torgard

I should say, doing this only mitigates the middle-click-paste pastejack exploit. The underlying issue - JAVASCRIPT CAN ALTER WHAT YOU HAVE SELECTED AT WILL AND WITHOUT DETECTION - remains, and I believe we'll see other exploits pop up from this.

Say you're about to copy a crypto wallet. You have it selected, and are about to press CTRL-C to copy it. It is entirely possible for malicious code to detect that. And, as it turns out, it's possible for it to change the selection to a different (invisible) string, right as you press CTRL-C.

No, that's only for pasting specifically.

It's copy that's an exploit vector.

To disable it, set clipboard.autocopy to false.

You can set clipboard.autocopy to false in about:config to disable this. It breaks the example, at least.

EDIT: I thought the behavior was preserved for textareas, as the comment box here still copied on select. But it suddenly disabled it here too. Restarting the browser is probably a safe bet :)

Well, I thought it was fun.

Glenn Howerton's performance is so good. Best performance I've seen this year, that's for sure.

The cause of ADHD has not been confirmed yet, but it is generally claimed to be related to dopamine production and uptake.

I certainly had ADHD before being exposed to work environments. I've had my entire life. But it wasn't until I got my diagnosis, and started taking medication for it, that my square-peg of an existence began to fit in with the round-hole of reality.

Work environments have nothing to do with it for me. In fact, I love my job. Here, my ADHD is something of a benefit. I've excelled at everything I have found enjoyable, and have no qualms with working insane crunch on the stuff I like.

The key word there being like. If I don't like doing it, it's practically impossible for me to do. Or rather, if it's mundane or otherwise just "not interesting", I struggle. Strangely enough, I have an easier time accomplishing things I actively dislike doing. Not sure why.

It's like my body is controlled by an autopilot gone rogue, and the medication helps me override it.

For example, I have trouble going to the bathroom to take a piss. Not because of any phobia or anything. I just cant. Literally. I'll sit and squirm until I'm about to piss myself, and only then will I go to the bathroom. Been doing that since I was a little kid.

One way around it is to trick myself somehow, like by putting on a podcast, even though I'll only hear like 20 seconds of it. Couldn't do that as a kid, tho. Back then, I would wait until it became physically painful, because only then would my rogue autopilot allow me to go piss.

Doing laundry? Impossible. Vacuuming? No. Washing dishes? Well, now I have a dishwasher, but emptying it? No way.

That is, unless I take my medication (methylphenidate). It doesn't make mundane things any less mundane. It's still boring to brush my teeth and piss. It just makes it possible.

I didn't get my diagnosis until I was 28. My entire life I've been struggling with this. It's a primary factor in my lifelong battle with depression. It's lead me down a path of substance abuse ­— alcohol and cocaine in particular.

Despite all of this, I still second-guess myself on whether I truly have ADHD. What if I'm just a drug addict, and I just tricked a psychiatrist into giving me those sweet sweet drugs?

Yes, but Apple Records aren't going to be phishing Apple Music customers.

Phishers won't be applying for trademarks to impersonate Apple.

My first internship was as a Dynamics AX dev. Me and another guy. Our mentor was a super-duper senior architect something something. He once asked us what we were planning on doing, career-wise, and we were kinda surprised; obviously we were working towards becoming Dynamics AX devs, and were hoping for a job at that place.

He got a somewhat wistful look in his eyes, and said (more to himself than to us) he wished he could go back and choose not to do that.

I'll never forget that. He was earning an insane amount of money, working super high-level at one of the largest IT firms in the country.

You should set up a health endpoint for that, rather than just serving the default page.

I've used it for resources that have been permanently deleted, rather than the 404 that you'll usually see. I think it makes sense for that sort of stuff.

From a user perspective, getting a 404 after following a link that previously worked can indicate a couple of things. Like maybe the resource still exists in some other place, but they didn't set up redirects. Maybe it's been "privated" in some way, and I no longer have access to it.

A 410 makes it explicitly clear to me, that the resource has been permanently deleted. It'd also be nice if the response included some metadata as to when the resource was deleted.

Zanzibar is their internal system, and they've released a paper describing it.

https://storage.googleapis.com/pub-tools-public-publication-...

This is really cool. Absolutely fantastic editor! I'm blown away

I curate a YouTube playlist of interesting, strange, or otherwise insightful content.

https://www.youtube.com/playlist?list=PL0yH4m1eWzvGpI_nloNFq...

It's very important work.

There are countless times where I would have found this incredibly helpful. Just 10 minutes ago, I wanted this exact tool.

Thanks!

I was not aware of the data-last convention. Thanks! Makes a lot of sense.

My mental model of assign was backwards, and it took me a while to comprehend why their implementation would be data-last.

