blog
-
And, my kids learned all about the inner workings of the car in areas that are usually hidden. This was an exhilarating accomplishment, and a triumph of a homeschool project. I hope to do more with the kids over the years so that they have practical life skills, and I encourage other parents to work with their children to fix the family car.
-
I am not a mechanic, but I like to dabble in fixing whatever is at hand, especially when it saves our family money.
-
-
www.dailywritingtips.com www.dailywritingtips.com
-
Why is it, then, that although publicly is far more common as the adverbial form of public than publically, the ratio of usage has diminished? Publically is becoming more common for the same reason that people write irregardless in place of regardless or write “diffuse the situation” instead of “defuse the situation” or “all of the sudden” rather than “all of a sudden”: evolution. Language is, in a sense, alive, and just as life itself evolves, so does language—but note that the primary definition of evolution is not “improvement”; it simply means “change.” And how does language change? The change is modeled: New words are coined, or new senses of existing words develop (or new spellings or new forms occur), because someone, somewhere acts to make it so, and the evolution goes viral.
-
First, dictionaries are not arbiters of highly literate writing; they merely document usage. For example, irregardless has an entry in many dictionaries, even though any self-respecting writer will avoid using it—except, perhaps, in dialogue to signal that a speaker uses nonstandard language, because that is exactly how some dictionaries characterize the word. Yes, it has a place in dictionaries; regardless of that fact, its superfluous prefix renders it an improper term.
what to call these words? illiterate words?
-
-
www.dol.wa.gov www.dol.wa.gov
-
www.dol.wa.gov www.dol.wa.gov
-
Washington wallet-sized birth registration cards aren’t accepted
Tags
Annotators
URL
-
-
www.dol.wa.gov www.dol.wa.gov
-
Ultra-high frequencies typically offer better range
better range for bad actors to try to steal the data from my tag?
-
Does the EDL/EID card transmit my personal information? No. The RFID tag embedded in your card doesn't contain any personal identifying information, just a unique reference number.
Can this unique reference number be used to identify me (assuming they've already identified me another way and associated this number with me)? Yes!!
So this answer is a bit incomplete/misleading...
-
-
www.mailgun.com www.mailgun.com
-
Our transactional and marketing email services allow you to send emails effortlessly.
-
-
With comprehensive drag-and-drop email builders like Mailgun's Drag-and-Drop Template Builder, or a responsive email language like MJML, you can create and change up your email marketing campaigns with ease
-
-
www.mailjet.com www.mailjet.com
-
Code your own template with HTML, or use our markup language MJML, the only framework that makes creating responsive designs easy.
-
-
www.mailjet.com www.mailjet.com
-
-
Send me the Mailjet newsletter. I expressly agree to receive the newsletter and know that I can easily unsubscribe at any time.
-
-
www.mailgun.com www.mailgun.com
Tags
Annotators
URL
-
-
github.com github.com
-
What are transactional emails? Typically any email that is triggered by or sent automatically from your application.
-
Welcome emails Actionable emails Password resets Receipts Monthly invoices Support requests App error alerts Reminders etc.
-
-
serversmtp.com serversmtp.com
-
for instance, when the recipient’s address is full (a soft bounce: just wait and re-send) or worst, when it’s non-existent (a hard bounce: you need to remove the account from your list)
-
-
-
Don't be a lump on a log. See an issue? Have a suggestion? Want to help? Well git in there!
Tags
Annotators
URL
-
-
rd.digital rd.digital
Tags
Annotators
URL
-
-
refactoring.guru refactoring.guru
-
mixandgo.com mixandgo.com
-
www.typescriptlang.org www.typescriptlang.org
-
A Method Decorator is declared just before a method declaration.
