Hacker News Reader

Comment by supriyo-biswas | Hacker News Reader

Great research. As I've said elsewhere, Firebase's authentication model is inherently broken and causes loads of issues, and people would be better off writing a small microservice or serverless function that fronts Firebase.

Also, for anyone trying to read the article, they should put `/oneko.js` in their adblocker.

View on HN

> Also, for anyone trying to read the article, they should put `/oneko.js` in their adblocker.

Only if you hate cats, pixel art, or are easily distracted.

I suspect it's that they hate are easily distracted (if "hate" falls outside of the series, such that it applies beyond just "cats")!

Looks like someone already added it to uBlock Origin since I see no cat.

Or maybe the cat doesn't support Firefox...

Did you enable the ui.prefersReducedMotion setting? That hides the cat from what I can tell

Hmm not that I remember. But I have reduced motion enabled on my phone system wide and maybe that synced to my desktop on its own.

Which is scary come to think of it.

Too late to edit... i just got around to checking and I do have system wide reduced motion and reduced transparency on this laptop. I'm sure I didn't set it up on there, just on the phone.

I think Apple is starting to sync too much...

That seems like a perfectly reasonable thing to sync. Accessibility settings are exactly the type of thing you shouldn’t have to configure again and again on every device.

Either way, you can disable syncing of system settings.

> That seems like a perfectly reasonable thing to sync. Accessibility settings are exactly the type of thing you shouldn’t have to configure again and again on every device.

No, because I disabled motion on my phone because the wiggling of icons on the main screen annoyed me, not because I have motion sickness. Nothing wiggles on the desktop (yet). This option doesn't even belong in accessibility IMO, it should be a "stop annoying me" section.

> Either way, you can disable syncing of system settings.

Where? The same spot where I can disable syncing the clipboard? I.e. somewhere deep in an undocumented file?

Gotta be honest, the aggressive and unreasonable snark completely turns me off from helping you. It feels that regardless of the obviousness of the setting, you’ll find some nitpick to shout back at me about it. Since I don’t work for Apple or yourself, I don’t have to justify their choices or be the recipient of your unjustified and unprompted bad humour. I’m making a conscious choice to not soil my Friday on account of some internet rando. You’re on your own for this one.

I genuinely wish you a calm weekend and peaceful start of the week.

Thanks for the martyrdom but last time I checked clipboard syncing it was a package with everything that gets synced, including sms forwarding etc on Apple. If there is a way to disable syncing granularly it’s not documented anywhere.

Ah thanks, that explains why I don't see the cat everybody mentions

I use uBlock Origin and Firefox (on Mac) and see the cat.

Im dyslexic and I tend to use the pointer to follow what I am reading to help me. The cat was annoying as hell. I just had to hide the element in the DOM before i could read more than a few lines. Infuriating design choice to make it follow the pointer.

It's really not hard to build this safely in firebase, this could've been authored the same way in node too. I think whoever authored this either majorly cut corners or just isn't experienced enough to understand how to write authenticated controllers like this. This should scare people away from this browser, it's such a basic thing to mess up and it shouldn't have happened.

> Firebase's authentication model is inherently broken

I'm not very familiar with Firebase. In what way is it broken and what issues does it cause?

The fact that clients write directly into the database and that it's widely encouraged.

There are security rules in Firebase to prevent this, but bolt-on security models that the user has to explicitly enable haven't shown to work.

Reply on news.ycombinator.com