derekprior

GitHub Sponsors is out of beta for developers with a bank account in any of the 30 countries supported by Stripe.

For folks with bank accounts outside of that list, GitHub Sponsors is still in beta, we're accepting applications, and we’ll continue to roll out general availability to those countries in the coming months.

You can't set an HTTP Header with an HTML link.

Would be nice to set a body though, wouldn't it? Also, not allowed by HTML.

I think people are looking to closely at the first degree attack -- a trusted partner is pwned. If this is the case, there's far more interesting things an attacker could do. It's not too hard to envision a scenario where an attacker does not have access to embeded assets, but does have access to logs.

1. You include a script such a TypeKit. The typekit deliverable itself is not owned, but bad actors have access to typekit.com logs.

2. You use a smaller third party add on service that itself uses a logging service such as PaperTrail. PaperTrail is hacked, providing attackers access to logs.

3. You reference no external assets, but your site contains external links in the footer. Users click the navigation links rather than completing the form. You have leaked the token to whatever site that is. You are at the mercy of their log storage. YES, this does actually happen. User's click crazy things.

As I mention in the article and in other comments here: this is not likely to be exploited. Fixes, however, are not too difficult. Even adding the not-quiet-fully-supported `meta` tag to your head is a good start.

If I read this article today, I'd think, "That's interesting. let me make a note to check that out." It's not a hair-on-fire security situation, but it's not "not a problem at all" either.

In my experience, password reset tokens are not single use. They are good for both loading the form and submitting the form. They are not invalidated until the form is submitted with the new password.

They are good for 1 password reset, not 1 page load. It's possible to make them good for 1 page load, but most I've encountered are not due to the tradeoffs that would involve (see other discussions).

https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_A...

I might not be using the right term here, but the general idea is that you create an encrypted token out of some data and verify that the data is unchanged and still valid on the server. In that way you can provide a token that ensures the user had access to the link you sent them, but you don't have to store it in the database.

This has been suggested numerous time since I published. I had not previously considered this solution and I think it's a fine solution for people to make if they know the tradeoffs.

It's worth noting there are a number of reasons this JavaScript could possibly not execute beyond people who have JS turned off. I've seen a number of sites fail to execute JavaScript when an Ad Blocker is run, for instance.

In this case, there are a number of server side fixes available that wouldn't require any JavaScript. They're not terribly complicated and will always work. For that reason, I'm still comfortable with the server side fix, but think the JS fix is a decent alternative.

Depends on how the reset behaves. Some resets log you in immediately after providing a new password. Some require you to log in after resetting the password.

I feel like I've seen more of the former than the latter.

I'd certainly consider this for some applications. It depends on the value of what you are protecting. For some sites and users, the error rate introduced by this method would be unacceptable.

Tradeoffs...

It's covered in the article, but this is not supported by IE11. That's pretty modern...

Author here. I completely agree that it's unlikely to be exploited but also think fixes are mostly simple enough that it should be addressed.

This requires non-idempotent get requests as you must invalidate the token on get.

I did consider this approach for Clearance and intended to go with it, but was discouraged from doing so after hearing reports that some enterprise email AV does things like open some links in emails.

There is also the user experience concern that a click the link in my email, do something else, then click the link again, having forgotten I already clicked the link. Now I'd have to re-request again.

Also, this approach is impossible if you use HMAC tokens.

I don't think anyone who opts for this approach is wrong but like most things, it's a tradeoff.

The manual verification steps are basically impossible for any non-trivial gem. I wonder if it would be possible to re-build (from git) the impacted gem versions and check their checksum against the downloaded version to detect differences?

homebrew-built vim worked fine for me. I followed the manual steps.

Huh? A bulleted list of release notes with a pot shot at Safari and some mighty large leaps of faith.

"Since most Mac users use Google Chrome as their primary browsers (sic)..." -- Oh really? I'd be surprised by this. Do you have numbers to back it up? I'm guessing most Mac users just use the default browser.

"Safari for Mac is just like IE for Windows, it is only used to access the web for the first time to download Google Chrome." -- I don't even... no.

"While it is a bit better than IE it still sucks and needs to be replaced ASAP." -- News to me. I use Safari every day. I've considered chrome and do tend to use it for development, but Safari is my default. It certainly doesn't suck and doesn't need to be replaced at all.

Okay, I won't tell you to enable JavaScript. Can I tell you to bump up your blog's font size?

Agree. I want to read this, but I haven't a damn clue as to how to go about that.