-
const requiredMetadataKey = Symbol("required");
-
-
tarasevich.wordpress.com tarasevich.wordpress.com
-
yehudakatz.com yehudakatz.com
-
stackoverflow.com stackoverflow.com
-
As an aside, I think I now prefer this technique to Python for at least one reason: passing arguments to the decorator method does not make the technique any more complex. Contrast this with Python: <artima.com/weblogs/viewpost.jsp?thread=240845>
-
When you call 'foo' in Ruby, what you're actually doing is sending a message to its owner: "please call your method 'foo'". You just can't get a direct hold on functions in Ruby in the way you can in Python; they're slippery and elusive. You can only see them as though shadows on a cave wall; you can only reference them through strings/symbols that happen to be their name. Try and think of every method call 'object.foo(args)' you do in Ruby as the equivalent of this in Python: 'object.getattribute('foo')(args)'.
-
def document(f): def wrap(x): print "I am going to square", x f(x) return wrap @document def square(x): print math.pow(x, 2) square(5)
-
-
german.stackexchange.com german.stackexchange.com
-
einwärts gewandter Spitze
-
Gänsefüßchen
literally, "little duck feet"
-
-
www.washington.edu www.washington.edu
-
Unless physical stature is of relevance in a conversation, simply using a person's name is appropriate.
-
-
support.google.com support.google.com
-
I am a developer, and we are developing the app for the customer, that will not publish through the google play store. But when we distribute the app to the customer, customer get that error. I want to avoid that alert of the Play stored.I want to understand, exactly which security concern has been break by my app.
-
-
www.droidwin.com www.droidwin.com
-
The benefits of getting administrative privileges over an open-source OS like Android stands aplenty. Among them, it’s the ability to flash modules and tweaks that is at the top of the priority queue, However, this is just one side of the coin. Rooting has its own downsides as well, the primary among them is the fact that SafetyNet getting triggered.
-
-
-
www.xda-developers.com www.xda-developers.com
-
Google has had the ability to harden SafetyNet checks using hardware-backed key attestation for several years now. The fact that they refrained to do so for 3 years has allowed users to enjoy root and Magisk Modules without sacrificing the ability to use banking apps. However, it seems that Magisk's ability to effectively hide the bootloader unlock status is soon coming to an end. It's a change that we've expected for years, but we're sad to see it finally go into effect.
-
-
-
www.reddit.com www.reddit.com
-
-
The conflict of interest he now has is evident but that's not something that should be used to flame him, it's just the way it is.
-
-
www.xda-developers.com www.xda-developers.com
-
Fortunately, topjohnwu has been given the green light to continue developing Magisk, but this approval is contingent on the project dropping support for its root hiding feature called MagiskHide.
.
-
-
litmus.com litmus.com
-
myemma.com myemma.com
-
ux.stackexchange.com ux.stackexchange.com
-
-
For people like me, who believe that accessibility applies to all users, the following two words come to mind: Inclusive design. The British Standards Institute (2005) defines inclusive design as "The design of mainstream products and/or services that are accessible to, and usable by, as many people as reasonably possible..."
inclusive design
-
-
webapps.stackexchange.com webapps.stackexchange.com
-
Conversations are collections of messages that all have the same Subject. When "conversation mode" is on, searches return entire conversations as results. So what should gmail search do if a conversation contains both a message that matches, and a message that does not match your search? You are probably expecting it to return conversations only if all messages in that conversation match. But that is not correct. Instead, Gmail search will return conversations even if only a single message in that conversation matches. So that means that if you do the same search above with "conversation mode" on, the results are likely to include messages that do not match your search!
-
- Feb 2023
-
github.com github.com
-
I am a software engineer, canoeist, gardener and and all-round tinkerer. I got into software because of my curiosity about how things work. I kept asking “why” until I eventually found myself doing it for a job. I love the range of work I get to do as an engineer. My work often focuses on performance improvements and coaching teams in code design choices. I value thoughtful communication that amplifies marginalized voices in the workplace.
-
-
github.com github.com
-
As a general practice, it seems like gems should remain compatible with current/recent versions of their dependencies. Otherwise, if you have 2 gems in your project that depend on faraday, and one of those is locked to faraday 0.17.6, and the other requires at least 2.x, then you have a problem...
