Hacker News: 80x25

Grit

80x25 — Thu, 17 Aug 2023 15:52:04 +0000

Article URL: https://www.grit.io/blog/seed

Comments URL: https://news.ycombinator.com/item?id=37163586

Points: 1

# Comments: 0

CSRFing VS Code's Debug Adapter Protocol

80x25 — Wed, 02 Aug 2023 15:46:04 +0000

Article URL: https://www.mcnulty.blog/posts/dap-csrf

Comments URL: https://news.ycombinator.com/item?id=36972484

Points: 2

# Comments: 0

The excellent Arc browser is now available for anyone to download

80x25 — Tue, 25 Jul 2023 14:30:19 +0000

Article URL: https://www.theverge.com/2023/7/25/23802843/arc-browser-mac-ios-waitlist-availability

Comments URL: https://news.ycombinator.com/item?id=36862786

Points: 6

# Comments: 2

Hacking Auto-GPT and escaping its Docker container

80x25 — Fri, 07 Jul 2023 18:46:43 +0000

Article URL: https://positive.security/blog/auto-gpt-rce

Comments URL: https://news.ycombinator.com/item?id=36636574

Points: 2

# Comments: 0

New comment by 80x25 in "Ask HN: Could you share your personal blog here?"

80x25 — Wed, 05 Jul 2023 20:42:46 +0000

https://www.mcnulty.blog/

Posts about the Web and the software that powers it. Light on content right now but will hopefully change that soon.

New comment by 80x25 in "Ask HN: Is the job market brutal? or is it just me?"

80x25 — Sat, 15 Apr 2023 01:42:45 +0000

Interesting idea. I signed up.

I noticed that the email confirmation links are using http:// vs. https://. Chrome has started to flag http:// links with a full-page speed bump, saying it is insecure. Perhaps those links should use https://?

I did try manually switching to https:// in the URL but Chrome didn't like the cert there either.

Mark Zuckerberg: “VR / AR strategy” (2015)

80x25 — Mon, 30 Jan 2023 18:22:30 +0000

Article URL: https://www.techemails.com/p/mark-zuckerberg-vr-ar-strategy

Comments URL: https://news.ycombinator.com/item?id=34584090

Points: 1

# Comments: 0

Bill Gates Tries to Install Movie Maker

80x25 — Sun, 15 Jan 2023 19:11:07 +0000

Article URL: https://www.techemails.com/p/bill-gates-tries-to-install-movie-maker

Comments URL: https://news.ycombinator.com/item?id=34392126

Points: 8

# Comments: 1

Do Users Write More Insecure Code with AI Assistants?

80x25 — Fri, 30 Dec 2022 01:58:15 +0000

Article URL: https://arxiv.org/abs/2211.03622

Comments URL: https://news.ycombinator.com/item?id=34180821

Points: 1

# Comments: 0

New comment by 80x25 in "Akamai wrestles with AWS S3 web cache poisoning bug"

80x25 — Tue, 20 Dec 2022 16:10:03 +0000

Here's the researcher's write-up of the issue with more details: https://spyclub.tech/2022/12/14/unusual-cache-poisoning-akam...

Interesting research and super useful write-up!

My observations:

- The characters that enable the Host header field forgery aren't unicode characters. They are a subset of separator characters from ASCII. My guess is that the Akamai parser is trimming the Host header field name and not enforcing the requirements from https://www.rfc-editor.org/rfc/rfc7230#section-5.4 after this trim, specifically:

   A server MUST respond with a 400 (Bad Request) status code to any
   HTTP/1.1 request message that lacks a Host header field and to any
   request message that contains more than one Host header field or a
   Host header field with an invalid field-value.

Even worse, the last Host header field appears to "win" and be the selected Host header field in the request forwarded to the origin.

- The OP does mention that Akamai intends to enable stricter header field parsing in 2023 but that response leaves a lot to be desired. They could probably provide a proactive analysis of a customer's traffic to inform them that they can turn on RFC compliant parsing without impact. Punting this decision to their customers requires their customers to be HTTP experts. If I were an Akamai customer, I would expect them to be my HTTP experts for me.

