Hacker News Reader

loginatnineon Postmortem: TanStack npm supply-chain compromise

https://github.com/opensearch-project/opensearch-js/issues/1...

The worm is spreading...

loginatnineon Pricing Changes for GitHub Actions

At our company, it's ~35k USD increase annually. This is not negligeable.

loginatnineon GitLab discovers widespread NPM supply chain attack

Send them a request to have Trusted publishers support at central-support (at) sonatype.com

I did that a couple of weeks ago and received an acknowledgment "Another request on Trusted Publishing option. Assigning to Product for review and further action." so this is a bit encouraging.

At least Maven dependencies don't execute scripts on install, but Maven plugins could have a big blast radius.

loginatnineon Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

That's a feature of stepsecurity though, it's not built-in.

loginatnineon Firebase Firestore down or high latency

We've been having timeouts, 504, 500 for about 30 minutes now on our "Login with Google" feature.

loginatnineon Pgactive: Postgres active-active replication extension

It's definitely DSQL with the multi-region active active feature[1].

[1]https://aws.amazon.com/rds/aurora/dsql/features/#topic-1

loginatnineon My first attempt at iOS app development

You calculated based on a 0.99$ purchase price though, at 2.99$ it's 4825 purchases to break even.

loginatnineon Just make it scale: An Aurora DSQL story

For me it's RO views.

loginatnineon Just make it scale: An Aurora DSQL story

Views and foreign keys!

loginatnineon How to harden GitHub Actions

This is good, just bear in mind that if you put the hash of an external composite action and that action pulls on another one without a hash, you're still vulnerable on that transitive dependency.

loginatnineon First and 2nd gen Nest Thermostats will lose support in Oct 2025

This week, Hydro-Québec, the nationalized company that provide electricity to residents of the province, has announced a major investment program to reduce electricity usage by using smart thermostats. I'm extremely worried about the life expectancy of those smart thermostats in the long run and whether it's a good use of public funds. I'm also not super thrilled of the amount of functional regular thermostats that will end up in landfills because of that initiative.

[1]https://news.hydroquebec.com/en/press-releases/2172/hydro-qu...

loginatnineon Good-bye core types; Hello Go as we know and love it

Unless the object is immutable, like String, Integer, Long, ImmutableCollections, etc. Or your own immutable objects.

loginatnineon JReleaser: quick and effortless way to release your project

It's inspired by it. It's mentioned here[1].

[1] https://jreleaser.org/guide/latest/index.html#_acknowledgmen...

loginatnineon Google’s OAuth login doesn’t protect against purchasing a failed startup domain

I've been working with an app that uses Google to login for the past 10 years, and I've had problems with sub changing when these situations happened : - Domain change - Company being bought by another one and being integrated in their Google Workspace - Employee leaving and coming back

To us, it's very very far from the quoted 0.04% which is to me very high. I had to deal with it 5-6 times in the past 10 years but of course that number will vary depending on the usage of your app and I'm not gonna venture and put a percentage on it.

loginatnineon Google’s OAuth login doesn’t protect against purchasing a failed startup domain

At my current company, if an employee leave and come back, they'll keep the same OID in Entra but they'll get a new `sub` in Google workspace. We had to put in place a process to be able to use an internal tool that used the login with Google.

That's most likely dependant on how the IT department handled the deprovisioning/provisioning of users in our Google Workspace, I unfortunately don't have the details for that.

loginatnineon Google’s OAuth login doesn’t protect against purchasing a failed startup domain

I really don't understand here, the proper way to use Google's OpenID implementation to authenticate someone is to use the `sub` claim. Don't use the email, don't verify it yourself, use the `sub` claim. It's a known fact and is properly documented[1].

If the `sub` changes, it's because it's not necessarily the same person so have a flow ready for that. It could be an employee left and came back, a domain change, an IT error that lead to a reprovisioning of the user, etc.

I also fail to see how the proposed solution of having a 'A unique user ID that doesn’t change over time' is different from the `sub` claim. However, the new ID associated to the domain could make sense to enforce a strong 'Everyone from the @domain.com has access' statement.

[1] https://developers.google.com/identity/gsi/web/reference/js-...

loginatnineon You cannot simply publicly access private secure links, can you?

Interesting, thanks for the additional info.

loginatnineon You cannot simply publicly access private secure links, can you?

It's called a fragment FYI!

loginatnineon Detect when your installed Chrome extensions have changed owners

Good find! I've dug a bit and the extension, at least for now, does not send any metadata associated to your browser[1], only a comma separated list of extension IDs. Of course the IP could be easily used.

Looking at the result from the API of one extension I had installed[2], it lists metadata associated to the developer. I've tried to use the `chrome.management.get(id)` Chrome API and it does not return this information, and there does not seem to be a way to get the content of the manifest.json programatically. Therefore, to do the job of the extension as it is, it does need an external source.

[1]: https://github.com/classvsoftware/under-new-management/blob/...

[2]: https://api.extensionboost.com/v1/developer?extension_ids=gh...

loginatnineon Hackers stole access tokens from Okta's support unit

It's now called Entra ID btw.

loginatnineon How Netflix uses Java

As a Spring power user, you sound like you're ranting against something you don't/didn't understand.

loginatnineon Level-up your Java Debugging Skills with on-demand Debugging

There's a lot of options you can put on each breakpoint in IntelliJ, every developer should know about them. Right click on the breakpoint and click the "More" link.

Using "Run to cursor" is my favorite less known feature in debugging, it's really useful.

loginatnineon Level-up your Java Debugging Skills with on-demand Debugging

I understand they are remote debugging flags of the agent, but is this somehow different than IntelliJ features:

- Pause button (onjcmd=y)

- Java Exception Breakpoints with caught/uncaught option (onthrow/onuncaught)

loginatnineon Show HN: E-Ink Day Schedule

I understand your desire to build out an "ecosystem" of app and everything, however, I'd really like an option to go fully on my own and skip your iOS/android app.

Is it something that you plan on doing and document? Or is there an easy way I can ssh into the device and figure out on my own?

TIA!

EDIT : well, 1 minute later you answered part of my question here : https://news.ycombinator.com/item?id=37645339. How about ssh-ing?

loginatnineon Bitwarden: Free, open-source password manager

I use BW for my personal use with my SO and 1P at work. I hit some errors in 1P that were crypting, stuff like "Failed to add this record" with no details, no help button, I had to fire up the chrome console for the extension to find out it was a 401 to our 1P portal. Very poor experience, probably related to our SSO setup but still.

Never had any weird issue like this with BW and I love the autofill shortcut and the absence of a popup when I access a password field like 1P.

So yea, YMMV as usual but definitely not miles ahead.

loginatnineon How Lee Valley built a cult-like following

I'm part of the cult, LV has some unique and quality items that are only available there, especially for woodworking and kitchen. Durable items that will last a lifetime, clear concise description, no BS website.

I had to call once for some backordered item and was pleasantly surprised that someone just picked up the phone, no automated system, no wait time.

loginatnineon OpenWRT 22.03.4

I second Merlin's recommandation, it's just the right amount of stock+custom features I want for my day to day. Rock solid for stability.

loginatnineon The technology behind GitHub’s new code search

I'm curious if they'll open source Blackbird, it does not seem mentioned in the post.

loginatnineon Gail.com FAQ

French canadian here and same comment, ploum does not mean anything. Even plouf (for us).

loginatnineon The quest for a family-friendly password manager

FWIW, I've bumped the KDF iterations count to 600000 in Bitwarden and I haven't seen any noticeable difference logging in from my M1 Pro and my iPhone 13 pro.