Tags
Annotators
URL
-
-
stackoverflow.com stackoverflow.com
-
Note though, that this only works when you're already using git for your dependency
I was trying to figure out why it wasn't working for me. This was probably the reason.
So if you just have
gem 'rack'
, it just silently has no effect.It seems like it should just work either way. Or at least give a warning/error if you try to use this config and it's not going to use that config!
-
-
github.com github.com
-
It looks like we are all in agreement that command line flags should be stateless
Tags
Annotators
URL
-
-
-
The official Bambora Ruby library is not thread-safe. This means you will run into errors when using it with Sidekiq or Puma. This gem is a thread-safe client for the Bambora and Beanstream APIs.
-
-
stackoverflow.com stackoverflow.com
-
Forwarding will always break emails specially in Outlook as it adds it's own code before composing. You can have a forward link on emails which takes you to a page to forward to a friend or you can go with a broken email when it's forwarded. It's harsh I know but there is no way around it.
-
-
www.reviewgeek.com www.reviewgeek.com
-
It used to be a lot more common for people to have work and personal phones before the internet made it possible for work to take over every aspect of your day to day life.
-
-
stackoverflow.com stackoverflow.com
-
Its outlooks rubbish filtering system. They have "AI" rules that look at the sending ip address for reputation. They score you on user reportsand lots of other bits they will not tell you about. Make sure you have SPF, DMARC, DKIM, and sign up for their JMRP and SDNS they will tell you. But it still is a game of cat and mouse. Its a slippery slope and even Microsoft trap their own mail to their own outlook users. PITA, to be honest and luckily we managed to get a mitigation to the issue. However some users in different domains still complain of email going to JUNK. Go figure. I hate having to work on issues with Outlook.com. They themselves send out spam and have the audacity to block well configured SMTP senders. I wish you luck. You will need it.
-
-
discussions.apple.com discussions.apple.com
-
software that thinks it knows better than you
Tags
Annotators
URL
-
-
discussions.apple.com discussions.apple.com
-
software that thinks it knows better than you
Tags
Annotators
URL
-
-
www.codetwo.com www.codetwo.com
-
software that thinks it knows better than you
Tags
Annotators
URL
-
-
apple.stackexchange.com apple.stackexchange.com
-
But, since they'll automatically encode in rich text if there are any HTML tags placed in the message by the device itself, putting a single space ( ) in the signature via the mail app itself, and then bold/italic-izing said space makes it work.
-
-
forums.macrumors.com forums.macrumors.com
-
The issue is that Mail isn't behaving as expected. If I tell it to always send messages as Rich Text I expect it to send them as Rich Text no matter what. Instead, sometimes it will send out emails as plain text. This is clearly an issue with Mail. If, for example, you tell your word processor of choice, be it Pages, LibreOffice or Word, to save all your documents as ODF files you expect it to do so no matter what and not to automatically revert to TXT files for documents that you haven't formatted yet without giving you proper notice, thereby preventing you from ever formatting those particular documents in the future.
software that thinks it knows better than you
software doing things without giving you notice
-
-
answers.microsoft.com answers.microsoft.com
-
This problem has been reported on these forums many, many times over the last few years and MS always quote the same non-answer but never get around to fixing it.
-
-
github.com github.com
-
Rack::Session was moved to a separate gem. Previously, Rack::Session was part of the rack gem. Not every application needs it, and it increases the security surface area of the rack, so it was decided to extract it into its own gem rack-session which can be updated independently.
-
-
github.com github.com
-
prefer https://github.com/leandromoreira/redlock-rb over this
-
Destroys the concurrency of your ruby code using Redis.
-
-
stackoverflow.com stackoverflow.com
-
The reason is Rails only reads and creates the session object when it receives the request and writes it back to session store when request is complete and is about to be returned to user.
-
Session race conditions are very common in Rails. Redis session store doesn't help either! The reason is Rails only reads and creates the session object when it receives the request and writes it back to session store when request is complete and is about to be returned to user.