Forming a W3C Solid Work Group

80x25 — Tue, 20 Dec 2022 15:37:12 +0000

Article URL: https://lists.w3.org/Archives/Public/public-solid/2022Nov/0001.html

Comments URL: https://news.ycombinator.com/item?id=34067344

Points: 2

# Comments: 0

New comment by 80x25 in "The code that ChatGPT can't write"

80x25 — Wed, 07 Dec 2022 20:37:13 +0000

This is spot on. I'm very glad to see this post mention the "No Silver Bullet" essay. Despite being written in 1986, it continues to provide a relevant, skeptical view on the impact of these LMMs on software. It even has a section addressing whether AI can provide the "silver bullet", which is drawn upon by the OP.

My immediate response to all the rightly-deserved excitement for ChatGPT is to reread that essay and reflect on whether this new tool will provide me more than marginal gains in my productivity. Experimenting with it a bit over the last day, my initial answer is, no, this doesn't provide more than marginal gains outside toy examples.

These tools may very well factor into my workflow in the future, but I don't see them fundamentally changing the way I construct, support, debug, and maintain software.

The Arc browser is the Chrome replacement I’ve been waiting for

80x25 — Sat, 19 Nov 2022 15:38:23 +0000

Article URL: https://www.theverge.com/23462235/arc-web-browser-review

Comments URL: https://news.ycombinator.com/item?id=33671088

Points: 3

# Comments: 1

New comment by 80x25 in "Learn to Read the Source, Luke (2012)"

80x25 — Fri, 28 Oct 2022 15:07:52 +0000

I find myself returning to this blog post about once a year. It think it has aged pretty well in the decade since it was written.

One thing that definitely did not pan out is being able to understand the source of a website/web app because it is written in JavaScript. Transpiling/minification/etc. without the corresponding source maps makes that near impossible for any app of a reasonable size.

Learn to Read the Source, Luke (2012)

80x25 — Fri, 28 Oct 2022 15:05:21 +0000

Article URL: https://blog.codinghorror.com/learn-to-read-the-source-luke/

Comments URL: https://news.ycombinator.com/item?id=33372286

Points: 1

# Comments: 1

New comment by 80x25 in "The many problems with implementing Single Sign-On"

80x25 — Tue, 13 Sep 2022 15:33:43 +0000

"Use OSS" is very close to if not the same as "Build".

To adopt an OSS approach for SSO, the startup still needs to dedicate resources to researching the OSS options, deploying the OSS, integrating it, and most importantly, operating it.

Once the startup gets into the weeds of integrating SSO functionality with customer's IdPs, in the limit, the cost of the effort will start to approach "Build".

New comment by 80x25 in "The many problems with implementing Single Sign-On"

80x25 — Mon, 12 Sep 2022 19:50:12 +0000

This post seems to suggest that a SaaS startup would consider creating their own SAML implementation. If a SaaS startup is considering creating a homebrew SAML implementation, they are doing it wrong.

When it comes to SSO, "buy" instead of "build", and focus on the core value proposition of the service with that saved time and resources.

Dancing in the Debugger – A Waltz with LLDB (2014)

80x25 — Mon, 12 Sep 2022 16:08:04 +0000

Article URL: https://www.objc.io/issues/19-debugging/lldb-debugging/

Comments URL: https://news.ycombinator.com/item?id=32812412

Points: 1

# Comments: 0

What is Web 2.0 (2005)

80x25 — Thu, 02 Jun 2022 16:30:18 +0000

Article URL: https://www.oreilly.com/pub/a/web2/archive/what-is-web-20.html

Comments URL: https://news.ycombinator.com/item?id=31596991

Points: 2

# Comments: 0

New comment by 80x25 in "WebAssembly"

80x25 — Sun, 28 Feb 2021 02:56:02 +0000

The rust+wasm story is quite nice these days. I've been working on a rust+wasm SPA for a few months and I have yet to run into issues with the tooling (wasm-pack, wasm-bindgen, etc).