Viewing profile — danscan

There is no right way :) SwiftUI is good, albeit not without issues, as long as you tolerate them. The same is true for any approach. My most recent app was built in SwiftUI becaus…

I think you may have meant to comment on another post :)

How does the directive bound what it applies to? I imagine they could be in compliance by renaming the model

I think this is saying it's: 1) A JS chromium browser automation API targeting Bun (uses Bun.* or "bun:*" apis) 2) Engineered to interact with webpages in a way that evades bot det…

> I've never even heard of Sacks until now Bless your soul

Axios, like Express, is something I'm shocked to see used in any modern codebase. I loved both in the 2010s. In JS/TS-land there are much simpler and better options these days. Dep…

TIL nobody can spell phyzix

Hey HN, I made a Github incident tracker in the style of Github's contribution graph. We're all feeling Github's increasing issues lately, so I quickly threw this together today. I…

It’s not about doing discovery _from_ personal apps, but the inverse: doing discovery _of_ personal apps. For example, an app that uses an AI chat API can discover and route reques…

Fair that this post lacks background. I’d say I have the opposite of a narrow view of software one can write, having written everything from typical web/mobile apps to DBs, network…

Ah, and just the subtle crypto API to generate keys? Or are you not generating them on the client?

Easy to imagine that haha. That’s part of the reason I’d lean on a standard like JOSE and make signing happen automatically for users who prefer to use an SDK

Fair. I assume you mean asymmetric key cryptography and not JWKs in particular? JOSE is a pretty good library if you need the latter and you’re already working in JS

IMO this is a tooling issue. You can make your SDK generate keys and even base64 encode them so they appear opaque to the uninitiated (like an API key)

Valid

Ah, yes I agree

It's interesting to imagine taking the pubkey as identity concept to its full extents in situations like this, for example if you could create a cloud account, spin up resources, a…

Not sure which way of constraint you're referring to, but WebAuthn credentials are bound to a domain via Relying Party ID. There's a proposal for cross-domain usage via Related Ori…

Yeah, I am sort of a fan of Passkeys in principal, but they are domain bound (you can't use them across domains). I wish there were something built into browsers that offered a sch…

For sure. Would likely need to be combined with another mechanism like IP rate limits

The key distinction I am getting at is: self-signed as in “signed with a self-issued key pair”, as opposed to using an API key/credential that has been issued to you

The things that change are: 1. With self-signed JWTs, you could start consuming APIs with free tiers immediately, without first visiting a site and signing up. (I could see this pa…

Haven't heard of PASETO, but I'll check it out. I'd say JOSE is an implementation detail of what I'm advocating for, so very open to alternatives.

Bummer. Not sure what I can do about that, but I assure you it is not pornography!