-
-
-
As you can see from the example, the session cookie is updated on every request, regardless of if the session was modified or not. Depending on when the response gets back to the client last, thats the cookie that will be used in the next call. For example, if in our previous example, if get_current_result’s response was slower than get_quiz, then our cookie would have the correct data and the next call to update_response would of work fine! So sometimes it will work and sometimes not all depending on the internet gods. This type of race condition is no fun to deal with. The implications of this is that using cookie storage for sessions when you are doing multiple ajax call is just not safe.
-
A better solution would be to use a server side session store like active record or memcache. Doing so prevents the session data from being reliant on client side cookies. Session data no longer has to be passed between the client and the server which means no more potential race conditions when two ajax are simultaneously made!
-
-
guides.rubyonrails.org guides.rubyonrails.org
-
If you already have an instance of your model, you can start a transaction and acquire the lock in one go using the following code: book = Book.first book.with_lock do # This block is called within a transaction, # book is already locked. book.increment!(:views) end
-
-
www.martinfowler.com www.martinfowler.com
-
Event Replay: If we find a past event was incorrect, we can compute the consequences by reversing it and later events and then replaying the new event and later events. (Or indeed by throwing away the application state and replaying all events with the correct event in sequence.) The same technique can handle events received in the wrong sequence - a common problem with systems that communicate with asynchronous messaging.
-
-
www.martinfowler.com www.martinfowler.com
-
As our needs become more sophisticated we steadily move away from that model. We may want to look at the information in a different way to the record store, perhaps collapsing multiple records into one, or forming virtual records by combining information for different places. On the update side we may find validation rules that only allow certain combinations of data to be stored, or may even infer data to be stored that's different from that we provide.
Tags
Annotators
URL
-
-
www.makeuseof.com www.makeuseof.com
-
If you haven't seen it yet, check out the PinePhone Pro and its docking station. Much like the Steam Deck's docking station, it plugs the phone into a monitor, keyboard, and mouse to turn your phone into a PC.
-
When Ubuntu was confronted with making Debian user friendly, the issue was speeding up software updates. Manjaro has the opposite issue with Arch and is handling it appropriately.
-
-
cachyos.org cachyos.org
Tags
Annotators
URL
-
-
unix.stackexchange.com unix.stackexchange.com
-
B/ Mainline kernel offers many ways to increase desktop responsiveness without the need to patch or reconfig it. Many tweaks can be activated using the cfs-zen-tweaks you can download and just run but I would advise you just read the very simple code and learn how each of the tweaks impact. Don't hesitate to lower the priority of your cpu-bound processes (compilations, simulations...) and increase the priority of your interactive tasks thanks to the renice command and even change their scheduling policy using chrt Ultimately, you can always pin interrupts to dedicated cpus (setting desired values in /proc/irq/[irq_id]/smp_affinity) , having one in charge of the keyboard and the mouse, another one for the graphic adaptor a third one for the sound card and a fourth one housekeeping for all the possible remaining. Just plenty of solutions left opened without changing a byte in your distro-kernel.
-
-
stanfordmag.org stanfordmag.org
-
www.healthline.com www.healthline.com
-
github.com github.com
-
-
Sure, eagerly failing loudly would be better also. The outcome is still the same - you wouldn’t be able to do the thing you want, you just would be informed faster.
-
deleting user files without being asked for is by far an "unsafe in nonzero scenarios" decision, no program should do it. The sane option is to refuse working and/or display a visible warning explaining why.
-
There should thus be an option to give npm a list of vulnerability IDs (CVEs etc.) that it does not need to defend because the admin has decided it does not apply to their edge case.
should be optional
-
-
-
If the answer to this is "no" with some set of reasons, that's a perfectly reasonable outcome.
-
The intent of this RFC is to do that - propose a solution. I do not expect that this solution will go through unanimously and unchanged, but I'd like to get something up that can be talked about and addressed both by the ecosystem and by those thinking about Security in the registry and CLI.
