HNHacker News
TopNewBestAskShowJobs

SethMLarson

1,019 karma · joined June 19, 2017

Security Developer-in-Residence at the Python Software Foundation, PSF Fellow, Minnesoootan, he/him

https://sethmlarson.dev

submissionscomments
SethMLarson··on When str.lower() is a security vulnerability in Python
Author here, that's a good idea. A straightforward way to exploit an implementation differential like this is if you have a software system that contains two different implementations of IDNA 2003 processing user input. One part of the process processes the domain correctly, the other incorrectly, and in this case you can have one part of a system (such as a policy/filter) "see" the data one way and the other part of the system (such as, taking an action as a result of the data) see the data in another way.

Server-side Request Forgery (SSRF) is an example of such an exploit targeting a differential in implementations of URL parsers, which is similar to this implementation difference.

SethMLarson··on Postmortem: TanStack npm supply-chain compromise
pip also supports relative dependency cooldowns starting in v26.1:

~/.config/pip/pip.conf

[install] uploaded-prior-to = P3D

SethMLarson··on The Frog for Whom the Bell Tolls
Woah, that's awesome!! Enjoy :)
SethMLarson··on The Frog for Whom the Bell Tolls
You'll have to play to find out ;) haha!
SethMLarson··on “Food JPEGs” in Super Smash Bros. and Kirby Air Riders
Great suggestion, I'll add an example!
SethMLarson··on “Food JPEGs” in Super Smash Bros. and Kirby Air Riders
Great eye to detail! Thank you: ill fix this when I get home :)
SethMLarson··on “Food JPEGs” in Super Smash Bros. and Kirby Air Riders
Maybe I'll do a follow up on this!
SethMLarson··on “Food JPEGs” in Super Smash Bros. and Kirby Air Riders
Oooh! I need to look into this... thanks for the tip.
SethMLarson··on “Food JPEGs” in Super Smash Bros. and Kirby Air Riders
Players that don't know the technical term "billboarding" might use this as a way to say that the images of the food are "flat" unlike the rest of the 3D modeled environment. Just a suspicion!
SethMLarson··on “Food JPEGs” in Super Smash Bros. and Kirby Air Riders
I would love to see a list of inspirations for keeping the food 2D even in a 3D environment! Pacman or Bubble Bobble seem like good places to start.
SethMLarson··on Deprecations via warnings don't work for Python libraries
Author here! Agreed that are different levels of "engaged" from users, which is okay. The concerning part of this finding is that even dependent users that I know to be highly engaged didn't respond to the deprecation warnings, so they're not working for even the most engaged users.
SethMLarson··on Blogrolls Are the Best(rolls)
That's awesome to hear you've been inspired :)
SethMLarson··on Instant Checkout and the Agentic Commerce Protocol
Many, many people expected this. https://news.ycombinator.com/item?id=42008569#42008733
SethMLarson··on Scream cipher
<3 Thanks for the kind words!! :)
SethMLarson··on Scream cipher
NICE!!
SethMLarson··on Scream cipher
OP here, I either didn't know or completely forgot this XKCD existed and it resurfaced as a good idea haha! Time to update the post lol
SethMLarson··on New Mexico is first state in US to offer universal child care
This is really great!!!
SethMLarson··on Draft SMS and iMessage from any computer keyboard
I'm an iPhone owner, but don't have a MacBook. I am seriously jealous of being able to send text messages with a laptop... hence this tool hah
SethMLarson··on Draft SMS and iMessage from any computer keyboard
Hey all, author here! Happy to answer questions anyone has :)
SethMLarson··on Show HN: I built an app to block Shorts and Reels
You can disable YouTube Shorts (kinda) by disabling history: https://sethmlarson.dev/youtube-without-youtube-shorts
SethMLarson··on Ask HN: Do you still bookmark websites?
Yep, with Inoreader!
SethMLarson··on The Missing Protocol: Let Me Know
Filtered RSS with some automation (ie: to delete the subscription) will do this for you.
SethMLarson··on Show HN: The missing link of a bookstore's tech stack
I use bookshop.org and have had a great experience. Not sure I'll try anything else.
SethMLarson··on I fear for the unauthenticated web
Hehe, just participating in POSSE :) Funnily enough the story you're linking to quotes me with pictures of a story I wrote (https://sethmlarson.dev/slop-security-reports) about LLM-generated reports to open source projects.
SethMLarson··on Fediverse Donut Club
As someone who doesn't drink alcohol, I get what you're saying. But I also don't judge others for indulging and similarly don't let how I want to live my life get in the way of attending group events. At bars I order sparkling waters, soda, or a non-alcoholic cocktail and don't make a big deal out of it and it hasn't failed me yet :)
SethMLarson··on Fediverse Donut Club
Author here: Agreed that there's certain dynamics that are different in public social web spaces compared to an office, honestly I am curious if the "online->action" barrier to be overcome with an extremely loose association (in this case: enjoys donuts), so we'll see!
SethMLarson··on Fediverse Donut Club
iirc a "starter pack"-like feature is being worked on, they would no doubt be useful for new folks looking to quickly find their communities in the Fediverse.

I think this experiment is a little different though, I want to explore how a simple human desire that doesn't have an "identity", like eating a baked good, can "manifest" more horizontally in a digital space :)

SethMLarson··on Reverse engineering my #1 Hacker News article
Love it, having an "aha-moment" is always a great indicator that it's something worth sharing! I encourage others to share their ahas so we can all learn together.
SethMLarson··on How do I pay the publisher of a web page?
Author here! My primary motivation is to tip the hundreds of web creators that I enjoy every year without linearly increasing my spend (I can only afford so many $3/month Patreons).

It's manual for now, but the computer tracks who to pay next, who to stop paying, and give you links to speed up the process.

See: https://fosstodon.org/@sethmlarson/113575887792359030

Happy to answer questions :)

SethMLarson··on My son (9 yrs old) used plain JavaScript to make a game, and wants your feedback
This is pure awesomeness and reminds me of how I got started programming: making games! Love it :)
Page 1 of 3Next →