How about a nested hash of attributes?

class PostsController attr_accessible: :title, :body, :related_links => { :href, :title } end

This would accept the attributes: post_title, post_body, post_related_links_0_href, post_related_links_0_title, posts_related_ink_1...

The names might not be right. I forget exactly how rails names fields. But you get the point, yes?

Until recently the GMail web interface was simply unmatched. When GMail first shipped, their conversation view was so far ahead of what anyone was doing on the web or in a fat client. I don't try out as many email platforms as I used to, but from what I have seen, it's still the best implementation of conversation view available.

Additionally, you hinted at the other main reason I use GMail in your first bullet point: "Control over your own data means you own it, you have it on your hard disk, it is not on somebody else's storage medium."

Sure, this means Google has access. But it also means I don't have to find a way to make that data accessible to me everywhere I want it to be. I don't have to pay for the storage. It's a solved problem... and available at a great price point ($FREE).

I trust google slightly further than I can throw them, so for now this is an okay deal.

Done right? Sorry, you bored me to death as soon as you started blabbering about Pascal's Triangle. I'm sure I learned about that at some point, but I've forgotten it. You asking me that questions would result in:

1) Me feeling stupid because I don't remember what Pascals Triangle is.

2) Me stumbling through some code while I try to understand the explanation you give me.

This seems like it would work in environments that aren't super competitive for top talent or if you are offering a dream job, but in the face of multiple offers this is going to be far less attractive to the candidate.

I've got a family. I need stability... and health insurance. Unless it's my only offer, a substantially better offer, or a dream job, I'm inclined to go elsewhere.

Maybe, but now you've changed your argument. Previously it was that they weren't learning at all, now they aren't learning as well. Even so, there are points in response:

1. I'm really not equipped to show him the multiple images of a coat or someone putting on a coat, or other children doing signs of coat. The video is. I don't know if this matters or not. It's certainly possible it doesn't.

2. I have to make dinner for us all at some point. As much as I'd love for my 15 month old to patiently engage in conversation with me while remaining a safe distance from the stovetop, it just doesn't happen. There are times when a parent's attention just cannot be 100%, or even 75% on their child. So yes, maybe he would learn EVERYTHING better if I were there to teach it to him, but the fact is that even the best parents can't be.

"it's about the fact that kids watching a screen aren't ... learning how to communiate (sic)"

Does sign language count as communication? Because my son learns signs from occasional DVD watching and then applies them in the proper contexts - sometimes without any reinforcement from his parents or anyone else.

Pretty sure that qualifies as learning how to communicate.

I agree that limiting screen time is important, and my wife and I are careful to limit our son's screen time and not expose him to "second hand TV." That said, I take issue with the following passage from the article:

"Even so-called educational videos do not benefit children under 2 because they are too young to be able to understand the images on the screen, the doctors’ group said."

My son watches a DVD from the "Baby Signing Time" series 2-3 times per week. At 15 months, he sports a 30 to 40 word signing vocabulary. While my wife and I work to reinforce many of the more useful signs (more, milk, eat, etc), there are a number that he has picked up straight from the video (banana, coat, cat, etc). As much as I'd like to believe that he's a genius, I think its much more likely that the doctors' group is just wrong about what children can understand on screen.

In the article one frustrated-sounding doctor says no one is listening to the message. Maybe that's because they're preaching zero tolerance rather than moderation. Perhaps that's because they're worried that parents will take moderation too far and they think zero-tolerance is safer. Either way, to say children under two can't learn from a screen is simply wrong. I see the evidence every singe day and the doctors are welcome to see it for themselves.

The dirty little secret is that most of these channels are very cheap. The only expensive ones are ESPN and other sports programming. People who dont watch sports subsidize those that do.

I always seem to find some television series that's available via streaming that my wife and I want to see. Each time I say, "We should cancel streaming when we're done with this" and each time we find something else that fits the bill. Firefly. Battlestar Galactica. Sports Night. Better of Ted...

We cut the cable cord over a year ago, relying on Netflix Streaming for older content and iTunes for newer stuff. Even paying for the iTunes stuff, we're WAY, WAY, WAY ahead. I should do that math someday...

I appreciate RVM and Wayne offers fantastic, other-worldly support. That said, there's always room for alternatives and I'm intrigued by rbenv. The part that gives me pause is the need to run `rbenv rehash` after installing a ruby (not so bad and possibly fixable if the aforementioned change to ruby-build is made) or after installing a gem that has binaries (I predict I will forget to do this a ton).

I could definitely see myself wanting to override `gem` in order to detect binary installations and automatically rehash. At which point, it's not so unobtrusive!

Still interested enough to try it out and see if that is as much of a hassle as I think it will be.