-
There's been an interest expressed in the ecosystem of having some form of counterclaim for advisories surfaced by npm audit. There's been some discussion of a potential counterclaim mechanism for some time, but I've not seen a solution proposed.
-
-
medium.com medium.com
-
-
Scaling a single VCS to hundreds of developers, hundreds of millions lines of code, and a rapid rate of submissions is a monumental task. Twitter’s monorepo roll-out about 5 years ago (based on git) was one of the biggest software engineering boondoggles I have ever witnessed in my career. Running simple commands such as git status would take minutes. If an individual clone got too far behind, it took hours to catch up (for a time there was even a practice of shipping hard drives to remote employees with a recent clone to start out with). I bring this up not specifically to make fun of Twitter engineering, but to illustrate how hard this problem is. I’m told that 5 years later, the performance of Twitter’s monorepo is still not what the developer tooling team there would like, and not for lack of trying.
-
In very large code bases, it is likely impossible to make a change to a fundamental API and get it code reviewed by every affected team before merge conflicts force the process to start over again.
-
Developers are faced with two realistic choices. First, they can give up, and work around the API issue (this happens more often than we would like to admit).
-
-
english.stackexchange.com english.stackexchange.com
-
en.wikipedia.org en.wikipedia.org
-
One approach to avoiding this kind of problem is regression testing. A properly designed test plan aims at preventing this possibility
The antecedent of "this possibility" is unclear. (Perhaps it used to be clear and then someone else made an edit and added a sentence in between?)
Tags
Annotators
URL
-
-
www.appsloveworld.com www.appsloveworld.com
-
As mentioned in comment by @Tyler Rick Capybara in these days have methods[ ancestor(selector) and sibling(selector)
-
-
stackoverflow.com stackoverflow.com
-
Capybaras ancestor and sibling methods are called on an element and take the same parameters as find. They are implemented by locating all elements that match the passed in parameters and intersecting that with the set of ancestor or sibling elements respectively.
-
-
patrickbrosset.medium.com patrickbrosset.medium.com
-
www.dekudeals.com www.dekudeals.com
-
www.iubenda.com www.iubenda.com
-
Apple can afford to make user privacy a priority AND be very strict about cookies because its revenue does not strongly depend on advertising.
-
-
store.steampowered.com store.steampowered.com
-
Discolored doesn't answer any questions like why the color is gone, why it's your job to fix them or how you even can, or why the player should even care about fixing the color; Discolored just tells you to do it.
-
-
Tags
Annotators
URL
-
-
rebrickable.com rebrickable.com
-
Premium MOC tax support. Yaay, taxes. I think this one takes the award for most effort required to implement a feature that no-one really wants.
-
-
www.bricklink.com www.bricklink.com
-
eBay got jealous when Dan’s site began to grow in leaps and bounds and made him change his name to Bricklink two years later.
Can they really do that? The name seems different enough?
-
Tags
Annotators
URL
-
-
rebrickable.com rebrickable.com
-
Post a publicly viewable comment on the MOC asking why you haven't received it yet
-
-
rubystyle.guide rubystyle.guide
-
to break up methods into logical paragraphs internally.
Interesting to call them "paragraphs" :)
-
-
graphql.org graphql.org
-
[Episode!]! represents an array of Episode objects. Since it is also non-nullable, you can always expect an array (with zero or more items) when you query the appearsIn field. And since Episode! is also non-nullable, you can always expect every item of the array to be an Episode object.
Note that this still allows an empty array,
[]
. It only disallows:null
and[null]
.
-
-
www.leblancwingchun.com www.leblancwingchun.com
-
So, when fighting, one should fix one's eyes firmly on the target with only one idea in mind, that of attacking the enemy most simply and directly.
.