So, the data is the object that is being modified? And the idea is it lets you write stuff like this more easily:

    const addStuffToObject = stuff -> object -> assign({ "some_stuff": stuff }, object);
    const addWeirdStuff = addStuffToObject("weird stuff");
    const weirdObj = addWeirdStuff({ "foo": "bar" });

Someone linked me to 1-liners[0], which is - you guessed it - a bunch of one-liners. I think it's nice to have as a reference. But a dependency? Really?

My least favorite is assign.

Not only does JavaScript feature that natively (though I suppose the library may predate widespread support for Object.assign), the 1-liner assign flips the order of the parameters!

    assign({ a: true }, { a: false }) -> { a: true }
    Object.assign({ a: true }, { a: false }) -> { a: false }

And most of them are just straight-up pointless! Like, let's introduce a dependency for decrement lol

EDIT: In looking up whether the 1-liners assign predated widespread Object.assign support, I found that their implementation - confusingly named extend[1] at first - literally used Object.assign from the very beginning. And they still chose to mess with the parameter order. For shame lol

[0] https://github.com/1-liners/1-liners

[1] https://github.com/1-liners/1-liners/blob/7c1f8d51df4b4b3e0a...

Yeah same. From the source code, the answer is a random 14-character string, generated on load:

    function randomPassword() {
        let letters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
        let digits = '0123456789';
        let punctuation = '!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~';
        let s = letters.repeat(7) + digits.repeat(4) + punctuation.repeat(3);
        let length = 14;
        let res = Array.from({length}, (() => s[randomInt(s.length)])).join('');
        debugger; // どうぞ
        return res;
    }

> Although we'll be working on adding support for recursive queries to EdgeQL in the near future.

Is there a roadmap I can subscribe to somewhere?

Looking forward to trying this out!

> full text content of Moby Dick serialized as JSON

Reminds me of when YouTube added a new comment system, but didn't specify a max length, and rendered the full text by default. People were spamming the Bible in comments.

> required GET with a body

Elasticsearch also encourages GET with body. But a request payload is undefined, according to the RFC:

   A payload within a GET request message has no defined semantics;
   sending a payload body on a GET request might cause some existing
   implementations to reject the request.

I dig it!

I prefer defining tables like this:

    CREATE TABLE category (
        id int GENERATED ALWAYS AS IDENTITY,
        name text
    );
    
    CREATE TABLE post (
        id int GENERATED ALWAYS AS IDENTITY,
        category_id int
            REFERENCES category (id)
                ON DELETE CASCADE
    );

That is, category.id rather than category.category_id. But the USING clause doesn't work with that style, as far as I understand.

This would make my queries nicer.

Just a heads-up, you might want to take down the example website. Now that it's been posted to HN you might see malicious actors.

I also think it's prone to SQL injection at the moment? At least, it's raising a syntax error when inputting an apostrophe.

This is cracking me up LOL

It would be an amazing screensaver, just iterations upon iterations of Fucked Up Homers.

The Stripe docs are a master-class in API documentation. I strive to write APIs that reach the knees of the height of theirs, all while keeping the docs simple and understandable.

Amazing. No surprise from me the success they've had.

This couldn't have come at a better time! I have to do a report on hardening and such of our infrastructure next week.

Great!

Here's a website tracking GDPR enforcement: https://www.enforcementtracker.com/

According to that website, one of Google's 10 fines is the highest fine ever, at €50 million. Hilariously, in a dystopian kind of way, they were fined €28 last year. Not as in millions, but twenty-eight euros.

Facebook only appears on the list once, with a paltry €51,000.

But in any case, the point of GDPR is not to bankrupt companies.

Companies could be held liable for gross misconduct. Although GDPR is not exactly a shining example of IT regulation, I think it's a good example of liability.

Companies get fined for breaking GDPR.

Governmental projects should have similar requirements in place, and companies and people should be held accountable for breaking them.

A post-mortem should not necessarily blame the individual, but blame the circumstances the individual finds themselves in.

Yes, a hard-coded password is bad practice. But does the company have a bad culture of keeping configs in repos? Maybe management thinks it easier to commit configs with sensitive data, than to set up proper deployment shit. And after all, the repos are private, so it should be fine yeah?

Bad code ending up in production is something you'll see often. Does the company have nice test suites for everything? Continuous integration pipelines? E2E tests? Or is upper management pushing everyone to their limits, because "fuck it ship it"?

> Cloudfront proxy

I mean, CloudFront is a CDN too.

EDIT: Oh, I misread. You weren't dismissing CDNs entirely. Only this type of CDNs. In that, I agree.

> initial setup and configuration?

If you think there is nothing more to maintaining a database than initial setup and configuration, you are in for a rude awakening. Shit happens.