Hacker News Reader

smaginon Ask HN: Share your personal website

That's my blog. I have opinions on software, make a couple of apps and patch other people programs when I like them enough.

People here liked https://smagin.fyi/posts/cross-site-requests/ this post the most.

smaginon Keyboard with Turntable Dials

This feels like April 1st joke made in October. Like the Enter dial in particular.

smaginon Passkeys and Modern Authentication

Like the take that we need to authentificate more often nowadays. AWS makes it extreme — it resets login each 12 hours I reckon, and each time I need to click like 10 times, touch the fingerprint button 3 times (fill email, fill password, passkey), and I fail to imagine how it's not a security theater.

smaginon Spacing Over Cards

Thanks for the information hierarchy / conceptual boundaries distinction, makes sense. I didn't know the latter term but tried to describe it in the last section of the post, nice to have a name now.

There are apps and sites that manage to keep the number of cards at min, one is selfridges (not an ad, was just open in another tab), another is firefox settings. MacOS Finder does a good job at grouping things with spacing, and macos generally. iOS seems to put everything on cards, at least nowadays.

smaginon Spacing Over Cards

yup, that's a good part of the page to stand out, when I've seen all the landing page can show and now it nudges me to try the app out

smaginon Spacing Over Cards

hm, I sort of agree with the train of thoughts but not with the conclusion. Maybe it's "is my blue your blue" situation. I talked to people while working on this post and some said e.g. grid with cards is way easier to them to scan through than grid without cards; other people feel the opposite and complain about too many things on the page that are not content. I'm in the latter category, but wondering if I could make an experiment, or if anyone made it already.

Thanks for getting me thinking this way.

smaginon Spacing Over Cards

author here (not super educated either). That's part of the idea — when cards are removed it becomes obvious that tags become the most noticeable part while not being the most (or any) important one. When you look at the cards you see cards and _something_ inside them.

So maybe if this post was in less flame-provoking tone I'd suggest trying to add cards back and see if it makes it better. It might, on landings there is a good chance it will.

smaginon How we made JSON.stringify more than twice as fast

Unrelated but I have the easiest design improvement for your website: change <html> background color to #4285f4 (same as in topbar) so it looks like a sheet of paper on a blue base

smaginon Ordinary life improvements 2018-2025

Gwern wrote a post about his everyday improvements in 2018, I thought I'd write a follow-up.

smaginon Why do we have both CSRF protection and CORS?

oh god you're right https://stackoverflow.com/a/57206146/1685746 yeah sure what can go wrong, let's listen to fetch and modify requests in a service worker.

smaginon Why do we have both CSRF protection and CORS?

I asked that in the post but nobody answered still, let's try here.

Why are CSRF tokens rotated? OWASP says it's somehow more secure but I don't really see why.

smaginon Why do we have both CSRF protection and CORS?

not even you don't need to, you shouldn't. Sessions shouldn't be accessible to js at all

smaginon Why do we have both CSRF protection and CORS?

mitm means you can control users network, doesn't it?

Another question, does this work with https?

And the third one, if this was the thing some dishonest governments or vpn providers would do this already. Would be cool to read on that (genuinely, not implying this never happened)

smaginon Why do we have both CSRF protection and CORS?

You shouldn't need your session token in JS, you can specify your fetch requests to include cookies, and you can setup CORS to allow that.

smaginon Why do we have both CSRF protection and CORS?

> How does server know the cookie is valid if it doesn't store it

depending on why you'are asking the question, * because it decrypts correctly * because it contains some user identifier

People don't usually store sessions in cookies because cookies can't be very big, and session do become big. So what people do instead they store cookies in databases, and put session identifiers into cookies.

smaginon Why do we have both CSRF protection and CORS?

Why would you need that?

Also, one thing I can speculate that phishing would become even easier if such things were allowed

smaginon Why do we have both CSRF protection and CORS?

This is my blog. I haven't posted all the articles from there to hackernews. I think some of them are not worth discussing because too old or too poorly written, but some are just not posted because I didn't think of it at the time. Thanks for the interest, I will re-read what I wrote and post some.

smaginon Why do we have both CSRF protection and CORS?

it is true. But again, writes are allowed, reads are not, you won't be able to see the reply. Which author of the question eventually realised https://stackoverflow.com/a/44122076/1685746

smaginon Why do we have both CSRF protection and CORS?

well it does make sense to assume that by default different origins belong to different people, and some of those people don't have to behave friendly to each other.

There is little server can do with that, because of the request-based model. The state that persists between requests lives in cookies, and it's browser job not to expose those cookies all around. Turning off single origin policy would be a terrible idea. For one, it makes CSRF work by not allowing cross-origin reads.

smaginon Why do we have both CSRF protection and CORS?

yup. You didn't imply it but just in case -- this token shouldn't be the same as session token. Session tokens should be `HttpOnly`, so that we don't even expose it to javascript

smaginon Why do we have both CSRF protection and CORS?

oh hell yes. And oh yes iframes and postmessages, of course people would setup them incorrectly and even if they do some (probably not that important but still) data will leak if you're creative enough. Thanks for the link!

smaginon Why do we have both CSRF protection and CORS?

"search this site in google" shouldn't even be a POST request, but yeah, when we'll have better defaults for cookies it should work nicer. And if you are a web developer, you should check your session cookie attributes and explicitly set them to SameSite=Lax HttpOnly unless your frameworks does that already and unless you know what you're doing

smaginon Why do we have both CSRF protection and CORS?

you're right, you can initiate cross-site requests that _could be_ form submissions. It was even in the post but I thought I'd omit that bit for clarity. I should have decided otherwise.