-
Having excessive ideals with regard to fighting will cause one to be far too nervous. Wing Chun theory is flawless indeed if one can accomplish it absolutely, but a theory is only just a theory, never can a person reach such a state of perfection, human beings are all apt to make mistakes at some time or another.
no one is perfect
-
We welcome your feedback on the accessibility of this site. If you have specific questions or feedback about this site's accessibility or need assistance using specific features, please contact us. If you have found an inaccessible area on the site, please specify the web page or element, and provide any other relevant information to help us locate the problem. In the event a page cannot be made accessible, we will work with you to make a text version of the content available. Please contact us via telephone or email to request a specific electronic format. Additionally, please provide us with your contact information, the format you require, the web page address, and the location of the content. We welcome your questions about this accessibility statement and comments on how to improve our website's accessibility.
-
-
github.com github.com
-
Strip unsafe tags, leaving behind only the inner text. Prune unsafe tags and their subtrees, removing all traces that they ever existed. Escape unsafe tags and their subtrees, leaving behind lots of < and > entities. Whitewash the markup, removing all attributes and namespaced nodes.
-
It includes some nice HTML sanitizers, which are based on HTML5lib's safelist, so it most likely won't make your codes less secure. (These statements have not been evaluated by Netexperts.)
Tags
Annotators
URL
-
-
stackoverflow.com stackoverflow.com
-
You can simulate a pre-checkout git hook:
-
Result of lots of searching on net is that pre-checkout hook in git is not implemented yet. The reason can be: There is no practical use. I do have a case It can be achieved by any other means. Please tell me how? Its too difficult to implement. I don't think this is a valid reason
-
-
stackoverflow.com stackoverflow.com
-
If you want a workaround for the case where you can't just replace key with a string literal, you could write your own user-defined type guard function called hasProp(obj, prop). The implementation would just return prop in obj, but its type signature explicitly says that a true result should cause obj to be narrowed to just those union members with a key of type prop: function hasProp<T extends object, K extends PropertyKey>( obj: T, prop: K ): obj is Extract<T, { [P in K]?: any }> { return prop in obj; } and then in your function, replace key in a with hasProp(a, key): function f3(a: A) { const key = 'b'; if (hasProp(a, key)) { return a[key]; // okay } return 42; }
-
-
medium.com medium.com
-
The variable x initially has the type unknown: the type of all values. The predicate typeof x === "number" extracts dynamic information about the value bound to x, but the type-checker can exploit this information for static reasoning. In the body of the if statement the predicate is assumed to be true; therefore, it must be the case the value bound to x is a number. TypeScript exploits this information and narrows the type of x from unknown to number in the body of if statement.
-
-
datatracker.ietf.org datatracker.ietf.org
Tags
Annotators
URL
-
-
en.wikipedia.org en.wikipedia.org
-
-
blog.appsignal.com blog.appsignal.com
-
The majority of real-world software benefits from the fast warm-up and performance enhancements provided by the YJIT basic block versioning JIT compiler.
-
- Jan 2023
-
wordpress.org wordpress.org
-
Do Not Post About Commercial Products For support of commercial themes or plugins, go to the official support channel. In order to be good stewards of the WordPress community, and encourage innovation and progress, we feel it’s important to direct people to those official locations. Doing this will provide the developer with the income they need to make WordPress awesome. Forum volunteers are also not given access to commercial products, so they would not know why a commercial theme or plugin is not working properly. Ultimately, the vendors are responsible for supporting their commercial product. If you are a vendor and observe someone asking questions about your paid plugin or theme, please direct them towards your own support resources.
Tags
Annotators
URL
-
-
stackoverflow.com stackoverflow.com
-
As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center. – Community Bot
How can a bot judge that the answer is unclear?
Why doesn't it also suggest what about it is unclear and suggestions for improving it while it's at it?
-
-
documentation.mailgun.com documentation.mailgun.com
-
Mailgun is primarily a developer’s tool so the best way use Mailgun is through our APIs.
developers first API first
-
-
rubystyle.guide rubystyle.guide
-
Do not separate numbers from letters on symbols, methods and variables.
