427 karma · joined January 10, 2022
Also some more background info https://systemd.io/THE_CASE_FOR_THE_USR_MERGE/
I use neomutt to access my archive over SSH. And notmuch is very fast at searching all of my emails.
* https://github.com/gauteh/lieer
Now that your cookie looks like this (probably also base64 encoded):
{"id": 42, "display_name": "John", "is_admin": false, "session_end_at":1726819411}
You don't have to hit the DB to display "Hi John" to the user and hide the jucy "Admin" panel. Without HMAC, an attacker could flip the "is_admin" boolean in the cookie.You could also create a cookie that is just random bytes
F2x8V0hExbWNMhYMCUqtMrdpSNQb9dwiSiUBId6T3jg
and then store it in a DB table with similar info but now you would have to query that table for each request. For small sites it doesn't matter much and if it becomes a problem you can quite easily move that info into a faster key-value store like Redis. And when Redis also becomes too slow you are forced to move to JSON Web Tokens (JWT) witch is just a more standardized base64 encoded json wrapped with HMAC to avoid querying a database for each request.But even if you are using random bytes as your session identifier, you should still wrap it in a HMAC so that you can drop invalid sessions early. Just for making it harder for someone to DDOS your DB.
The amount of people who have the free time to massage `.muttrc` for patch based flow is pretty small. And https://sr.ht/ does not work for the volume that Linux kernel sees.
* https://lwn.net/Articles/860607/
* https://lwn.net/Articles/952034/
* https://lwn.net/Articles/952146/
* https://lwn.net/Articles/950567/
Also doing PR code review is soo much nicer if each commit is logically self contained with a nice commit message.