Hacker News: benregenspan

New comment by benregenspan in "LinkedIn is searching your browser extensions"

benregenspan — Thu, 02 Apr 2026 17:47:28 +0000

What I'm wondering is if this requires sending the full list of extensions straight to a server (as opposed to a more privacy-protecting approach like generating some type of hash clientside)?

Based on their privacy policy, it looks like Sift (major anti-fraud vendor) collects only "number of plugins" and "plugins hash". No one can accuse them of collecting the plugins for some dual-use purpose beyond fingerprinting, but LinkedIn has opened themselves up to this based on the specific implementation details described.

New comment by benregenspan in "I beg you to follow Crocker's Rules, even if you will be rude to me"

benregenspan — Sat, 14 Mar 2026 16:12:12 +0000

I think the point is that some of the extra words OP is complaining about aren't needless. It's on the writer to know their audience, but it's also asking a lot to tune a message in a PR review to the one particular person who demands bluntness, especially if they don't know that person well. If the majority of people in the organization respond positively to a certain style (which may involve some amount of phatic speech), then the person who is "over-writing" here is probably making a good decision.

Once I build rapport with someone, I tend to be more blunt, but still balance that with the fact that other people may be reading the interaction, and I don't want to model a rude communication style.

An organization can choose to promote a very direct approach to feedback (Bridgewater is famous for this), but it requires top-down work to get everyone on the same page, not just expecting one developer to mind-read another.

New comment by benregenspan in "Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148"

benregenspan — Tue, 24 Feb 2026 14:59:11 +0000

It seems like the goal of the default configuration is preventing script injection while being otherwise very permissive. Basically, "safer than innerHTML, even when used very lazily". But I would expect guidance to evolve saying that it almost never makes sense to use the default and instead to specify a configuration that makes contextual sense for a given field.

The default might be suitable for something like an internal blog where you want to allow people to sometimes go crazy with `