Falsehoods programmers believe about addresses (2013) 4 months ago
in light of zipcodefirst site
HN user
smagin
130 karma
https://smagin.fyi
Posts9
Comments24
smagin.fyi 10mo ago
SM
smagin.fyi 1y ago
SM
Ask HN: Share your personal website 6 months ago
That's my blog. I have opinions on software, make a couple of apps and patch other people programs when I like them enough.
People here liked https://smagin.fyi/posts/cross-site-requests/ this post the most.
Keyboard with Turntable Dials 10 months ago
This feels like April 1st joke made in October. Like the Enter dial in particular.
Passkeys and Modern Authentication 11 months ago
Like the take that we need to authentificate more often nowadays. AWS makes it extreme — it resets login each 12 hours I reckon, and each time I need to click like 10 times, touch the fingerprint button 3 times (fill email, fill password, passkey), and I fail to imagine how it's not a security theater.
Spacing Over Cards 11 months ago
Thanks for the information hierarchy / conceptual boundaries distinction, makes sense. I didn't know the latter term but tried to describe it in the last section of the post, nice to have a name now.
There are apps and sites that manage to keep the number of cards at min, one is selfridges (not an ad, was just open in another tab), another is firefox settings. MacOS Finder does a good job at grouping things with spacing, and macos generally. iOS seems to put everything on cards, at least nowadays.
Spacing Over Cards 11 months ago
yup, that's a good part of the page to stand out, when I've seen all the landing page can show and now it nudges me to try the app out
Spacing Over Cards 11 months ago
hm, I sort of agree with the train of thoughts but not with the conclusion. Maybe it's "is my blue your blue" situation. I talked to people while working on this post and some said e.g. grid with cards is way easier to them to scan through than grid without cards; other people feel the opposite and complain about too many things on the page that are not content. I'm in the latter category, but wondering if I could make an experiment, or if anyone made it already.
Thanks for getting me thinking this way.
Spacing Over Cards 11 months ago
author here (not super educated either). That's part of the idea — when cards are removed it becomes obvious that tags become the most noticeable part while not being the most (or any) important one. When you look at the cards you see cards and _something_ inside them.
So maybe if this post was in less flame-provoking tone I'd suggest trying to add cards back and see if it makes it better. It might, on landings there is a good chance it will.
How we made JSON.stringify more than twice as fast 12 months ago
Unrelated but I have the easiest design improvement for your website: change <html> background color to #4285f4 (same as in topbar) so it looks like a sheet of paper on a blue base
Ordinary life improvements 2018-2025 1 year ago
Gwern wrote a post about his everyday improvements in 2018, I thought I'd write a follow-up.
oh god you're right https://stackoverflow.com/a/57206146/1685746 yeah sure what can go wrong, let's listen to fetch and modify requests in a service worker.
I asked that in the post but nobody answered still, let's try here.
Why are CSRF tokens rotated? OWASP says it's somehow more secure but I don't really see why.
not even you don't need to, you shouldn't. Sessions shouldn't be accessible to js at all
mitm means you can control users network, doesn't it?
Another question, does this work with https?
And the third one, if this was the thing some dishonest governments or vpn providers would do this already. Would be cool to read on that (genuinely, not implying this never happened)
You shouldn't need your session token in JS, you can specify your fetch requests to include cookies, and you can setup CORS to allow that.
How does server know the cookie is valid if it doesn't store it
depending on why you'are asking the question, * because it decrypts correctly * because it contains some user identifier
People don't usually store sessions in cookies because cookies can't be very big, and session do become big. So what people do instead they store cookies in databases, and put session identifiers into cookies.
Why would you need that?
Also, one thing I can speculate that phishing would become even easier if such things were allowed
This is my blog. I haven't posted all the articles from there to hackernews. I think some of them are not worth discussing because too old or too poorly written, but some are just not posted because I didn't think of it at the time. Thanks for the interest, I will re-read what I wrote and post some.
it is true. But again, writes are allowed, reads are not, you won't be able to see the reply. Which author of the question eventually realised https://stackoverflow.com/a/44122076/1685746
well it does make sense to assume that by default different origins belong to different people, and some of those people don't have to behave friendly to each other.
There is little server can do with that, because of the request-based model. The state that persists between requests lives in cookies, and it's browser job not to expose those cookies all around. Turning off single origin policy would be a terrible idea. For one, it makes CSRF work by not allowing cross-origin reads.
yup. You didn't imply it but just in case -- this token shouldn't be the same as session token. Session tokens should be `HttpOnly`, so that we don't even expose it to javascript
oh hell yes. And oh yes iframes and postmessages, of course people would setup them incorrectly and even if they do some (probably not that important but still) data will leak if you're creative enough. Thanks for the link!
"search this site in google" shouldn't even be a POST request, but yeah, when we'll have better defaults for cookies it should work nicer. And if you are a web developer, you should check your session cookie attributes and explicitly set them to SameSite=Lax HttpOnly unless your frameworks does that already and unless you know what you're doing
you're right, you can initiate cross-site requests that _could be_ form submissions. It was even in the post but I thought I'd omit that bit for clarity. I should have decided otherwise.