Okay... Why not?
-
These words are redundant and inconsistent with the style of boolean methods in the Ruby core library, such as empty? and include?.
Tags
Annotators
URL
-
-
stackoverflow.com stackoverflow.com
-
stackoverflow.com stackoverflow.com
-
click_link('Create Account', match: :first) It's better than first(:link, 'Create Account').click as it will wait till at least one Create Account link will appear on the page. However I believe it's better to choose unique locator that doesn't appear on the page twice.
-
-
rails.rubystyle.guide rails.rubystyle.guide
-
Since Rails creates callbacks for dependent associations, always call before_destroy callbacks that perform validation with prepend: true.
-
-
bugs.ruby-lang.org bugs.ruby-lang.org
-
This depends on the ruby code. Some projects will be semi-dormant due to various reasons. That's for us to address as a community. Are we going to let a single decade-old gem prevent us from moving Ruby forward? What's the threshold? There's libraries out there that don't work on Ruby 1.9. We left them behind or replaced them. And are people depending on a gem that's unmaintained really going to be the ones to jump on Ruby 3.0 the day after Christmas 2020? This is also still supposition. Name some gems that are unmaintained and in wide use. We can fix them! We have the technology! In my opinion, if matz's objective is to make the transition to ruby 3.0 simple, then it actually makes a lot of sense to postpone frozen strings by default. Postpone until when? 3.1? So then 3.1 will be the hard break? They've been discussed for what, ten years now? How long is long enough? We've added many ways for people to start transitioning to immutable literal strings, and people are using those mechanisms widely. We've pushed this transition a long time, and we still have another year until 3.0 is out and longer than that until people will need to make a move. What is the threshold for being "ready" to make this change? Unless we're planning to wait until Ruby 4.0 in 2030 to do this, I think we should do it now. I use frozen strings in most of my ruby projects, most of them set to true via the toplevel comment, so either way, it would not affect me. Exactly. Most people already do use frozen string literals. And adding a pragma means we can transition troublesome code to the new way with a single line per affected file. Heck, we can even add --enable:mutable-literal-string for people that are stuck with some of that old unmaintained code, allowing them to have a soft landing.
-
I guess the interaction between the "false" state and the current runtime default is what has me confused. I see "true" and "false" here more like "on" and "off", and if frozen-string-literal is off, to me that means it does nothing at all and whatever defaults are in place take effect.
-
I'm still against frozen-string-literal by default. It is arguable if the string creation limits performance so much in real-world programs. We need to first measure how much Ruby can be faster by frozen-string-literal. If it is not significant, Ruby should prefer dynamics and flexibility.
-
-
-
stackoverflow.com stackoverflow.com
-
because most languages treat strings as immutable, which helps ensure you don't accidentally modify them and can improve performance. Fewer state changes in a program mean less complexity. It's better to opt-in to mutability after careful consideration rather than making everything mutable by default. What is immutability and why should I worry about it? may help.
-
-
github.com github.com
-
https://github.com/collectiveidea/delayed_job/issues/1099 had possibly helpful solutions
Duplicate at: https://groups.google.com/g/delayed_job/c/5fsuBCZX1Ak
-
-
github.com github.com
-
Until we release 2.0 you should continue to use 1.6.4, which can be found at bblimke/webmock.
https://github.com/bblimke/webmock is at 3.18.1 so this repo is apparently abandoned and should be archived
Tags
Annotators
URL
-
-
joshfrankel.me joshfrankel.me
-
bundle update rails-controller-testing --conservative. The –conservative flag says when updating this gem do no update any of its dependencies. Using the –conservative flag with bundle is really useful for minimizing changesets as well as avoiding upgrading things that you don’t need to upgrade.
-
-
www.kickstarter.com www.kickstarter.com
-
Judge Domino is a game in which players judge if toppling a line of dominoes will succeed or fail. Players take turns adding to the line, but to score points, you must make others think that the toppling will fail. Can you baffle other players' judgment?
-